Table of Contents
Frequently Asked Questions
What is a Virtual Assets Custody Services licence in Dubai and what activity does it cover
A Virtual Assets Custody Services licence in Dubai operates under activity code 6619.84 within the financial services classification. It authorises a business to safeguard private keys and digital assets on behalf of clients — holding, managing, and protecting access to those assets without trading, advising on, or brokering them.
The role is closer in function to a prime broker or depository than to an exchange or fund manager. The custody provider is responsible for security architecture, key management protocols, and operational continuity that underpin a client's digital asset holdings.
Typical clients include institutional investors, family offices, crypto-native funds, tokenised asset issuers, and DAOs requiring third-party custody arrangements. These clients require institutional-grade security, audit trails, insurance coverage, and regulatory accountability.
Which regulatory bodies oversee virtual asset custody businesses in Dubai
VARA (Virtual Assets Regulatory Authority) is the primary regulator for virtual asset activities conducted in or from Dubai, excluding the DIFC. Established under Law No. 4 of 2022, VARA supervises licensing, compliance, and market conduct for virtual asset service providers, including custody businesses.
The Central Bank of the UAE governs broader financial services compliance at the federal level. Even though VARA handles virtual asset-specific regulation in Dubai, the Central Bank's AML/CFT frameworks apply across the board, meaning custody providers must maintain compliance with both regulatory layers simultaneously.
The Securities and Commodities Authority (SCA) operates federally and becomes relevant if your business model extends to other Emirates or involves tokenised securities. Understanding how all three bodies interact is essential before incorporating.
What is VARA and why is it significant for virtual asset businesses
VARA — the Virtual Assets Regulatory Authority — was established in Dubai in 2022 under Law No. 4 of 2022. It holds the distinction of being the world's first standalone virtual asset regulator at a city level, making Dubai's regulatory environment uniquely mature compared to most global jurisdictions.
VARA supervises licensing, compliance, and market conduct for virtual asset service providers operating in or from Dubai (outside the DIFC). Custody is a regulated activity under VARA's framework, meaning any entity providing custody services to clients must engage with VARA's licensing process in addition to obtaining a free zone trade licence.
Since its inception, over 500 virtual asset service providers have engaged with UAE regulators, reflecting the authority's active role in shaping a credible institutional market for digital assets.
How does free zone licensing through Meydan relate to VARA authorisation
Free zone licensing and VARA authorisation are two separate but complementary processes that run in parallel. They serve different purposes and neither replaces the other.
A Meydan Free Zone trade licence establishes your legal entity, provides a commercial address, and grants visa entitlements needed to operate in Dubai. It is the foundational corporate structure for your business.
VARA authorisation, on the other hand, is what permits you to actually conduct regulated virtual asset custody activity with clients. Without it, holding a free zone licence alone does not authorise you to provide custody services commercially.
What compliance obligations should a virtual asset custody business expect in Dubai
Because virtual asset custody sits within the financial services classification, the compliance obligations are substantive. Businesses should expect AML/CFT (Anti-Money Laundering and Counter-Financing of Terrorism) requirements from both VARA and the Central Bank of the UAE's federal frameworks.
Fit-and-proper assessments are part of the licensing process, meaning key personnel and beneficial owners will be evaluated for suitability. Engagement with Dubai's virtual asset regulatory framework is expected from the outset of incorporation, not as an afterthought.
Custody providers must also maintain institutional-grade operational standards including security architecture, key management protocols, audit trails, and insurance coverage — requirements driven as much by client expectations as by regulatory mandates.
What is the tax position for a virtual asset custody business operating from a UAE free zone
Qualifying free zone businesses in the UAE benefit from a 0% corporate tax rate on eligible income under the UAE Corporate Tax Law. This applies to businesses that meet the conditions for qualifying free zone person status, making the UAE structurally attractive for financial services businesses including virtual asset custody providers.
It is important to note that tax eligibility depends on the specific nature of income and whether the business satisfies the qualifying criteria under the law. Professional tax advice should be sought to confirm how the corporate tax framework applies to a particular custody business structure and its client base.
Who are the typical clients of a virtual asset custody business and what do they require
Virtual asset custody clients are overwhelmingly institutional rather than retail. Typical clients include institutional investors, family offices, crypto-native funds, tokenised asset issuers, and DAOs (Decentralised Autonomous Organisations) that require third-party custody arrangements for governance or operational reasons.
These clients have demanding requirements. They expect institutional-grade security, comprehensive audit trails, insurance coverage, and clear regulatory accountability from their custody provider. The custody provider's regulatory status and compliance posture are often prerequisites for winning and retaining institutional mandates.
This client profile distinguishes custody from retail-facing virtual asset services and explains why the compliance and operational bar for activity code 6619.84 is set at an infrastructure level rather than a consumer-facing one.
How large is the market opportunity for virtual asset custody and what is driving growth
The global digital asset custody market is projected to grow substantially through 2030, with institutional adoption identified as the primary driver. As more traditional financial institutions, family offices, and funds allocate to digital assets, the demand for regulated, insured, and auditable custody infrastructure increases proportionally.
The UAE's position is particularly strong. The country ranked among the top 10 globally for crypto adoption according to Statista, and Dubai's early regulatory clarity through VARA has attracted a concentration of virtual asset service providers — over 500 have engaged with UAE regulators since VARA's inception.
The combination of growing institutional demand, a mature regulatory framework, tax efficiency, and geographic positioning between European and Asian markets makes Dubai a commercially logical base for custody businesses targeting international institutional clients.
How to Start a Virtual Assets Custody Business in Dubai
Dubai is one of the few places in the world where holding crypto for other people is a proper licensed job. It is not a grey area here. The rules are written, the regulator is up and running, and demand keeps growing.
