ADGM vs DIFC vs VARA: Three Regimes in One Country

A company that wants to serve clients across all three perimeters needs three separate entities, each authorised by its own supervisor, with its own capital, substance, and banking stack. UAE company formation and licensing starts by mapping the perimeter to the business model before any document gets drafted, because the wrong perimeter costs more than a filing fee.

‍

What the perimeter map actually looks like

Dubai Law No. (4) of 2022 Article 3 sets VARA's geographic scope as the whole Emirate of Dubai, including free zones, with the DIFC carved out. Inside the DIFC, the relevant law is the DFSA Rulebook. Inside Abu Dhabi Global Market, the relevant law is the FSMR, administered by the FSRA. Those three sets of rules do not cross-apply. An FSRA Financial Services Permission does not authorise virtual-asset activity in Dubai under VARA's regime. A VARA VASP Licence does not authorise DFSA-regulated business inside the DIFC.

The UAE has three parallel licensing tracks for digital-asset businesses. A fourth, the onshore Capital Market Authority, applies to security-token issuers and is covered briefly below. The comparison here covers the three perimeters with the broadest VA-activity scope: VARA, DFSA/DIFC, and FSRA/ADGM.

‍

VARA: the Dubai perimeter for virtual-asset businesses

VARA was created under Dubai Law No. (4) of 2022 as an autonomous entity under the Dubai World Trade Centre Authority. Its scope is every virtual-asset service in or from Dubai, across all Dubai free zones, excluding the DIFC. As of 24 August 2026, Schedule 1 of the Virtual Assets and Related Activities Regulations 2023 (effective 19 June 2025) lists eight VA Activities: Advisory Services, Broker-Dealer Services, Category 1 VA Issuance, Custody Services, Exchange Services, Lending and Borrowing Services, VA Management and Investment Services, and VA Transfer and Settlement Services. A firm selects the activities matching its desk, files the corresponding activity rulebooks, and takes all four compulsory rulebooks (Company, Compliance and Risk Management, Technology and Information, Market Conduct). Custody must sit in a distinct entity with a standalone licence.

Legal perimeter and regulator

VARA operates under Dubai Law No. (4) of 2022 and the 2023 Regulations. It is the sole authority for virtual-asset service in Dubai, outside the DIFC. Its parent body is the DWTC Authority. Cabinet Resolution No. (134) of 2025 on AML/CFT applies on top of the VARA permission as a federal layer but does not itself create the VARA licence.

Permission type and activity scope

The VARA permission is a VASP Licence authorising one or more of the eight Schedule 1 VA Activities. Activity scope is set at application: the firm ticks the activities it will carry on, files the corresponding activity rulebooks, and pays per-activity fees from Schedule 2 (fees page refers to it as "Schedule B"; the live instrument is Schedule 2). Multi-activity licences are permitted except that Custody must remain in a separate entity. Proprietary trading is a No Objection Certificate path, not a VASP Licence. A US-incorporated group whose Dubai office conducts Exchange Services still needs a VARA overlay for that Dubai office.

Entity requirements and substance

An entity must be incorporated in Dubai, either through the Department of Economy and Tourism for a mainland company or through a Dubai free zone (excluding DIFC). The application runs in two stages: an Initial Disclosure Questionnaire triggers an Approval to Incorporate, which allows the company to be set up and office space rented; ATI is not permission to carry on VA Activities. The VASP Licence follows in Stage 2 once the full documentation pack is submitted and reviewed. VARA's documentation list covers corporate structure, UBO, fit-and-proper confirmations, source of funds evidence, regulatory business plan, financial projections, paid-up capital proof, reserve account, insurance certificates, succession and wind-down plans, plus risk, compliance, and technology categories.

Capital

Capital requirements sit in Part IV of the Company Rulebook. VARA does not publish a single simplified table of minimum capital on the applications page; the figure depends on the activities licenced and the business model. Confirm the live Part IV figure for your activity mix before filing.

Banking implications

A VARA-licensed entity needs fiat banking for operations and client money segregation. Banks and PSPs assess crypto-facing clients under their own risk criteria. An entity with a VASP Licence, a complete AML/KYC pack, and documented source of funds has a materially stronger onboarding file than one holding only a free-zone trade licence with a crypto activity code. Ksenia Babochkina, Commercial Director at Medici Expert: "We map jurisdiction options against banking access first, because a license without a working bank account is just a certificate on a wall." VARA's geographic coverage across Dubai's free zones means several UAE banks are familiar with the VASP Licence format. Familiarity shortens, but does not guarantee, account opening.

