Dubai runs two separate financial regulators over the same 4,114 square kilometres: the Virtual Assets Regulatory Authority (VARA) supervises virtual asset activity across the emirate except inside the Dubai International Financial Centre (DIFC), where the Dubai Financial Services Authority (DFSA) holds exclusive jurisdiction — and since January 1, 2026 a rebuilt federal layer sits above both. Choosing between them is not a branding decision; it determines which activities a firm may lawfully perform, how much capital it must lock up, and which clients it may approach.

The boundary is geographic and absolute. VARA’s remit under Dubai Law No. 4 of 2022 covers the emirate of Dubai including its free zones but expressly excludes the DIFC, which operates its own English common-law jurisdiction with the DFSA as sole financial regulator. Above both, Federal Decree-Law No. 32 of 2025 established the Capital Market Authority (CMA), which replaced the Securities and Commodities Authority (SCA) in all its rights and obligations with effect from January 1, 2026. This analysis maps where the three perimeters actually meet, what each licence permits, what it costs, and where a foreign-exchange (FX) broker lands compared with a pure virtual-asset firm.

Key facts

• Eight VARA activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, plus Category 1 VA Issuance (VARA).
• VARA paid-up capital: AED 100,000 to AED 1.5 million by activity, benchmarked against a fixed-annual-overheads percentage (Company Rulebook, Part VI.B).
• DFSA base capital: US$10,000 to US$10 million across Categories 1 to 5; Category 2 principal dealing sits at US$2 million (DFSA PIB 3.6).
• Recognised Crypto Token list abolished January 12, 2026, shifting token assessment onto firms under GEN Rule 3A.2.1 (DFSA).
• 19 firms fined AED 100,000 to AED 600,000 by VARA on October 7, 2025 for unlicensed activity and Marketing Regulations breaches (VARA notice).
• 100+ licensed virtual-asset entities across five UAE regulators: VARA, DFSA, ADGM’s Financial Services Regulatory Authority (FSRA), the CMA and the Central Bank of the UAE (Chambers 2026, UAE chapter).
• Federal reset effective January 1, 2026: Decree-Laws No. 32 and No. 33 of 2025 repealed Federal Law No. 4 of 2000 and substituted the CMA for the SCA (UAE CMA).

Methodology and sources

This analysis rests on primary documents read directly: the VARA Rulebooks at rulebooks.vara.ae (Company Rulebook Part VI on capital, the activity rulebooks, and the April 2026 Guidance on the Virtual Asset Issuance Rulebook); DFSA Rulebook modules GEN 3A (Crypto Tokens) and PIB 3 (Capital); VARA’s regulatory notices; and Federal Decree-Laws No. 32 and No. 33 of 2025 as published by the CMA. Secondary reading is limited to named law-firm alerts — Clyde & Co, Morgan Lewis, Linklaters — and the UAE chapter of the Chambers Blockchain & Crypto-Assets 2026 guide, published June 11, 2026.

The window is January 2022, when Dubai Law No. 4 of 2022 created VARA, to August 2026; scope is Dubai emirate, the DIFC and the UAE federal onshore perimeter, with ADGM in the table for contrast only. Two caveats are stated rather than smoothed over: fee schedules for both regulators sit in annexes that advisory firms report inconsistently, and the commencement date of the CMA’s new virtual-asset rulebook is reported differently by different law firms. Both are flagged in the text rather than resolved by picking a side.

Where the boundary actually falls

VARA’s jurisdiction is drawn by geography, not activity type. Dubai Law No. 4 of 2022 gives VARA authority over virtual asset activity conducted in or from the emirate of Dubai, including commercial free zones such as the Dubai Multi Commodities Centre (DMCC), and expressly carves out the DIFC. Cross into the DIFC — a defined 110-hectare zone — and VARA’s rulebooks stop applying entirely. The DFSA’s regime applies instead, and it is not a virtual-asset regime at all: it is a conventional financial-services regime in which crypto tokens are treated as a species of investment, or as something closer to a payment instrument where they are fiat-backed.

That distinction is the single most consequential fact in the whole comparison. VARA licenses virtual asset activities. The DFSA licenses financial services, and then separately determines whether the crypto token involved in that financial service is permitted. A firm wanting to operate a spot crypto exchange in Dubai outside the DIFC applies for a VARA Exchange Services licence. The same firm inside the DIFC applies for a DFSA authorisation to Operate an Alternative Trading System or a Multilateral Trading Facility, and then must satisfy itself, token by token, that every asset it lists passes the GEN 3A.2.1 suitability test.