This guide explains the Virtual Assets Custody Services license, activity code 6619.84. You will learn what the license lets you do, who it suits, and how to set up with Meydan Free Zone.
Key Stats at a Glance
| What to know | The detail |
|---|---|
| Crypto adoption | The UAE sits in the global top 10 for crypto use, according to Statista. |
| The regulator | Dubai set up the Virtual Assets Regulatory Authority (VARA) in 2022. It was the world's first city-level regulator built just for virtual assets. |
| Market growth | The global digital asset custody market is set to grow a lot by 2030. Big institutions are the main reason. |
| Corporate tax | Free zone companies that qualify pay 0% corporate tax on eligible income under UAE law. |
| Who is already here | More than 500 virtual asset service providers have dealt with UAE regulators since VARA opened. |
What a Virtual Assets Custody License Covers
Custody means you keep other people's digital assets safe. You hold the private keys. You look after access. That is the whole job.
What you do.
You hold, manage and protect client assets. You build the security setup, run the key management, and keep the service online. Think of it as infrastructure work, closer to a depository than a trading desk.
What you do not do.
You do not trade the assets. You do not advise on them. You do not broker deals. That line matters both commercially and to the regulator, so keep it clear from day one.
Who your clients are.
Mostly institutions, not the public. Expect institutional investors, family offices, crypto funds, firms issuing tokenised assets, and DAOs that need a third party to hold assets for them.
What clients expect.
Bank-grade security, full audit trails, insurance cover, and a clean regulatory record. Many of them cannot sign with you without it.
Activity code 6619.84 sits under the financial services license. That means the compliance duties are real. Plan for anti-money laundering checks, fit and proper tests on your people, and early contact with Dubai's virtual asset rules. Sort this out before you start, not after.
Who Regulates Virtual Asset Custody in Dubai
Three bodies matter. Learn how they fit together before you set up.
| Body | What it does | When it matters to you |
|---|---|---|
| VARA (Virtual Assets Regulatory Authority) | Sets the rules for virtual asset work in Dubai. Handles licensing, compliance and market conduct. | Always. Custody is a regulated activity, so you need VARA on board. |
| Central Bank of the UAE | Sets the federal rules for financial services, including anti-money laundering. | Always. These rules sit on top of VARA's, so you answer to both. |
| Securities and Commodities Authority (SCA) | Covers virtual asset work at federal level, outside VARA's patch. | If you work in other Emirates, or handle tokenised securities. |
VARA came out of Law No. 4 of 2022 and oversees anyone providing virtual asset services in or from Dubai. Custody is on that list. So you will deal with VARA as well as getting your trade license.
Your License and Your VARA Approval Are Two Different Things
People mix these up. They run side by side and neither one replaces the other.
- Your Meydan Free Zone license. This creates your company. It gives you a legal entity, a business address, and the visa places you need to operate. It is the base you build on.
- Your VARA approval. This is what lets you take on clients and hold their assets. A trade license on its own does not let you sell custody services.
Start both early. The two run in parallel, and lenders, banks and clients will ask about each of them.
[blockCTACostCalculator]
The Market and How You Make Money
Big money in the UAE now wants crypto risk on the books. Family offices, regional fund managers and funds close to sovereign wealth are all buying in. Before they can do that at scale, they need a regulated firm to hold the assets. That is your business case.
How custody firms charge.
There are three common models, and most firms mix them:
- Fees based on assets held: you charge a small percentage of the value you look after.
- Flat fees: a fixed monthly or yearly charge per account.
- Extra services: transaction reports, staking support, and portfolio data. Bigger clients tend to buy more of these.
Who to target in Dubai.
Wealthy individuals running mixed portfolios. Crypto funds that need serious security. Firms issuing tokenised assets who need a third party to satisfy investor checks.
The tax picture.
Free zone companies that qualify pay 0% corporate tax on eligible income under UAE law, which the Federal Tax Authority runs. If your fees come from clients abroad, that is a real advantage. Get tax advice on your own setup, because the 0% rate depends on the type of income and on meeting the conditions.
How to Set Up with Meydan Free Zone, Step by Step
- Step 1, name and code: Reserve your trade name and check that Virtual Assets Custody Services (6619.84) is listed as your main activity. Your name has to follow UAE naming rules.
- Step 2, paperwork: Send in your setup documents and shareholder details. That means passport copies, proof of address, and a short business plan or activity description. Financial services activities need extra checks, so expect more questions than a simple trading license.
- Step 3, your license: Get your Meydan Free Zone license. Simple applications often take a few working days. Your cost depends on share capital, your office package and how many visas you want.
- Step 4, your bank account: Open a corporate account. This is the hardest part for crypto firms, because UAE banks look closely at them. You will do much better if your VARA work is already underway and you can show a clear business plan and written compliance procedures.
- Step 5, VARA: Apply to VARA. The process covers your application, fit and proper tests on key people, and a review of how you run the business. Bring in a compliance adviser who knows VARA early.
A few practical points as you plan:
- Meydan Free Zone offers flexi-desk and physical office options, so you can meet both free zone and VARA requirements.
- Visas are tied to your license package. Work out your headcount at setup, not later.
- mResidency handles visas for you, your staff and your family. mAccounting keeps your books in order, which helps at bank and VARA stage.
- mCore, mAssist and mPlus cover the day to day support around your company once it is running.
Conclusion
Virtual asset custody asks a lot on compliance and pays back on opportunity. Dubai gives you something rare: clear rules from VARA, federal rules from the Central Bank, and a free zone setup that works. Get your structure right on day one and the rest gets easier.
Talk to the Meydan Free Zone team to check your activity, understand what VARA will ask of you, and get your license in place without delays.
[blockCTAContact]
