TL;DR: VARA's rulebooks expect a Compliance Officer (CO), a Money Laundering Reporting Officer (MLRO) and a head of the risk function (often titled Chief Risk Officer), alongside two senior Responsible Individuals. VARA approves these people as fit and proper before it licenses you. The hard part is finding UAE-based professionals who understand both blockchain and regulation. Start early, so the appointments are not the bottleneck.
What VARA licence requirements mean for your Dubai crypto business
VARA's Compliance and Risk Management Rulebook and Company Rulebook set the people requirements for every Virtual Asset Service Provider (VASP). VARA published Version 2.0 of its rulebooks in May 2025, and licensed firms had to comply by 19 June 2025. The roles that matter for appointments are:
- Compliance Officer (CO): must have at least five years of relevant experience in a compliance function, be approved by VARA as a fit and proper person, be a UAE resident or UAE passport holder, be a full-time employee of the VASP and report directly to the Board. They own the compliance management system, policies and staff training.
- Money Laundering Reporting Officer (MLRO): must be a fit and proper person with at least two years of experience handling AML/CFT matters, reports to the Board on the effectiveness of AML/CFT controls at least quarterly, and files suspicious transaction reports with the UAE Financial Intelligence Unit through the goAML platform.
- Head of the risk function (often called the Chief Risk Officer): needs appropriate qualifications and authority to oversee the VASP's overall risk exposures, and reports directly to the Board unless they are also the CO.
- Two Responsible Individuals: two senior people who are responsible for the VASP's compliance with its legal and regulatory obligations, each a full-time employee, fit and proper, a UAE resident or UAE passport holder, and approved by VARA during licensing.
These are not advisory positions. VARA expects real, accountable people who understand both blockchain mechanics and the UAE framework. Each appointment is reviewed annually to confirm the person remains fit and proper. (VARA is part of Dubai's increasingly complex regulatory landscape for SMEs.)
The rulebook is more flexible than the shorthand "three mandatory roles" suggests. The CO may also be the head of the risk function. The MLRO may hold more than one non-client-facing role, provided the roles do not create conflicting duties. What VARA will not accept is a function with no accountable owner.
The rulebook text above is VARA's starting position. In practice, VARA decides case by case: it is open to the CO also heading the risk function, and each of the CO, MLRO and risk roles can be outsourced in consultation with VARA, depending on your business plan, permissions and activities. It will listen to a solid proposal with the right roles embedded, so agree the structure with VARA early.
The compliance appointment challenge: why companies get stuck
Finding compliance professionals is rarely the problem. Dubai has plenty. Finding ones who understand crypto is harder. It is a different skill.
You have submitted your Initial Disclosure Questionnaire through Dubai Economy and Tourism or a free zone, as VARA's FAQ describes. You have rented an office. Fees are moving. Then the question arrives: who are your Responsible Individuals, your Compliance Officer and your MLRO?
Traditional compliance officers know AML frameworks and KYC procedures. Crypto adds wallet addresses, blockchain monitoring, token flows, smart contract risk and the FATF Travel Rule. Your MLRO has to recognise suspicious on-chain activity, not just complete forms.
Here is the hiring problem in practice:
- Few candidates fit both halves of the brief. Experienced crypto compliance professionals are concentrated at established exchanges, and VARA's own minimums (five years in a compliance function for the CO, two years of AML/CFT for the MLRO) narrow the field further.
- Compensation is hard to benchmark. Salary data for crypto-specialist compliance roles sits mostly in recruiters' gated guides, so treat any single headline range with caution and compare live offers.
- Residency and employment rules limit your options. The rulebook's default is a UAE-resident, full-time CO and Responsible Individuals. That means visas, relocation and notice periods before anyone can start. The HR challenges facing Dubai companies are sharpest in specialised fields like crypto compliance.
- The experience paradox. Dubai's virtual asset regime is young, so candidates with several years of in-jurisdiction experience are scarce.
Timeline problem: why hiring takes longer than planned
VARA does not give every applicant a fixed 12 months, though that is a common assumption. The 12-month, non-renewable window in VARA's FAQ is the Legacy Operating Permit for firms that were already operating. New applicants follow VARA's current application process. The real clock is how quickly your appointments, policies and documents are ready.
That still leaves a sequencing problem:
- You need approved appointments to complete a licence application.
- Strong candidates are reluctant to leave a secure job for a company that does not yet hold a licence.
- Notice periods, visas and VARA's own review all add time that is easy to underestimate.
This is the licensing catch-22: you need compliance officers to get your licence, but you cannot comfortably hire permanent ones until you are confident of the licence. Starting recruitment only after the application is under review makes it worse.
What successful companies do differently
Instead of waiting to hire permanent staff, successful companies bring in interim compliance professionals who can:
- Cover the function while permanent hires are recruited and approved
- Build the compliance management system and policies the application requires
- Prepare the team for VARA's review conversations
- Hand over cleanly to permanent hires
- Stay available through the transition
Our collective of executives includes professionals who work on regulatory set-up in this way. Typical interim support runs for several months. It covers the gap between the start of the licensing work and the permanent hire's approval. (Learn more about how fractional leadership works for UAE businesses.)
One constraint to respect: the rulebook's default is that the CO and Responsible Individuals are full-time employees approved by VARA. VARA may agree a different structure, including outsourcing a role, when your business plan supports it. Interim professionals add the most value by building the framework around the people VARA approves, and, where VARA accepts it, by serving in a fixed-term or outsourced capacity. Agree the structure with VARA before you rely on it.
