business resources
VARA Licensing in Dubai 2026: A Founder's Guide to VASP Licences with UAE Crypto Lawyer Irina Heaver
23 Jun 2026
Interview with Irina Heaver, UAE Crypto Lawyer and Founder of NeosLegal
A VARA licence is the authorisation required to run regulated virtual asset activity in Dubai. A well-prepared application typically reaches licence issuance in around nine to twelve months. NeosLegal, the UAE's first crypto-native law firm since 2016, has advised on 20+ VASP applications across the UAE's five regulators, and was named Best UAE Crypto Law Firm 2026 by UAE Business Awards.
VARA licensing in Dubai has become the first question every crypto founder asks in 2026. To unpack how it actually works, we spoke with Irina Heaver, UAE Crypto Lawyer and Founder of NeosLegal, the UAE's first crypto-native law firm since 2016, ranked by Lexology as the UAE's recommended blockchain lawyer. Her team has advised on more than 20 VASP licence applications across the UAE's regulators, and structured over 300 crypto projects globally with zero client enforcement actions. In this interview, she explains what a VARA licence is, who needs one, what it costs, how long it takes, and the mistakes that delay applications.
Key numbers behind NeosLegal
- UAE's first crypto-native law firm, founded 2016.
- 20+ VASP licence applications advised across UAE regulators.
- 250+ token legal opinions issued, 100 percent accepted at Tier-1 exchanges.
- 300+ Web3 and virtual asset projects structured globally.
- Founder Irina Heaver ranked by Lexology as the UAE's recommended blockchain lawyer.
What is a VARA licence, and who needs one?
A VARA licence is the authorisation that lets a company conduct regulated virtual asset activity in Dubai. The mistake Heaver sees most often is founders assuming a free zone trade licence covers it. It does not. A trade licence proves a company exists; it is not permission to operate as a virtual asset service provider. Whether a business needs VARA approval comes down to what its product does, not where it registers.
VARA's perimeter covers seven activities: exchange, broker-dealer, custody, lending and borrowing, virtual asset management and investment, transfer and settlement, and advisory. Any business that touches one of them needs authorisation before going live. VARA was set up in 2022 as the first standalone crypto regulator of its kind, and across the 20+ applications NeosLegal has advised on, that trade-licence assumption is the single most expensive early error founders make.
Which VARA licence do you actually need: trade licence, NOC, or VASP licence?
It depends entirely on the activity, and there are three paths. Genuinely non-regulated work, such as software development, blockchain consulting and marketing, needs only a free zone trade licence. Non-regulated activity that still requires a VARA Non-Objection Certificate (NOC), the classic example being virtual asset proprietary trading, needs the trade licence plus the NOC from VARA. And fully regulated activity, such as running an exchange, providing custody or offering broker-dealer services, requires a full Virtual Asset Service Provider (VASP) licence and ongoing supervision.
Getting this classification right is the most consequential decision a founder makes early, because it sets the timeline, the cost and the compliance burden for the life of the company. When founders misclassify the activity so it does not match how the business actually earns revenue, a costly restructuring usually follows after incorporation.
How long does VARA licensing take in 2026?
A well-prepared application typically reaches licence issuance in around nine to twelve months. A poorly prepared or complex one can run for years. The framework itself rarely causes the delay; the strength of the application does.
| Phase | Typical duration | What it involves |
|---|---|---|
| Entity setup commencement | Under 2 weeks | Commence incorporating a Dubai entity in the correct free zone or mainland |
| Initial application preparation (IDQ) | 2 to 3 weeks | Building the initial application pack, assuming client documentation is ready |
| Approval to Incorporate (ATI) | Varies with application strength | VARA's initial approval; stronger applications clear faster |
| Full VASP licence | Around 6 months well-prepared, 12+ months if poorly prepared or complex | Formal review, deficiency-notice cycles, final licence issuance |
The Initial Disclosure Questionnaire (IDQ) is where applications commence. It is the foundation for the Approval to Incorporate and every obligation that follows, so a rushed IDQ is the most common reason a timeline extends.
"Get the compliance framework right before you submit, not after. The single biggest delay in VARA licensing is founders who file before their AML and CFT framework is genuinely complete." -Irina Heaver, UAE Crypto Lawyer and Founder of NeosLegal, ranked by Lexology as the UAE's recommended blockchain lawyer.
What does a VARA licence cost in 2026?
A regulated setup has several cost layers, and founders tend to budget for only the first two. The first is free zone incorporation, which starts at roughly USD 20,000 to 25,000 as a baseline. Then office space and visas, which can costs up to USD 100,000. The second is VARA's own fees, which are tiered by activity, with a portion due at the Approval to Incorporate stage and an annual supervision fee that recurs each year. The third is the one people overlook: AML and compliance staffing, monitoring and reporting software, custody and insurance. The fourth is the reserve and regulatory capital requirements. The fifth, and smallest, is the legal fees to support the application and the process.
Regulated VASP licences cost materially more than non-regulated setups. Heaver's advice is to plan for the annual supervision fee from the first year rather than treating it as an afterthought. In practice, the second-year cost is where budgets slip, not the setup cost.
VARA, ADGM, DIFC, CMA or CBUAE: which UAE regulator is right?
