Crypto-authorization Process in the Dubai Virtual Currency Registry
The official VARA information describes the crypto authorization process in Dubai as a 2 step process. The first stage embodies the incorporation of a limited liability company in Dubai, while the second stage is the application for the VASP license.

The process to obtain the VARA license in Dubai begins with the initial approval application. The goal of this first half of the process is to incorporate the company and lay the basis to further comply with the VARA expectations for licensing.

An applicant for the VASP license in Dubai should have local substance:

Two “Responsible Individuals” need to be appointed as full-time employees, both of them being either residents of the UAE or holders of a UAE passport, and both approved by VARA;
A true physical office space with an address in Dubai (can be in a free zone).
While the corporate structure is formed, the crypto company presents itself and its project to the VARA and begins a conversation. This initial approval is subject to preparing and presenting the relevant documents and paying a part of the license application fee for the review.

Once the VARA has approved the applicant, the second half of the process begins, which is the VASP license application in Dubai. It can only be initiated once the VARA has given its approval. Additional documentation has to be prepared and provided, responding to the VARA Rulebooks and Guidelines. Once everything is confirmed to be compliant in terms of the corporate structure and functioning of the crypto business, the last portion of the license fee is paid and the VASP license is granted.

The registration of Dubai Company in the Register of Cryptocurrency companies
Only companies registered in Dubai can apply for the Virtual Asset Services Provider (VASP) license from the VARA. Since Dubai is one of the most business-friendly jurisdictions, it is fairly simple to incorporate a Dubai company to register as a cryptocurrency company.

The company can be formed in a free zone (FZ) in Dubai. It can also be registered with the Dubai Department of Economy & Tourism. The legal entity should be in the form of a limited liability company. Sole proprietorships are excluded and will not be granted the VARA license.

The minimum share capital for a Dubai company to apply for a VASP license depends on the virtual assets activity it will register for. A paid-up capital contribution of 100,000 AED (about 27,000 USD) has to be deposited in full before application. Then, depending on the intended activities, the share capital shall rise to a minimum of 500,000 AED (135,000 USD).

Finally, as the company is set up and the share capital is contributed, a Dubai crypto company shall appoint 2 UAE citizens or residents as responsible individuals, embodying the duty often referred to as AML officer or MLRO (money laundering reporting officer). Subsequently, the company has to rent an office space within Dubai.

Governmental Statements on Crypto in Dubai
“Establish the UAE and Dubai's position as a key player in designing the future of virtual assets globally.” This is the goal of VARA as declared by Mohammed bin Rashid, Prime Minister of the UAE and ruler of Dubai.

Dubai is the first ever country to form an independent and specialized regulator for Virtual Assets in the world. The ambition is repeated by Helal Saeed Almarri, Chairman of VARA’s executive board: “our mission [is] to establish the Emirate as the capital of the Future Economy anchored by Metaverse, AI, Web3.0 and Blockchain”.

These declarations set the stage for Dubai to become a leading jurisdiction in the crypto industry. Already famous for its business-friendly stances and blooming economy, Dubai began an aggressive strategy to position itself as the number one crypto country.

Requirements for companies engaged in crypto activities in Dubai
It's not just the crypto license in Dubai cost that is crucial to take into account when preparing for an application. Obtaining and maintaining the Dubai VARA crypto license implies compliance at all times with requirements of different nature:

Financials: the paid-up share capital, financial projections, and group level statements, etc;
Corporate: key personnel disclosed, up-to-date corporate information, etc;
Technical: technology infrastructural design, data management policy, cybersecurity policy, and systems, etc;
Legal: AML/CFT policy and procedures, compliance manual, anti-bribery and corruption policy and procedures, etc.
To make it simpler for companies engaged in crypto activities in Dubai, VARA has issued themed Rulebooks. Every applicant and holder of a VASP license in Dubai shall acknowledge and refer themselves to these Rulebooks before and after securing the crypto authorization.

There are four Rulebooks that apply at all times for every applicant and holder of the license:

Company Rulebook;
Compliance and Risk Management Rulebook;
Technology and Information Rulebook;
Market Conduct Rulebook.
The Dubai VARA warns that these rulebooks are subject to change if deemed necessary by the regulatory authorities.

Additionally, depending on the Virtual Asset activity registered by a crypto company in Dubai, specific Rulebooks apply. There are various crypto-related activities classified by the VARA in Dubai:

Advisory Services;
Broker-Dealer Services;
Custody Services;
Exchange Services;
Lending and Borrowing Services;
VA Management and Investment Services;
VA Transfer and Settlement Services.
Registration to one or more of these VA activities happens in the application stage, as different rules will then apply to the crypto company.

