For companies that need a senior role without a full-time hire
A fractional CFO, MLRO, compliance officer or CISO for your company
The short answer
A fractional appointment puts an experienced person in a senior role for the hours it needs, accountable to your board. Whether the regulator accepts it depends on the role. VARA requires a virtual asset service provider's compliance officer to be a full-time employee reporting directly to the board, but sets no full-time rule for its MLRO. We set scope and reporting in writing and say before the engagement starts what the regulator must approve.
Three situations bring companies here. A licence application asks for named officers before the business has revenue to pay them. A board needs finance leadership between a bookkeeper and a full-time CFO. A regulator or customer expects a security function. For a VARA-licensed firm, the Technology and Information Rulebook requires a named chief information security officer (CISO), who must be a different person from the compliance officer. A fractional appointment fills the role with a real person who holds the authority and answers for the work, for the fraction of time the work takes.
The consulting service writes the scope before the appointment: the hours, the reporting line, the decisions the person may take, the ones they escalate, and what the regulator expects of the role. For an MLRO at a VARA-licensed firm, that includes the quarterly report to the board on how well the AML/CFT policies work, which VARA can ask to see. The regulator will ask what the officer did, so the record starts on day one.
At a glance
- Indicative cost
- The regulator's fees are paid at the regulator's published rates. The Velarozone service fee is monthly for the scoped hours, itemised in your engagement letter.
- Timing
- Scope and appointment in weeks; the regulator's approval of the person on its own clock; the role served on the agreed cycle.
- What's included
- The role scoped in writing: hours, authority, reporting
- The regulator's approval prepared where required
- Board reporting and a hand-over to a full-time hire
This is for you if
- You need a named MLRO, CISO or other officer for a licence application or an existing licence, and the regulator's rules do not require a full-time employee.
- You need a finance lead for planning, bank relationships and investor reporting, beyond what bookkeeping provides.
- A regulator, bank or customer asks who is accountable for security or compliance, and you cannot yet name that person.
- You want the role filled by someone accountable, not a consultant on call.
This may not be the right route if
- You want a name for a form and no work behind it; regulators check, and so do we.
- You want the person to sign audit opinions or legal opinions; those come from a registered auditor or a licensed law firm.
- You expect the regulator's approval of the person to be promised.
At a glance
- Indicative cost
- The regulator's fees are paid at the regulator's published rates. The Velarozone service fee is monthly for the scoped hours, itemised in your engagement letter.
- Timing
- Scope and appointment in weeks; the regulator's approval of the person on its own clock; the role served on the agreed cycle.
- What's included
- The role scoped in writing: hours, authority, reporting
- The regulator's approval prepared where required
- Board reporting and a hand-over to a full-time hire
What this service includes
- The role scoped in writing: hours, authority, reporting line, escalation and the regulator's expectations.
- An experienced person from our senior advisers in the role, accountable to your board.
- The regulator's approval of the person prepared and lodged where the role requires it.
- Board reporting on the cycle the role needs; hand-over to a full-time hire when the business is ready.
- Coordination with the accountant, the auditor and any law firm the role's work touches.
What it does not include
- Audit opinions and legal opinions.
- Any assurance of the regulator's approval of the person.
- Acting as a shield: an officer reports what the rules require, including to the regulator.
Process
How the work is sequenced
Each stage has its own dependencies (activity approvals, document legalisation, authority processing, and bank review), and we report progress against them rather than against one overall date.
- 01
Scope
The role, its hours, authority and reporting set out and agreed with the board.
- 02
Appoint
The person named; the regulator's approval lodged where required.
- 03
Serve
The role performed, with board reports on the agreed cycle: quarterly for a VARA-licensed firm's MLRO.
Framework or review due as well? The AML page covers the work the officer will own.
Prefer to start in writing? Send the details through the contact form.
Start with a structure assessment
In an initial consultation you receive a plain-language decision summary, a document-preparation list, and the next actions for your situation. Current figures are confirmed within your adviser-reviewed route comparison.
The roles
What each fractional role carries
A CFO usually needs no regulator approval. The MLRO, compliance officer and CISO may, and VARA's rules for virtual asset firms set different conditions for each.
Fractional roles, what each does and what the regulator typically requires of the person.
