VARA licence vs CBUAE banking licence: who regulates what in the UAE
A Central Bank of the UAE banking licence lets a firm take deposits and provide banking services across the UAE, while a VARA licence lets a firm carry out named virtual asset activities, such as custody, in Dubai outside the DIFC; Zand Bank PJSC is an example of one firm holding both, with VARA licence no. VL/2024/12/001 covering Custody Services.
Key takeaways
- The Central Bank of the UAE licenses banks and issuers of dirham payment tokens; VARA licenses virtual asset activities in Dubai, except in the DIFC.
- VARA was established by Dubai Law No. (4) of 2022. The Central Bank's Payment Token Services Regulation, Circular 2/2024, is shown as in force from 31 August 2024.
- A VARA licence names its activities. The entry for Zand Bank P.J.S.C., reference VL/2024/12/001, lists one, Custody Services, issued on 9 December 2024.
- Both regulators publish registers. VARA's has a page per firm, and the Central Bank's CB Register is a monthly PDF; the August 2026 edition lists 63 banks.
- A licence is not a protection scheme. VARA's marketing rules require a statement that the investor "does not benefit from any form of financial protection".
The short answer: two regulators, two jobs
The UAE has no single financial licence. The Central Bank of the UAE (CBUAE) licenses banks under federal law, and the Dubai Virtual Assets Regulatory Authority (VARA) licenses virtual asset service providers under Dubai Law No. (4) of 2022.
The two permissions do different jobs. A banking licence is about deposits and the services built on them. A VARA licence, which many people search for as "VARA license", is about named virtual asset activities such as custody or exchange, and only in Dubai outside the Dubai International Financial Centre (DIFC). Neither replaces the other. The table sets them side by side, and the rest of this guide shows how to check each one on the regulator's own register. There are more regulation and banking guides in Insights.
| Question | CBUAE banking licence | VARA licence |
|---|---|---|
| Regulator | Central Bank of the UAE, the federal central bank | Dubai Virtual Assets Regulatory Authority, a public corporation of the Emirate of Dubai |
| What it licenses | Banks: companies that take deposits of all types | Virtual asset activities named on the licence, such as Custody Services |
| Where it applies | The UAE; the financial free zones have their own financial regulators | All zones of Dubai, free zones included, except the DIFC |
| Where the register is | CB Register, a monthly PDF from the Central Bank | Public register on vara.ae, one page per firm |
| Example entry | Zand Bank P.J.S.C: National Bank, Conventional Retail | Zand Bank P.J.S.C.: VASP Licence, Custody Services, VARA licence no. VL/2024/12/001 |
| What it is silent on | Virtual asset activities | Bank deposits and bank lending |
Terms used in this guide
- Virtual asset. In Dubai's law, a digital representation of value that can be traded or transferred digitally, or used for payment or investment (Law No. (4) of 2022, Article 2).
- VASP. Virtual asset service provider. In VARA's rulebooks, an entity that holds a VARA licence to carry out virtual asset activities in the Emirate.
- Payment token. In the Central Bank's regulation, a virtual asset that purports to keep a stable value by reference to a fiat currency. A dirham payment token is what the market calls an AED stablecoin.
- Register. The regulator's public list of the firms it has licensed. It is the evidence; a logo on a website is not.
The glossary has fuller VASP, qualified investor and payment token definitions.
What a CBUAE banking licence covers
A CBUAE banking licence allows a company to operate as a bank in the UAE. The Central Bank's Payment Token Services Regulation defines a bank as a juridical person licensed under the Central Bank Law to take "deposits of all types", including Shari'ah-compliant deposits.
Deposits, payments and lending
Deposit-taking is what makes a firm a bank in that definition. Payments and lending are also offered by firms that are not banks, and the Central Bank's register keeps them apart: the August 2026 edition has separate sections for banks, finance companies, exchange companies, representative offices and payment token services, among others.