The Process of Setting up a Company for a Cryptocurrency Business in Dubai
Setting up a company in Dubai is a key step toward becoming a licensed cryptocurrency business regulated by VARA. It is correct to see the incorporation stage as being strategic to the licensing process, as it is an integral part of the pre-application process.

A crypto business is free to register in a free zone in Dubai or to the Dubai Department of Economy and Tourism (DET). The choice shall not affect the company’s operations and should also be motivated by the choice of location and actual place of business.

To successfully obtain the VASP license in Dubai, it is compulsory that Dubai is the actual place of business. This means, at a minimum, that the company should rent an office space in a dedicated area of its registration place, and hire at least 2 residents or holders of a UAE passport as responsible Individuals.

Taxation for Cryptocurrency Companies in Dubai
The corporate income tax rate in Dubai is 9%. It is important to note that this tax rate does not apply to free zones in Dubai, where VASP companies are free to register. Therefore, it is possible to form a crypto business benefitting from a 0% tax rate in Dubai.

Cryptocurrency companies are, even for the ones registered in free zones and not liable to taxes, expected to fill tax returns. The compliance rulebooks state that licensed VASP companies must comply with tax reporting obligations at all times, under all the applicable laws. This includes national but also international best practices, like the United States Foreign Account Tax Compliance Act (FATCA).

This underlines the importance of having good accounting practices when operating a cryptocurrency company in Dubai. Rengang’s FinTech lawyers and specialists can provide valuable advice to crypto companies getting started in Dubai.

Obligations for Crypto Companies in Dubai
VARA has made it simple for VASP companies to comply with the regulation by providing them with a set of rulebooks detailing all the requirements. These rulebooks are freely available on the VARA website and their content is to the point, leaving no place for free interpretation. The key to obtaining a Dubai crypto license is having a legal team that has experience preparing compliance programs and knows how to communicate with the regulator.

The company rulebook pertains to the legal entity, the board members and ultimate beneficiary owners (UBOs), corporate governance, etc. It defines how the company should be structured, including in terms of personnel (mandatory company secretary, two responsible individuals) and in terms of training and background of the individuals (senior management is expected to be fit and proper by VARA, for example).

The compliance and risk management rulebook defines the AML/KYC policy and procedures to implement, as well as the internal compliance and risk management measures to enforce.

The technology and information rulebook relates to every software aspect of the business. This includes the application developed to perform their virtual asset activities, their cybersecurity measures, the laws and policies pertaining to data, and the requirement for testing and auditing of the systems.

The market conduct rulebook can be seen as the applicable financial regulation. It defines how the VASP company shall behave in regard to market participants. This includes marketing and promotion, agreements signed between the company and the clients, but also with the shareholders, the investors, the market makers and financial institutions, etc.

Those four rulebooks constitute the reglementary basis for all virtual asset services providers in Dubai. In addition to them, a specific rulebook applies to every virtual asset activity that the company will register for.

There are 8 VA activities in Dubai. When applying for the license, a crypto business shall notify the VARA on which of them it intends to practice. This is critical, as not only the obligations in terms of ongoing requirements but also in terms of incorporation, will change accordingly.

The 8 VA activities in Dubai are the following:

Advisory Services;
Broker-Dealer Services;
Custody Services;
Exchange Services;
Lending and Borrowing Services;
VA Issuance Category-1;
VA Management and Investment Services;
VA Transfer and Settlement Services.
Issuing anonymity-enhanced cryptocurrencies, and anything having to do with these kinds of virtual assets, is strongly prohibited in the Emirate.

Sanctions for Violating Dubai Crypto-Business Obligations
It is implied by the official statements of the VARA, that behind the licensing of crypto businesses in Dubai, there is an intention to form trusted corporate bonds between the regulatory bodies and the licensees. Consequently, violating the VASP license obligations is severely repressed.

VARA can impose fines, civil penalties, and other enforcement actions directly against the responsible individuals of a VASP.

A single violation of rules as they are described in the rulebook can lead to a fine, whose amount shall be the higher of:

50,000,000 AED (about 13,500,000 USD);
15% of the company’s annual gross revenue;
300% of the profits gained or loss avoided by the breach of the rules.
Unpaid fines generate a penalty of 1% per month.

The VARA also has the right and duty to sanction any action that they would consider improper, even though it may not be described as a rule that has been breached. VARA is the judge and arbiter of crypto companies in Dubai, as it is required by law to make and enforce the rules.