VARA licence compliance checklist: required appointments and timeline

TL;DR: VARA expects a Compliance Officer (CO), a Money Laundering Reporting Officer (MLRO) and a head of the risk function (often titled Chief Risk Officer), plus two senior Responsible Individuals, each approved as fit and proper. VARA does not publish a general 12-month deadline for new applicants, so the real timeline is set by how fast you can appoint and onboard approved people. This checklist sets out what the rulebooks say, in the order to work through it.

What VARA licence requirements mean for your Dubai crypto business

The two VARA rulebooks that govern your appointments are the Company Rulebook and the Compliance and Risk Management Rulebook. VARA's rulebooks are published at rulebooks.vara.ae. VARA published Version 2.0 of its rulebooks in May 2025, and licensed firms had to comply by 19 June 2025. Those updates tightened AML/CFT expectations. They also made clear that MLROs and senior management can face enforcement action personally.

These are not advisory positions. VARA expects real, accountable people who understand both blockchain mechanics and the UAE regulatory framework. (VARA is part of Dubai's increasingly complex regulatory landscape for SMEs.)

The appointments checklist

Work through these in order. Each item is drawn from VARA's own rulebook text, which sets the starting position. In practice, VARA decides case by case: it is open to the CO also heading the risk function, and each of the CO, MLRO and risk roles can be outsourced in consultation with VARA, depending on your business plan, permissions and activities. It will listen to a solid proposal with the right roles embedded.

1. Name two Responsible Individuals. The Company Rulebook requires two individuals of sufficient seniority who are each a full-time employee of the VASP, a fit and proper person, a UAE resident or UAE passport holder, and approved by VARA during licensing. You must validate that they still meet these requirements every year.
2. Appoint a Compliance Officer. The CO needs at least five years of relevant experience in a compliance function, must be VARA-approved as fit and proper, a UAE resident or passport holder, a full-time employee, and must report directly to the Board. Duties include staff training, compliance policies, a business continuity and disaster recovery plan, and board reporting.
3. Appoint an MLRO. The MLRO needs at least two years of experience handling AML/CFT matters and must be a fit and proper person, reviewed annually, reporting to the Board at least quarterly on the effectiveness of your AML/CFT controls.
4. Appoint a head of the risk function. This person needs appropriate qualifications and authority to oversee the VASP's overall risk exposures, and reports directly to the Board unless they are also the CO.
5. Check the combinations. The CO may also be the head of the risk function, and the MLRO may hold other non-client-facing roles provided they do not create conflicting duties.
6. Set up suspicious transaction reporting. AML/CFT reports go to the UAE FIU on the goAML platform, and your MLRO needs access and a documented process before launch.
7. Plan for change. VARA expects to be notified and to approve a change in Responsible Individuals before it happens, except for reasonably unforeseen circumstances, where you must notify VARA immediately and show how you will keep meeting the rules.
8. Diarise the annual review. Compliance Officer and MLRO fitness and propriety is reviewed every year, so build it into your calendar.

The compliance appointment challenge: why companies get stuck

Finding compliance professionals is rarely the problem. Dubai has plenty. Finding ones who understand crypto is harder, and it is a different skill. Traditional compliance officers know AML frameworks and KYC procedures. Crypto adds wallet addresses, blockchain monitoring, token flows, smart contract risk and the FATF Travel Rule. Your MLRO has to recognise suspicious on-chain activity, not just complete forms.

You have submitted your Initial Disclosure Questionnaire through Dubai Economy and Tourism or a free zone, as VARA's FAQ describes. Then the question arrives: who are your compliance officers?

Here is what the hiring problem looks like:

• Few candidates fit both halves of the brief. Experienced crypto compliance professionals cluster at established exchanges, and VARA's own minimum experience rules narrow the field further.
• Compensation is hard to benchmark. Salary data for crypto-specialist compliance roles sits mostly in recruiters' gated guides, so compare live offers rather than relying on a headline range.
• Residency and employment rules limit your options. The rulebook's default is that the CO and Responsible Individuals are full-time employees who are UAE residents or passport holders. The recruitment and HR challenges facing Dubai companies are sharper in specialised fields like crypto compliance.
• The experience paradox. Dubai's virtual asset regime is young, so candidates with several years of in-jurisdiction experience are scarce.

Timeline: why the clock is shorter than it looks

VARA does not give every applicant 12 months, though that is a common claim. The 12-month, non-renewable window in VARA's FAQ is the Legacy Operating Permit for firms that were already operating. For a new application, follow VARA's current application guidance. Its fees are set out in Schedule 2 of the Virtual Assets and Related Activities Regulations 2023, which its FAQ points to.

A realistic planning sequence looks like this:

Notice periods, visas and VARA's own review all add time that is easy to underestimate. Strong candidates are also reluctant to leave a secure job for a company that does not yet hold a licence.

That is the licensing catch-22: you need appointments to get your licence, but cannot comfortably hire permanent officers until you are confident of the licence.

What successful companies do differently

Instead of waiting to hire permanent staff, successful companies bring in interim compliance professionals who can:

1. Cover the function while permanent hires are recruited and approved
2. Build the compliance management system and policies the application requires
3. Prepare the team for VARA's review conversations
4. Hand over cleanly to permanent hires
5. Stay available through the transition

Our collective of executives includes professionals who work on regulatory set-up in this way. (Learn more about how fractional leadership works for UAE businesses.) This is not cutting corners. It is managing regulatory timelines honestly.

