What FSRA Category 4 actually permits
Within the FSRA Conduct of Business Rulebook, Category 4 is the lowest-risk regulated category — it covers Advising on Investments and Arranging Deals in Investments, and explicitly excludes activities that would carry higher capital and conduct expectations: dealing as principal, managing assets, holding client money, and operating an exchange.
For a virtual asset advisory firm, the structural advantage is that a Category 4 firm can provide regulated advice on Accepted Virtual Assets without taking on the operational burden of custody, trading or asset management. The firm's perimeter is precisely the perimeter of an advisory practice — which is what most institutional founders building a UAE virtual asset advisory actually want.
To bring virtual assets explicitly within the perimeter, the application is filed alongside a Virtual Asset Application Form, with the regulated activity scoped to Accepted Virtual Assets under Rule 17.1.1 of the FSRA Conduct of Business Rulebook. ADGM maintains and publishes an updated list of Accepted Virtual Assets — covered separately in our briefing on the ADGM Accepted VA list.
The capital and prudential floor
FSRA capital is structured as a base requirement, an expenditure-based floor, and (where applicable) a risk-based add-on. For a Category 4 firm with no client money or asset-holding activity, the structure typically resolves to:
| Component | Indicative figure | Notes |
|---|---|---|
| Base capital | USD 10,000 | Statutory floor for Category 4 firms. |
| Expenditure-based floor | 6 to 13 weeks of operating expenses | The "higher of" rule applies — base or expenditure floor, whichever is greater. |
| Risk-based add-on | Case-by-case | Driven by the firm's specific risk profile, including virtual asset exposure. |
In practice, almost every virtual asset advisory firm we have shepherded through Category 4 has resolved to the expenditure-based floor — often in the USD 100,000 to USD 200,000 range once the firm is staffed for institutional delivery. That is meaningfully higher than the USD 10,000 base figure and is the figure founders should plan around for the capital lock-up.
The Responsible Individual stack
FSRA expects a Category 4 firm to have a defined controlled-functions structure, with named Responsible Individuals fit-and-proper-vetted by the regulator. The minimum stack for a virtual asset advisory firm typically includes:
- Senior Executive Officer (SEO) — the regulator's primary point of contact, accountable for the firm's overall conduct.
- Money Laundering Reporting Officer (MLRO) — accountable for the firm's AML/CFT framework, with direct reporting to the board.
- Compliance Officer (CO) — accountable for the regulatory compliance framework, often combined with the MLRO function in a firm under a defined scale threshold.
- Finance Officer (FO) — accountable for the firm's financial controls and regulatory reporting.
Each named individual is interviewed by the regulator as part of the application. The interview is substantive — not ceremonial — and is one of the most common timing risks in a Category 4 application. Mock interviews and structured RI preparation are not optional for an institutional application.
The fee structure
ADGM revised its commercial licence fee structure with effect from January 2025. For a virtual asset advisory firm, the indicative fees in 2026 are:
| Fee | Indicative figure | Cadence |
|---|---|---|
| FSRA application fee | USD 25,000 – 40,000 | One-off, payable on application |
| FSRA annual supervision fee | USD 15,000 – 30,000 | Annual |
| ADGM Registration Authority (commercial) | USD 16,700 (financial) / USD 10,300 (non-financial) | Annual |
| Data protection registration | USD 300 | Annual |
| Office (Grade A, ADGM) | USD 60,000+ | Annual |
Indicative ranges only. The exact figures depend on the firm's size, risk profile and the specific permissions sought. Confirm with FSRA and ADGM at the time of application.
The application timeline
An institutional Category 4 application typically runs six to nine months end-to-end. The structure breaks down into four phases:
- Pre-application (4 to 8 weeks). Pathway selection, business plan, target operating model, capital plan, RI selection and the regulatory engagement strategy.
- Application drafting (4 to 6 weeks). The Regulatory Business Plan, the Compliance Manual, the AML/CFT Manual, the Risk Framework, the Three-Year Financial Projections, the IT and operational risk write-up, and the Virtual Asset Application Form.
- Regulator review and Q&A (12 to 20 weeks). FSRA Q&A cycles, RI interviews, and (typically) one or more material refinements to the application pack.
- In-Principle Approval and conditions (4 to 8 weeks). Capital lock-up, office signing, RI appointment, and the build-out of the operational stack to a state where the firm can commence regulated activity.
The five common application traps
- Under-staffed RI plan. The application names two or three RIs, but only one of them is genuinely full-time. FSRA tests this in interview.
- Capital plan that under-states the operating envelope. The expenditure floor is calculated against an aspirational opex number, not the realistic full-year burn. FSRA flags this in the financial-projections review.
- Compliance manual cloned from a non-VA firm. The manual reads as if the Word find-and-replace was the entire customisation effort. Inspection-grade firms rebuild the manual to the actual VA risk landscape.
- VA risk assessment that does not match the customer book. The enterprise risk assessment treats VA risk as a footnote when the firm's actual book is concentrated in higher-risk segments. FSRA expects the risk assessment to be specific to the firm's strategy.
- Banking access deferred to the post-licence phase. Banking is one of the most material practical risks in any UAE licensing pathway. Founders who treat it as a Phase-2 problem typically lose two to four months at go-live.
How CASA helps
- Application Readiness Sprint — a fixed-fee pre-application bundle: pathway review, evidence pack, RI mock interviews and policy drafting, designed specifically for the FSRA Category 4 standard.
- Full licence programme — end-to-end ownership of the application from pre-submission through In-Principle Approval and Licence grant.
- Outsourced MLRO and CO — named, FSRA-vetted individuals available on a retainer basis for firms that want to launch lean.
Considering a UAE pathway and want a side-by-side view of VARA, ADGM and DIFC?
Brief our teamReferences: ADGM FSRA Conduct of Business Rulebook (incl. Rule 17.1.1 on Virtual Asset activities); FSRA Guidance on the Regulation of Virtual Asset Activities in ADGM; ADGM PRU Rulebook; ADGM Registration Authority commercial licence rules.
This briefing is general commentary by CASA and does not constitute regulated legal, financial or investment advice. Firms should confirm specific positions with retained counsel and the relevant supervisory authority.