Dubai's crypto regulator has issued about twenty licences in four years

Dubai's Virtual Assets Regulatory Authority was established in 2022 as the world's first regulator dedicated solely to virtual assets, with jurisdiction across Dubai's mainland and free zones. More than twenty entities now hold VARA licences across seven categories of regulated activity , and its updated Exchange Services Rulebook took effect on 31 March 2026 . Applications typically take three to six months, depending on business model complexity. Twenty licences in four years reads as a small number until it is read as policy, at which point it looks deliberate. The alternative approaches were tried elsewhere. Registration regimes that licensed hundreds of firms quickly ended up supervising businesses they could not meaningfully examine. Jurisdictions that licensed nobody saw the activity happen anyway, offshore and unsupervised. A regulator authorising roughly twenty firms can inspect them properly. It can read their custody arrangements, test their AML controls, and know who the beneficial owners are. That is a supervisory capacity argument, and it is the reason the number is what it is. The seven activity categories are the more interesting design choice. VARA's scope covers centralised and decentralised exchanges, custody, brokerage and dealing, advisory, and token issuance and promotion — activity-based rather than entity-based licensing. That matters because crypto businesses do not map onto traditional financial firm categories. An exchange that also custodies assets, runs a lending book and issues its own token is doing four regulated things, and the failures of the 2022 cycle were overwhelmingly failures at the seams between those functions. Licensing by activity requires a firm to declare which of them it does and be supervised for each. The UAE runs three such regimes at once. A firm choosing where to operate picks between VARA in Dubai, the DFSA in the Dubai International Financial Centre, and ADGM in Abu Dhabi — with the federal Securities and Commodities Authority and the UAE Central Bank coordinating above them. Regulatory competition of this kind has two effects. It gives firms a choice of regime and gives regulators an incentive to be responsive. It also produces jurisdictional complexity that a small firm has to navigate with advice, and makes cross-jurisdictional supervision a coordination task. The federal coordination layer that developed by 2026 is what addresses the second, and it is the piece that lets three specialised regimes operate as one national framework.