What founders need to know
Key Takeaways
- Crypto custody is the safeguarding of client virtual assets and the control of private keys. Four UAE regulators license it: VARA, ADGM (FSRA), DIFC (DFSA) and the CMA, with the CBUAE covering payment-token custody.
- VARA licenses Custody Services, including wallet services where a third party controls keys, with capital from AED 1,500,000 to AED 3,000,000.
- ADGM licenses Providing Custody; public-fund custody sits in Category 3B at USD 4,000,000, with cryptographic key-management documentation to FSRA standard.
- The CMA splits the activity into Providing Custody (AED 3,000,000) and Arranging Custody (AED 1,000,000); arranging facilitates access to a licensed custodian without holding the assets.
- The DFSA licenses custody of crypto tokens within the DIFC.
- Custody applications are decided on key-management architecture, client-asset segregation, business continuity and insurance, not capital alone.
- A trade licence does not authorise custody. Privacy tokens and algorithmic stablecoins cannot be held in any UAE jurisdiction.
The Custody Permission
What a Crypto Custody Licence Covers
Custody is the regulated activity of holding, controlling or safeguarding client virtual assets, or the private keys that move them. The regulators draw a sharp line between holding assets and merely arranging access to a custodian, and the line decides which permission and which capital tier apply.
- Providing custody. Taking control of client assets or keys: VARA Custody Services, ADGM Providing Custody, or CMA Providing Custody. This is the heaviest permission, carrying the highest capital and the deepest technology review.
- Arranging custody. Facilitating client access to a licensed custodian without holding the assets yourself. The CMA licenses this separately as Arranging Custody at AED 1,000,000, a lighter route for firms that route to a third-party custodian.
- Custody inside a stack. Exchanges and broker-dealers that hold client assets need custody as part of their permission set.
If your platform controls keys, holds balances, or can move client assets at any point, you are providing custody. If it never touches client assets and only routes to a licensed custodian, you may be arranging. The distinction is factual and is one of the most common sources of scope error.
Who Needs a Custody Licence
Who Needs a Crypto Custody Licence?
If your business holds, controls or can move client virtual assets or their keys, you need a custody permission. Typical use-cases:
You likely do not need a custody licence if you are:
Licence required
- Institutional custodians Dedicated custody businesses safeguarding assets for funds, exchanges and institutions.
- Exchange and broker custody arms Trading venues and dealers holding client balances as part of the stack.
- Wallet providers controlling keys Services that hold or control private keys on behalf of users.
- Fund and RWA custodians Custody for tokenised funds, real-world-asset platforms and structured products.
- Staking-as-a-service holding assets Providers that take control of client assets to stake or delegate on their behalf.
- Tokenisation platforms Issuers and platforms safeguarding the underlying or the issued tokens for clients.
Likely outside the perimeter
- Non-custodial wallet software Code that lets users hold their own keys, where you never control or access client assets.
- A firm using a third-party custodian Routing all client assets to a separately licensed custodian without controlling keys, though arranging custody may still apply.
- A corporate treasury Holding virtual assets on your own account only, not for clients.
The providing-versus-arranging line decides your permission and your capital. A strategy call settles the classification in 30 minutes.
Who Regulates Custody
Which UAE Regulator Licenses Crypto Custody?
Four regulators license custody as a standalone activity, and the CBUAE adds a payment-token custody regime on top.
-
VARA (Dubai)
- Custody Services for Dubai-based custodians, including wallet services where a third party controls keys.
- Capital AED 1,500,000 to 3,000,000.
-
ADGM (FSRA)
- Providing Custody under the FSMR, with public-fund custody in Category 3B at USD 4,000,000 and cryptographic key-management documentation to FSRA standard.
- The institutional route.
-
CMA (Federal)
- Providing Custody at AED 3,000,000 for firms holding assets, and Arranging Custody at AED 1,000,000 for firms routing to a licensed custodian.
-
DFSA (DIFC)
- Custody of crypto tokens within the DIFC under a common-law framework, suited to institutional custodians with international counterparties.
-
CBUAE (Payment Tokens)
- Custody and transfer of payment tokens under the Payment Token Services Regulation, with capital from about AED 2,000,000.