So a payments or finance company licence is not a banking licence, and only the Banks section answers the question "is this firm a bank?". Zand Bank's published range, for instance, includes demand deposit accounts, term deposits in AED, USD and EUR, and payments in 15 currencies. The companion guide sets out the steps to open a corporate bank account in the UAE.
The CB Register: how to check a bank
The Central Bank publishes its list of licensed institutions as a PDF called the CB Register, dated by month. The August 2026 edition runs to 28 pages, and its Banks section has 63 rows.
Each row gives the institution name, licence type, licence category, head office and an identification number. Every licence type in that edition is either National Bank or Foreign Bank, with categories such as Conventional Retail, Islamic Retail and Conventional Wholesale; there is no separate "digital bank" type. Zand Bank P.J.S.C, which describes itself as an all-digital bank, is listed at row 59 as a National Bank, Conventional Retail, head office Dubai, identification number 01.01.01.064.2022.02. The register calls this an identification number, not a licence number. A new file appears each month, so open the latest edition.
Complaints and the Sanadak route
A bank's customer complains to the bank first and, if that fails, to Sanadak, the ombudsman unit that the Central Bank established in 2023. Sanadak takes complaints about financial institutions and insurers that hold a Central Bank licence.
Its eligibility screen asks, among other things, whether the complainant is a natural person, a sole proprietor or a small to medium sized enterprise, and whether 15 calendar days have passed since an official complaint to the firm without a satisfactory written response. A complaint is free for consumers and SMEs, and an appeal costs AED 500. Zand Bank's procedure lets a client escalate within six months of the bank's final response; the steps are on the page about complaints and escalation to Sanadak.
What a VARA licence covers
A VARA licence allows a firm to carry out the virtual asset activities named on it, in or from the Emirate of Dubai. VARA was established by Dubai Law No. (4) of 2022, which applies in all zones of the Emirate, free zones included, except the DIFC (Article 3). Under Article 15, no person may conduct a regulated virtual asset activity there without a permit from VARA. The law says "permit" where VARA's rulebooks and register say "licence"; this guide uses "licence" for both.
Licensed activities and investor classes
A VARA licence is granted for specific activities and can limit the classes of investor a firm may serve. Article 16 of the law lists seven groups of activity that need a permit, from operating a platform to safekeeping. VARA's public register can be filtered by today's activity names, among them Exchange Services, Broker-Dealer Services, Custody Services, Lending and Borrowing Services and Advisory Services.
The Market Conduct Rulebook (Part IV) sets three investor classes. An Institutional Investor includes any entity that a competent financial services regulator regulates, and any VASP. A Qualified Investor is an individual with relevant knowledge and either net assets of at least AED 3,500,000 or annual income of at least AED 700,000, or a legal entity with the same net assets whose directors have relevant knowledge. Everyone else is a Retail Investor, and a firm may serve only the classes its licence permits.
Worked example with illustrative figures
Only 50% of the market value of virtual assets counts towards the AED 3,500,000 net asset test. Take an invented trading company with AED 2,000,000 in cash, AED 4,000,000 in virtual assets and no liabilities. Its net assets for the test are AED 2,000,000 + (50% × AED 4,000,000) = AED 4,000,000, so it passes that limb. If the virtual assets fell to AED 2,400,000, the figure would be AED 3,200,000 and it would not. The figures are invented to show the arithmetic; the rulebook also asks for proof of funds and for directors with relevant knowledge.
The public register and the licence number format
Every firm with a VARA licence has its own page on the public register at vara.ae, showing the licence reference. The register keeps two groups on separate tabs: licensed VASPs and firms with an In-Principle Approval (IPA). VARA states there that an IPA holder may not start operations or serve clients until it has the full licence.
The reference has the form VL/year/month/sequence. The entry for Zand Bank P.J.S.C. prints the year with four digits, as VARA licence no. VL/2024/12/001, while entries issued in 2026 print it with two, so copy a reference exactly as the register shows it.
Marketing rules and the mandatory disclaimer
VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024 apply to all marketing of virtual assets in or targeting the UAE, whether or not the marketer holds a VARA licence. Marketing is defined widely: any advertisement, invitation, inducement, solicitation, offer or promotion.