Chief financial officer
- What it does
- Planning, reporting, treasury, banking and investor relations
- What the regulator typically requires
- Usually none; the board decides
Money-laundering reporting officer
- What it does
- Receives internal reports, decides on filing, liaises with the authority
- What the regulator typically requires
- VARA: at least two (2) years of AML/CFT experience; fit and proper, reviewed annually; other roles only if duties do not conflict
Compliance officer
- What it does
- Owns the compliance framework, monitoring and regulatory reporting
- What the regulator typically requires
- VARA: five (5) years in a compliance function; fit and proper as approved by VARA; UAE resident or passport holder; full-time; reports to the board
Chief information security officer
- What it does
- Security governance, controls and incident response
- What the regulator typically requires
- VARA: a named CISO, separate from the compliance officer, of good standing and appropriately experienced
Company secretary or governance lead
- What it does
- Board process, minutes, filings, registers
- What the regulator typically requires
- Jurisdiction-dependent
| Role | What it does | What the regulator typically requires |
|---|---|---|
| Chief financial officer | Planning, reporting, treasury, banking and investor relations | Usually none; the board decides |
| Money-laundering reporting officer | Receives internal reports, decides on filing, liaises with the authority | VARA: at least two (2) years of AML/CFT experience; fit and proper, reviewed annually; other roles only if duties do not conflict |
| Compliance officer | Owns the compliance framework, monitoring and regulatory reporting | VARA: five (5) years in a compliance function; fit and proper as approved by VARA; UAE resident or passport holder; full-time; reports to the board |
| Chief information security officer | Security governance, controls and incident response | VARA: a named CISO, separate from the compliance officer, of good standing and appropriately experienced |
| Company secretary or governance lead | Board process, minutes, filings, registers | Jurisdiction-dependent |
The service
Regulatory consulting and fractional roles
The service page sets out the fractional roles and the licensing and AML advisory around them.
See the consulting service
Every route is planned against how the business will actually operate in the UAE.
After the licence
What you may also need
The four services most founders in this situation ask about next, each on its own page.
Visas & PRO services
Residence visas for owners, staff and family, plus the MOHRE labour files, medicals and Emirates ID renewals that keep a licence and its people in good standing. A sponsored visa lasts 1, 2 or 3 years; approval stays with the authority.
→UAE bank account setup
A bank-ready file built around your ownership, activity and expected transactions, matched to the bank whose risk appetite suits your profile. The bank alone decides approval and timing.
→Accounting & tax
Monthly bookkeeping, VAT and corporate-tax filings and year-end accounts, with statutory audit signed by a registered auditor.
→Legal services
Contracts, corporate documents, disputes and regulatory matters, advised by lawyers licensed to practise in the UAE and named in the engagement letter.
→
Questions
Frequently asked
- Will the regulator accept a fractional officer?
- It depends on the regulator and the role. VARA requires a virtual asset service provider's compliance officer to be a full-time employee, so that role cannot be fractional there. Its MLRO rules set no full-time requirement: the person needs at least two (2) years of AML/CFT experience, must be fit and proper and may hold other non-client-facing roles if the duties do not conflict. We read these conditions before the appointment.
- How many hours does the role take?
- It depends on the business and the regime: a licence application's officer is busier before and after the application than between; a CFO's month peaks at the close and the board. For a VARA-licensed firm's MLRO, the quarterly board report is one fixed peak. The scope states the hours and the peaks.
- Who does the officer report to?
- The board, in writing, on the agreed cycle, and the regulator where the rules require it. At a VARA-licensed firm the compliance officer reports directly to the board, and the MLRO's quarterly reports are available to VARA on request. The reporting line is part of the scope and is not changed informally.
- Can we convert to a full-time hire later?
- Yes, and the engagement is designed for it: the role's documentation, registers and reports are the hand-over pack, and the fractional officer briefs the hire.
- What does it cost?
- A monthly Velarozone service fee for the scoped hours, itemised in your engagement letter, with the regulator's own fees charged as they are.
Sources
- Virtual Assets Regulatory Authority (VARA)
- UAE AML/CFT framework guidance
- ADGM (Abu Dhabi Global Market)
- DIFC (Dubai International Financial Centre)
Regulations, fees, and eligibility can change. Every regulatory statement is re-checked before publication and dated above.
Legal notes and scope
Velarozone provides setup and operational-readiness coordination. This page is general information, not legal, tax, immigration, or banking advice.
General information drawn from the CBUAE Rulebook, including the Retail Payment Services and Card Schemes Regulation (C 15/2021), and Cabinet Resolution No. (134) of 2025 as published, not legal or tax advice. Rules and guidance change, so confirm the current text and each institution's own requirements before you submit.
Regulated roles are subject to the regulator's approval of the person and its rules on the role; nothing here asserts an approval, a category or a timeline the regulator has not published or decided. Audit and legal opinions come from a registered auditor or a licensed law firm.