Key takeaways
- A DMCC licence is a company licence; a VARA licence is a regulatory licence for virtual asset activity, and one does not replace the other.
- VARA covers virtual asset activity in and from Dubai, including free zones but excluding the DIFC, which is under the DFSA.
- Many licensed firms hold both: the free zone supplies the company and premises and VARA supervises the regulated activity.
- Work backwards from the activity: if any activity is a regulated virtual asset service, plan for VARA first and choose the vehicle second.
Indian Web3 founders who look at Dubai often ask for a crypto licence from DMCC or from VARA as if they were alternatives. They are not. A DMCC licence is a company licence issued by a free zone authority. A VARA licence is a regulatory licence for virtual asset activity. Confusing the two is one of the most common and most expensive mistakes in Dubai Web3 setups.
This guide explains what each does, which activities need VARA, how DMCC fits, what changes for the DIFC, how the two usually work together and how an Indian founder should choose a setup. We could not find an official list of the activities that a free zone licence alone covers, and cost figures online are mostly from vendors, so we give none. UAE-law points should be confirmed with UAE-licensed counsel.
Two different licences doing different jobs
A DMCC licence, issued by the Dubai Multi Commodities Centre, lets a company exist and trade in that free zone. It deals with incorporation, office arrangements, visas and the activities the free zone authority permits. It is a corporate and commercial licence.
| Feature | DMCC licence | VARA licence |
|---|---|---|
| What it is | A company licence from a free zone authority | A regulatory licence for virtual asset activity |
| What it permits | Incorporation, premises, visas and the activities the free zone allows | Specified regulated activities such as exchange, broker-dealer, custody and advisory |
| Regulates | Corporate and commercial matters | Conduct, capital, compliance and technology controls |
| Where it applies | The free zone | Dubai, including free zones but excluding the DIFC |
A VARA licence is issued by Dubai’s Virtual Assets Regulatory Authority. It authorises a business to carry on specific regulated virtual asset activities, such as exchange services, broker-dealer services, custody, lending, management and investment services, and advisory, subject to conditions, capital, staffing, compliance and technology requirements set out in VARA’s regulations and rulebooks. It is a regulatory licence.
The key point is that having the first does not give you the second. A DMCC commercial licence on its own does not authorise a business to carry on regulated virtual asset activity. Reports note that VARA’s regime covers virtual asset activity in and from Dubai, including its free zones, but excluding the DIFC.
Which activities need VARA
If your business offers a regulated virtual asset service to customers, in or from Dubai outside the DIFC, you need VARA authorisation or must arrange to operate through a licensed firm. Typical examples are running an exchange or a broker-dealer, holding customer assets, operating a lending or staking product, managing virtual asset investments or advising on them, and issuing certain tokens under VARA’s issuance rules.
Token issuance has its own path. VARA’s issuance rulebook, adopted in 2025, requires approval of a token before it is offered, with 2026 guidance building on it. Overlap with the UAE Securities and Commodities Authority is possible for tokens that are securities or commodities, so classification is a first step, not an afterthought.
Marketing is regulated as well. Promoting virtual asset services in Dubai without a licence can be an offence even if the business is registered elsewhere, and VARA has taken action against unlicensed promotion. Founders who test the market through advertising before they are licensed take a real risk.
Two practical examples show how this plays out. A company that builds wallet software and sells it as a licensed product to other businesses, without holding customer assets or arranging transactions, may be a technology business whose activity does not need VARA authorisation. A company that offers a custodial wallet to retail users, holding their assets and executing transfers, is carrying on a regulated activity and needs authorisation. The code may be similar, but the legal analysis is not. The analysis turns on who holds the keys, who the customer is and what the company does with the assets.
Regulatory classification can also change as the product grows. A platform that begins as software may add custody, staking or lending features and cross the line without anyone noticing. Build a simple internal rule that any new feature touching customer assets, execution of trades or token issuance must be reviewed by compliance before launch.
Where DMCC fits
DMCC has built a reputation as a base for crypto and Web3 companies, with a dedicated crypto centre. A DMCC licence can be a sensible home for activities that do not need VARA authorisation, such as software development, technology services, research, consulting, community and events, and some trading by a company on its own account. Which specific activities are permitted without a regulatory licence is a question for DMCC and VARA, and we could not find an official list.
DMCC can also serve as the corporate base of a business that holds a VARA licence. Many licensed firms are free zone companies that obtain both the commercial licence and the VARA licence. In that case the free zone supplies the company, premises and visas, and VARA supervises the regulated activity.
Some proprietary traders operating below a threshold can register voluntarily with VARA instead of obtaining a full licence. The threshold, conditions and consequences should be checked with VARA directly. Registration does not turn a business into a licensed exchange or custodian.
