What the Resolution actually does

Cabinet Decision No. 111 of 2022 empowered the Securities and Commodities Authority (SCA) as the federal regulator for Virtual Asset Service Providers across the UAE. Cabinet Resolution No. 112 of 2022 then delegated VASP licensing in Dubai (excluding the DIFC) to VARA, with two structurally important provisions:

  1. Any VASP authorised by VARA is automatically registered with the SCA — no separate federal application is required.
  2. The VARA-licensed firm may, by virtue of that auto-registration, operate across the UAE — with the express exception of the DIFC, which is regulated separately by the DFSA.

This delegation is the load-bearing legal mechanism behind the commercial proposition that "a Dubai VARA licence gives you the rest of the UAE." It is correct in spirit, but it has structural limits that founders should understand precisely.

What "operating across the UAE" means in practice

The federal-reach provision authorises the VARA licensee to provide its licensed activity to clients located anywhere in the UAE, except DIFC, on the basis of its VARA licence and SCA auto-registration. It does not:

  • Require the firm to take a separate licence in any other Emirate.
  • Require a separate ADGM authorisation to serve ADGM-located clients (provided the firm is not establishing a place of business in ADGM).
  • Override DIFC's separate regulatory perimeter — DIFC clients require the firm to engage with DFSA's Crypto Token regime, or to operate through a DIFC-authorised entity.

The federal layer transition under Decree-Law 33/2025

Federal Decree-Law No. 33 of 2025 (covered separately in our SCA-to-CMA briefing) re-bases the federal layer by establishing the Capital Market Authority (CMA) as the SCA's successor. The Cabinet Resolution 112 delegation is preserved under the new federal regime: VARA licensees are auto-registered with the federal authority — now the CMA — and may operate UAE-wide (excluding DIFC) on that basis.

The architectural relationship is unchanged. What is changing through 2026 is the implementing-regulation layer underneath — the precise scope of CMA primary authority over virtual assets used for investment purposes, and the operational mechanics of the auto-registration handover. CASA's regulatory monitoring stack tracks these implementing regulations as they are issued.

The DIFC exception — and what to do about it

DIFC is the one structural exception to the Cabinet Resolution 112 federal-reach provision. A DIFC-located client is, for regulatory purposes, in a separate jurisdiction with its own regulator. A VARA-licensed firm wishing to provide regulated services to DIFC clients has three practical options:

  1. Refer the activity to a DFSA-authorised counterparty, with appropriate disclosures to the client about the regulatory perimeter.
  2. Establish a separate DIFC entity authorised by the DFSA under the Crypto Token regime — typically Category 4 for an advisory firm, with the activity scoped to Crypto Tokens.
  3. Limit the firm's footprint to non-DIFC UAE clients, with documented client-eligibility controls in onboarding.

For most institutional advisory firms we work with, option (1) is the most practical at launch — supplemented by a documented partner-panel arrangement with one or more DFSA-authorised firms. The DIFC entity option becomes commercially relevant only once the firm's DIFC client pipeline justifies the additional capital and operating overhead.

What this means for licensing strategy in 2026

Cabinet Resolution 112's federal-reach provision is one of the most attractive structural features of the VARA pathway. For a virtual asset advisory firm whose target clients are primarily Dubai-based with selected reach into Abu Dhabi mainland and other Emirates, the VARA licence with SCA / CMA auto-registration provides a credible, federally-anchored operating perimeter without requiring a second authorisation.

Three implications follow:

  • The "VARA + DMCC sister entity" architecture remains the strongest primary licensing strategy for a Dubai-anchored institutional virtual asset advisory. The VARA entity carries the regulated arm; the DMCC sister carries the unregulated services with an institutional brand.
  • ADGM FSRA Cat 4 is the credible Plan-B rather than a competing primary pathway — particularly attractive for founders prioritising common-law jurisdiction and cross-border (GCC, MENA, Europe) reach.
  • DIFC is a complementary perimeter, not a substitute. Firms with a heavy DIFC client pipeline should sequence a DFSA Category 4 application as a Phase 2 or 3 expansion, not at launch.

How CASA helps

  • UAE Pathway Diagnostic — a fixed-fee comparison of VARA, ADGM FSRA, DIFC DFSA and the DMCC/DWTC unregulated routes against the firm's specific commercial profile.
  • Cross-perimeter operating model design — the governance, client-eligibility controls and partner-panel arrangements that make the VARA + DIFC referral architecture credible to a regulator.
  • Federal monitoring — quarterly briefings on CMA implementing regulations as they are issued through 2026 and beyond.

Want a side-by-side view of which UAE pathway fits your commercial profile?

Brief our team

References: Cabinet Decision No. 111 of 2022; Cabinet Resolution No. 112 of 2022; Federal Decree-Law No. 33 of 2025; VARA Compliance and Risk Management Rulebook; DFSA Crypto Token Rules.

This briefing is general commentary by CASA and does not constitute regulated legal, financial or investment advice. Firms should confirm specific positions with retained counsel and the relevant supervisory authority.