What founders need to know
Key Takeaways
- A crypto exchange is a permission stack, not a single licence. A centralised venue typically needs a trading-venue permission plus a dealing permission plus custody.
- VARA licenses exchanges under its Exchange Services category, the route for Dubai retail-facing spot and, where in scope, derivative platforms. Minimum capital runs AED 1,500,000 to AED 3,000,000.
- The CMA licenses Operating a Multi-Party Trading Platform, an automated non-discretionary venue, from AED 500,000. Discretionary organised trading facilities are prohibited.
- ADGM licenses a Multilateral Trading Facility under the FSMR, usually stacked with Dealing as Principal and Providing Custody; the public-fund custody stack sits in Category 3B at USD 4,000,000.
- The DFSA licenses DIFC trading venues and, since 12 January 2026, assesses token suitability firm by firm rather than from a recognised-token list.
- A trade licence from any UAE free zone does not authorise exchange activity. VARA fined 19 firms for unlicensed operation in 2025.
- Privacy tokens (Monero, Zcash) and algorithmic stablecoins cannot be listed in any UAE jurisdiction.
The Permissions Stack
What a Crypto Exchange Licence Actually Covers
No UAE regulator issues a single document called an exchange licence. An exchange is a bundle of permissions, and the bundle is what determines capital, governance and timeline. A centralised venue is built from three layers.
- The trading venue. The matching engine and order book itself: VARA Exchange Services, an ADGM or DFSA Multilateral Trading Facility, or a CMA Multi-Party Trading Platform.
- Dealing. Most exchanges also deal, on their own book or for clients: VARA Broker-Dealer Services, ADGM Dealing in Investments as Principal or as Agent, or CMA Dealing in Virtual Assets as Principal or as Agent.
- Custody. Holding client assets or controlling private keys: VARA Custody Services, ADGM Providing Custody, or CMA Providing Custody.
A platform that holds only the venue permission cannot deal on its own book or hold client assets. Sizing the stack to the actual model, not the launch-day minimum, is the difference between a licence that fits and a variation application six months after go-live.
Who Needs an Exchange Licence
Who Needs a Crypto Exchange Licence?
If your platform matches orders, holds client funds, or stands between buyers and sellers of virtual assets in or from the UAE, you are operating a regulated trading venue. Typical use-cases:
You likely do not need an exchange licence if you are:
Licence required
- Centralised spot exchanges Order-book platforms matching buy and sell orders for virtual assets.
- Derivatives and perpetuals venues Platforms offering virtual asset derivatives, where the activity is in scope.
- Hybrid OTC and order-book venues Desks that pair bilateral execution with an on-platform matching venue.
- Tokenised-asset trading venues Secondary-market platforms for tokenised securities or real-world assets.
- White-label and brokerage front-ends Client-facing venues routing flow to an underlying matching engine.
- Regional exchange launches International venues opening a UAE-licensed entity to serve the region.
Likely outside the perimeter
- Non-custodial peer-to-peer software Code that lets users trade wallet to wallet with no intermediary function and no order matching by you.
- A firm trading as a client Using a licensed exchange for your own account, without operating a venue.
- Pure data or analytics providers Surfacing prices or market data without execution, custody or matching.
Whether a model sits inside or outside the perimeter turns on fine detail. A strategy call resolves the classification in 30 minutes.
Who Regulates Exchanges
Which UAE Regulator Licenses a Crypto Exchange?
Four of the five UAE regulators license trading venues. The choice is set by where you operate, who you serve, and whether the venue is retail or institutional, not by the lowest fee.
-
VARA (Dubai)
- Exchange Services for Dubai-based, retail-facing spot and, where in scope, derivative venues.
- The natural home for a Dubai consumer exchange, paired with Broker-Dealer and Custody.
-
ADGM (FSRA)
- A Multilateral Trading Facility under English common law, stacked with Dealing as Principal and Providing Custody, for institutional and professional-client venues with international counterparties.
-
CMA (Federal)
- Operating a Multi-Party Trading Platform for federal onshore venues outside Dubai and the free zones, automated and non-discretionary, from AED 500,000.
