Advisory Report — Virtual asset exchange, custody and advisory — Dubai

---

Executive Summary

The client should proceed under the Virtual Assets Regulatory Authority (VARA) in Dubai, applying for a VASP Licence covering Exchange Services as the primary activity, with Custody Services and Advisory Services as additional licence lines. Exchange, trading and advisory activities can sit within a single UAE entity, but the Custody Services Rulebook requires the custodian to be a separate legal entity; a second company and a second VARA application are therefore needed for custody. Minimum capital totals AED 2,200,000 across all planned activities, with floors adding up per activity under Company Rulebook VI.B.2, plus a Licence Extension Fee of 50% of the lower application fee for each extra activity and annual supervision fees per activity. The client's declared capital of AED 5–20 million comfortably exceeds the requirement, so no capital gap exists; the estimated 6–18 month timeline should be planned against the two-entity structure.

Three actions are critical immediately. First, incorporate the UAE entities and inject the AED 2,200,000 minimum capital, ring-fencing the custody company separately. Second, appoint a UAE-resident CEO and MLRO before the application is filed, as VARA requires fit-and-proper senior management in place at submission. Third, decide whether to pursue own custody or appoint a VARA-licensed third-party custodian; using a third party removes the custody line and lowers the exchange floor to AED 800,000, simplifying to a single application.

---

1. Engagement Profile

Engagement type: VIRTUAL ASSET SETUP Classification confidence: —

Client Brief

A founder team (EU nationals, all relocating to Dubai) wants to launch a retail and institutional crypto exchange in Dubai, hold client assets themselves, and offer research and advice on virtual assets. First regulated entity. About AED 5–20M of capital available. Target launch within 12 months.

Collected Parameters

---

2. Token Classification

A Virtual Asset under VARA is any digital representation of value that can be digitally traded or transferred and used for investment or payment purposes. This includes cryptocurrencies (BTC, ETH), VA derivatives, and tokens that do not fit a more specific classification.

---

3. Regulatory Track

Primary regulator: Virtual Assets Regulatory Authority — VASP Licence — Exchange Services All applicable tracks: VARA_VASP Minimum capital required: AED 2,200,000 Estimated timeline: 6–18 months

Note: VARA does not recognise branch structures. All VASP licence holders must be UAE-incorporated entities. Every VASP follows the Company, Compliance & Risk Management, Technology & Information and Market Conduct Rulebooks, plus the rulebook for each licensed activity. Capital is set per activity and adds up when one company holds several (Company Rulebook VI.B). Capital for Exchange Services: Higher of AED 1,500,000 or 25% of fixed annual overheads; higher of AED 800,000 or 15% if client assets are held by a VARA-licensed custodian (or as otherwise approved).

---

4. Licence Scenario Comparison

Recommendation: For a first UAE entry, consider starting with exchange services and a VARA-licensed custodian: the minimum capital falls by about AED 1,300,000 and the second company and application drop out. Your own custody company can follow once the main licence is running.

Licence lines for every planned activity

Minimum capital across VARA (Dubai) lines: from AED 2,200,000 (floors add up; each may rise with that activity's overheads)
Application fees: AED 170,000 (dearest activity in full, each further activity at 50%)
Annual supervision fees: AED 480,000

How the lines combine

• One company can hold several VARA activities. Capital is set per activity on that activity's share of overheads, and the floors add up (Company Rulebook VI.B.2).
• Custody is the exception: the Custody Services Rulebook requires the custodian to be its own legal entity, separate from group companies doing other VA activities. Plan a second company and a second application for custody.
• Each extra activity on the same application adds a Licence Extension Fee of 50% of the lower application fee; the annual supervision fee is charged for every activity (Regulations 2023, Schedule 2).
• Using a VARA-licensed third-party custodian instead of your own custody lowers the floors for exchange (AED 800,000), broker-dealer (AED 400,000) and management (AED 280,000), and removes the custody line.

---

5. Entity Structure

Recommended structure: direct uae entity

As a first-time VA entity, a direct UAE incorporation is the cleanest path. It works for all VA regulators including VARA (which does not accept branches), keeps capital requirements and compliance obligations contained to the UAE entity, and is the standard route for most new VASP applicants.

---

6. Key Personnel Requirements

The following roles must be appointed before licence issuance. All key individuals must pass the regulator's fit-and-proper assessment.

• CEO (UAE resident) — 🇦🇪 UAE residency required (licence condition)
• MLRO — Money Laundering Reporting Officer (UAE resident) — 🇦🇪 UAE residency required (licence condition)
• Chief Risk Officer
• Compliance Officer

Eligible zones / locations:

• Dubai Mainland (DED)
• DMCC
• DAFZA
• Dubai Silicon Oasis

---

7. Key Risks

No critical risks identified from the intake profile.

