Where a Crypto Exchange Can Be Incorporated in the UAE

Those four rows describe what each regime is built around, not which one is better. The useful reading is the opposite of a league table: work out which vocabulary describes what you are actually building, and the centre follows. This decision often involves picking the structure that fits best.

VARA's Exchange Services definition has four limbs: conducting an exchange, trade or conversion between virtual assets and fiat currency; the same between one or more virtual assets; matching orders between buyers and sellers and conducting such an exchange; and maintaining an order book in furtherance of any of those. The fourth limb stands on its own, which means a venue that never touches fiat and never holds a client asset can still be inside the definition on the strength of the order book alone, making it essential to consider crypto exchange setup UAE.

What most founders assume is included is not. Margin trading is an add-on: VARA's rulebooks state, in the same words for broker-dealers and for exchanges, that VASPs may only provide margin trading services if explicitly authorised to do so by VARA and such authorisation is expressly stipulated in their licence. Exchange-traded derivative services carry the identical construction in the Exchange Services Rulebook. These are endorsements on an activity licence, not separate licences and not defaults, which is a crucial consideration when choosing UAE crypto structure options.

That the endorsement is visible on the public record is worth knowing for anyone doing counterparty diligence: VARA's public register carries Exchange Services (including Exchange Traded Derivative Services) as a distinct filter value, so the presence or absence of the derivative permission can be read from outside the firm. This transparency is vital for those considering a crypto market-making company.

Where derivatives are offered, retail exposure is capped in the rulebook rather than in policy. VASPs may not permit retail investors to use or access exchange-traded derivative services with greater than 5-to-1 leverage, the minimum initial margin being twenty percent, and must require higher initial margin where twenty percent is not suitable for a given client or product. For institutional and qualified investors the firm must instead have and implement its own policies for determining maximum leverage. Firms offering these products also have to track the number and percentage of retail investors experiencing losses in each review period and remediate where the review identifies disproportionate retail losses. This is an important aspect of crypto custody provider setup.

Two further conditions shape the business plan rather than the application. Retail access is not automatic — VARA states that VASPs can provide services to retail customers upon approval of a licence, and that at VARA's discretion certain VASPs may be approved to provide services only to qualified investors and institutional clients, with any such restriction published by the firm as a condition of its licence. And the venue may not trade its own book: the Exchange Services Rulebook prohibits VASPs from actively investing their own or their group's portfolio, and states expressly that investing in exchange-traded derivatives is included in that prohibition. These stipulations are crucial for those looking to establish a crypto trading platform UAE.

The FSRA describes Operating a Multilateral Trading Facility as a key virtual-asset regulated activity, and notes that it was the first regulator globally to regulate virtual-asset trading platforms as MTFs. The structural consequences are specific.

The access model is different from a traditional exchange. The FSRA records that virtual-asset MTFs generally operate an access model that does not include members, with access granted directly to retail and institutional clients of the MTF, and that in doing so the MTF loses a layer of regulatory and supervisory defence. Its response is to require MTFs to undertake their own customer due diligence for every client accessing and trading on the market — a compliance function sized to the whole user base rather than to a member list.

The step up to a recognised exchange is not a step up. The Market Infrastructure rules permit a Recognised Investment Exchange to operate an MTF where its recognition order carries a stipulation allowing it, with the virtual-asset part meeting the virtual asset framework. But the guidance states that an authorised person operating an MTF that also wishes to operate a recognised exchange will be required to relinquish its Financial Services Permission on obtaining a recognition order. The two are not additive, and the regulator can require the move on its own initiative where an MTF admits accepted virtual assets or accepted spot commodities.

An MTF that holds client assets is also doing something else. The guidance states that an MTF which either holds itself out as responsible for custody, or performs custody in-house, will also be considered to be providing custody of virtual assets, and expects appropriate segregation of responsibilities, staff, technology and, as appropriate, financial resources between the venue and the custody operation.

Substance is stated qualitatively and is not negotiable in outline: resources across all lines including commercial, governance, compliance and surveillance, operations, technical, IT and human resources, and an expectation that the mind and management of the authorised person is located within ADGM. No headcount or office size is published, which means the test is met by argument rather than by a number.

The Capital Market Authority issued its Virtual Assets Framework on 13 April 2026, describing five core modules — General Requirements, Conduct of Business, Alternative Trading System, anti-money-laundering and counter-terrorist financing, and Prudential Requirements — and expanding the regulated activities from three to eight, including Operating a Multilateral Trading Facility. The framework's stated organising principle is same activity, same risk, same regulatory outcome, with alignment claimed to IOSCO and FATF.

The Alternative Trading System module is not virtual-asset-only. The regulator states that it extends to conventional multilateral trading facilities for securities and to facilities dedicated to tokenised securities — which makes it the natural home for a venue whose instruments are tokenised versions of things that were already securities.

The candour required here: the operative resolution is named in the regulator's later 2026 resolutions but its text is not on the regulator's published pages, and the guidance still hosted on the same site describes the superseded regime with a different, six-licence vocabulary — platform operator, safe custody, financial consulting, portfolio management, broker and dealer. The announcement's own count of the prior regime is three regulated activities, which is not the same unit as six licence types and cannot be reconciled with it from anything published. So the activity names are public and the definitions, perimeters, exemptions and transition arrangements are not. No transition mechanism for firms licensed under the previous regime has been published either.

