Capital and licence fees are predictable. Substance, custody architecture, and proof of insurance are not.
VARA categories and what Category 4 covers
VARA issues virtual asset service licences across seven service categories. Category 4 (VA Exchange) authorises spot exchange of virtual assets, OTC desk operations, order-book exchange operations, and brokerage — effectively the full-service exchange model. It is the category sought by established centralised exchanges wanting a Dubai institutional presence, OTC desks expanding from other MENA jurisdictions, and trading platform operators seeking VARA authorisation for Gulf institutional client onboarding. Categories 2 (Broker-Dealer) and 3 (Custody) are often required alongside Category 4 for operators whose model includes discretionary trading or custody services.
The cost picture — licence fees vs. total first-year investment
VARA’s published Category 4 licence fee is AED 200,000 (approximately USD 54,500) per year. This is the number that appears in most jurisdiction comparison tables. It is not the relevant cost figure for planning purposes. The total first-year investment runs USD 500,000–1.2 million depending on the exchange model and custody approach. The major components beyond the licence fee: DIFC or mainland Dubai entity incorporation and freezone registration (AED 50,000–150,000 depending on structure); physical office establishment and lease (AED 180,000–400,000 annually in DIFC or DMCC); compliance officer hire or secondment (AED 360,000–600,000 annually for a qualified Chief Compliance Officer); AML programme development and technology (USD 80,000–150,000); and custody infrastructure — where the real variance sits.
VARA Category 4 applicants consistently underestimate two things: the custody insurance premium, and the time required to find a compliant custodian. Budget for both from day one, not from grant date.GSS Legal — VARA practice
Substance requirements
VARA requires genuine operational substance in Dubai: a physical office (DIFC, DMCC, or mainland — VARA accepts all three, with DIFC being the most institutionally recognised), minimum two senior management personnel resident in Dubai, a UAE-resident Chief Compliance Officer, and a Board with at least one UAE-resident or UAE-experienced director. VARA’s inspectors conduct site visits during the review process and have found and acted upon situations where the “Dubai office” existed on paper only. The compliance officer hire is typically the critical path item — the market for qualified CCOs with both VARA and crypto exchange experience is limited, and hiring timelines often exceed 90 days.
Custody architecture and insurance
VARA’s custody requirements for Category 4 are stringent: client virtual assets must be held in cold storage, segregated from operator assets, with daily reconciliation. The insurance requirement for hot wallet assets is the cost item that most surprises applicants. VARA does not prescribe a minimum insurance amount, but its guidance indicates that hot-wallet insurance coverage should reflect the actual value of assets held intraday. For a mid-sized exchange with USD 50–100M in daily hot-wallet volume, qualifying insurance premiums run USD 200,000–600,000 annually. The market for qualifying VA custody insurance in the UAE is concentrated among a handful of Lloyd’s syndicates and two or three specialist crypto insurers active in MENA. Lead times for insurance placement are 8–12 weeks from initial broker engagement.
Banking and settlement infrastructure
VARA Category 4 licence holders need AED, USD, and ideally EUR settlement infrastructure. The practical banking options in 2026: Emirates NBD, Mashreq, and RAKBANK have active crypto-business onboarding programmes for VARA-licensed entities; Tier-1 international banks (Standard Chartered UAE, HSBC UAE) are accessible for operators with institutional-grade substance and operational history. The banking onboarding process for a new VARA licensee typically runs 8–16 weeks from initial application. Running the banking application in parallel with the VARA review — rather than sequentially after grant — is essential for achieving operational commencement within a reasonable period post-grant.
Timeline in practice
VARA’s published review timeline for Category 4 is 3–9 months. In practice, across our active VARA mandates, the range is 5–12 months from complete application submission to grant. The primary determinants of review duration: completeness of the initial dossier (applications with gaps in the AML programme or custody architecture attract RFIs that extend the review by 2–4 months); compliance officer appointment timing (VARA has asked about CCO candidates during review, and operators who have not yet hired create delays); and business plan credibility (VARA reviews financial projections for plausibility).
Who Category 4 suits
Category 4 is appropriate for: established exchange operators seeking a Tier-1 MENA presence to access Gulf institutional clients and UAE-based family office capital; OTC desks with existing MENA business who need regulatory authorisation to continue operating; and operators who have received institutional LP or banking inquiries requiring VARA authorisation as a condition. It is not appropriate for early-stage exchanges that have not yet achieved operating scale — the total first-year investment and ongoing compliance costs are calibrated for operations that can support them. The engagement starts with a 45-minute scoping call to assess whether Category 4 fits the operator’s actual model, capital position, and timeline — before any commitment to the application process.
