Getting a Crypto Licence in the UAE: The Realistic Timeline

Elapsed time for a UAE file, as published on Medici’s licensing FAQ on 18 August 2026, sits in a 4 to 6 month band. That band is a documentation and process clock. It is not a regulator service-level agreement.

UAE company formation and licensing starts by naming the perimeter, then lining up the entity, the fit-and-proper people, the policy pack, the substance, and the banking file before anyone pays a second-stage fee.

‍

Why the UAE has four crypto-licence files

Dubai’s Virtual Assets Regulatory Authority governs virtual-asset service in and from the emirate, including free zones, and excludes the Dubai International Financial Centre. VARA’s own homepage states that perimeter. Law No. (4) of 2022 created the supervisor. The Virtual Assets and Related Activities Regulations 2023, current version effective 19 June 2025, live on rulebooks.vara.ae. A free-zone trade licence that lists a crypto-adjacent activity is not that file. Search results still sell consultancy packages from AED 12,500 as VASP permissions.

The DIFC sits under the Dubai Financial Services Authority. Crypto Token rules in force from 12 January 2026 put suitability on the firm under GEN Rule 3A.2.1. The DFSA no longer keeps a prescribed list of Recognised Crypto Tokens. An Investment Token (a Security or Derivative in token form) is a different capital-markets file.

Abu Dhabi Global Market sits under the Financial Services Regulatory Authority. Guidance – Regulation of Virtual Asset Activities in ADGM, version VER07.100625, is issued under section 15(2) of the Financial Services and Markets Regulations 2015. Virtual Asset regulated activity needs a Financial Services Permission. A token that exhibits Security features is a Digital Security, not a Virtual Asset.

Onshore, the federal capital-markets supervisor is the Capital Market Authority. Federal Decree-Law No. (32) of 2025 and Federal Decree-Law No. (33) of 2025 took effect on 1 January 2026 and renamed the Securities and Commodities Authority. Security tokens sit in Chairman’s Resolution No. (15/Chairman) of 2025, in force from July 2025 according to two independent practitioner notes. Open the live CMA text before you file. A VARA VASP permission does not cover that instrument.

Cabinet Resolution No. (134) of 2025, the executive regulation of Federal Decree-Law No. (10) of 2025, lists Virtual Asset activities in Article 4: exchange against fiat, exchange between virtual assets, transfer, safekeeping or administration, and financial services related to an issuer’s offer or sale. That list is an AML overlay. It tells you who is a VASP for federal CDD, Travel Rule, and targeted financial sanctions. It does not start a VARA, DFSA, FSRA, or CMA licence clock. Crypto compliance in 2026 is the operating layer on top of whichever permission you hold.

‍

What does elapsed time include?

Founders ask for a number of days. Official pages name stages. They do not publish a processing-day SLA that you can put in a term sheet. Medici’s live licensing FAQ, checked 18 August 2026, gives documentation clocks: EU and offshore 2 to 4 months; UAE and Asia 4 to 6 months; the United States longer. Company formation in the UAE is 1 to 3 weeks. High-risk bank accounts are 6 to 8 weeks. Read those figures as the time to assemble people, policies, substance, and a bank-ready file, plus the regulator’s iterative review. A complete pack still waits on interviews, information requests, invoices, and conditions.

Nataly Medici, Managing Partner and CEO, puts the stack in one sentence on the digital-assets page: “Entering a regulated market is not just about registering a company or applying for a license. Your entity, business model, banking setup, compliance framework and jurisdictional logic must work together from day one.”

A calendar that starts at “we submitted the form” is already late.

Planning map dated 18 August 2026. The low end assumes a single activity, named officers, policies written for this firm, and a bank that will look at the file. The high end assumes extra activities, missing people, template policies, and a banking file that starts after the licence PDF arrives. Confirm every stage against the live regulator page on the day you file.

‍

VARA (Dubai, including free zones, excluding DIFC)

The clock contains IDQ via DET or a Dubai free zone; typically 50% of the application fee; Approval to Incorporate; incorporation, office, staff; VASP pack against four compulsory rulebooks plus activity books; meetings and interviews; balance of fees and year-1 supervision; licence that may carry conditions. Typical elapsed range: 4–6 months documentation/process (Medici FAQ, 18 August 2026). Formation 1–3 weeks sits inside Stage 1. VARA names stages, not processing days. What stretches it: wrong perimeter; IDQ that cannot describe flows; unpaid first-stage fee; ATI treated as authority to carry on VA activity; template AML pack; missing fit-and-proper files; capital and insurance “to follow”; Travel Rule controls promised rather than evidenced.