The federal layer complicates rather than clarifies. The CMA regulates onshore UAE financial activity outside the two financial free zones, and issued a standalone virtual-asset rulebook in 2026 — Decision No. 4/R.M/2026 — superseding the SCA’s Decision No. 26/R.M/2023 in full and creating eight federal virtual-asset activities with minimum capital from AED 500,000 to AED 4 million. Clyde & Co dates that decision to April 22, 2026; other practitioner commentary dates it to February 13, 2026. Treat the commencement date as unsettled and confirm it against the Official Gazette before relying on any transition assumption. The carve-out is not contested: the federal rulebook does not apply inside the DIFC or ADGM, and operates alongside — not over — VARA in Dubai.

Regulator / regime	Territory	Effective instrument	Entry capital	Key constraint
VARA (Dubai emirate, ex-DIFC)	Dubai mainland plus commercial free zones; DIFC excluded	Dubai Law No. 4 of 2022; Virtual Assets and Related Activities Regulations 2023	AED 100,000 (Advisory) to AED 1,500,000 (Exchange without approved custodian)	Virtual assets only; no authority over FX, securities or CFDs
DFSA (DIFC)	DIFC only — 110 hectares	DIFC Regulatory Law 2004; GEN 3A; PIB 3	US$10,000 (Category 4) to US$10,000,000 (Category 1)	Firm-led token suitability under GEN 3A.2.1 since January 12, 2026; privacy and algorithmic tokens prohibited
CMA (federal onshore)	UAE mainland; DIFC and ADGM excluded	Federal Decree-Laws No. 32 and 33 of 2025; Decision No. 4/R.M/2026	AED 500,000 to AED 4,000,000 across eight activities	Approved-token “Green List”; controller consent at 30% and 50% ownership
FSRA (ADGM)	Abu Dhabi Global Market	ADGM Financial Services and Markets Regulations 2015	Set by Financial Services Permission category	Separate emirate; no reciprocity with VARA licences

Sources: VARA Rulebooks; DFSA Rulebook GEN and PIB modules; UAE CMA published decree-laws; Clyde & Co client alert, April 2026. Last updated: August 5, 2026.

What each licence permits, and what it costs

VARA’s capital regime is activity-scaled and, unusually, rewards outsourcing custody. Under Part VI.B of the Company Rulebook, a Broker-Dealer that uses a VARA-licensed custodian holds the higher of AED 400,000 or 15% of fixed annual overheads; one that self-custodies holds the higher of AED 600,000 or 25%. Exchange Services follow the same logic at a higher base — AED 800,000 at 15% with an approved custodian, AED 1.5 million at 25% without. Custody Services itself is fixed at the higher of AED 600,000 or 25%. Advisory Services, the cheapest entry point, requires AED 100,000 flat. Issuers of Asset-Referenced Virtual Assets face a separate test: the higher of AED 1.5 million or 2% of the average market value of the Reserve Assets over the preceding 24 months.

The DFSA prices differently because it is pricing a different risk. Base capital under PIB 3.6 attaches to the financial-service category, not to the asset class: Category 1 deposit-taking at US$10 million, Category 2 principal dealing at US$2 million (falling to US$500,000 for matched principal), Category 3A agency dealing at US$200,000 following the 2025 prudential reforms, Category 3B custody in the US$500,000 to US$2 million band, and Category 4 advisory and arranging at the bottom of the scale. Advisory sources disagree on whether Category 4 base capital is US$10,000 or US$30,000 depending on the permission mix; PIB 3.6 is the governing text and should be read directly. On top of base capital sits an expenditure-based capital minimum expressed as a fraction of annual audited expenditure — 18/52, 13/52, 9/52 or 6/52 by category — so a high-opex firm can find the expenditure test binding long before the base figure does.

The practical cost gap is not in capital, it is in fees and time. VARA charges a non-refundable application fee reported at AED 100,000 for a first activity category (AED 40,000 for Advisory) and roughly AED 50,000 per additional category, with annual supervision fees of about AED 80,000 to AED 200,000 by activity. Those figures come from advisory summaries of Schedule B to the Virtual Assets and Related Activities Regulations 2023 and are reported inconsistently — some firms cite supervision fees above AED 300,000 for exchanges. The schedule itself is the authority. Timelines are similarly soft: practitioners describe eight to sixteen weeks to Approval to Incorporate and six to ten months end to end, but VARA publishes no service standard, so those are observed averages, not commitments.

“What this Guidance does, in substance, is move the regulatory perimeter upstream. For a long time, the focus in this space has been on how assets are traded. This framework focuses on how they originate.”

