Where virtual-asset activity sits in the UAE's regulatory perimeter, and how we structure around it.

Founders usually arrive having already picked a free zone or an emirate, and ask us to fit the virtual-asset activity into it. The right order runs the other way. The first question is whether the activity is a virtual-asset service at all — custody, exchange, broker-dealing, transfer or advisory services involving virtual assets generally are, while some activity, such as software that never touches client money or custody, is not. The second question, once the first is answered, is which regulator's perimeter the activity falls inside: VARA in Dubai outside the DIFC, the ADGM Financial Services Regulatory Authority, the DIFC's own regulator, or the Securities and Commodities Authority's federal framework elsewhere in the UAE. The Central Bank's own remit can sit on top of any of these where a token functions as a payment instrument or stored value rather than an investment.

Only the regulator gives the final answer for a specific activity. What a perimeter assessment does is take the activity as it is actually designed — not as a category label — and set out which regime it most plausibly sits inside, so the jurisdiction, the entity and the governance are chosen to fit that answer rather than the other way round.

Once the perimeter question has an answer, the work that follows runs in a fairly consistent order, whichever regulator applies.

Velarozone's part is the assessment, the structure and the documentation, not the licence itself. We form the view on where the activity sits, build the entity and the governance around that view, write the business plan and the AML/CFT programme the application needs, and coordinate the application through the regulator's process. Where the business needs an MLRO, a compliance officer or another named role once it is licensed, that is delivered through the consulting and fractional-roles service, subject in each case to the regulator's own approval of the individual.

The same team carries the file from the first perimeter question through to an operating, licensed business, rather than handing it between separate advisers at each stage. That continuity matters here specifically because the entity, the governance and the business plan all follow from the same perimeter answer — a different adviser picking up the structuring work without having made that assessment usually ends up re-asking the question the assessment was meant to settle.

Velarozone is not a financial regulator and does not hold a VARA licence, an ADGM Financial Services Regulatory Authority licence or a Securities and Commodities Authority licence of its own. The licensing decision, whatever the activity, belongs to the regulator alone, and nothing on this page should be read as a prediction of that decision.

The same separation applies to execution. Where a business needs to convert virtual assets to fiat or back, that trade is carried out on a VARA-licensed broker-dealer's own licence, under that desk's own terms and its own classification of the client — never on any licence Velarozone holds, because Velarozone holds none. And where the activity, on assessment, turns out to sit outside every regulator's perimeter, we say so rather than route it to a licence it does not need.

A licence changes what has to be kept running, not just what had to be built to get it. A licensed virtual-asset business typically carries ongoing obligations: the AML/CFT programme has to be operated and evidenced, not merely filed; senior roles approved by the regulator have to remain filled; and reporting, record-keeping and any originator-and-beneficiary information obligations that apply to virtual-asset transfers have to be met on a continuing basis. A company holding virtual assets on its own balance sheet, rather than providing a virtual-asset service to others, faces a narrower version of the same question — whether its own activity, including any conversion it undertakes, stays outside the perimeter or inside it.