DFSA Crypto Token (DIFC)

Enquiry via DFSA Connect; permissions mapped to GEN 2.2.2; fitness and propriety; application or variation; GEN 3A.2.1 token-suitability file; in-principle conditions; DIFC Registrar incorporation, premises, capitalised account. Same 4–6 month UAE planning band. No live SLA on the 2026 crypto page. A 2011 DFSA leaflet cited a four-month aim; treat that file as stale. What stretches it: packs reused from another regulator; unclear Financial Service; undocumented token suitability; Investment Token filed as Crypto Token; premises and banking left until after in-principle.

FSRA Virtual Assets (ADGM)

Authorisation meeting; draft regulatory business plan; FSP forms and fee; review and Approved Person interviews; in-principle approval with pre-conditions; ADGM commercial licence, premises, bank accounts, capitalisation; Financial Services Permission. Same 4–6 month UAE planning band. The FSRA general-application page names eight steps, not days. IPA does not authorise regulated activity. What stretches it: cold filing; Virtual Assets mixed with Digital Securities; Accepted Virtual Asset assessment unread; IPA conditions (lease, capital, officers, accounts) run in series.

Onshore CMA / security tokens

Classification as a security; live text of Resolution 15/2025 (July 2025 in-force per practitioner notes); issuer, register, venue or permitted OTC path; CMA successor permissions under FDL 32/2025 and 33/2025 from 1 January 2026. Same 4–6 month UAE band once the instrument, issuer, and venue path are named. This is not a VARA calendar. What stretches it: VASP pack filed for a share, sukuk, or fund unit; January 2025 consultation draft used instead of the live resolution; counsel has not opened the Arabic/English CMA text.

A European CASP under MiCA sits on a different statute and a shorter Medici band (2 to 4 months). What MiCA means for every company is the EU file. Do not import a CASP calendar into Dubai.

‍

How a VARA file moves in Dubai

VARA supervises virtual-asset activity in and from Dubai, including Dubai free zones, excluding the DIFC. Law No. (4) of 2022 created that perimeter. The Virtual Assets and Related Activities Regulations 2023, current version effective 19 June 2025, live on rulebooks.vara.ae. For new firms the public licensing page states two stages: Approval to Incorporate, then a VASP Licence. You file through Dubai Economy and Tourism on the mainland, or through a Dubai free zone other than DIFC. ATI lets you finish incorporation and operational set-up. It does not let you carry on VA Activities. VARA can refuse ATI where the activity sits outside the perimeter or the firm will not meet the standard.

Approval to Incorporate

Stage 1 is an Initial Disclosure Questionnaire to DET or the free zone, a business plan, beneficial-owner and senior-management detail, and payment of the initial fees, typically 50 percent of the licence application fee. The live 2023 Regulations put licensing and supervision fees in Schedule 2 (the applications page still says Schedule B). Confirm the live schedule before you budget. Capital requirements sit in Part IV of the Company Rulebook. ATI, once issued, is the green light to complete legal incorporation, rent the office, and onboard staff. The licensing page prints a note in plain language: at this point the firm is not permitted to carry on Virtual Asset activities.

Banks, exchanges, and counterparties will ask whether VA activity is authorised. The answer is no until Stage 2 closes. Legacy operators who carried on VA activities in Dubai before 7 February 2023 sit on a separate path (Application Acknowledgment Notice, Legacy Operating Permit or NOC). New firms do not inherit that discount by renaming an old product.

The VASP pack after ATI

Stage 2 starts when VARA issues guidance with the ATI. You prepare the pack that guidance names, take feedback, attend meetings and interviews, and submit further documents. You then pay the remaining application fee and the first year’s supervision fees. A VASP Licence may issue subject to operational conditions. VARA reserves the right not to issue it.

Every applicant must meet four compulsory rulebooks: Company; Compliance and Risk Management; Technology and Information; Market Conduct. Activity rulebooks sit on top for the VA Activities you seek. This article does not pick the category. That choice is a separate file. The licensing page publishes a non-exhaustive list: corporate and UBO files, fit-and-proper confirmations, source of funds, governance, a local website, key-personnel CVs, a regulatory business plan, financials, paid-up and locked capital, insurance, succession and wind-down, close links, plus risk, compliance, and technology materials. VARA may ask for more.