Two rules matter most to a reader. First, a virtual asset activity may be marketed only by the firm that holds the VARA licence for it, or on that firm's behalf with its approval (I.B.3). Second, marketing of a virtual asset must carry a risk statement: a prominent disclaimer that "Virtual Assets may lose their value in full or in part, and are subject to extreme volatility" (I.C.3(b)), and a clear statement that the owner or investor "can lose all the money or other value they invest, and does not benefit from any form of financial protection" (I.C.3(c)). Records of marketing must be kept for at least eight years (I.C.4). That is why the same two sentences appear in the footer of this site.
Who regulates stablecoins: the Payment Token Services Regulation
The Central Bank of the UAE, not VARA, sets the rules for dirham stablecoins. The rule set is the Payment Token Services Regulation, Circular 2/2024, shown in the Central Bank's rulebook as in force from 31 August 2024.
It covers issuing payment tokens, converting them, and custody and transfer. Four of its rules explain most of what a reader sees in the market:
- A bank may not act as a payment token issuer itself, but it may set up a subsidiary or affiliate to do so (Article 2(8)).
- An issuer may not pay holders interest, or any other benefit tied to how long they hold the token (Article 12(3)).
- Each licence gets a unique reference number, which the Central Bank lists in a public register and the licensee must display on its website and promotional material (Article 7).
- An external auditor must check the reserve every month (Article 22).
Only a firm with the relevant licence or registration, or an agent it appoints, may promote payment token services in the UAE (Article 2(9)). The August 2026 CB Register lists three companies under Dirham Payment Token Issuance. For the mechanics, see how AED stablecoin reserves and redemption work.
Where the DIFC, ADGM and federal regulators fit
The DIFC and the Abu Dhabi Global Market (ADGM) are financial free zones with their own financial regulators, so the two licences above do not settle what a firm may do there. Dubai's law excludes the DIFC from VARA's remit in Article 3.
The Central Bank's payment token regulation draws the same line from the federal side: its references to the UAE exclude the jurisdiction of the financial free zones (Article 2(13)), and a licence applicant must be incorporated in the UAE outside them (Article 6(2)). VARA's Market Conduct Rulebook names the Dubai Financial Services Authority and the Financial Services Regulatory Authority of the ADGM, next to the CBUAE, as competent financial services regulators.
At federal level, the texts cited here refer to the Securities and Commodities Authority (SCA) and to Cabinet Resolution No. (111) of 2022 on virtual assets and their service providers, under which an emirate's own authority can act as the local licensing authority. VARA register entries carry a "CMA Registration Number" that the register does not explain. This guide does not describe free-zone or federal securities rules, and it is not legal advice.
Is crypto legal in the UAE?
Yes. Virtual asset activities are legal in the UAE when the firm carrying them out holds the licence that the relevant authority requires; carrying them out, or promoting them, without that licence is not permitted.
In Dubai, Law No. (4) of 2022 says that no person may conduct a regulated virtual asset activity without a VARA permit (Article 15), and VARA can fine a violator, suspend a permit for up to six months or revoke it (Article 20). VARA's marketing regulations allow a virtual asset activity to be marketed in or to the UAE only by the licence holder or with its approval, and they prohibit marketing of anonymity-enhanced cryptocurrencies. For payments, the Central Bank's regulation lets a merchant in the UAE accept a virtual asset only if it is a dirham payment token from a licensed issuer or, for buying virtual assets, a foreign payment token from a registered issuer (Article 2(7)). Legal does not mean protected: an investor can still lose everything.
How to verify a licence in five minutes
To verify a licence, read the regulator's register yourself and compare it with what the firm says. The four steps below use the entries of the publisher of this guide, Zand Bank, licensed by the Central Bank of the UAE and holder of VARA licence no. VL/2024/12/001, as they stood on 12 October 2026.
Step 1: find the firm on the VARA public register
Open the VARA public register and search for the legal name, not the brand. The list shows the VASP name, licence type, reference, activities, issue date, status and CMA registration number. Check which tab the firm is on, "Licensed VASPs" or "In-Principle Approval". The entry used here is filed under "Zand Bank P.J.S.C.", with full stops.