The DIFC and other zones
The Dubai International Financial Centre is outside VARA’s remit and has its own regulator, the Dubai Financial Services Authority, with its own regime for crypto tokens and related activities. A business that wants the DIFC’s common-law courts and financial-centre status deals with the DFSA, not VARA. The DFSA’s rules apply a different list of recognised tokens and conditions.
Other Dubai free zones, such as those for media, technology or commerce, are within VARA’s reach, but the zone authority’s own rules on permitted activities still apply. The mainland route is also available, with different ownership, licence and premises rules. Which structure is suitable depends on activity, customers, banking and tax.
Banking is a practical filter. A regulated licence helps with bank onboarding, but banks apply their own risk appetite, and crypto firms often find account opening slow. Ask about banking early, not after incorporation.
Cost and timing deserve honest planning, even though we give no figures. Licensing from a standing start usually takes many months, involves a technology audit, policies for anti-money laundering, market abuse and custody, a fit and proper review of senior people, and ongoing reporting. Many Indian founders start with a free zone company to build the product and approach VARA once the business model is stable, rather than the other way round. Whichever route you take, avoid taking customer funds or promoting regulated services before the licence is in place.
Choosing a setup, remedies and quick answers
Work backwards from the activity. Write down what the business does, who the customers are and where they are. If any activity is a regulated virtual asset service, plan for VARA or the DFSA, and choose the corporate vehicle second. If the business is technology, services or research, a free zone licence may be enough, but get written confirmation of permitted activities. Decide where the team will sit, because substance matters for tax and for the VARA application. Consider Indian-law constraints in parallel: FEMA for any investment from India, FIU-IND registration if you serve Indian users, and the risk that a Dubai company managed from India is treated as Indian tax resident. Budget for compliance staff, technology audits and capital, which usually cost more than the licence fees. If you have already launched without the right licence, stop regulated activity, take advice and consider approaching the regulator, because voluntary correction is generally better than being found. Review the structure each time the product changes, since adding custody or lending can move a business from unregulated to regulated overnight.
Keep investors informed. Investors in Dubai Web3 businesses increasingly ask which licence the company holds, which it has applied for and which activities are conducted outside any licence. Giving a plain account of the position, with dates, avoids later disputes and shows that management understands the perimeter.
Related reading: VARA and UAE corporate tax for Indian-founded firms, the VARA and Securitize tokenisation MoU, the UAE FIU and VARA agreement, VARA licence, Indian users and FIU-IND registration, Dubai vs GIFT City for crypto and Web3, the UAE DeFi licensing deadline for Indian teams and paying Indian developers from a Dubai Web3 company; also VARA token issuance guidance 2026 and ADGM tokenisation options for Indian founders; also how to check a crypto firm’s licence in the UAE and DIFC versus ADGM for crypto tokens in 2026; also whether crypto is legal in Dubai in 2026, whether the UAE bans Bitcoin self-custody and crypto corporate tax in the UAE; also a UAE bank account for a crypto company.
Quick answers
Is a DMCC licence enough to run a crypto exchange in Dubai?
No. A DMCC licence is a company licence. Operating an exchange or other regulated virtual asset service in Dubai outside the DIFC needs VARA authorisation.
Can I hold both a DMCC and a VARA licence?
Yes, and many firms do. The free zone provides the company and premises, and VARA supervises the regulated activity.
Does VARA regulate the DIFC?
No. The DIFC is regulated by the Dubai Financial Services Authority, with its own crypto token regime.
Can I operate a crypto exchange with only a DMCC licence?
No. A DMCC licence is a company licence. Operating an exchange or other regulated virtual asset service in Dubai outside the DIFC needs VARA authorisation.
Does VARA regulate the DIFC?
No. The DIFC has its own regulator, the Dubai Financial Services Authority, with a separate crypto token regime. Founders who want the DIFC deal with the DFSA, not VARA.
Final word
Halverton & Co. is an Indian law firm advising NRIs, founders, investors and businesses in Dubai and across the UAE on Indian law, including Dubai company setup, FEMA structuring, FIU-IND registration and Indian-law planning for Web3 founders. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and work alongside UAE-licensed counsel, who advise on UAE law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.
This article reflects developments reported up to late October 2026. It is for general information only, is not legal advice, and does not create an advocate-client relationship. Halverton & Co. is an Indian law firm and does not advise on UAE law; UAE-law points should be confirmed with UAE-licensed counsel.
Sources
Related practice area
Crypto, Web3 & Digital Assets
Advice for virtual digital asset businesses on registration, reporting and structure.
View the practice areaComments
No account needed. Comments are reviewed before they appear, so yours will show here once approved. Please do not share confidential details or describe your own legal matter: replies are general discussion, not legal advice, and do not create an advocate-client relationship. For your own situation, write to office@halvertonandco.com.