---

8. Post-Licensing Compliance Obligations

• Corporate Tax (CT) registration with the FTA — within 3 months of licence issuance; late registration exposes the VASP to administrative penalties under UAE CT law.
• Annual Corporate Tax return — within 9 months of financial year-end; failure to file triggers FTA penalties and potential tax assessments.
• VAT registration — if taxable supplies exceed AED 375,000 in any 12-month period; failure to register and file quarterly returns results in VAT penalties and back-tax liability.
• Annual licence renewal with VARA — before licence expiry (VASP licences are not automatically renewed); operating on an expired licence is an unauthorised activity subject to enforcement action.
• UBO register filing — within 60 days of licence issuance, with updates within 15 days of any ownership change; non-compliance breaches UAE beneficial ownership obligations and attracts regulatory sanctions.
• Annual regulatory return to VARA — annually, including audited financial statements, capital adequacy confirmation, and Approved Persons confirmation; late or incomplete returns can result in VARA enforcement and licence conditions.
• Approved Person change notifications — pre-notification to VARA required for changes to CEO, MLRO, CRO, CO, CISO; failing to pre-notify renders the appointment non-compliant and may trigger supervisory action.
• Annual AML/CFT compliance review — annually, covering STR filing records, training records, and updated AML risk assessment; deficiencies risk regulatory penalties and reputational harm. goAML registration with the UAE FIU is required.
• MOHRE Tasheel and WPS registration — for all employees; non-registration breaches UAE labour law and exposes the VASP to MOHRE fines.
• Cybersecurity controls, audits and incident reporting — as required by the VARA Technology and Information Rulebook; non-compliance with technology and incident-reporting obligations can lead to VARA enforcement and licence conditions.

---

---

Disclaimer

This report was generated by the Arakan Advisory Engine on 28 October 2026. It is a first-draft advisory output designed to compress research and drafting time — it does not replace professional judgment on decisions that carry regulatory consequence. Regulatory filings, licence applications, constitutional documents, and client-facing legal positions must be reviewed and signed off by qualified UAE legal and compliance counsel before submission or delivery. Regulatory requirements, fee schedules, and authority guidance change frequently; all figures and timelines in this report should be verified against current authority publications at the time of use. This output does not constitute legal advice.

Advisory Report — OTC brokerage and Web3 software — Ras Al Khaimah

---

Executive Summary

The client should pursue a direct UAE entity licensed by the Capital Market Authority (CMA), which replaced the SCA on 1 January 2026, under the CMA's 2026 virtual assets decision. The primary activity is broker/OTC desk — Dealing in Virtual Assets as Principal — requiring a minimum capital of AED 4,000,000 (or a share of annual overheads or expenses, if higher) and an estimated timeline of 4–10 months. A separate, non-regulated Web3/blockchain technology licence in Innovation City (formerly RAK DAO) may be housed in a distinct free zone company, keeping it outside the licensed entity's capital and supervision; the CMA activity requires its own licence regardless. The declared capital range of AED 1,000,000 to AED 5,000,000 presents a material gap: the minimum threshold may not be met, so the committed amount must be confirmed to clear AED 4,000,000 before applying.

Three actions are critical immediately. First, confirm and inject the committed capital into the UAE entity so it demonstrably clears the AED 4,000,000 minimum, together with liquid resources covering at least six months of operating expenses. Second, appoint a UAE-resident CEO and MLRO before the CMA application is submitted. Third, finalise the structure by incorporating the Innovation City free zone company for non-regulated Web3 work, ensuring the licensed entity remains separately capitalised and supervised.

---

1. Engagement Profile

Engagement type: VIRTUAL ASSET SETUP Classification confidence: —

Client Brief

A small team wants to run an institutional OTC desk for crypto from Ras Al Khaimah, and separately build and license wallet and analytics software to other Web3 firms. Owned by the two founders directly. AED 1–5M available. Wants to start within 6–12 months.

Collected Parameters

---

2. Token Classification

A Virtual Asset under VARA is any digital representation of value that can be digitally traded or transferred and used for investment or payment purposes. This includes cryptocurrencies (BTC, ETH), VA derivatives, and tokens that do not fit a more specific classification.