Step 2: read the activities, conditions and status
Open the firm's own entry and read every field; do not stop at the name. The table lists the fields of the register entry for Zand Bank P.J.S.C. with the values copied exactly, and what each one tells you.
| Field on the register | What the entry shows | What to check |
|---|---|---|
| VASP name | Zand Bank P.J.S.C. | It is the legal entity named in your agreement, not only a brand |
| Reference | VL/2024/12/001 | The firm's website prints the same string |
| Licence type | VASP Licence | A full licence, not an In-Principle Approval |
| Licensed activities | Custody Services | The service you are buying is listed; nothing else is covered |
| Licence issued | 2024/12/09 | Year, month, day: |
| Licence condition | Permitted to serve Institutional Investors and Qualified Investors. | Your own investor class fits the condition |
| Status | Active | Any other status is a reason to stop and ask |
| CMA registration number | CMA-VASP-0010000-0023 | A second identifier; copy it exactly |
| Website URL | https://www.zand.ae/en | The domain you are dealing with is the one on the register |
Step 3: check the bank on the CB Register
For a bank, open the latest CB Register PDF and search the Banks section for the legal name: the August 2026 edition lists Zand Bank P.J.S.C at row 59. For a stablecoin issuer, go to the Payment Token Services section near the end of the file instead, because a banking entry does not cover a token issued by a subsidiary.
Step 4: match the legal name and number on the firm's website
Now compare. The legal name, reference, activity and investor class on the firm's website should match the register character for character. Zand Bank prints its reference as VL/2024/12/001, and this site gathers the register fields on one page, Zand Bank licences with register links; the entities are described under Zand Bank legal entities and leadership. If a site claims an activity the register does not list, or the status is not Active, ask the firm in writing before sending money or assets.
Example: one bank, two licences
Zand Bank PJSC is one firm that holds both kinds of permission: a banking licence from the Central Bank of the UAE and VARA licence no. VL/2024/12/001 for Custody Services. This section describes what the group holds. It is not a rule about what any other bank must hold.
- Banking. The bank states that "Zand Bank PJSC is licensed by the Central Bank of the UAE", and a release dated announced the licence. Step 3 above shows its CB Register row.
- Custody. VARA issued the VASP Licence for Custody Services on , with the condition "Permitted to serve Institutional Investors and Qualified Investors." The bank's product page describes the split as "Digital Asset Custody by VARA" and "Banking services by CBUAE", and also describes custody as provided "under its banking license". Those are the bank's words, quoted so that a reader can see why this guide states no general rule.
- Stablecoin. Zand AED is issued by Zand Trust, a wholly owned subsidiary, and not by the bank. A release dated announced the Central Bank's approval of the launch. A statement on zandtrust.com describes the issuer as holding a licence under the Payment Token Services Regulation, and the August 2026 CB Register lists Zand Trust L.L.C S.O.C under Dirham Payment Token Issuance with identification number 09.01.01.002.2025.02.
Product detail is on the page for Zand AED, a dirham payment token.
Custody under the VARA licence
The custody service is open to Institutional Investors and Qualified Investors only. The product page sets out the licence, how keys are stored and the fee basis.
What a licence does not tell you
A licence tells you that a named firm may carry out named activities under a regulator's rules. It does not tell you that an asset will hold its value, that losses are covered, or that every service the firm sells is within the licence.
- Scope. A custody licence is not an exchange licence. VARA's Custody Services Rulebook goes further: a custody provider must be a separate legal entity from any group company that provides other virtual asset activities (Rule III.B.5).
- How assets are held, not what they are worth. Under the same rulebook, client virtual assets are not assets of the custodian, may not be rehypothecated even with the client's consent, and must sit in wallets that hold that client's assets only (Rules III.B.1 to III.B.3). None of this limits price risk.
- Protection. VARA's required wording says the owner or investor "does not benefit from any form of financial protection". A licence is not a compensation scheme.
