How to Verify a VASP: A Checklist for Using Dubai’s Regulated Crypto Exchanges

In October 2025, the Virtual Assets Regulatory Authority (VARA) fined 19 unlicensed crypto firms operating in Dubai, with penalties between AED 100,000 and AED 600,000 each. Its public list of unlicensed VASPs now runs to dozens of names. Most had professional websites, confident marketing and at least one founder who could talk a good game about "UAE regulation".

Before you deposit funds with a Dubai crypto exchange, list a token, or sign a partnership, you should know one thing. Verifying a UAE Virtual Asset Service Provider (VASP) takes about ten minutes if you know what to look for. This is the checklist.

Key takeaways

1. A VARA licence is granted by activity. An advisory licence is not a custody licence.
2. "In-principle approval" is not a licence. The firm cannot onboard clients.
3. A free-zone trade licence is not a financial services licence.
4. The legal entity name on the licence must match the legal entity name on the platform’s terms of service.
5. If something is wrong, screenshots first, complaint second.

Five regulators, one map

The UAE crypto perimeter splits by geography and activity. Five regulators are involved, and which one matters to you depends on where the firm sits and what it does.

1. VARA. Dubai outside DIFC. The most common case for retail crypto exchanges.
2. DFSA. Inside DIFC. Updated crypto-token rules took effect on 12 January 2026.
3. FSRA. Inside ADGM, in Abu Dhabi. Framework refreshed in June 2025.
4. CMA. Federal onshore activity outside the financial free zones. The CMA was previously called the SCA; it was renamed with effect from 1 January 2026 and issued a new federal Virtual Assets Framework in April 2026.
5. CBUAE. Stablecoins and payment tokens. Sits alongside the others, with different rules for onshore activity and for the financial free zones (DIFC and ADGM).

A firm in DMCC, JAFZA or Meydan answers to VARA. A firm in ADGM answers to FSRA. A firm in DIFC answers to DFSA. A firm in another emirate, or operating onshore at the federal level, answers to the CMA. If a stablecoin is involved at any point, the Central Bank is also in the picture.

The ten-minute checklist

Run this before you move funds. If any line breaks, stop and treat the platform as unverified.

1. Find the firm’s legal name in its terms of service. Marketing names ("BrandX") rarely match licensed names ("BrandX VA Services FZ-LLC"). The legal name is what you search.
2. Search the VARA public register at vara.ae. Confirm a full VASP Licence, not "in-principle approval", and read the licensed activities and any conditions.
3. If the firm is in DIFC, search the DFSA register at dfsa.ae. If it is in ADGM, search the FSRA register at adgm.com.
4. For activity outside Dubai, ADGM and DIFC, search the CMA register at sca.gov.ae. The URL still uses the old SCA path at the time of writing.
5. Match the licensed activities to what the platform is selling you. An Exchange Services licence does not authorise yield, lending or staking. Custody must sit in a separate licensed entity.
6. Read the regulator’s enforcement and warning notices. A reprimand, fine or alert naming the firm is a serious negative signal.
7. If a stablecoin is involved, check the CBUAE Payment Token Services Regulation. Onshore and ordinary free zone firms need CBUAE licensing; financial free zone firms have a different route.

Red flags you can spot in two minutes

These come up again and again in enforcement notices and consumer disputes. One is enough to pause.

1. "Regulated in the UAE" with no regulator named and no licence number.
2. A free-zone commercial trade licence offered as proof of "regulation".
3. The brand name on the website does not appear anywhere on the regulator’s register.
4. An offshore parent (BVI, Seychelles, Cayman) with a Dubai marketing office that has no UAE financial services permission.
5. Yield, staking or lending products offered without a VARA Lending and Borrowing licence.
6. All client communication runs through Telegram or WhatsApp with no licensed UAE entity standing behind it.
7. The firm is named in a VARA, FSRA, DFSA or CMA alert.

Three traps that catch smart investors

The IPA trap. "In-principle approval" sounds like a licence. It is not. An IPA holder cannot onboard clients or run live operations until VARA grants the full VASP Licence. Firms sometimes market themselves as "VARA approved" while sitting on an IPA. That is misleading, and VARA has acted against firms doing it.

The activity trap. A VARA licence is issued for specific activities: Advisory, Broker-Dealer, Custody (which must be a separate legal entity), Exchange, Lending and Borrowing, Management and Investment, and Transfer and Settlement. A separate Issuance regime covers token launches. A firm with one of these cannot legally do the others. If your platform offers exchange and yield, it needs two permissions. A surprising number do not have both.

The free-zone trap. A DMCC, IFZA or Meydan trade licence authorises commercial activity. It does not authorise virtual asset services. A platform that points to its trade licence as proof of regulation is either confused or hoping you are.

If you have already sent money

Speed matters more than perfection. Work in order.

1. Secure access. Change passwords, enable hardware-based two-factor authentication, stop sending more.
2. Document everything. Screenshots of the platform, terms of service, transaction IDs, wallet addresses, bank transfer references, all chat logs.
3. File a regulatory complaint. Use the contact form on the relevant regulator’s website. This protects other users and starts the public file on the firm.
4. Take legal advice on civil recovery. A claim before the Dubai Courts under the UAE Civil Transactions Law may be available, with a freezing order where assets can be traced.
5. Report suspected fraud. File a parallel report with Dubai Police’s eCrime portal. Do not factory-reset devices; forensic evidence matters.

Do not assume an unlicensed platform will become licensed if you wait. Once the regulator publishes a warning or imposes a fine, the path forward is recovery, not negotiation.

The bottom line

The ten-minute checklist filters out most problem platforms. If anything is unclear, or if the licence categories do not match the product, get a written licence opinion before moving funds.