What Is a VARA Broker-Dealer Licence? Scope, Limits and What It Permits

A VARA Broker-Dealer licence authorises a firm to arrange and execute virtual asset transactions on behalf of clients, including conversion between virtual assets and fiat currency. It is one of eight distinct activity categories VARA licenses separately. It does not authorise custody, operating an exchange, lending, or investment management, each of those requires its own licence. If a counterparty tells you it is "VARA licensed," that statement is incomplete until you know which activities the licence actually covers.

What is a VARA Broker-Dealer licence?

The Dubai Virtual Assets Regulatory Authority was established by Law No. 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai - the Dubai VA Law - to regulate virtual assets and virtual asset service providers. VARA is affiliated to the Dubai World Trade Centre Authority and operates under the Virtual Assets and Related Activities Regulations 2023.

A VASP, in VARA's own definition, is an entity authorised by VARA to conduct virtual asset activities in the Emirate. Licensed means holding a valid licence.

Broker-Dealer Services is one of the activities VARA licenses. Broadly, it concerns arranging and executing virtual asset transactions on behalf of clients rather than trading purely on a firm's own account. The precise scope is defined in Schedule 1 of the Virtual Assets and Related Activities Regulations 2023 and in the Broker-Dealer Services Rulebook, and any firm assessing whether its own activity falls inside the category should read those rather than a summary of them.

The important framing, and the one most firms miss: what matters is not what a business calls itself, but what it actually does. A firm describing itself as an OTC desk, a liquidity provider, a settlement partner or a conversion service may be conducting Broker-Dealer activity regardless of the label. VARA's position is unambiguous — no virtual asset activity is exempt from regulatory supervision, and any entity carrying on a regulated activity in or from Dubai requires a licence before it begins.

What are the eight VARA licence categories?

VARA has identified eight distinct virtual asset activities that define the regulatory perimeter. A VASP applies for one or more of them explicitly.

Source: VARA, Licensed Activities. The full definition of each activity is set out in Schedule 1 of the Virtual Assets and Related Activities Regulations 2023 and in the relevant activity Rulebook. Firms should read the definitions there rather than rely on any summary.

Two features of this structure matter when assessing a counterparty.

A VASP may hold several activities under one overarching licence, but the aggregation is not unlimited. Where Custody Services are involved, VARA imposes specific requirements to segregate activities and demonstrate independence of governance or arm's-length arrangements. Custody is treated as structurally different because the firm holds client assets.

A licence in one category authorises nothing in another. This is the single most useful thing to understand about the framework, and it is why "licensed by VARA" is an incomplete statement.

What does a Broker-Dealer licence not permit?

Being clear about the limits is what makes the permissions meaningful.

A firm licensed for Broker-Dealer Services only is not authorised to:

• Provide custody services to others. Custody Services is a separate category with its own Rulebook and its own segregation and governance requirements. Where a firm needs custody provided as a service, that must be separately licensed.
• Operate an exchange. Running a trading venue that matches buyers and sellers is Exchange Services.
• Lend, borrow, or arrange leverage. That is Lending and Borrowing Services.
• Manage or invest client assets on a discretionary basis. That is Management and Investment Services.
• Issue virtual assets. That is VA Issuance, governed by the VA Issuance Rulebook.

There is also an activity-level prohibition worth knowing, because it is absolute rather than a matter of licensing. Anonymity-Enhanced Cryptocurrencies, virtual assets that prevent tracing of transactions or ownership through public ledgers, where the VASP has no mitigating mechanism to allow traceability, cannot be marketed in or targeting the UAE, and any virtual asset activity involving them is strictly prohibited in the Emirate. No licence category permits it.

What obligations does a licensed Broker-Dealer carry?

A licence is not a one-off approval. It places a firm under continuous supervision across two layers of rules.

VARA's rules operate on two levels. A set of compulsory Rulebooks applies to every VASP regardless of the activities it holds, covering areas including corporate governance and capital, compliance and risk management, technology and information security, and market conduct. Activity-specific Rulebooks apply on top, for a Broker-Dealer, the Broker-Dealer Services Rulebook.