Fits when / fails when

VARA fits a business whose primary market is Dubai, the UAE broadly, or the GCC retail and institutional crypto sector. Exchange desks, OTC brokers, VA custodians wanting a UAE domicile, and lending platforms targeting regional clients are all natural VARA applicants. The two-stage IDQ and ATI process, the four compulsory rulebooks plus activity rulebooks, the capital and substance requirements, and the prohibition on carrying on VA Activities until the VASP Licence is in hand mean this is not a low-cost or low-documentation path. It fails when the business has no genuine connection to Dubai, when the activity scope is primarily institutional capital-markets business that maps more naturally to the DFSA or FSRA perimeters, or when the product is a security token (which sits under the CMA, not VARA).

‍

DFSA/DIFC: the financial-services gate inside Dubai

The Dubai International Financial Centre is a federal financial free zone under Federal Law No. (35) of 2004. Dubai Law No. (4) of 2022 explicitly carves it out of VARA's perimeter, making the DFSA the sole financial regulator inside the DIFC. Crypto Token rules came into force on 12 January 2026. Before that date, the DFSA maintained a prescribed list of Recognised Crypto Tokens; suitability is now firm-led under GEN Rule 3A.2.1. An Investment Token (a Security or Derivative in token form) is a separate capital-markets authorisation, not a Crypto Token.

Legal perimeter and regulator

The DFSA operates under the DIFC Law No. 1 of 2004 (as amended) and the DFSA Rulebook. The DIFC itself is a federal financial free zone with its own civil and commercial law, English common-law courts, and independent legal system. UAE federal criminal law still applies inside the DIFC. The DFSA's perimeter covers all financial services conducted in or from the DIFC, including Crypto Token and Investment Token activities.

Permission type and activity scope

A DFSA authorisation permits the holder to conduct one or more DFSA-regulated activities involving financial instruments, including Crypto Tokens and Investment Tokens. The activity categories are drawn from the DFSA Rulebook rather than from VARA's Schedule 1 labels. Relevant activities for crypto businesses include dealing in investments as agent or principal, managing assets, advising on financial products, and operating a collective investment fund. A firm dealing in Crypto Tokens under the post-January 2026 rules must satisfy GEN Rule 3A.2.1's firm-led suitability requirements. The DFSA does not maintain a prescribed list of Recognised Crypto Tokens; individual firms assess the tokens they deal in against the DFSA's criteria.

Entity requirements and substance

A DIFC entity is incorporated by the DIFC Registrar of Companies. Legal forms available include companies limited by shares, partnerships, and branches of foreign companies. The DFSA application requires a regulatory business plan, fit-and-proper assessment of key persons, an AML/CFT framework, technology and operational controls, and evidence of capital adequacy. The DFSA does not run a two-stage ATI process; the application moves from submission through review to in-principle approval and then to authorisation once pre-conditions are met. Physical presence in the DIFC is required. An authorised firm is expected to have genuinely decision-making functions in the DIFC, not just a registered address.

Capital

Capital requirements depend on the specific activity category under the DFSA Rulebook's prudential regime. The DFSA publishes its fee schedule and prudential requirements in the Rulebook (PIB module for prudential capital). Confirm the live PIB requirements for your activity category. They differ by firm type: an asset manager faces different capital rules than a broker-dealer.

Banking implications

The DIFC is home to several large international banks and is the established institutional financial centre in Dubai. DFSA-authorised firms dealing in Crypto Tokens operate within a recognised common-law framework, which can make certain institutional counterparties and correspondent banks more comfortable than an equivalent VARA-licensed entity. The DIFC Courts also give counterparties access to a proven dispute-resolution system. That institutional credibility comes at a cost: DIFC setup and licensing fees, office costs within a high-rent financial centre, and the substance requirements add up. A firm whose primary business is retail crypto exchange volumes is unlikely to find the DIFC regime a proportionate fit. AML and compliance documentation built for the DFSA's standards, particularly around Crypto Token suitability and Investment Token classification, differs in structure from a VARA compliance pack.

Fits when / fails when

DFSA/DIFC fits institutional and wholesale digital-asset businesses: asset managers investing in crypto on behalf of institutional clients, investment banks structuring Investment Token products, or fintech platforms that need to passport DFSA-authorised activities to EU or APAC institutional counterparties who recognise the DIFC framework. It fits a business that needs the common-law DIFC Courts for contract enforcement and the DIFC's double-tax treaty network. It fails when the business is oriented toward retail crypto exchange volumes, when the operator wants to serve clients physically located outside the DIFC and across Dubai's free zones (those clients would need a VARA-licensed entity for those activities), or when the token in question is a Crypto Token rather than an Investment Token but the business model requires broad distribution rather than institutional dealing.