- Endorsement. The Central Bank's acceptance of a payment token white paper "shall not constitute an endorsement" of the token or its issuer (Article 26(5)).
- Time. Status, conditions and dates change. An In-Principle Approval is not a licence, and a register read last year proves nothing today.
Security controls are a separate question from licensing. Zand Bank's are listed with its independent attestations and key custody.
Frequently asked questions
What is a VARA licence?
A VARA licence is the permission that the Dubai Virtual Assets Regulatory Authority gives a firm to carry out named virtual asset activities, such as Custody Services or Exchange Services, in or from Dubai. Dubai Law No. (4) of 2022 requires it. It does not cover the DIFC, and it can carry conditions, for example a limit to Institutional Investors and Qualified Investors.
Is VARA part of the Central Bank of the UAE?
No. VARA is a public corporation of the Emirate of Dubai, established by Dubai Law No. (4) of 2022 and affiliated to the Dubai World Trade Centre Authority. The Central Bank of the UAE is the federal regulator that licenses banks. The same law tells VARA to coordinate with the Central Bank on the protection and stability of the UAE financial system.
Can a bank hold a VARA licence as well as a banking licence?
Yes, and the registers show one example. Zand Bank PJSC appears in the Banks section of the Central Bank's CB Register and holds VARA licence no. VL/2024/12/001 for Custody Services, issued on 9 December 2024. This describes what one bank holds. It is not a statement of which licences any other bank needs.
How do I check a VARA licence number?
Search for the firm's legal name on the public register at vara.ae and open its entry. The entry shows the reference, the activities covered, the issue date, any licence condition and the status. Compare the reference with the one on the firm's website character by character; Zand Bank's is written VL/2024/12/001. An In-Principle Approval is not a licence.
Who regulates AED stablecoins?
The Central Bank of the UAE does. Its Payment Token Services Regulation, Circular 2/2024, shown as in force from 31 August 2024, requires a licence to issue a dirham payment token. A bank may not issue one itself but may set up a subsidiary to do so, and the issuer may not pay holders interest linked to how long they hold the token.
Sources
Regulators' texts and registers opened for this guide, each read on 12 October 2026. Statements about Zand Bank's own products, releases and complaints procedure come from the bank's published pages.
- Dubai Virtual Assets Regulatory Authority, "Public Register: Zand Bank P.J.S.C.", vara.ae/en/licenses-and-register/public-register/zand-bank-pjsc/, accessed 12 October 2026.
- Government of Dubai, "Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai", English translation hosted by VARA, rulebooks.vara.ae/sites/default/files/en_net_file_store/VARA_EN_338_VER1.pdf, accessed 12 October 2026.
- Dubai Virtual Assets Regulatory Authority, "Regulations on the Marketing of Virtual Assets and Related Activities 2024", rulebooks.vara.ae/entiresection/419, accessed 12 October 2026.
- Dubai Virtual Assets Regulatory Authority, "Custody Services Rulebook", rulebooks.vara.ae/entiresection/257, accessed 12 October 2026.
- Dubai Virtual Assets Regulatory Authority, "Market Conduct Rulebook", Part IV, rulebooks.vara.ae/entiresection/190, accessed 12 October 2026.
- Central Bank of the UAE, "Payment Token Services Regulation", C 2/2024, rulebook.centralbank.ae/en/rulebook/payment-token-services-regulation, accessed 12 October 2026.
- Central Bank of the UAE, "CB Register as of August 2026", PDF, centralbank.ae/media/hw0lreyi/cb-register-august-2026.pdf, accessed 12 October 2026.
- Sanadak, "Submit a Complaint", sanadak.gov.ae/en/make-a-complaint/, accessed 12 October 2026.
For information only. This article is not investment, legal or tax advice, and it is not a recommendation to buy, hold or sell any virtual asset. Rules and register entries change: check the regulator's current text and register before relying on anything here.
Check the licence, then look at the service
The custody page shows the VARA licence fields, the investor classes served and how keys are held.