The Compliance and Risk Management Rulebook, file VARA_EN_123_VER20250519, effective 19 June 2025, requires you to show Travel Rule compliance during licensing (III.G.8), including a plan for counterparties in jurisdictions that have not legislated the rule. The federal floor is the CBUAE Virtual Assets Travel Rule, in force on rulebook.centralbank.ae. That is a control you evidence in the pack, not a second licence clock. AML and compliance documentation is the work that fills those rows.

‍

How a DFSA Crypto Token file moves in DIFC

The DIFC is outside VARA. Firms that want to carry on Financial Services involving Crypto Tokens in or from the DIFC need DFSA authorisation, or a variation if they already hold a licence. Updated Crypto Token rules took effect on 12 January 2026. Suitability of each Crypto Token, excluding Fiat Crypto Tokens, sits with the firm under GEN Rule 3A.2.1: characteristics, foreign regulatory status, market size and history, technology, and whether use of the token would prevent compliance with DFSA-administered legislation.

Use of a Crypto Token is not, by itself, a Financial Service. The activity list in GEN Rule 2.2.2 is. Initial enquiry runs through DFSA Connect. The assessment covers the proposed business model, fitness and propriety of the operators, and the permissions required. The page tells you not to reuse packs submitted to other regulators unless you have reviewed them for this submission.

Investment Tokens remain a separate perimeter: a Security or Derivative in token form, or a token with substantially similar rights or effect. File that as an Investment Token analysis. The 2026 crypto page does not publish a processing-day count. Plan inside the UAE 4 to 6 month documentation band, then add DIFC Registrar incorporation, premises, and a capitalised account as in-principle conditions. Treat any four-month figure copied from a 2011 DFSA leaflet as historical.

‍

How an FSRA Virtual Asset file moves in ADGM

ADGM does not sell a generic crypto licence. You apply for a Financial Services Permission covering named regulated activities in or from the Global Market. The digital-assets page lists Virtual Assets, Fiat-Referenced Tokens, Digital Securities, and derivatives and funds of digital assets as separate suites. Guidance VER07.100625, read with FSMR and the FSRA rulebooks, is the Virtual Asset map. A token with Security features is a Digital Security under Schedule 1 of FSMR and the Digital Securities guidance. Mix the two and the Authorisation team will send you back to the plan.

The FSRA general-application page names eight steps: contact the Authorisation team; an initial meeting, after which FSRA may invite a draft regulatory business plan; review of that draft; formal submission of forms, documents, and the fee; review, questions, and Approved Person interviews; in-principle approval with pre-conditions; fulfilment of those conditions, including an ADGM commercial licence, premises, bank accounts, and capitalisation where relevant; then the Financial Services Permission. The digital-assets page compresses the same sequence into six public steps. Neither list is a day count.

In-principle approval is a milestone. It is not authority to commence regulated activity. Operating on IPA alone is a breach of FSMR. The clock after IPA is the lease, the officers, the capital, and the accounts, run in parallel if you prepared them, or in series if you waited. Authorised Persons conducting Virtual Asset regulated activity work only with Accepted Virtual Assets, self-assessed against COBS 17.2.2 and notified to the FSRA no later than five business days before use.

‍

When the file is an onshore security token

A token that is a share, a sukuk, a note, or a fund unit is a capital-markets instrument. Onshore that file sits with the CMA, the legal successor to the SCA from 1 January 2026 under Federal Decree-Law No. (32) of 2025. Federal Decree-Law No. (33) of 2025 regulates the capital market. References to the SCA in earlier legislation are read as references to the CMA. The consultation you will still find in search is the SCA news item of 22 January 2025: an 18-article draft on security tokens and commodity tokens, comments by 14 February 2025.

The live instrument, per two independent practitioner notes (one dated 18 February 2026), is Chairman’s Resolution No. (15/Chairman) of 2025, also cited as Decision No. 15/RM/2025, in force from July 2025. Those notes describe a technology-neutral rule: a security recorded on a distributed ledger remains a security. Virtual assets fall outside. Trading defaults to a licensed market or alternative trading facility, with OTC through a licensed digital-wallet service provider as an exception. The issuer is responsible for ledger integrity and for telling investors what rights the token confers. An official English PDF of the July 2025 resolution was not on the fetched consultation URL. Counsel must open the live CMA text on sca.gov.ae before anyone files.

