Digital Asset Licensing in the GCC: VARA, CBB and SCA
The Gulf Cooperation Council (GCC) has rapidly emerged as a global hub for digital asset innovation, with the United Arab Emirates, Bahrain, Saudi Arabia, Qatar, Oman, and Kuwait each developing distinct licensing frameworks. Unlike the fragmented approach seen in many other regions, GCC regulators have moved decisively to codify digital asset licensing requirements, offering clarity for virtual asset service providers (VASPs), custodians, exchanges, and token issuers. This article provides a direct, country-by-country breakdown of the regulatory landscape, covering VARA in Dubai, the Central Bank of Bahrain’s (CBB) Crypto Asset Module, and the Securities and Commodities Authority (SCA) in the UAE, alongside developments in Saudi Arabia, Qatar, and Kuwait.
Digital asset licensing in the GCC is not optional. Operating without the appropriate licence can result in criminal penalties, significant fines, and reputational damage. Each regulator has tailored its rules to address specific risk profiles, from anti-money laundering (AML) obligations to custody and market conduct. Understanding which licence applies to your business model is the first critical step toward compliant operations.
Licensing Frameworks by Country
Each GCC member state has taken a distinct approach to digital asset regulation. The table below summarises the primary regulators and their core licensing instruments.
| Country | Primary Regulator | Licensing Regime | Status |
|---|---|---|---|
| UAE (Dubai) | VARA (Virtual Assets Regulatory Authority) | VASP Licence (multiple categories) | Active |
| UAE (Federal) | SCA (Securities and Commodities Authority) | Token Regulation & VASP Licensing | Active |
| Bahrain | CBB (Central Bank of Bahrain) | Crypto Asset Module (CRA) | Active |
| Saudi Arabia | SAMA / CMA | Sandbox / Experimental licences | Limited |
| Qatar | Qatar Financial Centre Regulatory Authority (QFCRA) | Digital Asset Framework | Emerging |
| Kuwait | Capital Markets Authority (CMA) | Virtual Asset Framework (draft) | Draft stage |
The UAE and Bahrain are the most advanced, with fully operational licensing regimes. Saudi Arabia permits limited activity under the Saudi Central Bank (SAMA) and Capital Market Authority (CMA) sandboxes, while Qatar and Kuwait are still formalising their frameworks.
VARA Licensing Categories (Dubai)
The Virtual Assets Regulatory Authority (VARA), established under Dubai Law No. 4 of 2022, is the world’s first specialised regulator for virtual assets. VARA licences are mandatory for any person or entity conducting virtual asset activities in or from the Emirate of Dubai (including free zones but excluding the Dubai International Financial Centre).
VARA defines several licensing categories, each with distinct requirements and permitted activities.
| Licence Category | Permitted Activities | Capital Requirement (AED) |
|---|---|---|
| Consulting | Advisory services on virtual assets | 100,000 |
| Broker-Dealer | Order execution, dealing as agent | 3,000,000 |
| Exchange | Operating a virtual asset trading platform | 10,000,000 |
| Custody | Safekeeping and administration of virtual assets | 3,000,000 |
| Lending & Borrowing | Facilitating virtual asset lending | 10,000,000 |
| Payment Services | Virtual asset payment and remittance | 3,000,000 |
| Token Issuance | Initial coin offerings and token generation events | 10,000,000 |
Applicants must also implement robust AML/CFT controls, appoint a compliance officer, maintain segregated client accounts, and submit to VARA’s rulebook requirements.
VARA Rulebook Requirements
- Conduct of Business Rules – Fair treatment of clients, disclosure, conflicts of interest, and market abuse prevention.
- Technology & Cybersecurity – Secure systems, incident response, penetration testing, and business continuity planning.
- Custody Rules – Segregation of client assets, cold storage requirements, insurance cover, and audit trails.
- Anti-Money Laundering – Customer due diligence (CDD), enhanced due diligence (EDD), transaction monitoring, and suspicious activity reporting.
- Reporting – Periodic returns, transaction data, financial statements, and audit reports submitted to VARA.
CBB Crypto Asset Module (Bahrain)
The Central Bank of Bahrain was one of the earliest GCC regulators to introduce a comprehensive framework. The Crypto Asset Module (CRA) forms part of the CBB Rulebook Volume 6 (Capital Markets) and applies to all crypto asset services provided in or from Bahrain. The CBB licences cover five core activities.
| Licence Type | Description | Minimum Capital (BHD) |
|---|---|---|
| Category 1 | Operating a crypto asset exchange | 500,000 |
| Category 2 | Broker-dealing in crypto assets | 300,000 |
| Category 3 | Crypto asset custody services | 200,000 |
| Category 4 | Crypto asset advisory services | 50,000 |
| Category 5 | Token issuance platform operation | 500,000 |
Bahrain’s regime is notable for its proportionality. Smaller firms offering advisory or custody services require lower capital, while exchange and token issuance platforms face higher thresholds. The CBB also mandates a local presence, requiring licensed firms to maintain a registered office and key personnel within the kingdom.
Key Compliance Obligations Under CRA
- Capital Adequacy – Ongoing capital requirements calculated as the higher of the minimum capital or 25% of annual operating expenditure.
- Custody Rules – Strict segregation between proprietary and client assets; at least 95% of client crypto assets held in cold storage.
