VARA Custody Services License: What you Need to Know

Dubai’s virtual asset ecosystem is expanding at a rapid pace, and with that growth comes the need for structures that protect users, secure assets, and build trust. The Dubai Virtual Assets Regulatory Authority (“VARA”) serves as the dedicated regulator overseeing Virtual Asset Service Providers (“VASPs”) across Dubai. Its mandate is to create a secure, transparent, and sustainable environment for virtual asset activities, ensuring that innovation is balanced with investor protection and financial stability.

Among all regulated activities, Custody Services sit at the core of client protection. If trading venues are where markets form, custody is where assets live, and VARA’s rulebook treats custody as a high-integrity, high-responsibility function with strict regulatory expectations.

1. What does custody service actually cover?

A lot more than most people think.

Under VARA, custody isn’t simply about keeping someone’s crypto in a wallet. It’s about guarding it with the same seriousness that a bank protects deposits. Custodians have to make sure clients can always access their assets, that nothing gets moved without permission, and that no one, not even the custodian, can touch the assets improperly.

And it doesn’t stop there. VARA has strict expectations for all VASPs when it comes to storing and safeguarding client assets. But only a VASP with a specific custody license can actually provide true custodial services.

So, exchanges and brokers can’t just toss your coins into their internal wallets and call it a day. Custody isn’t something you "also provide." It’s a standalone, permissioned activity, and the bar is high.

2. How does a VASP prove it’s ready for custody?

Several core requirements underpin the provision of custody services under VARA; each designed to safeguard client assets and ensure the integrity of the services provided.

VASPs providing custody services must be an independent legal entity, that means the custody entity must be separated from any other group company that deals with trading, brokerage, lending, or anything else that could create a conflict or contaminate client assets.

Technology, Security and Wallet Architecture

Think of custody as digital asset security on hard mode. VARA wants to see:

In practice, this means multi-sig keys, geo-distributed backups, real-time monitoring, external audits, the kind of infrastructure you would expect from an institutional-grade custodian.

Segregation of Client Assets

Each client’s assets must live in their own dedicated wallet. Not pooled, not mixed, not handled together.

This protects clients if the VASP ever faces an operational issue, liquidity problem, or even insolvency. Everyone’s assets remain clearly identifiable and retrievable.

Independent & Accountable Corporate Governance

For VARA, custody is only as strong as the governance behind it. The board of a VASP offering custody services must be properly structured, with a combination of executive and non-executive directors and with a minimum of one director qualifying as an independent director required to ensure impartiality and avoid conflicts of interest. Regular board meetings are mandated, along with transparency in board remuneration. This structure ensures that the VASP remains accountable and operates in the best interests of its clients.

3. How these rules play out in practice

In day-to-day operations, VARA’s custody services regulations ensure that virtual assets held by VASPs are managed in a way that provides security and transparency for clients. For example, during periods of market volatility, these regulations require VASPs to have protocols in place that ensure clients can access and withdraw their assets.

VASPs operating in Dubai must also be prepared to handle risks such as lost or stolen keys by maintaining effective recovery procedures and notifying clients promptly about any such incidents. This provides confidence to clients that their assets are handled with the utmost care and diligence, even in the face of unforeseen challenges.

4. The operational reality: custody is not easy

Fast withdrawals versus strong security, this is the daily balancing act for custodians. Cold storage keeps assets safe, but clients expect speed. Hot wallets offer speed, but increase risk.

The solution for most custodians?

Dynamic controls: routine withdrawals flow automatically, but large or unusual movements trigger additional verification.

It’s a constant juggling act, and it requires high-caliber systems and disciplined operations.

5. Costs considerations (Additional Information)

The cost of running custody services in Dubai goes beyond just paying a licensing fee. Yes, VARA charges application and supervisory fees, but the real investment lies in building the kind of infrastructure that can actually protect client assets. Custodians need secure storage systems, advanced key-management setups, and continuous monitoring tools, the sort of technology that keeps hackers and operational risks at bay.

Then there’s the ongoing commitment: regular internal and external audits, system reviews, and compliance checks. These aren’t optional extras; they’re part of the day-to-day reality of operating a serious, regulated custody business.

Lastly, a custody provider must maintain a solid financial buffer. VARA requires the entity to hold the higher of AED 600,000 or 25% of its fixed annual overheads as paid-up capital. This ensures the custodian can absorb operational shocks and continue safeguarding client assets even during periods of stress. As for the application fee for the custody services License under VARA is AED 100,000, with an annual supervision fee of AED 200,000.

How Rasma Legal Can Support You

Rasma Legal helps businesses navigate every stage of the VARA licensing and compliance journey. Our team has successfully worked with VARA across multiple licensing categories and understands the practical and regulatory requirements for operating in Dubai’s fast-evolving digital or crypto asset market. Whether you are applying for a VARA license or strengthening your ongoing compliance, we provide the strategic guidance and hands-on support you need to build a secure, compliant, and scalable VA business.