-
DFSA (DIFC)
- A Multilateral Trading Facility for crypto tokens within the DIFC, with token suitability assessed firm by firm since 12 January 2026, and regulator approval retained only for fiat-referenced stablecoins (currently USDC, EURC and RLUSD).
Regulator Comparison
Exchange Licensing Compared: VARA, ADGM, DIFC and CMA
Cross-check each route against the live UAE VASP Licence Tracker , which lists current licence holders by regulator, updated monthly.
| VARA (Dubai) | ADGM (FSRA) | DIFC (DFSA) | CMA (Federal) | |
|---|---|---|---|---|
| Venue permission | Exchange Services | Multilateral Trading Facility | Multilateral Trading Facility | Multi-Party Trading Platform |
| Typical stack | Exchange, Broker-Dealer, Custody | MTF, Principal, Custody | MTF, dealing, custody | MTF, Principal or Agent, Custody |
| Client focus | Retail and professional | Professional and institutional | Professional | Federal onshore |
| Min. capital | AED 1,500,000 to 3,000,000 | Up to USD 4,000,000 (Category 3B) | USD 140,000 to 500,000+ | From AED 500,000 |
| Token listing | Retail listing via the VA Issuance framework | Firm-assessed, FSMR perimeter | Firm-led suitability since 12 Jan 2026 | Per the CMA permitted-token rules |
| Typical timeline | 9 to 15 months | 8 to 14 months | 10 to 12 months | 5 to 9 months |
| Year 1 all-in | AED 3,000,000+ | USD 350,000 to 900,000 | USD 300,000 to 2,000,000+ | From AED 1,000,000 to 8,000,000+ |
| Best suited for | Dubai retail venues | Institutional venues | DIFC institutional venues | Federal onshore venues |
Cost and Timeline
What Does an Exchange Licence Cost?
All-in first-year cost for a venue is driven by the capital tier of the heaviest permission in the stack (usually custody), the technology build, and the senior team a trading venue requires. A retail venue carries a heavier governance and capital load than a single-permission firm.
| Route | Minimum capital | Indicative Year 1 all-in | Well-prepared timeline |
|---|---|---|---|
| VARA (Dubai) | AED 1,500,000 to 3,000,000 | AED 3,000,000+ | 9 to 15 months |
| ADGM (FSRA) | Up to USD 4,000,000 (Category 3B) | USD 350,000 to 900,000 | 8 to 14 months |
| DIFC (DFSA) | USD 140,000 to 500,000+ | USD 300,000 to 2,000,000+ | 10 to 12 months |
| CMA (federal) | From AED 500,000 | From AED 1,000,000 to 8,000,000+ | 5 to 9 months |
Figures are first-year all-in ranges covering regulator fees, premises, senior-person hires, technology and compliance tooling, and legal fees. Capital is a floor that must stay unencumbered at all times, not a one-time deposit at application.
Legal fees
NeosLegal works on fixed-fee, milestone-based engagements. Fees depend on the permission stack, business model complexity, application readiness at engagement start, and the scope of ongoing post-authorisation support. A specific written cost estimate is provided after the free assessment call, before any engagement commitment.
Engagement Model
How Does NeosLegal Structure an Exchange Licensing Engagement?
Across 20+ VASP licence applications advised since 2016, the most expensive exchange mistake we see is under-scoping the permission stack, then discovering mid-launch that the venue cannot deal or custody. The model below scopes the full stack first, then drives the application to the regulator in a shape that clears queries rather than inviting them.
- 01
Permission-stack scoping
Every function of the venue mapped to the right permissions across venue, dealing and custody, and to the regulator that fits the model. Output: a written scoping memo with capital, timeline and senior-person plan, signed by Irina.
- 02
Regulator and entity selection
The regulator and entity structure chosen to fit the venue, capital position and target market before incorporation. This is the single biggest lever on cost and timeline.
- 03
Pre-application engagement
Where the regulator runs pre-application meetings (VARA and the FSRA both do), we surface listing, custody and market-conduct concerns before filing, which routinely saves three to six months.