Cost: permanent vs interim
Our engagements typically run 30 to 60% less than a full-time hire. You add no employment visa, no end-of-service liability and no insurance burden on the interim side, because the arrangement is business to business with one month's notice. Permanent hires carry a salary, benefits, visa costs and end-of-service liability. You carry them whether or not the licence arrives on schedule. Interim cover is paid for the months you need it.
What you get with interim cover:
- Experienced professionals available within weeks
- No visa delays or relocation costs on the interim side
- No long-term commitment
- Flexibility to scale up or down as VARA's requirements become clear
- Built-in knowledge transfer to permanent hires
For pre-profit startups funded by venture capital or founder savings, that flexibility often matters as much as the saving. You secure experienced compliance and risk cover without carrying every permanent salary before the licence generates revenue. When income stabilises, you move to permanent staff from a position of strength, not desperation hiring. For the full appointment checklist, see our VARA licence compliance checklist.
The quality question
Strong interim professionals in this field typically bring regulatory experience, familiarity with VARA's rulebooks and practical knowledge of what a credible compliance management system looks like. Compare a first-time permanent hire. They may be learning the rulebooks, building regulator relationships from scratch and ramping up on crypto-specific controls all at once.
Interim cover does not replace the permanent team. The executive holds accountability for their domain, and the firm still has to appoint its approved role-holders. Interim cover makes sure those people inherit a working function, not a blank page.
How Dubai companies bridge the gap
Strategy 1: early interim support
Engage interim compliance professionals as soon as you decide to pursue a VARA licence. Build frameworks while recruiting permanent staff in parallel, so the permanent officers join an operational function rather than building from scratch.
Strategy 2: hybrid model (recommended)
Hire one permanent senior compliance professional early, as the approved CO and a Responsible Individual. Fill specialist gaps, such as the MLRO or risk function, with interim support while you recruit. Transition gradually as the team forms. This shows VARA commitment and keeps flexibility.
Strategy 3: outsourced functions
Use outsourced specialist support, for example for MLRO tasks such as transaction monitoring and goAML filings, while building internal capability for the CO and risk seats. Check each arrangement against VARA's outsourcing requirements in the Company Rulebook. This works best for smaller VASPs.
What does not work
- Waiting until the application is under review to recruit: approvals and notice periods will outrun your plan.
- Hiring on cost over quality: VARA assesses each appointment as fit and proper and can decline weak ones.
- Assuming you can DIY compliance: frameworks patched together without proper expertise tend to show under review.
- Ignoring the employment and residency rules: any structure that departs from the rulebook's default needs VARA's agreement before you rely on it.
Your options compared
Immediate permanent hires:
- Pros: long-term commitment, team stability
- Cons: longest lead time, highest fixed cost, greatest hiring risk
- Best for: well-funded companies with plenty of runway
Interim-to-permanent transition:
- Pros: fastest start, lower cost, reduced risk, specialised expertise
- Cons: requires managing the handover, and any departure from the rulebook's employee default needs VARA's agreement
- Best for: most crypto startups and SMEs
Hybrid approach:
- Pros: combines the benefits, demonstrates commitment, maintains flexibility
- Cons: more complex at the outset
- Best for: companies building a lasting compliance function
The strategic path forward
Companies struggle with VARA appointments because they underestimate how long approved appointments take and how specialised the experience must be, not because they take regulation lightly.
Success looks like this:
- Start early: begin planning appointments when you decide to pursue VARA, not after you have submitted.
- Map people to rulebook roles: decide who is the CO, MLRO, head of risk and the two Responsible Individuals, and check each against the experience, residency and employment requirements.
- Use interim cover deliberately: treat it as risk management, not a compromise.
- Invest in quality: VARA scrutinises appointments, and weak ones cost more time than they save.
- Plan the handover: your permanent team should inherit operational frameworks, not start from scratch.
Why enforcement raises the stakes
VARA's attention has moved from licensing to supervision. The people in these roles are directly in view:
- In August 2025, VARA published enforcement action against Morpheus Software Technology (Fuze) citing failures in its AML programme, governance, compliance and internal controls, unlicensed activity in breach of its licence and non-disclosure of material facts. A Skilled Person was to be appointed to oversee remediation. VARA did not state the penalty amount in the notice.
- On 7 October 2025, VARA penalised 19 unlicensed firms with fines between AED 100,000 and AED 600,000.
- On 22 June 2026, VARA issued a notice of fines to CoinMENA, a licensed firm, for compliance failures in its AML programme caused by weaknesses in internal systems and controls.
- Rulebook 2.0 also flagged that MLROs and senior management may face enforcement action for non-compliance.
The wider law moved too. Federal Decree-Law No. 10 of 2025 on anti-money laundering, counter-terrorist financing and proliferation financing repealed Federal Decree-Law No. 20 of 2018, took effect on 14 October 2025 and expressly brings virtual asset service providers within scope. Legal commentators note it also places greater personal responsibility on managers. The UAE's next FATF mutual evaluation was scheduled for June 2026, following its removal from the FATF grey list in February 2024. Get the appointments right during licensing. It matters well beyond licence day.
Support with VARA compliance
If you are preparing for VARA licensing, our collective of executives includes professionals experienced in regulatory set-up for Dubai crypto businesses. Explore our fractional risk and compliance officers service or take the regulatory compliance readiness assessment.
Related guides: Risk and Compliance hub, MLRO, Compliance Officer, Chief Risk Officer.
Contact us to discuss your VARA licensing timeline and compliance appointment strategy.