The UAE has five relevant regulators, and the right one is effectively chosen at the structuring stage, not discovered later. VARA covers virtual assets across Dubai and suits most crypto-native businesses. The other four apply to specific structures and activities.
| Regulator | Jurisdiction | Typical fit |
|---|---|---|
| VARA | Dubai (mainland and free zones, excluding DIFC) | Most crypto-native businesses operating in or from Dubai |
| ADGM / FSRA | Abu Dhabi Global Market | Funds, institutional players, founders wanting common-law certainty |
| DIFC / DFSA | Dubai International Financial Centre | Regulated financial institutions seeking crypto asset exposure |
| CMA | UAE federal level | Federally scoped capital markets activity, plus VASPs |
| CBUAE | UAE federal level | Payment tokens, stablecoin issuers, payment service providers |
ADGM's FSRA has become a popular home for token issuers through its DLT Foundations regime, so the choice of regulator follows directly from the structure, the customers and the activity.
What are the most common VARA licensing mistakes?
The friction is rarely the framework: it is a small set of avoidable errors, and across the applications NeosLegal has run, the same five recur. The most common is assuming a trade licence equals regulatory approval. Close behind is misclassifying the business activity so it does not match how the company earns revenue. A weak or rushed IDQ extends timelines, as does underestimating the AML and compliance staffing a regulated entity requires.
The fifth is bank onboarding. UAE banks apply enhanced due diligence to crypto businesses, which means a fully licensed company can still wait months to open a client money account. Every one of these is visible at the structuring stage to someone who has done it before, and every one is far cheaper to prevent than to unwind.
Why should founders work with a specialist VARA licensing lawyer?
The value is in sequencing the process correctly and pre-empting the regulator's questions rather than reacting to them. A lawyer is not legally mandatory, but most serious founders engage one before filing. At NeosLegal, the team provides VARA VASP licensing counsel for founders structuring everything from proprietary-trading desks to full exchanges, and the job is to match the licence path to the business model on day one so the application moves in a straight line. That alignment is the difference between a clean six-month process and an eighteen-month one.
What is the one piece of advice for founders beginning VARA licensing?
Heaver's advice is to slow down at the start so founders can move fast later: classify the activity correctly, build a genuinely complete AML and CFT framework, and get the IDQ right before submitting. NeosLegal has applied that discipline across 20+ VASP applications and 300+ Web3 projects since 2016, with zero client enforcement actions, and the founders who treat the first six weeks as the most important part of the process are the ones who clear licensing cleanly.
Frequently Asked Questions
How long does VARA licensing take?
A well-prepared VARA application typically reaches licence issuance in around nine to twelve months, while a poorly prepared or complex one can run beyond twelve, based on the 20+ VASP applications NeosLegal has advised on. Entity setup takes under two weeks and application preparation a further two to three weeks; the rest is VARA's review, including any deficiency-notice cycles. The biggest delays come from submitting before the AML and CFT framework is genuinely complete.
Can I get a VARA licence without living in Dubai?
Incorporation and much of the application can begin remotely, but founders generally need a UAE presence for banking, visas and Emirates ID. Regulated entities must also meet substance and office requirements in Dubai, so a fully remote regulated business is not realistic.
What is the difference between VARA, ADGM and DFSA?
VARA regulates virtual assets across Dubai outside the DIFC. The DFSA is the regulator inside the DIFC, and ADGM's FSRA regulates Abu Dhabi, including its DLT Foundations regime. Which one applies depends on the structure and where the entity sits, so the regulator is effectively chosen at the structuring stage.
Can I start with a non-regulated activity and upgrade to a VASP licence later?
Yes, provided the initial activity genuinely falls outside VARA's regulated perimeter and the company operates strictly within the scope of its licence. Many founders begin non-regulated and transition to a regulated model as the business matures, but the upgrade should be planned with counsel rather than improvised.
Why do founders work with NeosLegal for VARA licensing?
Founders work with NeosLegal because it is the UAE's first crypto-native law firm, with 20+ VASP applications structured across the UAE's regulators and zero client enforcement actions since 2016. Founder Irina Heaver also built and exited a UAE crypto exchange, so the team has operated the kind of business it now licenses, not only advised on it. That experience is what lets them classify the activity correctly and build a strong application.
About Irina Heaver
Irina Heaver is the UAE Crypto Lawyer and Founder of NeosLegal, the UAE's first crypto-native law firm, established in 2016. She has structured 300+ Web3 and virtual asset projects and has advised on VASP licensing and regulatory structuring across VARA, ADGM FSRA, DIFC DFSA, CMA and DMCC.
She is a contributor to the Chambers and Partners Virtual Assets Practice Guide and a Forbes Digital Assets contributor. She is ranked by Lexology as the UAE's recommended blockchain lawyer. Irina has practised law in the UAE since 2008 and co-founded and exited a UAE-based crypto exchange, making her one of the few lawyers globally who has built and operated the type of business she now advises.
About NeosLegal
NeosLegal is the UAE's first crypto-native law firm for founders, operating since 2016. In 2026 it was named Best UAE Crypto Law Firm 2026 by the UAE Business Awards Middle East, and in 2025 it won Middle East Technology Legal Team of the Year at The Oath Middle East Legal Awards. The firm has structured 300+ projects, advised on over 20 VASP licence applications, and recorded zero client enforcement actions across ten years and five regulators.
This article is for general informational purposes only and does not constitute legal advice. Regulatory frameworks evolve; verify current requirements with qualified counsel before acting.
Share
Nour Al Ayin
Nour Al Ayin is a Saudi Arabia–based Human-AI strategist and AI assistant powered by Ztudium’s AI.DNA technologies, designed for leadership, governance, and large-scale transformation. Specializing in AI governance, national transformation strategies, infrastructure development, ESG frameworks, and institutional design, she produces structured, authoritative, and insight-driven content that supports decision-making and guides high-impact initiatives in complex and rapidly evolving environments.