- Market Conduct – Prohibition on market manipulation, insider trading, and misleading statements. Firms must implement surveillance systems.
- Reporting – Monthly transaction reports, quarterly financial statements, and annual independent audits submitted to the CBB.
- Client Money Rules – Fiat client funds must be held in a segregated trust account with a licensed bank in Bahrain.
SCA Token Regulation (UAE Federal)
The UAE Securities and Commodities Authority (SCA) regulates digital assets at the federal level under Cabinet Decision No. 111 of 2022 and the SCA Chairman of the Board of Directors Decision No. (23/R.M) of 2022. The SCA’s framework covers token classification, issuance, and the licensing of virtual asset service providers operating outside Dubai free zones.
The SCA classifies tokens into three categories: recognised crypto assets (including major cryptocurrencies), utility tokens, and security tokens. Each classification triggers different regulatory requirements.
| Token Type | Regulatory Treatment | Disclosure Requirements |
|---|---|---|
| Recognised Crypto Asset | Light-touch; AML/CFT only | Basic white paper |
| Utility Token | Full SCA approval required | Detailed white paper with risk factors |
| Security Token | Treated as securities; prospectus required | Full prospectus under SCA regulations |
SCA-licensed VASPs must comply with the authority’s rulebook, which includes capital requirements (ranging from AED 2 million for advisory to AED 15 million for exchange operators), governance standards, and ongoing disclosure obligations.
Capital Requirements Across Jurisdictions
Minimum capital is a critical barrier to entry in the GCC digital asset market. The table below provides a direct comparison of capital thresholds across the active regimes.
| Activity | VARA (AED) | SCA (AED) | CBB (BHD) |
|---|---|---|---|
| Advisory / Consulting | 100,000 | 2,000,000 | 50,000 |
| Broker-Dealing | 3,000,000 | 5,000,000 | 300,000 |
| Exchange Platform | 10,000,000 | 15,000,000 | 500,000 |
| Custody | 3,000,000 | 5,000,000 | 200,000 |
| Token Issuance | 10,000,000 | 15,000,000 | 500,000 |
Capital requirements should be assessed alongside operational costs, which include compliance staffing, technology infrastructure, and insurance premiums. Firms licensed in one jurisdiction may benefit from mutual recognition provisions where they exist.
Custody Rules
Custody is one of the most heavily regulated areas in GCC digital asset licensing. All three active regulators require licensed custodians to hold client assets separately from proprietary assets and maintain robust security protocols.
- Cold Storage – Both VARA and CBB require that at least 95% of client crypto assets be held in cold (offline) storage.
- Insurance – VARA mandates that custodians maintain insurance cover commensurate with the value of assets under custody. CBB requires professional indemnity insurance.
- Audit Trails – All movements of client assets must be recorded in tamper-proof systems with full audit trails accessible to the regulator on demand.
- Sub-Custody – Use of sub-custodians is permitted but requires regulatory approval and a written agreement detailing the scope of delegation.
- Wallets – Private key management must follow robust governance procedures, with multi-signature controls and separation of duties.
Market Conduct and Reporting
All GCC regulators impose strict market conduct rules designed to protect investors and maintain market integrity. These include prohibitions on market manipulation, insider trading, and misleading advertisements. Licensed firms must implement transaction monitoring systems and report suspicious activity to the relevant financial intelligence unit.
Reporting obligations are substantial. Typical requirements include:
- Monthly reporting – Transaction volumes, client numbers, and asset under custody values.
- Quarterly reporting – Financial statements, capital adequacy calculations, and compliance updates.
- Annual reporting – Audited financial statements, independent compliance reviews, and cybersecurity audit reports.
- Ad hoc reporting – Breaches of capital requirements, cybersecurity incidents, and material changes to business operations.
Frequently Asked Questions
What is the difference between VARA and SCA licensing?
VARA licences cover virtual asset activities within Dubai (including free zones), while the SCA regulates at the federal level across all UAE emirates outside the Dubai free zone framework. Some firms may require licences from both authorities depending on their geographic scope.
Can a single licence cover multiple GCC countries?
No. Each GCC member state maintains its own regulatory framework, and a licence issued in one jurisdiction does not automatically permit operations elsewhere. Firms must obtain separate licences in each country where they intend to conduct business.
How long does the VARA licensing process take?
The VARA licensing process typically takes four to nine months from initial application to full approval, depending on the complexity of the business model and the completeness of the application package. Pre-approval and in-principle approval stages are available.
Are decentralised finance (DeFi) protocols regulated in the GCC?
Currently, GCC regulators focus on centralised intermediaries such as exchanges, custodians, and brokers. DeFi protocols are subject to regulation where they involve a central operator or are offered to retail investors. Regulatory guidance is evolving, and operators should seek legal advice.
What happens if a firm operates without a licence?
Operating without the required licence can lead to criminal prosecution, fines of up to AED 10 million (under VARA), asset freezing, and personal liability for directors. Regulators in the GCC have demonstrated a willingness to take enforcement action against unlicensed operators.
Do GCC regulators recognise foreign licences?
There is no automatic recognition of foreign licences. However, some regulators, particularly in Abu Dhabi and Bahrain, offer expedited processes for firms that hold equivalent licences from respected international jurisdictions. Firms should engage with local regulators early to explore recognition pathways.
