CBB Category 3 vs VARA: What Each Licence Means for Your Payment Provider

GCC businesses routing cross-border payments through digital asset rails need to know whether their payment provider is licensed for that activity - and which regulatory authority issued the licence. The Central Bank of Bahrain (CBB) issues Category 3 licences for cross-border digital asset payment services; VARA - the UAE Virtual Assets Regulatory Authority - issues virtual asset service licences covering digital asset activities in the UAE. ARP Digital holds a full CBB Category 3 licence and VARA In-Principle Approval (IPA), operating under both regulatory frameworks.
This article covers what each licence authorises, where they differ, and what a GCC CFO or procurement team should ask any payment provider to confirm before committing volume.

See how ARP Digital's dual-licensed infrastructure works →

What is the CBB Category 3 licence and what does it authorise?

A CBB Category 3 licence is a regulated crypto-asset services licence issued under Volume 6 of the CBB Rulebook, Crypto-Asset Module (CRA). Per Rule CRA-1.1.13, Category 3 licensees are authorised to undertake: trading in accepted crypto-assets as agent; trading in accepted crypto-assets as principal; portfolio management; crypto-asset custody; and investment advice. The critical permission for cross-border payment settlement is trading as principal — a Category 3 licensee may buy and sell accepted crypto-assets on its own account against client transactions, which is the mechanism enabling fiat-to-USDT conversion for payment settlement. Per Rule CRA-1.1.14, Category 3 licensees may hold or control client assets and client money, and may deal as principal, but must not operate a crypto-asset exchange — that requires a Category 4 licence. The CBB's Crypto-Asset Module has been operational since February 2019. (CBB Rulebook Vol. 6, CRA Module, Rules CRA-A.2.1, CRA-1.1.13–1.1.14, cbb.gov.bh)

What is VARA and what does VARA approval authorise in the UAE?

VARA - the Virtual Assets Regulatory Authority - was established under Federal Decree-Law No. 4 of 2022 as the UAE's dedicated virtual asset regulator, and issues Virtual Asset Service Provider (VASP) licences for specified digital asset activities in the UAE, including payment services, exchange, custody, and advisory. VARA's licensing process includes an In-Principle Approval (IPA) stage, which is a conditional preliminary decision - it is not a full VASP licence and does not authorise unrestricted live commercial operations. Full VASP licensing is required for that. ARP Digital holds a VARA In-Principle Approval, as confirmed in ARP Digital's VARA In-Principle Approval announcement.

What is the difference between a CBB Category 3 licence and VARA approval?

CBB Category 3 and VARA are issued by different regulatory authorities, cover different jurisdictions - Bahrain and the UAE respectively - and authorise overlapping but distinct digital asset activities. A payment provider serving GCC clients across both markets may require both frameworks. The table below covers the dimensions that matter for due diligence.

(Sources: Central Bank of Bahrain, CBB Rulebook Vol. 6, CRA Module, cbb.gov.bh; VARA, vara.ae - Regulations & Guidelines)

The key operational distinction for a GCC business: CBB Category 3 is the licence that authorises the settlement activity - conversion and cross-border payment routing under Bahrain's regulatory framework. VARA covers the UAE-based digital asset service layer. A provider operating a Bahrain settlement rail under CBB authority and engaging UAE-based clients benefits from both, but they authorise different things in different jurisdictions.

Do GCC businesses need a payment provider with both licences?

The answer depends on the corridors and the specific services involved. A provider operating cross-border digital asset payment services from Bahrain is required to hold a CBB Category 3 licence. GCC businesses should verify their provider holds this licence before routing volume through them. A business requiring UAE-based digital asset services - exchange, custody, or UAE-regulated payment activity - needs VARA coverage for that layer. A business with requirements spanning both jurisdictions benefits from a provider holding both.

The practical frame for due diligence: licensing jurisdiction and licensing scope are separate questions. A provider licensed in Bahrain is not automatically authorised to conduct UAE-regulated digital asset operations; a VARA IPA does not substitute for a CBB Category 3 licence for cross-border settlement purposes. The correct question is not "are they licensed?" but "licensed by whom, and for what?"

