VARA Licensed Activities and Activity Scoping — Determining Your License Scope

VARA Licensed Activities and Activity Scoping

Determining the correct scope of licensed activities is one of the most consequential decisions in the VARA licensing process. Each additional activity category increases capital requirements, compliance complexity, and ongoing supervisory burden. Conversely, applying for insufficient activity coverage risks operating outside license scope — a violation that triggers enforcement measures.

The Seven Licensed Activity Categories

VARA’s Virtual Assets and Related Activities Regulations 2023 define seven categories of virtual asset (VA) activities that require licensing:

1. Advisory Services

Advisory services involve providing advice to clients on virtual assets, including investment recommendations, portfolio structuring guidance, and strategic counsel on VA-related matters. Firms operating in a purely advisory capacity — without handling client assets, executing trades, or operating platforms — may qualify for advisory-only licensing with correspondingly lower capital requirements.

Scoping Consideration: Practitioners should distinguish between advisory activities (which require licensing) and general educational or informational content (which may not). The boundary is client-specific, individualized advice versus general market commentary. Firms providing personalized investment recommendations on virtual assets to specific clients require advisory licensing.

2. Broker-Dealer Services

Broker-dealer services involve acting as an intermediary in virtual asset transactions, executing orders on behalf of clients. Broker-dealers may operate on an agency basis (matching buyers and sellers without taking proprietary positions) or on a principal basis (trading from the firm’s own inventory against client orders).

Scoping Consideration: The distinction between agency and principal broker-dealer activity affects capital requirements and risk management obligations. Firms that only match orders without taking positions face lower capital thresholds than firms that deal as principal.

3. Custody Services

Custody services involve holding, storing, and safeguarding virtual assets or the cryptographic keys that control them on behalf of clients. Custody is one of the highest-responsibility activity categories, carrying significant capital requirements and operational controls including key management procedures, cold storage infrastructure, insurance coverage, and client asset segregation.

Scoping Consideration: Firms that facilitate transactions but rely on third-party custodians must assess whether their operational role constitutes custody under VARA’s definitions. Holding cryptographic keys at any point in the transaction process, even temporarily, may constitute custody.

4. Exchange Services

Exchange services involve operating a platform that enables the exchange of virtual assets for other virtual assets or for fiat currency. Exchange licensing carries the highest capital requirements and operational complexity, reflecting the custodial, counterparty, and technology risks inherent in exchange operations.

Scoping Consideration: Exchange licensing may be required for both centralized order book platforms and other matching mechanisms. Practitioners should assess whether their platform model constitutes an exchange under VARA’s regulatory framework.

5. Lending and Borrowing Services

Lending and borrowing services involve facilitating virtual asset lending and borrowing between parties, including interest-bearing arrangements, margin lending, and collateralized borrowing.

Scoping Consideration: DeFi-adjacent lending protocols that interact with UAE-based users may trigger this licensing category. Practitioners should assess whether their lending facilitation involves custodial elements that would also trigger custody licensing.

6. Management and Investment Services

Management and investment services involve managing virtual asset portfolios or investment vehicles on behalf of clients, including discretionary portfolio management, fund management, and managed account services.

Scoping Consideration: This category overlaps with traditional fund management regulation. Firms operating virtual asset funds or managed portfolios must assess whether they need both VA activity licensing and potential fund regulation depending on the vehicle structure.

7. Transfer and Settlement Services

Transfer and settlement services involve facilitating the transfer of virtual assets between parties and settling transactions. This category covers payment processing, remittance-like services, and settlement infrastructure.

Scoping Consideration: Transfer services may also trigger CBUAE payment service regulation if the services involve fiat currency components or payment token processing.

Activity Combination Strategies

Most licensed VASPs require multiple activity categories. Common combinations include:

• Exchange + Custody: Exchange operators typically custody customer assets, requiring both licenses
• Broker-Dealer + Custody: Broker-dealers handling customer assets need custody authorization
• Advisory + Management: Firms providing advice and managing client portfolios need both categories
• Exchange + Broker-Dealer + Custody + Transfer: Full-service platforms need comprehensive coverage

Capital Impact of Activity Scoping

Each licensed activity carries minimum capital requirements. Firms applying for multiple activities must meet the highest applicable capital threshold plus any additive requirements. Over-scoping (applying for activities the firm does not intend to conduct) unnecessarily locks up capital and increases compliance costs.

