A Free-Zone Crypto Licence and a Regulatory Licence Are Two Different Instruments

A commercial licensor answers one question: may this company be registered here, and may it describe itself as being in this business? A regulator answers a different one: may this activity be carried on at all — by these people, on these systems, for these clients, in this territory? The first is a registration decision. The second is an authorisation decision, and it is the one that carries conditions.

The two are sequenced rather than parallel. In Dubai the file opens with the zone and closes with the regulator, and the company exists in the interval — incorporated, staffed, leased, and not permitted to trade. That interval is a funding constraint, and neither instrument tells you how long it lasts. For guidance on navigating this process, consider consulting Velarozone's advisers.

VARA's licence-applications page sets out two stages. An Initial Disclosure Questionnaire goes to the Department of Economy and Tourism or to the relevant zone licensing channel and produces an Approval to Incorporate. VARA's own note against that step reads: at this point, the firm is not permitted to carry on Virtual Asset activities. Stage two is the full VASP licence application, and VARA adds that the licence may be subject to operational conditions.

The application page itself is permissive about the channel: it says application submissions can be made through the Department of Economy and Tourism for firms trading with an onshore commercial licence, or any Dubai free zone. The mandatory version is on VARA's FAQ, which states that submission of applications or any documents must be made through the relevant commercial licensor, either the Department of Economy and Tourism or a free zone. Taken together that is the clearest published statement of the relationship: the zone is the channel, not the decision.

One terminology point matters if you are reading zone marketing closely. VARA's application page calls the stage-one output an Approval to Incorporate. Its public register instead describes an In-Principle Approval as a conditional step allowing firms to complete the final requirements needed to secure a VASP licence, and lists holders of it on a separate tab. VARA does not say on either page whether those are the same instrument, so nobody should assert that they are. Understanding how a trade licence works can provide further clarity.

VARA has also published a notice stating that it has entered into no partnership or arrangement with external consultancies or professional services firms in relation to the licence application process, and that no firm is authorised to represent that it has a favourable relationship with VARA or an arrangement that may lead to an accelerated or more expedient application. Anyone promising you speed through a relationship is contradicting the regulator in writing.

None of the statements below is a contradiction of the zone's own marketing. They are the same distinction, published at different depths on each zone's own site.

There is a duller question that comes before the two-instrument question. Does the zone you have shortlisted publish an activity row for the thing you intend to do? We hold the authority-published activity lists — DMCC's own approved-activities workbook, and IFZA's and Meydan's own public activity endpoints — and they do not carry the same rows.

DMCC's virtual-asset set maps one-to-one onto VARA's eight activities and adds a proprietary trading row. Its own restriction text against the custody row states that custody is a standalone licence activity and cannot be conducted with other activities under the same company — the zone independently reproducing the regulator's segregation rule in its own register. IFZA's captured set carries eight rows but no custody row and no issuance row. Meydan's carries seven, with neither issuance nor proprietary trading.

That is not a criticism of any zone. A commercial licensor lists what it has chosen to license. But it is a hard constraint that bites before price, visa allocation or office format ever come up: if the model needs to issue, or needs a standalone custody vehicle, the shortlist narrows first and everything else is downstream of that.

One row is flagged inconsistently across the same emirate. IFZA records Distributed Ledger Technology Services as requiring VARA approval before licence issuance. DMCC's equivalent row records no external approval. The Dubai mainland equivalent records none either. Same activity family, same emirate, same regulator, three different answers in authority-published data — and VARA's own published position is that DLT service providers must determine whether they are carrying out a virtual-asset activity, which places the determination on the applicant rather than on the zone.

This is not a sequencing footnote, because the entity is fixed early and the regulator's structural rules attach to entities rather than to plans.

Custody is the clearest case. VARA's Custody Services Rulebook requires a VASP providing custody services to be a separate legal entity from any group member providing virtual-asset services other than custody. There is a narrow exception permitting a transfer and settlement licence in the same entity, granted only where VARA is satisfied on segregation, and a second one treating staking from custody as a sub-set of the custody activity rather than as a separate entity. VARA's public summary page states the general rule without either exception, which is a good reason to work from the rulebook rather than the summary.

Everything else aggregates. VARA states that a VASP may apply to be licensed for multiple activities and aggregate them under a single overarching licence, except where certain custody services are concerned, and that a multi-activity VASP must meet the requirements for each activity in full. So the number of companies you need is a function of the activity mix — and the activity mix is the output of a classification exercise most founders have not done at the point they choose a zone.

Knowing that two instruments exist, and which one actually matters, is the useful half of this. The other half is not published anywhere.

Nothing on any zone page tells you which regulated activity definition your model falls inside, or whether it falls inside more than one. VARA's definitions overlap by design: facilitating the matching of transactions between buyers and sellers is a broker-dealer limb, while matching orders and conducting an exchange, and maintaining an order book, are exchange limbs. A single product surface can sit in both, and no published tie-breaker exists.

Nor does anything tell you whether you are carrying on the activity by way of business at all. VARA's test has three factors — whether the entity holds itself out as conducting the activity by way of business, the regularity, scale and continuity of the activity, and whether there is any commercial element including remuneration or value in kind — and VARA reserves sole and absolute discretion over the answer. There is no published volume floor that puts a firm outside the perimeter.

And the approval obligation itself sits differently depending on where you incorporate. IFZA states in terms that it is the duty of the licensee to secure the approval. DMCC states that the VARA licence will be required through DMCC. Those are two different positions on who carries the risk when an approval stalls, published by two zones in the same emirate, and they change what you need from an adviser.

Every one of those is a judgement made on your facts rather than a lookup, and each one is cheaper to make before an entity exists than after. If you are at the stage of choosing a zone, that is the moment to have the structuring conversation — talk to us before the incorporation, not after it.