One constraint to respect: the rulebook's default is that the CO and Responsible Individuals are full-time employees approved by VARA. VARA may agree a different structure, including outsourcing a role, when your business plan supports it. Interim professionals add the most value by building the framework around the people VARA approves, and, where VARA accepts it, by serving in a fixed-term or outsourced capacity. Agree the structure with VARA early.

Cost: permanent vs interim

Our engagements typically run 30 to 60% less than a full-time hire. There is no employment visa, no end-of-service liability and no insurance burden on the interim side, because the engagement is business to business with one month's notice. Permanent hires carry a salary, benefits, visa costs and end-of-service liability, whether or not the licence arrives on schedule. Interim cover is paid for the months you need it.

What you get with interim cover:

• Experienced professionals available within weeks
• No visa delays or relocation costs on the interim side
• No long-term commitment
• Flexibility to scale as VARA's requirements become clear
• Built-in knowledge transfer

For pre-profit startups funded by venture capital or founder savings, preserving runway is often as important as the saving. You secure experienced compliance and risk cover without carrying every permanent salary before the licence generates revenue.

When income stabilises, you move to permanent staff from a position of strength, not desperation.

The quality question

Strong interim professionals in this field bring regulatory experience, familiarity with VARA's rulebooks and practical knowledge of what a credible compliance management system looks like. Compare a first-time permanent hire. They may be learning the rulebooks, building regulator relationships from scratch and ramping up on crypto-specific controls all at once.

How Dubai companies bridge the gap

Strategy 1: early interim support

Engage interim compliance professionals as soon as you decide to pursue VARA. Build frameworks while recruiting permanent staff in parallel, so the permanent officers join an operational function rather than building from scratch.

Strategy 2: hybrid model (recommended)

Hire one permanent senior compliance professional early, as the approved CO and a Responsible Individual. Fill the other seats with interim specialists. Transition gradually as you build your team. This shows VARA commitment while keeping flexibility and cost down.

Strategy 3: outsourced functions

Use outsourced specialist support for tasks such as transaction monitoring and goAML filings while you build internal capability for the CO and risk seats. Check each arrangement against the outsourcing requirements in VARA's Company Rulebook. Our fractional risk and compliance officers service covers exactly this transition period.

What does not work

• Waiting until the application is under review to recruit: approvals and notice periods will outrun your plan.
• Hiring on cost over quality: VARA assesses each appointment and can decline weak ones.
• Assuming you can DIY compliance: frameworks patched together without expertise tend to show under review.
• Ignoring the employment and residency rules: any structure that departs from the rulebook's default needs VARA's agreement before you rely on it.

Your options compared

Immediate permanent hires:

• Pros: long-term commitment, team stability
• Cons: longest lead time, highest fixed cost, greatest hiring risk
• Best for: well-funded companies with plenty of runway

Interim-to-permanent transition:

• Pros: fastest start, lower cost, reduced risk, specialised expertise
• Cons: requires managing the handover, and any departure from the rulebook's employee default needs VARA's agreement
• Best for: most crypto startups and SMEs

Hybrid approach:

• Pros: combines the benefits, demonstrates commitment, maintains flexibility
• Cons: more complex at the outset
• Best for: companies building a lasting compliance function

The strategic path forward

Success looks like this:

• Start early: begin planning appointments when you decide to pursue VARA, not after you submit.
• Be realistic: allow for notice periods, visas and VARA's approval of each appointee.
• Consider interim solutions: they are sound risk management, not compromises.
• Invest in quality: VARA scrutinises appointments, and hiring on cost creates bigger problems.
• Plan transitions: your permanent team should inherit operational frameworks, not start from scratch.

Why enforcement raises the stakes

• In August 2025, VARA published enforcement action against Morpheus Software Technology (Fuze) for failures in its AML programme, governance, compliance and internal controls, unlicensed activity in breach of its licence and non-disclosure of material facts. A Skilled Person was to be appointed to oversee remediation, and VARA did not state the penalty amount.
• On 7 October 2025, VARA penalised 19 unlicensed firms with fines of AED 100,000 to AED 600,000.
• On 22 June 2026, VARA issued a notice of fines to licensed firm CoinMENA over AML programme compliance failures in its internal systems and controls.

The wider law changed too. Federal Decree-Law No. 10 of 2025 repealed Federal Decree-Law No. 20 of 2018 and took effect on 14 October 2025. It expressly covers virtual asset service providers. The UAE was removed from the FATF grey list in February 2024, and its next FATF mutual evaluation was scheduled for June 2026, so regulators are watching how AML controls work in practice.

Support with VARA compliance

VARA rewards the firms that appoint early and appoint well. If you are preparing for licensing, our collective of executives includes professionals experienced in regulatory set-up for Dubai crypto businesses. For the appointment detail behind this checklist, see our guide to VARA licence compliance appointments in Dubai, or take our regulatory compliance readiness assessment to benchmark where you stand. You can also explore our fractional risk and compliance officers service.

Related guides: Risk and Compliance hub, MLRO, Compliance Officer, Chief Risk Officer.

Contact us to discuss your VARA licensing timeline and compliance appointment strategy.