- This applies on top of any other licence where the assets are payment tokens.
Regulator Comparison
Custody Licensing Compared: VARA, ADGM, DIFC and CMA
Cross-check each route against the live UAE VASP Licence Tracker , which lists current licence holders by regulator, updated monthly.
| VARA (Dubai) | ADGM (FSRA) | DIFC (DFSA) | CMA (Federal) | |
|---|---|---|---|---|
| Permission | Custody Services | Providing Custody | Custody of crypto tokens | Providing or Arranging Custody |
| Min. capital | AED 1,500,000 to 3,000,000 | Up to USD 4,000,000 (Category 3B) | USD 140,000 to 500,000+ | Providing AED 3,000,000; Arranging AED 1,000,000 |
| Client focus | Retail and professional | Professional and institutional | Professional | Federal onshore |
| Key management | To VARA standard | To FSRA standard | To DFSA standard | To CMA standard |
| Typical timeline | 9 to 15 months | 8 to 14 months | 10 to 12 months | 5 to 9 months |
| Year 1 all-in | AED 1,800,000 to 3,000,000+ | USD 350,000 to 900,000 | USD 300,000 to 2,000,000+ | From AED 1,000,000 to 8,000,000+ |
| Best suited for | Dubai custodians | Institutional custodians | DIFC institutional custody | Federal onshore custody |
Cost and Timeline
What Does a Custody Licence Cost?
All-in first-year cost is driven by the capital tier, the technology and security build, and the senior technology and risk team a custodian requires. Custody carries the highest capital of the standalone activities at most regulators.
| Route | Minimum capital | Indicative Year 1 all-in | Well-prepared timeline |
|---|---|---|---|
| VARA (Dubai) | AED 1,500,000 to 3,000,000 | AED 1,800,000 to 3,000,000+ | 9 to 15 months |
| ADGM (FSRA) | Up to USD 4,000,000 (Category 3B) | USD 350,000 to 900,000 | 8 to 14 months |
| DIFC (DFSA) | USD 140,000 to 500,000+ | USD 300,000 to 2,000,000+ | 10 to 12 months |
| CMA (federal) | Providing AED 3,000,000; Arranging AED 1,000,000 | From AED 1,000,000 to 8,000,000+ | 5 to 9 months |
Figures are first-year all-in ranges covering regulator fees, premises, senior-person hires, technology and security tooling, insurance and legal fees. Capital is a floor that must stay unencumbered at all times, not a one-time deposit at application.
Legal fees
NeosLegal works on fixed-fee, milestone-based engagements. Fees depend on the custody model, business complexity, application readiness at engagement start, and the scope of ongoing post-authorisation support. A specific written cost estimate is provided after the free assessment call, before any engagement commitment.
What Decides a Custody Application
Custody Applications Are Decided on Architecture, Not Capital
Meeting the capital floor is the easy part of a custody application. The review turns on whether the safeguarding model is sound. Four elements decide it.
- Key management. How keys are generated, stored, split and recovered, the balance of cold and warm storage, and who can authorise a movement. VARA and the FSRA expect documented cryptographic key-management frameworks, not a description of a wallet.
- Client-asset segregation. Client assets held separately from firm assets, on-chain and in the books, so that client holdings are identifiable and protected on insolvency.
- Resilience. Business continuity and disaster recovery for key material and access, including loss-of-personnel and loss-of-site scenarios.
- Insurance and proof of reserves. Cover proportionate to assets under custody, and the ability to demonstrate, on demand, that client assets are present and controlled.
Engagement Model
How Does NeosLegal Structure a Custody Licensing Engagement?
Across 20+ VASP applications advised since 2016, custody is the activity where applications most often stall on the technology file. The model below documents the safeguarding architecture to regulator standard before the application is filed, so the review confirms the model rather than discovering gaps in it.
- 01
Activity and permission scoping
Whether you are providing or arranging custody, and which regulator fits, mapped against the business model and the asset types held. Output: a written scoping memo signed by Irina.
- 02
Regulator and entity selection
The regulator, entity and capital tier chosen to fit the custody model before incorporation, with capital sized to assets under custody rather than the rulebook floor.