‍

FSRA/ADGM: the Abu Dhabi financial-free-zone perimeter

Abu Dhabi Global Market is a federal financial free zone on Al Maryah Island, established under Federal Law No. (14) of 2013. The FSRA administers the Financial Services and Markets Regulations 2015 (FSMR). The FSRA was the first regulator globally to regulate spot virtual-asset activities and the first to license spot VA multilateral trading facilities. Guidance on the current framework is at Version VER07.100625, issued under FSMR section 15(2) in June 2025.

ADGM's framework covers Virtual Assets (spot MTFs, brokers, custodians, asset managers), Fiat-Referenced Tokens (FSRA maintains an Accepted FRT list), Digital Securities, and Derivatives and Funds over digital assets. A token exhibiting Security characteristics is a Digital Security, not a Virtual Asset. That classification line determines which FSRA permission applies.

Legal perimeter and regulator

The FSRA operates under the FSMR 2015 and ADGM's body of regulations. ADGM uses English common law as its base legal system, mirroring the approach of major international financial centres. The FSRA's guidance VER07.100625 is the primary reference for digital-asset activity authorisation in ADGM as of August 2026. The perimeter covers activities in and from ADGM. A firm with an ADGM Financial Services Permission operates within ADGM's geographic boundary and its legal system.

Permission type and activity scope

The FSRA grants a Financial Services Permission (FSP) authorising one or more FSMR Regulated Activities. For digital-asset businesses, the relevant activities include dealing in investments as principal or agent, advising on investments, arranging deals, managing assets (including discretionary management), providing custody, and operating a Multilateral Trading Facility. These are FSMR permission categories, not Schedule 1 VARA labels. The FSP for VA activities sits on top of the FSMR's existing financial-services architecture. An FSRA MTF permission for VA trading is one of the most sophisticated licence types in the UAE, reflecting ADGM's position as the first jurisdiction to regulate spot VA MTFs.

Entity requirements and substance

An ADGM entity must be incorporated by the ADGM Registration Authority. Available forms include companies, limited liability partnerships, branches, and foundations (the latter relevant for DAO structures under ADGM's DLT Foundations Framework, the first such framework globally). The FSRA application follows eight steps: initial contact and regulatory-plan discussion, proposal review against the draft business plan, formal submission with fee, review and interviews with Approved Persons, In-Principle Approval with pre-conditions, then fulfillment of those conditions, and finally the Financial Services Permission. IPA pre-conditions require a Commercial Licence from the Registration Authority, secured ADGM office premises, bank accounts, and capitalisation to be in place before the FSP is issued. Operating regulated activities before the FSP is granted is not permitted.

Capital

Capital requirements depend on the FSMR category authorised under the FSP. The FSRA publishes its fee schedule and prudential rules in the Rulebook (PRU module). Published application fees are available on the ADGM website. Confirm the live PRU capital figure and fee schedule for the specific FSMR activities before filing.

Banking implications

ADGM's location in Abu Dhabi, with proximity to large UAE sovereign wealth-related institutions and major regional banks, gives FSRA-authorised entities a particular banking profile. Several UAE banks maintain ADGM presence. ADGM's common-law English system, FSRA regulation, and institutional positioning make it a recognisable counterparty framework for international institutional partners. For a digital-asset MTF or custodian targeting institutional capital allocators and sovereign-level counterparties, ADGM's signalling value exceeds VARA's in certain conversations. Retail-facing exchange volumes are a weaker fit for the ADGM cost and substance profile.

Fits when / fails when

FSRA/ADGM fits institutional digital-asset businesses: spot VA MTF operators, institutional-grade custodians, asset managers with a VA mandate, Fiat-Referenced Token issuers seeking an Accepted FRT designation, and firms whose investor base or counterparty network expects ADGM-grade institutional oversight. The DLT Foundations Framework also makes ADGM relevant for DAO and decentralised governance structures. It fails when the business is primarily retail-facing crypto exchange, when the ADGM office-substance and capitalisation requirements exceed what the business model supports, or when the firm is a Dubai-focused exchange that needs to reach customers across Dubai's mainland and free zones under VARA's coverage. A Digital Security business in ADGM uses the Digital Securities framework, not the VA framework, so a mixed token portfolio requires careful classification before the FSP application is filed.

‍

Three legal systems with no mutual recognition

VARA is a Dubai public entity under Dubai emirate law. The DFSA administers DIFC's own legal framework, built on English common law. The FSRA administers ADGM's FSMR, also English common law. All three sit within the UAE's borders, and none of them recognises the others' authorisations. An FSRA FSP does not passport to VARA's perimeter. A VARA VASP Licence does not authorise DFSA-regulated activity inside the DIFC. A group covering all three perimeters incorporates three separate legal entities, each capitalised, staffed, and banked independently.

