The eight licensed activities
VARA identifies eight licensed virtual asset activities. A VASP may hold several under one overarching licence and must satisfy the requirements of each in full. Custody is the exception that changes the corporate structure. Law stated as at 30 October 2026.
- Virtual Assets Advisory Services — advising on virtual assets. The lightest of the eight, and the one most often carried on unknowingly by businesses that describe themselves as consultants.
- Virtual Assets Broker-Dealer Services — arranging or executing transactions for others. The boundary with exchange services is about whether you are matching or intermediating.
- Virtual Assets Custody Services — holding assets for clients. See the segregation rule below; this one does not share a licence.
- Virtual Assets Exchange Services — operating a trading venue. The Exchange Services Rulebook was updated to version 2.1 with effect from 31 March 2026, adding a regime for exchange-traded derivatives.
- Virtual Assets Lending and Borrowing Services — credit against or in virtual assets.
- Virtual Assets Management and Investment Services — managing assets or portfolios for others.
- Virtual Assets Transfer and Settlement Services — moving and settling virtual assets.
- Virtual Assets Issuance Category 1 — issuance, with VARA having published dedicated issuance guidance in April 2026.
The custody rule, and why it is structural
Custody is the only activity on the list that must be kept separate from the others. A VA Custodian must be established as a distinct legal entity holding its own standalone licence, and where custody sits alongside other activities the business must segregate them or demonstrate independent governance.
This is not a compliance formality that can be bolted on. It determines how many companies exist, who owns them, how intra-group agreements are written and where client assets sit on a balance sheet. It has to be decided before incorporation. Re-engineering a single-entity platform into a segregated structure after launch means migrating client assets, which is the most dangerous operation a custodian can perform.
Proprietary trading is not on the list
Proprietary trading — trading the firm's own or its group's book — is not one of the licensed activities and cannot be carried on under a regulated activity licence. It has to run through a separate company, and it requires a No Objection Certificate from VARA, with trading above certain volumes registered with the authority.
This catches market makers and treasury desks inside otherwise well-run platforms, because the activity grows organically out of operations rather than being launched as a product.
Activity drift — the way businesses become unlicensed
Almost no one applies for the wrong licence. What happens is that the business changes and the licence does not.
- A broker-dealer begins holding client balances between trades, and is performing custody.
- An advisory business starts executing on client instructions, and is a broker-dealer.
- An exchange adds a yield product, and is lending.
- A platform lists a perpetual, and is in derivatives.
- A treasury function starts quoting two-way prices, and is proprietary trading.
Each of these is a product decision taken by people who are not reading the rulebook. The control that works is a simple one: a standing rule that no new product, pair or feature ships without someone confirming in writing which licensed activity it falls under.
The same activity in a different perimeter
The eight categories are VARA's. The other regulators draw their lines differently, and an activity that is cleanly within one category in Dubai may be split, combined or excluded elsewhere — crypto mining in ADGM being the clearest example, handled as a commercial licence through the Registration Authority rather than as an FSRA regulated activity. The Regulator Selection Matrix sets the five perimeters side by side.
Primary sources
The law and rules this page relies on. Links go to the regulator rather than to a summary, because the rulebooks move faster than commentary on them. Law stated as at 30 October 2026.
- Federal Decree-Law No. 32 of 2025 concerning the Capital Market Authority — in force 1 January 2026; the CMA is the legal successor to the Securities and Commodities Authority, and references to the SCA in legislation are read as references to the CMA. CMA
- Federal Decree-Law No. 33 of 2025 on the Regulation of Capital Markets — in force 1 January 2026. UAE Legislation
- VARA Rulebooks and Licensed Activities — the eight licensed virtual asset activities, the custody segregation rule and the proprietary-trading carve-out. VARA
- VARA Exchange Services Rulebook v2.1 — effective 31 March 2026, introducing a regime for exchange-traded derivatives. VARA rulebooks
- CBUAE Payment Token Services Regulation (Circular No. 2/2024) — issuance, conversion, custody and transfer of payment tokens; Dirham Payment Token issuance is licensable. CBUAE
- DFSA Crypto Token regime — DIFC. DFSA
- ADGM FSRA virtual asset framework — Abu Dhabi. ADGM
Frequently asked questions
Do I need a custody licence if I only hold assets briefly between trades?
Very possibly, and this is the single most common way a broker-dealer becomes an unlicensed custodian. The question is whether client assets are under your control at any point, not how long for. If balances sit with you between instruction and settlement, take advice before assuming the activity is incidental.
Can one company hold all eight activities?
No. Seven of them can sit under one overarching licence, with the requirements of each met in full. Custody cannot: a VA Custodian must be a distinct legal entity with its own standalone licence.
Is market making proprietary trading?
It generally involves trading the firm's own book, which is outside the licensed activities and needs a separate company plus a No Objection Certificate. Treating it as an incident of running an exchange is a common and expensive error.