— Ruben Bombardi, General Counsel and Head of Regulatory Enablement, Virtual Assets Regulatory Authority (Crowdfund Insider, April 10, 2026)

Why an FX broker and a crypto firm land in different places

Here is the split that decides most real mandates. VARA has no authority over foreign exchange, contracts for difference (CFDs), equities or conventional derivatives. Its constituting law is confined to virtual assets. A retail FX or CFD broker therefore cannot obtain a VARA licence for its core business at all — not because VARA refuses, but because the activity falls outside the perimeter. That broker has exactly two Dubai options: a DFSA authorisation inside the DIFC, or a CMA licence to operate onshore. Plus500 took the onshore route under the then-SCA regime when it opened mainland UAE operations, and IFX Payments took the DIFC route with a Category 3C authorisation. Both are Dubai firms; neither is a VARA licensee.

A pure virtual-asset firm faces the mirror-image question. If it wants to serve the Dubai market from a commercial free zone, VARA is the only door. If it wants DIFC’s common-law contract enforceability, its banking relationships and its institutional counterparties, the DFSA is the only door — and it must then accept token-level suitability documentation as an ongoing obligation rather than a one-off listing decision. Ripple chose the DFSA for its crypto payments business; Crypto.com chose VARA for virtual-asset derivatives. Neither choice is wrong. They reflect different client bases.

The hybrid case is where firms most often go wrong. A broker offering both leveraged FX and spot crypto to the same Dubai client base needs two authorisations from two regulators, because no single UAE licence covers both perimeters in the same territory. Inside the DIFC that problem partly collapses — the DFSA can authorise both, since crypto tokens are simply another instrument within its financial-services categories — which is an underappreciated argument for the DIFC over the mainland for multi-asset brokers. Outside the DIFC there is no collapsing it.

Enforcement context: the October 2025 marketing sweep

On October 7, 2025, VARA published a regulatory notice confirming that it had penalised 19 firms for conducting unlicensed virtual asset activities and for breaches of its Marketing Regulations, with fines calibrated between AED 100,000 and AED 600,000 and accompanied by cease-and-desist orders and a public warning. The action matters less for its size than for what it targeted. VARA’s Marketing Regulations bind any entity — licensed or unlicensed, domestic or foreign — whose promotional activity relates to virtual assets in or from Dubai or targets UAE residents. Schedule 1 provides for fines up to AED 10 million, doubling for a repeat violation within one year of the original.

That extraterritorial reach is the trap for offshore firms. A brokerage licensed in a third country that runs paid acquisition into the UAE, sponsors a Dubai event, or engages local finfluencers sits inside VARA’s marketing perimeter whether or not it holds a UAE licence and whether or not it books a single UAE client. The federal layer tightened the same screw when the SCA introduced a dedicated finfluencer licence for digital financial content. The DFSA’s equivalent is its financial-promotion regime, restricting who may communicate an invitation to engage in financial services in or from the DIFC — narrower in territory, comparable in bite. VARA’s parallel rulebook tightening across compliance and risk management has run on the same trajectory.

What this means for brokers, exchanges, custodians and compliance teams

For FX and CFD brokers: stop treating VARA as an option. Model the choice as DFSA-in-DIFC versus CMA-onshore, and price it on client type. DIFC gives common-law contracts, professional-client defaults and the ability to add crypto tokens to the same authorisation later. Onshore gives direct access to UAE retail in dirhams. Budget for base capital of US$500,000 to US$2 million if dealing as principal or matched principal, and remember that the expenditure-based minimum can exceed base capital for a firm with heavy marketing spend.

For exchanges and custodians: VARA’s custody-linked capital discount is a real structuring lever. Using a VARA-licensed custodian rather than self-custodying cuts an exchange’s floor from AED 1.5 million to AED 800,000 and its overheads multiplier from 25% to 15%. That is a AED 700,000 balance-sheet difference plus an ongoing 10-point reduction, against the cost of an external custody relationship. Run that arithmetic before defaulting to self-custody.

For fund managers and treasury operations: the DIFC and ADGM retain a fund-passporting arrangement with the federal regulator, allowing DIFC-domiciled funds to be promoted into mainland UAE where the conditions are met — a channel Morgan Lewis has documented in its analysis of foreign-fund marketing guidance. That passport covers funds. It does not create a general right for a DFSA-licensed firm to solicit mainland clients for other services, and reverse solicitation is not codified in UAE law and should not be relied on as a marketing strategy.

For legal and compliance teams: since January 12, 2026 a DIFC firm must maintain a documented, reasoned suitability file for every non-fiat crypto token it touches, assessed against the criteria in GEN 3A.2.1 — token characteristics and governance, regulatory status elsewhere, market size and liquidity, underlying technology, and whether use of the token would prevent compliance with DFSA legislation. GEN 3A.2.2 and 3A.2.3 place absolute prohibitions on privacy tokens, privacy devices and algorithmic tokens. The DFSA gave roughly three months, to about April 12, 2026, to reassess previously recognised tokens. That transition has closed; the obligation is now continuous.

