VARA Custody Services Licence for Crypto Custodians
Businesses that safeguard virtual assets or control private keys on behalf of clients in Dubai need a VARA Custody Services licence. VARA focuses on how client assets are protected: key management, segregation, reconciliation and operational resilience. VAF Global prepares the compliance and control framework custodians need.
Who needs this licence?
- Institutional digital asset custodians
- Custodial wallet providers
- Exchanges and brokers holding client assets in-house
- Platforms safeguarding assets for funds or asset managers
What custody covers
Safekeeping of virtual assets
Holding client virtual assets on their behalf.
Private key control
Controlling or managing private keys, including shared or MPC arrangements.
Asset administration
Administration tied to custody, such as reconciliation and client reporting.
Sub-custody arrangements
Using third-party custodians requires due diligence and oversight.
Key requirements
- A commercial licence from Dubai Economy and Tourism (DET) or a Dubai free zone authority
- Compliance with VARA's compulsory rulebooks: Company; Compliance & Risk Management; Technology & Information; Market Conduct
- Fit and proper shareholders, board and senior management, including a Compliance Officer and MLRO
- AML/CFT programme with KYC, transaction monitoring (KYT), sanctions screening, Travel Rule and goAML reporting
- Key generation, storage and recovery procedures, including cold and hot wallet policy
- Segregation of client assets from the firm's own assets
- Regular reconciliation of on-chain and internal records
- Insurance, business continuity and incident response arrangements
- Independent security and technology audits
The licensing process
- 1
Activity mapping
Confirm exactly which VARA activities your model needs. Many businesses need more than one.
- 2
Initial Disclosure Questionnaire
Submit VARA's IDQ through DET or your Dubai free zone, with the business plan and owner and management details.
- 3
Approval to Incorporate
VARA issues an Approval to Incorporate. Set up the company and operations; no virtual asset activity is allowed yet.
- 4
Full application
File the full licence application with policies, risk assessments, financials and key personnel.
- 5
VASP Licence
VARA issues the licence, which may carry operational conditions; supervision and annual renewal follow.
How VAF Global helps
We prepare and run the compliance side of your licence, so your application meets the regulator's expectations from day one.
- Activity mapping across VARA rulebooks
- AML/CFT, KYC, sanctions and Travel Rule policies
- Business-wide and customer risk assessments
- Compliance manuals aligned to the activity rulebook
- Outsourced MLRO (where VARA permits) and support for your in-house Compliance Officer
- KYT transaction monitoring with our KYT tool
VARA Custody Licence: FAQ
Do non-custodial wallet providers need a VARA custody licence?
+
If the provider never controls client private keys or assets, custody may not apply. The answer depends on the technical design, so the model should be assessed carefully against VARA's definitions.
Can an exchange use a third-party custodian instead?
+
Yes. Many firms use a VARA-licensed custodian rather than holding assets themselves, with appropriate due diligence and oversight.
Can I combine this with other VARA activities?
+
Yes. A VARA licence lists each authorised activity, and many firms hold several. Each additional activity brings its own rulebook requirements, so it is best to plan the full scope before applying.
Other UAE licensing guides
Last reviewed October 2026. This guide is general information for compliance planning, not legal advice. Regulatory requirements change; always confirm current rules with the regulator. VAF Global is a compliance consultancy and does not provide legal services.