---

3. Regulatory Track

Primary regulator: Capital Market Authority (replaced the SCA on 1 January 2026) — VA licence per activity (CMA virtual assets decision, 2026) — Dealing in Virtual Assets as Principal All applicable tracks: CMA_VA, RAKDAO_DAO Minimum capital required: AED 4,000,000 Estimated timeline: 4–10 months

Note: The CMA replaced the SCA on 1 January 2026 (Federal Laws No. 32 and 33 of 2025). The CMA's 2026 virtual assets decision (reported as No. 4/R.M/2026; official number unconfirmed) replaced the SCA's VA regime in full with eight activities, each licensed on its own with its own capital floor, plus liquid resources covering six months of operating expenses. The CMA keeps the official list of virtual assets that may be traded in the UAE. Licensed firms may not deal in utility tokens or NFTs except custody and trading-venue operation with prior approval. VARA remains the regulator for Dubai, outside DIFC. Capital figures come from law-firm summaries and are marked medium confidence until checked against the decision text. Capital for Dealing in Virtual Assets as Principal: Higher of AED 4,000,000 or 25% of annual expenses (35% or risk-based capital if client assets are held) (medium confidence — the binding rule text not yet checked).

---

4. Licence Scenario Comparison

Single-licence scenario — no meaningful alternatives identified for this activity and jurisdiction combination.

Licence lines for every planned activity

Minimum capital across CMA (federal) lines: from AED 4,000,000 (floors add up; each may rise with that activity's overheads)

How the lines combine

• Under the CMA's 2026 virtual assets decision each activity is licensed on its own, with its own capital floor, and the firm must also hold liquid resources covering at least six months of operating expenses.
• Non-regulated work (software, protocol development, a DAO) can sit in a separate Innovation City company, keeping it outside the licensed entity's capital and supervision. The licensed activities still need their own regulator.

---

5. Entity Structure

Recommended structure: direct uae entity

As a first-time VA entity, a direct UAE incorporation is the cleanest path. It works for all VA regulators including VARA (which does not accept branches), keeps capital requirements and compliance obligations contained to the UAE entity, and is the standard route for most new VASP applicants.

---

6. Key Personnel Requirements

The following roles must be appointed before licence issuance. All key individuals must pass the regulator's fit-and-proper assessment.

• General Manager
• Compliance Officer
• MLRO

Eligible zones / locations:

• Innovation City, Ras Al Khaimah (formerly RAK DAO) — company base; the VA activity itself is licensed by the CMA
• Other emirates' mainland and non-financial free zones (outside Dubai)

---

7. Key Risks

• ⚠️ Capital may fall short: the planned licence lines need at least AED 4,000,000 of capital (or a share of annual overheads or expenses, if higher). The declared range starts at AED 1,000,000, so confirm the committed amount clears the minimum before applying.

---

8. Post-Licensing Compliance Obligations

• Corporate Tax (CT) registration with the FTA — within 3 months of licence issuance; annual CT return within 9 months of financial year-end. Failure to register or file exposes the VASP to administrative penalties and FTA assessments.

• VAT registration — required if taxable supplies exceed AED 375,000 in any 12-month period; quarterly VAT returns thereafter. Non-registration or late filing triggers VAT penalties and retrospective tax liabilities.

• Annual licence renewal with the CMA — must be submitted before licence expiry (VASP licences are not automatically renewed). Operating on an expired licence constitutes unlicensed activity and can result in enforcement action and licence revocation.

• UBO register filing — within 60 days of licence issuance; update within 15 days of any ownership change. Failure to maintain an accurate UBO register breaches beneficial ownership transparency rules and attracts regulatory sanctions.

• Annual regulatory return to the CMA — annually, including audited financial statements, capital adequacy confirmation, and Approved Persons confirmation. Late or incomplete returns may lead to supervisory action, conditions on the licence, or financial penalties.

• Approved Person change notifications (CEO, MLRO, CRO, CO, CISO) — pre-notification to the CMA before any change takes effect. Appointing or replacing an Approved Person without CMA pre-approval is a breach of licensing conditions and may invalidate the appointment.

• Annual AML/CFT compliance review — annually, covering STR filing records, training records, and an updated AML risk assessment; goAML registration with the UAE FIU is required. Inadequate AML/CFT controls expose the VASP to FIU/CMA enforcement and significant fines.

• MOHRE Tasheel and WPS registration for all employees — required for every employee prior to/at employment commencement, with ongoing WPS salary transfers. Non-compliance results in MOHRE fines, labour disputes, and visa processing blocks.

• Cybersecurity controls and incident reporting to the CMA — controls maintained on an ongoing basis; incidents reported to the CMA promptly upon detection. Failure to report incidents or maintain adequate controls breaches CMA technology risk requirements and can trigger enforcement and remediation orders.

---

---

Disclaimer

This report was generated by the Arakan Advisory Engine on 28 October 2026. It is a first-draft advisory output designed to compress research and drafting time — it does not replace professional judgment on decisions that carry regulatory consequence. Regulatory filings, licence applications, constitutional documents, and client-facing legal positions must be reviewed and signed off by qualified UAE legal and compliance counsel before submission or delivery. Regulatory requirements, fee schedules, and authority guidance change frequently; all figures and timelines in this report should be verified against current authority publications at the time of use. This output does not constitute legal advice.