The due-diligence question to ask any prospective provider: "Which regulatory authority has issued your licence, for which specific activities does it apply, and what is your licence registration number?" A licensed operator answers this immediately and with documentation. A vague reference to "regulatory compliance" or "licensed operations" without a named authority and registration number is not a licence claim - it is a compliance posture.

How can GCC businesses verify a payment provider's regulatory status?

Check the CBB Public Register for Bahrain-licensed entities at cbb.gov.bh/financial-institutions/licensed-entities. Check the VARA public register for UAE-licensed entities at vara.ae. Any legitimate licensed provider will direct you to their listing in both without hesitation.

Four things to request from any prospective provider:

Licence type. The specific category - CBB Category 3, not "we are licensed in Bahrain." Category 3 authorises trading as agent and principal, which is the permission required for payment settlement via digital asset rails. Category 4 authorises operating a crypto-asset exchange. Different categories carry fundamentally different permitted activities.

Issuing authority. The named regulator: Central Bank of Bahrain or VARA - not "GCC regulatory approval" or "regional compliance frameworks."

Registration number. The number under which the entity appears on the public register. This is independently verifiable in seconds. A provider that cannot supply this does not have it.

Current status. Licences can be suspended, conditions can be imposed, and In-Principle Approvals can lapse. Ask for current status confirmation, not the original licence announcement date.

Red flags: a provider that references "regulatory compliance" without a specific licence type, issuing authority, and registration number is not demonstrably licensed. Compliance documentation is not a licence. A press release about regulatory engagement is not a licence. A public register entry is a licence.

Frequently Asked Questions

What is the difference between a CBB Category 3 licence and VARA approval?

CBB Category 3, issued by the Central Bank of Bahrain, authorises cross-border digital asset payment services and fiat/crypto conversion in Bahrain. VARA approval, issued by the UAE Virtual Assets Regulatory Authority, covers digital asset services in the UAE. They are issued by different regulators, cover different jurisdictions, and authorise overlapping but distinct activities. A provider may hold both. (CBB Rulebook Vol. 6, CRA Module; VARA Regulations 2023)

Does my GCC payment provider need both a CBB and VARA licence?

It depends on where the services operate. A provider operating a Bahrain-based cross-border digital asset payment service is required to hold a CBB Category 3 licence. UAE-based digital asset services require VARA licensing. A provider serving both markets under both frameworks holds both. Ask your provider which authority issued their licence, for which specific activities, and request their public register entry.

What does a CBB Category 3 licence allow a payment provider to do?

Per CBB Rulebook Vol. 6, CRA Module Rule CRA-1.1.13, a Category 3 licensee may trade accepted crypto-assets as agent and as principal, manage portfolios, provide crypto-asset custody, and give investment advice. The "trading as principal" permission is the regulatory authority enabling fiat-to-digital asset conversion for cross-border settlement. Category 3 does not authorise operating a crypto-asset exchange — that requires a Category 4 licence. The CRA Module has been operational since February 2019. (Central Bank of Bahrain, cbb.gov.bh)

What is VARA In-Principle Approval and is it the same as a VARA licence?

No. VARA's In-Principle Approval (IPA) is a conditional preliminary decision - it is not a full VASP licence and does not authorise unrestricted live commercial operations. A full VARA licence is required for that. Businesses should confirm whether their provider holds IPA or a full VARA VASP licence, as these represent different stages of the licensing process. (VARA Regulations 2023, vara.ae)

How do I verify whether my GCC payment provider is licensed?

Check the CBB Public Register at cbb.gov.bh/financial-institutions/licensed-entities for Bahrain-licensed entities, and the VARA public register at vara.ae for UAE-licensed entities. Any legitimately licensed provider can supply their licence type, issuing authority, and registration number. Request these in writing and verify independently against the relevant register before committing volume.

ARP Digital holds a full CBB Category 3 licence - authorising cross-border digital asset payment services under CBB oversight - and VARA In-Principle Approval, operating across both regulatory frameworks. The firm has processed over $3.5 billion in transaction volume across 450+ institutional and corporate counterparties, recording 4× year-on-year volume growth in 2025.
See how ARP Digital's dual-licensed infrastructure works →