Cryptocurrency in Dubai: crypto licences in DMCC

Dubai is one of the few jurisdictions in the world with a regulator created exclusively for virtual assets: the Virtual Assets Regulatory Authority (VARA), born from the emirate’s Law No. 4 of 2022. And within Dubai, DMCC concentrates one of the region’s largest crypto and Web3 ecosystems, with a dedicated Crypto & Web3 block of activities on its official list.

That list draws two very different families of business: the VASPs — virtual asset service providers, who handle third-party assets and go through VARA — and crypto mining, which generates its own assets and follows a different approval track. This guide walks through the nine activities in the block with their codes, what each activity allows and prohibits, the capital required and the approvals that set the incorporation timeline.

The map: two families of activities

All activities in DMCC’s Crypto & Web3 block share the same minimum share capital — AED 50,000 — but they split by who approves and what type of licence they carry:

The strategic reading is immediate: if the business touches client assets, VARA is involved; if the business generates its own assets or rents out infrastructure, approval is internal to DMCC. And that difference shapes budget, timelines and structure from day one.

The seven VASP activities: what each one covers

The entries on the official list describe the scope of each service with precision:

• Transfer & Settlement (6599-83): transmission or transfer of virtual assets from one entity to another, or from an entity to a wallet, address or location.
• Management and investment (6599-84): acting as agent or fiduciary for a third party’s virtual assets — management, administration or disposal — including investment management services and staking: taking responsibility for delegating assets to earn the fees paid to validators and node operators of a proof-of-stake DLT.
• Lending & Borrowing (6599-85): contracts under which the lender transfers virtual assets to the borrower, who undertakes to return them on demand, during or at the end of the agreed term.
• Exchange (6599-86): exchange, trading or conversion between virtual assets and currencies — or between virtual assets — with matching of orders between buyers and sellers and maintenance of the order book.
• Custody (6599-87): safekeeping of virtual assets on behalf of third parties, acting only under verified instructions. It is the activity with the strictest rules in the block — we cover it separately.
• Broker & Dealer (6599-88): receiving and accepting orders, matching trades between buyers and sellers, operating as a dealer for the company’s own account, market making with client assets, and placement, distribution or issuance services for virtual assets.
• Advisory (6599-89): personalised recommendations to clients — at their request or on the firm’s initiative — on transactions involving virtual assets.

All seven share the same structure: a Service licence, capital of AED 50,000 and VARA approval as a third party. In practice, the file before the regulator is what governs the timeline: the DMCC licence is not issued without sign-off from the virtual assets authority, and the VARA process has its own fitness, governance and compliance requirements that are best prepared before starting the incorporation.

Custody: the activity that stands alone

The custody entry adds two rules that do not exist in the rest of the block:

1. It is a standalone activity: it cannot be carried out alongside other activities under the same company. Anyone who wants custody and exchange needs two companies — a structural decision that affects capital, governance and the contracts between the two entities.
2. Segregation per client: only VASPs that separate each client’s assets into individual wallets (VA wallets) obtain the custody services licence. The technical architecture of the wallets is not an operational detail: it is a licensing requirement.

It is the regulatory translation of a lesson the industry learned: the custodian cannot mix client assets either with its own or with each other’s. For groups planning several crypto business lines, custody is the first corporate structuring decision.

Crypto mining: the route without VARA

The two mining activities follow a different track — a specific questionnaire and prior approval from DMCC management before registration — and do not involve VARA as a third party:

• Proprietary mining (659990, Trading licence): verifying and adding transactions to the blockchain — proof-of-work or proof-of-stake — to generate crypto assets and sell them for the company’s own account on exchange platforms. The entry expressly excludes providing services to third parties: no exchange, no brokerage, no financial or banking services, no peer-to-peer operations, no payment processing. It is a standalone activity for new companies, with a single permitted combination: proprietary trading in crypto commodities.
• Crypto mining facility operator (7229-96, Service licence): setting up and managing the facility — computer systems, telecommunications, storage — where miners generate virtual assets. The operator likewise cannot trade, mine on its own account, run an exchange, provide brokerage or offer financial services: its business is the infrastructure, not the assets.

The split is clean: one activity for those who mine with their own machines and another for those who rent the data centre to miners. Both require passing DMCC management’s prior filter, so the questionnaire and the approval are part of the real incorporation timeline.

Taxation of the crypto company

The framework is the general one for a UAE free zone company. On profits, Corporate Tax at 9% above AED 375,000 of taxable income. On VAT, services to local clients are taxed at 5% and supplies to clients outside the country can qualify for the 0% export rate by meeting the conditions of the regulations, with mandatory registration once taxable turnover exceeds AED 375,000 per year. The sector’s particularity lies in the accounting: valuing volatile assets, separating own assets from client assets and documenting every on-chain movement with accounting support is what underpins both the tax close and the reports to the regulator.

Steps to set up the crypto company in DMCC

1. Define the model: third-party assets (VASP) or own assets (mining)? The answer determines the regulator, the licence and the structure.
2. Choose the activities: review which entries cover the real business and which combinations the list allows — with custody always in a separate company.
3. Prepare the approval: a file before VARA for the VASP activities; a questionnaire and prior approval from DMCC management for mining.
4. Incorporate the company: a free zone company with AED 50,000 of capital and the licence type dictated by the activity.
5. Operate in order: accounting prepared for crypto assets, VAT registration when due and the reports the licence requires.

If the project is more Web3 than VASP — tokenisation, DAOs, protocols — it is worth comparing DMCC with RAK DAO, the Ras Al Khaimah free zone specialised in decentralised organisations: they are different frameworks for different businesses, and choosing the right starting jurisdiction saves a migration later.