The legal system choice carries contract-level weight. DIFC and ADGM both offer common-law courts; DIFC Courts have a longer track record of international enforcement recognition. VARA-licensed entities in Dubai free zones operate under UAE federal and free-zone law. Each supervisor also adds its own AML/CFT rulebook on top of the federal layer: VARA's Compliance and Risk Management Rulebook, the DFSA's AML module, and the FSRA's AML rules sit above the obligations under Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025. Building real rules for crypto covers what that operating layer requires in practice.

‍

Comparing permission scope and when one business needs multiple files

VARA names eight Schedule 1 VA Activities. The DFSA uses its own Rulebook activity categories, with Crypto Token and Investment Token as product-level designations. The FSRA uses FSMR Regulated Activities (dealing, advising, arranging, managing, custody, MTF). The labels are not interchangeable. An Exchange Services VASP Licence from VARA does not authorise the holder to operate an ADGM MTF or deal as a DFSA-authorised person inside the DIFC.

A group running a Dubai retail exchange and also managing institutional VA capital for ADGM-domiciled investors needs two entities: a VARA VASP Licence for the Exchange Services activity in Dubai, and an FSRA FSP for the asset management activity in ADGM. Groups that scale across UAE perimeters separate activities at the entity level, then document the intra-group relationships, rather than trying to consolidate regulatory perimeters that have no mutual recognition.

‍

Capital and fee structure across the three regimes

No single published table covers all three regimes. Each regulator's prudential requirements sit in its own rulebook, and each publishes a fee schedule. As of August 2026: VARA capital requirements are in Part IV of the Company Rulebook; fees are in Schedule 2 of the 2023 Regulations (the applications page also calls this Schedule B; the binding instrument is Schedule 2); both depend on the activities selected. DFSA capital requirements sit in its PIB prudential module; fees vary by firm category (asset manager versus dealer). FSRA capital requirements sit in the FSMR's PRU module; the ADGM website publishes a fee schedule for FSP applications; both vary by activity category.

In all three cases, confirm the live schedule before filing. Consultant aggregator pages frequently show "from" figures that exclude substance costs. Substance costs (office, staff, compliance function, banking fees) sit outside the regulatory fee schedule and vary widely by activity profile. Commercial formation, advisory, compliance, and banking fees are separate from the regulatory tariffs described here; those sit outside this map. Refer to UAE company formation and licensing for a structuring conversation.

‍

The onshore perimeter: a pointer on security tokens

Dubai Law No. (4) of 2022 does not cover security tokens. VARA's Schedule 1 does not include a security-token issuance or dealing activity. Security tokens fall under the onshore federal capital-markets regulator, which was renamed from the Securities and Commodities Authority to the Capital Market Authority by Federal Decree-Laws No. (32) and No. (33) of 2025, effective 1 January 2026. CMA Resolution No. (15/Chairman) of 2025, in force from July 2025 per two independent practitioner notes, addresses the security-token framework. Open the live CMA text before any security-token issuance is structured; practitioner summaries vary. This is a separate perimeter from VARA, DIFC/DFSA, and ADGM/FSRA, and a security-token business cannot substitute a VARA VASP Licence for CMA authorisation or vice versa. What MiCA means for every company covers the EU parallel to this classification question.

‍

Which perimeter fits which business

No single perimeter is best. Each fits a different operational profile and fails for businesses that exceed its cost profile, fall outside its activity scope, or have no genuine substance link to its geography.

VARA covers the widest geographic footprint for virtual-asset service inside the Emirates. An exchange, OTC broker, lending platform, or transfer rail whose clients, operations, or marketing are in Dubai needs this file. The two-stage IDQ and ATI process and the four compulsory rulebooks plus activity-specific rulebooks make this a documentation-intensive path. Elapsed time from IDQ to VASP Licence runs in the four-to-six-month band that Medici's licensing FAQ placed UAE licensing in as of 18 August 2026. It fails for businesses with no genuine Dubai connection or for products that classify as securities under CMA's framework.

DFSA/DIFC fits institutional and wholesale digital-asset businesses whose counterparties, investors, or governing-law preferences require the DIFC's common-law framework and treaty network. Retail exchange volumes are a poor fit for the DIFC cost floor. A firm that wants to reach clients across Dubai's free zones still needs a VARA entity for those clients.