Digital-asset and tokenization legal support is the issuer-and-rights half of that file. The licence half is still a CMA permission, not a VARA VASP. Elapsed time follows the same UAE 4 to 6 month planning band once you have named the instrument, the issuer entity, and the venue path. It does not follow a VARA ATI calendar.

‍

What stretches the clock after you file

Regulators review what you sent, then they ask for what is missing. The delay is a model that does not match the activity list, a person who cannot pass fit-and-proper, a policy written for another country, an office that exists only on a brochure, and a bank file that has not been opened. Building real rules for crypto is the same point at policy level: a framework that cannot be operated will not survive a meeting. Nataly Medici’s licensing line is the filing version of that test: “We tell clients early: a license rejected for sloppy documentation is harder to recover from than one that was never filed.”

Fit-and-proper and approved persons

VARA asks for fit-and-proper confirmations, source-of-funds evidence, CVs, passports, and key-personnel job descriptions. The DFSA assesses fitness and propriety of the operators. The FSRA interviews Approved Persons. Named officers who are still “to be hired,” dual-hatted across five group companies, or unable to explain the product in the interview, add rounds. An MLRO who is not in the jurisdiction the rulebook requires, or a group that will not produce UBO papers, stops the file.

Policies written for this firm

Four VARA compulsory rulebooks, plus the activity books, are not a binder of generic AML chapters. The DFSA says reused documents from other regulators fail unless you have rewritten them for this submission. Template packs miss the product flows, the client types, the wallet architecture, and the Travel Rule tooling this firm will use. Cabinet 134/2025 still applies as the federal AML overlay. It does not replace the supervisor’s rulebook. A policy that cites repealed Cabinet 10/2019 numbering, or that treats the Travel Rule as a future project, will draw a question. VARA III.G.8 wants the licensing demonstration now.

Substance you can show

ATI exists so you can rent the office and hire people. IPA in ADGM lists premises, a commercial licence, bank accounts, and capital as pre-conditions. DFSA in-principle letters attach the same cluster: Registrar incorporation, account, premises. A slide that says “flexi-desk to follow” is not substance. A website that does not exist is on VARA’s list as a required local-entity site. Insurance, succession, and wind-down plans are listed because a firm that cannot fail in an orderly way has not finished the pack.

Custody, wallet operations, and exchange matching belong in the technology file. The Technology and Information Rulebook is compulsory for VARA. DFSA supervision looks at custody, technology resilience, and financial crime. FSRA Virtual Asset activity has its own COBS Chapter 17 overlay.

‍

Company formation is a separate week count

UAE company formation, on the live licensing FAQ, takes 1 to 3 weeks. Founders collapse that clock with the VASP invoice because both arrive in the same month. They are different legal acts.

A Dubai free zone or mainland company can exist without a VA permission. It cannot carry on VARA VA Activities in or from Dubai, excluding DIFC, without the VASP licence. DMCC’s public crypto-ecosystem page, which ranks in the same search results, quotes a crypto-centre package and a trading-licence time of about four weeks. That is a zone product. It is not VARA Stage 2.

ADGM requires FSRA approval before you proceed with registration. The commercial licence is an IPA condition. DIFC follows the same logic: the Registrar completes incorporation against DFSA conditions.

Plan the 1 to 3 week formation inside the 4 to 6 month licence file. Do not quote the formation week as the licence timeline to investors.

‍

Banking runs beside the licence

Ksenia Babochkina, Commercial Director at Medici Expert, maps the sequence banks use: “We map jurisdiction options against banking access first, because a license without a working bank account is just a certificate on a wall.” High-risk corporate accounts, on Medici’s accounting-and-tax FAQ as of 18 August 2026, take 6 to 8 weeks. Standard corporate accounts sit at 2 to 4 weeks. Crypto and fintech files are the high-risk band. Start the bank file when the entity, the ownership chart, the AML pack, and the business narrative exist. Every UAE perimeter that uses in-principle or ATI conditions will ask you to show an account, or the ability to open one, before you go live.