- 03
Pre-application engagement
Where the regulator runs pre-application meetings, the key-management and segregation model is surfaced before filing, which routinely saves months on the technology review.
- 04
Entity, governance and capital
The UAE entity incorporated and the senior team appointed, including the technology and risk functions a custodian requires, with capital in place and unencumbered.
- 05
Custody architecture and application
The full application built to rulebook standard: the cryptographic key-management framework, segregation model, business continuity and disaster recovery, insurance, and the AML programme, all documented as an operating model.
- 06
Submission, technology review and go-live
Submission and active query management, then the technology and systems review, capital confirmation and final approvals through to a live custody operation. Ongoing retainer covers audits, new asset types and regulatory change.
“Founders think a custody licence is about capital. It is not. The regulator wants to know what happens to client coins if a key holder is hit by a bus, if a site goes dark, or if the firm fails. If your key-management and segregation model answers those questions on paper before you file, the review is short. If it does not, no amount of capital saves the timeline.”
WHY CHOOSE NEOSLEGAL
Why Founders and Institutions Choose NeosLegal
NeosLegal has worked only on crypto and Web3 since 2016, before VARA existed, before ADGM had a crypto framework, and before most UAE firms understood what Bitcoin was. That head start shows in the track record, the recognition, and the way engagements run.
Track Record
- 300+ UAE Web3 and crypto projects structured and 700+ founders advised since 2016, with zero client enforcement actions in ten years.
- USD 500 billion in transactions advised and deals closed.
- 20+ VASP licence applications advised across the UAE regulators.
- 250+ Tier-1 exchange legal opinions at a 100% acceptance rate, a commercially verifiable outcome across hundreds of submissions.
Independent Recognition
- Best UAE Crypto Law Firm 2026, UAE Business Awards Middle East.
- Middle East Technology Legal Team of the Year, The Oath Middle East, November 2025.
- Authors the UAE chapters of the Chambers Blockchain and Crypto Assets guide, 2025 and 2026.
- Irina Heaver ranked as Recommended Blockchain Lawyer in the UAE 2025 and 2026, Lexology.
Regulatory Coverage
- All five UAE regulatory pathways, VARA, ADGM (FSRA), DIFC (DFSA), the federal CMA and CBUAE, handled within a single firm, with no coordination overhead between separate advisers.
- 60+ jurisdictions covered in total for cross-border structuring since 2016.
- Federal CMA Category RWA Tokenization Exchange, broker-dealer and OTC dealing desk licences delivered end to end, including the full policy suite, AML risk and controls register, and Approved Persons submissions the regulator requires.
Every engagement is fixed-fee with defined milestones confirmed before work begins. Direct access to Irina Heaver and senior associates throughout, not associates managing the relationship.
Founder differentiator
Founded by Irina Heaver, a former co-founder of a UAE crypto exchange (later exited), NeosLegal operates with founders’ commercial realities in mind. Irina has also drafted crypto laws and advised on virtual asset policy for multiple regulators and governments, including UAE regulators, helping shape the frameworks her clients are now licensed under, a perspective no other crypto lawyer in the UAE can offer.
Track record
Representative Custody Cases
-
VASP Licensing & Regulatory
Institutional Custodian – ADGM/FSRA
Advised an institutional digital-asset custodian on ADGM/FSRA licensing, capital-adequacy treatment and operational manuals, clearing the path for compliant onboarding of high-value clients and cross-border custody from the UAE.
-
Crypto Custody
Custody Licence – Regulator Selection
Advised an institutional custodian comparing VARA, ADGM/FSRA and DIFC/DFSA custody permissions, mapping capital, asset-segregation and reporting requirements across the four UAE routes to select the optimal licensing path.
-
Crypto Custody
Qualified Custody Build-Out
Advised a digital-asset custodian on structuring a qualified-custody offering, covering client-asset segregation, MPC/key-management controls, insurance and the operational manuals required by the regulator.
-
Crypto Custody
Custody Arrangements for an Exchange/Fund
Designed the custody arrangements for a regulated exchange and fund client, separating custody from trading and aligning wallet infrastructure, reconciliation and liability allocation with licensing conditions.
Browse 100+ Representative Case Studies
View All Case Studies