The Rulebooks are published on VARA's website and are revised periodically, so a firm assessing a counterparty, or its own obligations, should work from the current versions rather than a secondary summary.

There is a third layer that receives far less attention and applies to every entity marketing in or targeting the UAE, licensed or not. The Regulations on the Marketing of Virtual Assets and Related Activities 2024 define "Marketing" broadly enough to include advertising, social media, and educational content such as articles and presentations. Under those Regulations, marketing of a virtual asset activity may only be carried out by a VASP licensed for that specific activity, or on its behalf with its approval. Fines under the Marketing Regulations reach AED 10 million per violation.

The practical read: a firm's licence constrains not only what it may do, but what it may say it does.

Where does VARA's authority apply, and where does it not?

VARA regulates virtual asset activity across all zones of the Emirate of Dubai, including Special Development Zones and Free Zones, but excluding the Dubai International Financial Centre.

That exclusion matters. The DIFC is regulated by the Dubai Financial Services Authority under a separate framework. A firm licensed in the DIFC is not VARA licensed, and vice versa.

Beyond Dubai, the picture fragments further. Abu Dhabi Global Market operates its own framework through the ADGM Financial Services Regulatory Authority. The Securities and Commodities Authority has federal remit. Bahrain regulates crypto-asset services through the Central Bank of Bahrain under Volume 6 of the CBB Rulebook.

So "licensed in the UAE" is not a single claim. It identifies neither the regulator nor the permitted activity, and a counterparty may hold authorisation from a regulator whose remit does not extend to the transaction in question.

For a closer comparison of two of these frameworks, see CBB Category 3 vs VARA: What Each Licence Means for Your Payment Provider.

How do you verify a VARA licence?

VARA maintains a public register of licensed entities. Verification takes a few minutes and answers three questions a website cannot:

1. Is the entity on the register, under the exact legal name you are contracting with?
2. Which activity categories does it hold? This is the question that matters most. A firm may be genuinely licensed and still not licensed for what you need.
3. What is the licence status? Licences are subject to conditions and renewal.

A claim on a marketing page is not verification. The register is the source, and it is public precisely so counterparties can check.

Why the activity distinction matters commercially

Consider a UAE corporate holding stablecoins that needs dirhams in its bank account.

That requirement is a conversion and settlement question. It calls for a counterparty authorised to arrange and execute the conversion — and, depending on the structure, to hold assets during the process. A counterparty licensed for Broker-Dealer Services can arrange and execute. If the arrangement requires custody, that must be separately licensed or provided by a VASP licensed for it.

A corporate that asks only "are you VARA licensed?" has not established whether the counterparty can perform the transaction. The better question is: which activities does your licence cover, and does that include what I need done?

ARP Digital's position

ARP Digital FZCO is licensed by the Dubai Virtual Assets Regulatory Authority to provide Broker-Dealer Services in Dubai, under VASP Reference VL/26/07/03. The licence covers digital asset and stablecoin conversion into UAE dirham for UAE-domiciled corporates, capital markets participants and qualified investors.

Separately, ARP Digital Bahrain B.S.C. (Closed) holds a CBB Category 3 licence in Bahrain — Capital Markets Crypto-Asset Service Provider, per Rule CRA-1.1.13 of the CBB Rulebook. Two entities, two regulators, two frameworks.

That distinction is worth making explicit, because it applies to any group operating across the Gulf. A licence is held by a specific legal entity in a specific jurisdiction. Confirming which entity you are contracting with is part of the same check as confirming which activities the licence covers.

ARP Digital FZCO is one of a number of firms holding a VARA Broker-Dealer licence. The public register lists them, and any counterparty assessment should begin there rather than with a provider's own description of itself.

For how conversion into AED works in practice, see ARP Digital's Receive product. Where the choice of stablecoin arises, see USDT vs USDC: Which Stablecoin Should GCC Businesses Accept?. ARP's own licence announcement is here.