- 04
Entity, governance and capital
The UAE entity incorporated, the senior team appointed (CEO, Compliance Officer, MLRO, and a CTO and Risk Officer for a venue), and capital sized to the business plan rather than the rulebook floor.
- 05
Application and technology architecture
The full application built to rulebook standard: business plan, matching-engine and custody architecture, market-surveillance and listing policies, AML programme, and approved-person evidence. The trading-venue technology file is where exchange applications most often stall.
- 06
Submission, query and go-live
Submission and active query management, then the technology review, capital injection and final approvals through to a live, operating venue. Ongoing retainer covers listing reviews, new permissions and marketing compliance.
“Founders pitch us an exchange and mean three regulated activities at once. The platform matches orders, it takes the other side of trades, and it holds customer coins. That is a venue, a dealer and a custodian. Licence one layer and you cannot legally run the other two. The whole engagement is getting that stack right before a single line of the application is written.”
WHY CHOOSE NEOSLEGAL
Why Founders and Institutions Choose NeosLegal
NeosLegal has worked only on crypto and Web3 since 2016, before VARA existed, before ADGM had a crypto framework, and before most UAE firms understood what Bitcoin was. That head start shows in the track record, the recognition, and the way engagements run.
Track Record
- 300+ UAE Web3 and crypto projects structured and 700+ founders advised since 2016, with zero client enforcement actions in ten years.
- USD 500 billion in transactions advised and deals closed.
- 20+ VASP licence applications advised across the UAE regulators.
- 250+ Tier-1 exchange legal opinions at a 100% acceptance rate, a commercially verifiable outcome across hundreds of submissions.
Independent Recognition
- Best UAE Crypto Law Firm 2026, UAE Business Awards Middle East.
- Middle East Technology Legal Team of the Year, The Oath Middle East, November 2025.
- Authors the UAE chapters of the Chambers Blockchain and Crypto Assets guide, 2025 and 2026.
- Irina Heaver ranked as Recommended Blockchain Lawyer in the UAE 2025 and 2026, Lexology.
Regulatory Coverage
- All five UAE regulatory pathways, VARA, ADGM (FSRA), DIFC (DFSA), the federal CMA and CBUAE, handled within a single firm, with no coordination overhead between separate advisers.
- 60+ jurisdictions covered in total for cross-border structuring since 2016.
- Federal CMA Category RWA Tokenization Exchange, broker-dealer and OTC dealing desk licences delivered end to end, including the full policy suite, AML risk and controls register, and Approved Persons submissions the regulator requires.
Every engagement is fixed-fee with defined milestones confirmed before work begins. Direct access to Irina Heaver and senior associates throughout, not associates managing the relationship.
Founder differentiator
Founded by Irina Heaver, a former co-founder of a UAE crypto exchange (later exited), NeosLegal operates with founders’ commercial realities in mind. Irina has also drafted crypto laws and advised on virtual asset policy for multiple regulators and governments, including UAE regulators, helping shape the frameworks her clients are now licensed under, a perspective no other crypto lawyer in the UAE can offer.
Track record
Representative Exchange Cases
-
VASP Licensing & Regulatory
Asian Exchange – UAE Entry & VARA Licensing
Built the UAE market-entry and VARA licensing roadmap for a major Asian crypto exchange, sequencing corporate setup, regulator engagement and product scope so the launch stayed aligned with the group's existing global operations.
-
Market Entry & Advisory
EU-Regulated Exchange – UAE Entry
Managed the UAE market entry of an EU-regulated crypto exchange, handling corporate structuring, federal regulatory submissions and preparation for full operational rollout.
-
VASP Licensing & Regulatory
Global Payment Network – All Five UAE Regimes
Advised a leading global payment network across all five UAE VASP regimes (VARA, ADGM, DIFC, CMA/SCA and CBUAE), benchmarking each against the client's activities and delivering a jurisdiction-selection matrix that anchored a multi-entity licensing strategy.
-
Corporate & Web3 Structuring
Decentralized Exchange Corporate Stack
Structured the corporate stack for a decentralized exchange - offshore entities for token issuance paired with Dubai-based DevCos - to support protocol operations within a globally compliant framework.
Browse 100+ Representative Case Studies
View All Case Studies