What the older guidance does establish about venues, and what has not been contradicted, is a structural point worth carrying forward: a virtual assets platform operator may provide custody without obtaining an additional licence, but must maintain appropriate separation between responsibilities, employees, technology and financial resources, and using a third-party custodian does not discharge it from its responsibilities to clients. Whether that survives into the 2026 framework is exactly the kind of thing that has to be confirmed rather than assumed.

DIFC is carved out of VARA's perimeter by VARA's own definition of the Emirate — that much is published by VARA and is not in doubt. It is a fourth centre with its own regulator, the DFSA, and its own rules.

We are not setting out what those rules currently say. The DFSA's own site did not respond to us, and our standing position is that we do not describe a regulator's requirements from a secondary summary or from a page we could not open. Commencement dates, assessment standards and criteria counts are exactly the details that go stale and get repeated, and a reader planning a venue in DIFC needs them from the regulator rather than from us.

The structural point survives without them, and it is the one that matters at this stage: DIFC is a separate regime, not a variation on Dubai's. A model designed against VARA's vocabulary has to be re-analysed from the beginning if the centre changes, and that re-analysis is a reason to settle the centre before the entity exists.

This is the question that decides the answer, and it is not settled by what you call the product. The FSRA names the features it treats as venue-characteristic: allowing for price discovery, displaying a public trading order book accessible to any member of the public regardless of whether they are clients, and allowing trades to be automatically matched using an exchange-type matching engine. A firm intending to operate solely as a broker or dealer, including an over-the-counter desk, is not permitted to structure its service or platform in a way that would have it considered as operating a market.

And the assessment extends past the architecture. The guidance states that operations, the user interface, the website, marketing materials and any public or client-facing information must not create the impression that the firm is running an MTF. The product design decision and the regulatory decision are the same decision, which is not how most teams sequence them.

In Dubai the overlap runs in the other direction. Facilitating the matching of transactions in virtual assets between buyers and sellers is a broker-dealer limb, while matching orders and conducting an exchange, and maintaining an order book, are exchange limbs. One product surface can sit inside both definitions, and VARA publishes no tie-breaker. Request-for-quote systems, aggregators routing to a single external venue, internalisers and screens showing indicative prices sit in territory nobody has resolved in published text.

A permission to run a venue is not a permission to list anything on it, and each centre runs the asset question separately from the firm question.

In ADGM the mechanic is Accepted Virtual Assets, and the assessment sits with the firm: an authorised person assesses a virtual asset against seven published criteria, notifies the regulator before commencing, and — absent a direction — may treat it as accepted. The consequence people miss is that an accepted virtual asset is accepted for that authorised person only, and each firm must maintain a current list of its accepted assets on its own website and monitor them continuously. Fiat-referenced tokens work the opposite way: the regulator itself decides and publishes a consolidated list, acceptance is recorded per token per network, and acceptance results in acceptance for use only within ADGM. The same ticker on a different chain is a different question.

There are hard stops too. In ADGM, no person may carry on a regulated activity involving the issue, sale, purchase, transfer or custody of a virtual asset or fiat-referenced token which is an algorithmic stablecoin or a privacy token — a statutory prohibition rather than a policy preference. In Dubai, the issuance of anonymity-enhanced cryptocurrencies and all virtual-asset activities related to them are prohibited in the Emirate.

Under the federal guidance, a licensed body may deal only in accepted virtual assets, the asset itself must be registered with the regulator, and the operator must produce a third-party certificate of compliance with the applicable due-diligence standards. A listing decision is not purely commercial in any of the four centres, and a business plan built on an asset list is a business plan with a second approval inside it.

The same product, in three centres, produces three different company counts.

In Dubai, VARA's Custody Services Rulebook requires a VASP providing custody services to be a separate legal entity from any group member providing other virtual-asset services, with a narrow exception permitting transfer and settlement services in the same entity where VARA is satisfied on segregation, and a second treating staking from custody as a sub-set of custody. Custody also has a definitional condition attached: only VASPs that segregate each client's assets into separate VA Wallets qualify for a custody licence, or as otherwise permitted in the Custody Services Rulebook. The Regulations reserve that exception expressly; the rulebook as published requires per-client wallets without one. An omnibus model therefore does not meet the qualifying condition on the current texts, which is a narrower statement than saying the Regulations forbid it outright.

In ADGM, the venue that custodies is simply also providing custody, and the requirement is segregation of responsibilities, staff, technology and, as appropriate, financial resources. The phrase as appropriate is doing a great deal of work there, and whether it means separate systems, separate teams or separate companies is a supervisory conversation rather than a published rule.

Under the older federal guidance, the platform operator may custody in the same licence provided it separates responsibilities, employees, technology and financial resources — and outsourcing does not discharge responsibility to clients. Three centres, three structural answers, and the answer decides the entity count, the capital stack and the client documentation.

None of those has a published answer for your specific model, and several of them are decided by a regulator that reserves discretion and can revisit the position later. That is the point at which a form stops being useful and structuring judgement starts — talk to us before the vehicle is incorporated and the interface is built.