Blockchain Company or VASP? Drawing the UAE Regulatory Line

UAE virtual-asset regulation runs through three regulators, each with its own perimeter. VARA licenses virtual-asset activity carried out from Dubai, onshore and across the Dubai free zones within its remit. The DIFC is carved out of VARA's perimeter and is supervised instead by the DFSA under its own token regime. ADGM, in Abu Dhabi, answers to the FSRA under a separate virtual-asset framework. A company formed in one of these zones is governed by that zone's regulator alone; moving the registered office does not move the question, because what pulls a business into the perimeter is the activity and the customer, not the address on the trade licence.

A model that also touches payments or e-money sits astride two perimeters at once, a pattern the wider fintech build runs into regardless of virtual assets. Marketing into, or onboarding from, more than one zone can put more than one regulator's rules on the same company.

VARA's framework separates two layers. Every licensed firm complies with its compulsory rulebooks (covering the company itself, compliance and risk management, technology and information, and market conduct), whatever activity it performs. Activity-specific rulebooks sit on top and apply only to the licensed function: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and issuance each have their own. VARA updates these periodically, so a rulebook read early in a project can already be superseded by the time an application is drafted; the current text lives on VARA's own rulebook platform and should be read fresh, not inherited from an earlier download.

An application is a documentation exercise before it is a legal one: a business plan, a financial model and a policy suite matched to the specific activity, not a generic template. Business plans and documentation built around the actual customer journey and asset flow stand up to that scrutiny better than one assembled after the fact.

Banks and payment partners treat any virtual-asset business as an enhanced-due-diligence client, licensed or not. Before onboarding is discussed, the file needs to show how value moves through the business: who holds the private keys, whether client money is ever held and where, how a deposit becomes an on-chain transaction, and where that money came from before it reached the business at all. Source of wealth and funds evidence for founders and early customers answers the question a bank asks first, and corporate bank account readiness work is largely this file put in order beforehand. None of this guarantees an account; it only removes the reasons a bank declines one without saying why.

A commercial shell is not enough once a business performs a regulated function. Regulators expect substance: management resident and accountable for the business's decisions, a compliance and risk capability sized to the activity, and systems matched to the specific function. Custody needs different controls from pure advisory work. Layering an SPV, an IP company or an offshore parent above the licensed entity is common and can be sound, but the licensed, customer-facing entity still has to carry that substance itself. A structure built mainly to show a low headline setup figure reads as exactly that to an authorisation team and to every bank afterwards, the same test a regulated or multi-entity ownership structure has to pass more generally.

Cost here is built in layers, and the firm's own fee is itemised in the engagement letter, as set out in how Velarozone works. For a business that crosses the perimeter, the floor is set by the roles the activity needs filled, not by the registration fee.

A crypto custody provider, a proprietary crypto-trading company and a crypto market-making company each work through the perimeter test for one of these functions in more depth.

A VARA, DFSA or FSRA licence is held separately from the commercial registration that issues the establishment card, the lease and the immigration quota: that side still runs through the relevant free zone authority, or Dubai's Department of Economy and Tourism (DET) for mainland activity. Visa quota, premises and renewal attach to the commercial registration on its own timetable. The virtual-asset licence renews and is supervised on the regulator's own timetable instead, and the two calendars do not move together. Losing sight of either one is how a business ends up trading on a lapsed virtual-asset permission while its trade licence is still current, or the reverse.