For detailed capital analysis, see our capital requirements comparison and VARA licensing fee schedule.

Enforcement Implications

Entities operating VA activities outside their license scope face the same enforcement risk as entirely unlicensed operators. The enforcement register demonstrates VARA’s willingness to act against scope violations. Proper activity scoping at application stage prevents this risk.

Detailed Activity Category Analysis

Exchange Services: The most common licensed activity, encompassing platforms that facilitate exchange between virtual assets and fiat currencies or between different virtual assets. Exchange licensees face the highest capital requirements and most intensive compliance obligations, including real-time transaction monitoring using blockchain analytics (Chainalysis, Elliptic, or Crystal Blockchain), robust KYC/CDD procedures for customer onboarding, and comprehensive AML programs. For the exchange-specific comparison between jurisdictions, see our VARA vs ADGM exchange licensing comparison.

Broker-Dealer Services: Entities facilitating VA transactions on behalf of clients. Broker-dealer licenses may cover principal dealing (the entity trades its own book) or agent dealing (the entity facilitates trades between third parties). Capital requirements and risk profiles differ between these sub-categories. Broker-dealer services are frequently combined with exchange or custody licenses.

Custody Services: Entities providing safekeeping and administration of virtual assets or instruments enabling control over virtual assets. Custody licenses carry specific requirements for private key management, cold storage arrangements, client asset segregation, and insurance or capital buffers protecting client assets against loss. This is one of the most technically demanding activity categories from a technology governance perspective.

Advisory Services: Entities providing advice on virtual asset investments, regulatory strategy, or compliance. Advisory-only licenses carry the lowest capital requirements and least intensive operational compliance obligations. However, advisory firms must still maintain AML compliance programs and avoid providing services that cross into other activity categories without appropriate authorization.

Transfer and Settlement Services: Entities facilitating the transfer of virtual assets between parties or providing settlement services. This category covers payment-oriented VA services and may overlap with the regulatory perimeter of other UAE financial regulators. Travel rule compliance is particularly relevant for transfer services.

Management and Investment Services: Entities managing virtual asset portfolios or providing investment management services. This category covers fund management, portfolio management, and discretionary investment activities involving virtual assets. Capital requirements are moderate to high, reflecting the custodial responsibility for managed assets.

Lending and Borrowing Services: Entities facilitating virtual asset lending or borrowing arrangements. This category carries specific credit risk management requirements and may require additional governance controls for managing counterparty risk.

Multi-Activity Licensing Considerations

Many VASPs require licenses across multiple activity categories. For example, an exchange typically needs exchange services, custody services, and potentially broker-dealer services. When applying for multiple activities, practitioners should consider:

• Capital aggregation: The capital requirement for a multi-activity license may be the highest single-activity requirement rather than the sum of all activity requirements, but this varies by the specific combination
• Fee aggregation: Application and annual supervision fees increase with each additional activity category
• Compliance complexity: Each activity category may carry additional compliance requirements that compound the overall compliance program scope
• Phased approach: Consider applying for core activities first and adding additional activities later as the business develops

Enforcement Risk from Activity Scope Violations

Entities operating VA activities outside their license scope face the same enforcement risk as entirely unlicensed operators. The enforcement register demonstrates VARA’s willingness to act against scope violations. The Morpheus Software (Fuze) case specifically cited engaging in unlicensed virtual asset activities alongside AML programme failures, indicating that scope violations compound other enforcement risks. For the full enforcement framework, see the VARA enforcement powers deep dive and the enforcement action dashboard.

Proper activity scoping at application stage prevents this risk. Use the pre-application readiness checklist to systematically map your planned activities against VARA’s seven categories.

For the complete licensing process, see our VARA license application guide. For jurisdiction alternatives, see ADGM and DFSA guides. For cost modeling of different activity scopes, see the cost comparison dashboard and total cost of compliance model.

For regulatory context, visit UAE Tokenization Regulations and Dubai Tokenisation.