ATI, IPA and the account condition

VARA Stage 1 lets you complete operational set-up after ATI. Banks still ask whether the activity is licensed. Many will wait for the VASP PDF. The 6 to 8 week high-risk band sits beside Stage 2. If you start the bank file on the day the licence arrives, you add those weeks after the regulator has finished.

ADGM states the dependency on the FSRA general-application page: IPA pre-conditions include a commercial licence, premises, opening bank accounts, and capitalising the entity where relevant. DFSA in-principle practice attaches a similar cluster. Run the bank pack in parallel with the regulator questions.

High-risk onboarding, 6–8 weeks

Six to eight weeks is a documentation clock for high-risk onboarding, published on the live site, not a promise that a particular desk will say yes. The bank reads the same file as the regulator: incorporation, UBO, source of wealth, policies, and product flows. Gaps that stretch the licence file stretch the account file.

‍

Who this timeline fits

This clock fits a founder who can name the perimeter, the activity, the people, and the bank path, and who will spend the first weeks on the pack rather than on a press release. A single, bounded activity, officers who can sit the interview, policies written for the flows you will run, and a banking narrative that matches the licence application, is how you stay inside 4 to 6 months as a planning range.

A free-zone consultancy certificate is not a crypto licence. A tokenized security does not belong in a VARA IDQ. An application without an MLRO, and an investor model that assumes deposits on the week the licence PDF lands, leave the 4 to 6 month band. The UAE file is available. It is not a four-week zone product.

‍

FAQ

Do I need a licence to trade crypto in the UAE?

Personal investment in virtual assets is not, by itself, a VASP activity. A business that exchanges, transfers, safekeeps, or offers virtual assets for others is inside Cabinet 134/2025 Article 4 as a VASP for AML, and it needs the permission of the supervisor for that place: VARA in Dubai excluding DIFC, DFSA in DIFC, FSRA in ADGM, or the CMA for a security token. Confirm the live rulebook before you treat a hobby as a business.

How long does a UAE crypto licence take?

Medici’s licensing FAQ, 18 August 2026, plans UAE files at 4 to 6 months elapsed. That is a documentation and process clock: entity, people, policies, substance, regulator questions, and banking. Official VARA, DFSA, and FSRA pages name stages. They do not publish a processing-day SLA you can treat as a guarantee. Formation is 1 to 3 weeks inside that band. High-risk accounts are 6 to 8 weeks on a parallel rail. Incomplete packs run longer.

How do I get a crypto licence in Dubai?

Name the perimeter first. Dubai excluding DIFC is VARA: IDQ through DET or a Dubai free zone, ATI, then the VASP pack. DIFC is DFSA authorisation for the Financial Service, with Crypto Token rules from 12 January 2026. A free-zone company licence, including a crypto-centre package, is not the VASP file. Do not file a security token as a virtual-asset activity.

Is cryptocurrency legal in the UAE?

Yes, inside the perimeters above. Unlicensed VA activity in or from Dubai excluding DIFC is prohibited by the VARA Regulations. ADGM and DIFC prohibit the relevant Financial Services without permission. Onshore security tokens follow CMA rules, including Resolution 15/2025 as described by practitioner notes, subject to the live text. Cabinet 134/2025 still applies as the federal AML overlay.

How much is a crypto licence in the UAE?

Fees depend on the supervisor and the activity. VARA prints licensing and supervision fees in Schedule 2 of the 2023 Regulations and capital in the Company Rulebook. DFSA fees sit in the Fees Module. ADGM publishes FSRA application fees on adgm.com. Confirm the live schedule on the day you file. A free-zone “from AED 12,500” consultancy package is not a VASP fee. This article is the timeline file, not a full cost schedule.

Can I operate on Approval to Incorporate or in-principle approval?

No. VARA’s licensing page states that ATI does not permit Virtual Asset activities. ADGM’s process grants a Financial Services Permission only after IPA pre-conditions are met; IPA is not authority to commence regulated activity. DFSA in-principle letters attach conditions such as incorporation, premises, and a funded account before the licence. Build the operating calendar to the final permission.

Does a MiCA CASP replace a UAE file?

No. A CASP authorisation covers Union crypto-asset services under Regulation (EU) 2023/1114. It does not authorise VARA, DFSA, FSRA, or CMA activity. Medici plans EU files at 2 to 4 months and UAE files at 4 to 6 months. Read the EU statute on its own page, then file the UAE perimeter you will use.