“The UAE is the only country where a crypto founder can choose between five regulators. That’s a feature, not a bug, and it’s why the world’s capital keeps landing here.”

— Irina Heaver, UAE Crypto Lawyer and Founder, NeosLegal (Chambers Blockchain & Crypto-Assets 2026, UAE chapter)

Heaver’s point deserves to be taken seriously rather than dismissed. Optionality lets a custodian, a market maker and a retail exchange each pick a proportionate regime instead of being forced into one designed for someone else. The counter-argument is equally concrete: every additional regulator adds a licensing application, a supervision fee, a reporting calendar and compliance headcount, and a firm operating across Dubai mainland and the DIFC pays all of it twice.

What’s next: the forward view

Three things are genuinely unresolved. The first is the federal-emirate hierarchy. Practitioner commentary increasingly describes VARA’s position as shifting from sovereign regulator toward a delegated local licensing authority inside the CMA’s federal architecture. Nothing in the published text of Decision No. 4/R.M/2026 subordinates VARA, but the direction of travel is worth watching, and the commencement-date discrepancy noted above suggests the drafting history is not yet fully public.

The second is issuance. VARA’s April 2026 Guidance made Dubai the first jurisdiction to codify token issuance categories in dedicated guidance, treating whitepapers and Risk Disclosure Statements as enforceable instruments. Whether the DFSA follows with an equivalent issuance perimeter inside the DIFC, or keeps handling issuance through prospectus and offer rules, will determine how far the two regimes diverge on primary markets.

The third is capital calibration. The DFSA’s 2025 prudential reforms moved matched principal dealing from Category 3A to Category 2 and cut Category 3A base capital to US$200,000, with further amendments signposted for 2026. The DFSA has reported steady growth in its regulated population — a 14% rise in regulated entities in its most recent published cycle — which historically precedes tightening rather than loosening. Firms modelling five-year capital plans on today’s PIB 3.6 figures should stress-test them. This divergence is not a Gulf peculiarity; the same fault line runs through SEC, MiCA, MAS and VARA treatment of liquid staking.

Frequently asked questions

Can one licence cover both VARA and DFSA territory?

No. VARA’s jurisdiction under Dubai Law No. 4 of 2022 expressly excludes the DIFC, and the DFSA’s jurisdiction is confined to the DIFC. A firm operating on both sides of that boundary needs two authorisations, two compliance functions and two supervision-fee lines. There is no passporting between them for financial services generally; the only established bridge is the fund-passporting arrangement between the federal regulator and the financial free zones, which applies to funds rather than to services.

Which licence does a retail FX broker need in Dubai?

Not a VARA licence. VARA’s remit is virtual assets, and foreign exchange and contracts for difference sit outside it. A retail FX or CFD broker needs a DFSA authorisation if it operates inside the DIFC — typically Category 2 for principal or matched-principal dealing, Category 3A for agency dealing, or Category 4 for arranging and advising — or a Capital Market Authority licence to operate onshore in mainland UAE.

What replaced the SCA?

The Capital Market Authority. Federal Decree-Law No. 32 of 2025 established the CMA and Federal Decree-Law No. 33 of 2025 restructured capital-markets regulation, both effective January 1, 2026, repealing Federal Law No. 4 of 2000 which had created the SCA. The CMA replaced the SCA in all its rights, obligations and contracts, and references to the SCA in existing instruments now read as references to the CMA.

What is the cheapest route into Dubai virtual-asset regulation?

By capital alone, VARA Advisory Services at AED 100,000 paid-up capital, with a reported application fee of AED 40,000. But capital is rarely the binding constraint. Application and annual supervision fees, technology-audit costs, local substance requirements and banking onboarding usually dominate the budget, and advisory-only permissions cannot be upgraded without a fresh application and further fees for each additional activity category.

Does a DFSA licence let a firm serve mainland UAE clients?

Not generally. The DIFC is a separate jurisdiction, and a DFSA authorisation does not confer a right to solicit clients in mainland UAE, which is the CMA’s perimeter. The exception is the fund-passporting arrangement, under which DIFC-domiciled funds may be promoted into the mainland where the conditions are met. Reverse solicitation is not codified in UAE law and is an unreliable basis for a client-acquisition strategy.

Do VARA’s marketing rules apply to firms outside Dubai?

Yes. VARA’s Marketing Regulations apply to any entity, whether or not VARA-licensed and whether domestic or foreign, where the marketing relates to virtual assets in or from Dubai or targets the UAE market. Schedule 1 sets fines up to AED 10 million, doubling for a repeat violation within one year. The October 7, 2025 action against 19 firms included marketing breaches alongside unlicensed activity.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.