FSRA/ADGM fits institutional operators targeting the Abu Dhabi and Gulf sovereign-wealth ecosystem: spot VA MTF operators, institutional custodians, asset managers with a VA mandate, and Fiat-Referenced Token issuers seeking Accepted FRT status. The DLT Foundations Framework is the only DAO governance vehicle currently available in the Gulf. The eight-step authorisation process and IPA pre-conditions make the cost and substance floor material. Retail-volume crypto exchange is a weak fit for this profile.

‍

FAQ

Is ADGM better than DIFC for a crypto business?

Neither is better without knowing the business model. ADGM pioneered the VA MTF and VA spot-trading regulatory framework and suits institutional operators, custodians, and asset managers targeting sovereign or institutional capital. DIFC fits institutional financial services with a longer court-enforcement track record and treaty connectivity. Retail exchange volumes are a weak fit for either; they belong in the VARA perimeter. The right answer depends on the activity mix, counterparty profile, and substance budget.

Does a VARA licence cover activity inside the DIFC?

No. Dubai Law No. (4) of 2022 Article 3 explicitly excludes the DIFC from VARA's perimeter. A VARA VASP Licence authorises virtual-asset activity in Dubai outside the DIFC. Conducting DFSA-regulated activity inside the DIFC requires a DFSA authorisation. A group wanting to operate both inside and outside the DIFC needs two separate entities, each under its own regulator.

Can one entity hold VARA, DFSA, and FSRA permissions simultaneously?

One legal entity cannot hold authorisations from all three regulators because each regime requires the entity to be incorporated within its own jurisdiction: a Dubai company for VARA, a DIFC company for DFSA, and an ADGM company for FSRA. A group can establish three separate entities, each authorised in its own perimeter, and connect them through documented intra-group arrangements. Each entity carries its own capital, compliance function, and banking relationship.

What is the difference between a VARA VASP Licence and an ADGM Financial Services Permission for virtual assets?

A VARA VASP Licence authorises one or more of eight Schedule 1 VA Activities in Dubai (outside DIFC). An ADGM FSP authorises one or more FSMR Regulated Activities involving virtual assets in ADGM. The activity labels differ: VARA uses Exchange Services, Custody Services, Broker-Dealer Services and so on; ADGM uses dealing in investments, managing assets, operating an MTF and so on. Both require genuine substance, approved persons, AML/CFT frameworks, and capital. The two licences are not interchangeable. A token exhibiting Security characteristics is a Digital Security under ADGM rules, outside the VA framework; VARA's Schedule 1 handles virtual assets, not securities.

How long does it take to get licensed under each regime?

Medici Expert's licensing FAQ, published on 18 August 2026, places UAE licensing at four to six months elapsed. That figure covers documentation preparation, regulatory review, and substance setup; it is not a regulator-published service-level agreement. Elapsed time runs from a complete and accurate pack, not from the decision to apply. Thin or incomplete submissions extend the clock across all three regimes.

Are there crypto activities that none of the three regimes covers?

Security-token issuance and dealing sits under the onshore CMA (Capital Market Authority) under Federal Decree-Laws 32 and 33 of 2025 and CMA Resolution 15/2025. A VARA VASP Licence, DFSA authorisation, or ADGM FSP for virtual assets does not authorise security-token activities. A virtual asset that VARA, the DFSA, or the FSRA reclassifies as a security also moves to the CMA perimeter. Open the live CMA text before structuring a security-token product.

What AML obligations apply across all three perimeters?

Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025 apply as the federal AML layer regardless of perimeter. Article 4 of the Cabinet Resolution defines the Virtual Asset operations that bring a person into the federal VASP definition for CDD, Travel Rule, and targeted financial sanctions. Each regulator then adds its own AML rulebook: VARA's Compliance and Risk Management Rulebook, the DFSA's AML module, the FSRA's AML rules. Crypto compliance in 2026 covers that operating layer.

‍

Sources

• Dubai Law No. (4) of 2022 Regulating Virtual Assets (HTML)
• VARA, Licence Applications (fetched 24 Aug 2026)
• VARA, Licensed Activities
• VARA, Virtual Assets and Related Activities Regulations 2023 (current version effective 19 June 2025)
• DFSA Crypto Token Regulation (rules in force 12 January 2026)
• ADGM Digital Assets (fetched 24 Aug 2026)
• ADGM FSRA General Application Process (fetched 24 Aug 2026)
• ADGM / FSRA Guidance — Regulation of Virtual Asset Activities in ADGM (VER07.100625)
• SCA / CMA new laws — FDL 32/2025 and 33/2025
• Cabinet Resolution No. (134) of 2025, CBUAE Rulebook
• Medici Expert, Crypto compliance in 2026
• Medici Expert, Building real rules for crypto
• Medici Expert, What MiCA means for every company