How to Choose a Crypto Exchange License Jurisdiction: MiCA vs VARA vs Offshore
Pick the wrong crypto exchange license jurisdiction and you cannot reach users – or you burn months on a bank that never opens. Treat licensing as market access, not a tax race. Map who you serve and what you operate, compare MiCA CASP vs Dubai VARA vs a common offshore VASP path, score capital, timeline, banking, and passporting, then make a go / wait / dual-structure call with a real dossier.
TL;DR / Quick take: EU/EEA core users need a MiCA CASP – the EU transitional period ended on 1 July 2026. MENA/Asia with a Dubai base points to VARA. Offshore VASP (e.g. Seychelles) is only a limited bootstrap for non-EU / non-UAE markets. VARA does not passport into the EU; groups that need both run a dual structure. Build the dossier before application fees.
This is a founder playbook, not legal advice – confirm capital, fees, and timelines with counsel and live rulebooks. Still choosing build vs buy? See white-label vs build and how to start a crypto exchange.
1. Map users, products, and activity set before you pick a regime
A license is permission to run specific activities for specific customers. Regulators care about what you do, not the brand name. Finish this map on one page before any comparison table.
- List target geos – EU/EEA, MENA/Gulf, Asia, other – and retail vs institutional.
- List products – spot matching platform, brokerage, custody, fiat on-ramp, or a mix.
- Translate into activities – under MiCA, a trading platform maps to Class 3; custody plus exchange without a platform often maps to Class 2. Under VARA, list Virtual Asset (VA) activities such as Exchange and Custody separately.
- Write markets you will not solicit – especially “no EU retail” if you stay offshore.
- Name owners – founder + counsel; freeze the map before capital talks.
CASP = crypto-asset service provider under MiCA. VASP = virtual asset service provider outside the EU (VARA and many offshore regimes). Substance = real local presence (people, management, office), not a mailbox.
Do this: finish the user/activity map first. Do not pick a regime because a blog called it “cheaper.”
2. Compare MiCA CASP, Dubai VARA, and common offshore VASP paths
Use one three-way table. Soften consultant ranges as “typically / often” and re-check live schedules.
| Factor | MiCA CASP (EU) | Dubai VARA | Offshore VASP (e.g. Seychelles) |
|---|---|---|---|
| Market access | Passport across 27 EU (+ EEA path via Art. 65) | Dubai (excl. DIFC); no EU passport | No EU/UAE passport |
| Licence model | One CASP auth; capital by Class 1/2/3 | Per VA activity (Exchange, Custody, etc.) | Category under local FSA |
| Capital floor | Platform = Class 3 EUR 150k; custody/exchange often Class 2 EUR 125k; then higher of floor or 1/4 fixed overheads (Art. 67) | Exchange: higher of AED 800k (approved custodian) or 15% FAO; else higher of AED 1.5M or 25% FAO | Often ~USD 25k-100k by category – verify live |
| Official fees | NCA fees vary by Member State | Typically AED 100k application + AED 200k annual supervision – confirm Schedule B | Lower official fees; substance + banking still dominate |
| Timeline | Often ~3-6 months (estimates) | ATI then VASP; often ~4-8 months | Often ~6-8+ months with real substance |
| Banking | Stronger with MiCA mark; still enhanced due diligence | Usually better Gulf rails than classic offshore | Licence ≠ bank account in 2026 |
| Best when | Core users in EU/EEA | MENA/Asia corridor; Dubai base | Non-EU / non-UAE bootstrap only – plan exit or dual license |
ATI (Approval to Incorporate) is VARA’s first stage: incorporate yes, VA activity no until the full VASP licence. Passporting means one MiCA home authorization can support cross-border EU services after home NCA notification (Article 65) – not a free pass to add unauthorized services. DIFC sits outside VARA (DFSA).
Verdict: Choose on where users and banking live. MiCA for EU/EEA core. VARA for Dubai/MENA core. Offshore only when you will not solicit EU or UAE clients and you already have a banking plan.
Do this: mark one primary column that matches your map. Do not use VARA or offshore to serve EU clients after 1 July 2026.
3. Score capital, timeline, banking, and passporting
Fill a founder scorecard for your model – not a generic “best jurisdiction” ranking.
| Score row | MiCA | VARA | Offshore | Your note |
|---|---|---|---|---|
| Capital | Class 2/3 + Art. 67 overheads | AED 800k / 1.5M + FAO % | Lower sticker; banking still costly | Funded? Y/N |
| Timeline | ~3-6 months | ~4-8 months; ATI then VASP | ~6-8+ months | Launch still realistic? |
| Banking | Often better with MiCA mark | Often stronger Gulf rails | Structurally constrained Tier-1 | LOI or warm intro? |
| Passporting | EU/EEA path | Dubai only | No EU/UAE passport | Does the license hit users? |
- Hard gate – EU clients: MiCA CASP is mandatory; non-EU entities generally cannot solicit EU clients.
- Hard gate – Dubai ops: VA activity in or from Dubai (excl. DIFC) needs a VARA VASP licence before go-live.
- Reject “cheap paper licence only” for a real exchange – substance and banking dominate cost.
- Pick path: single MiCA, single VARA, dual structure, or wait.
- Write the decision in one paragraph with owners and a review date.
Workflow:
User/activity map → regime classification → 4-row scorecard → single / dual / wait → dossier owners named.
Do this: score all four rows before fees. Do not optimize for tax while customers sit outside your licence reach.
4. Build the licence dossier and align the product stack
Regulators repeatedly ask for the same core pack. Start it before you wire fees.
- UBO / fit-and-proper packs and governance org chart
- Regulatory business plan and financial projections
- AML/CFT policies and Travel Rule messaging plan
- Custody and client-asset segregation model
- ICT / security controls (EU: plan DORA-ready ICT risk management)
- Proof of capital (Annex IV / Art. 67 for MiCA; VARA Exchange capital table)
- Orderly wind-down plan and local substance evidence
For VARA, expect Company, Compliance, Technology, and Market Conduct Rulebooks plus activity books such as Exchange Services. New firms go ATI → full VASP. Before filing, confirm the software supports KYC/AML, Travel Rule messaging, wallet segregation, audit logs, and multi-entity configs. After the path is written, teams can explore White Label Exchange solutions for a compliance-ready stack.
Do this: assign a dossier owner per section with a freeze date. Do not treat “hire compliance later” as a filing strategy.
5. Go / no-go checklist: apply, wait, or dual-structure
- Go – single MiCA if EU/EEA users are core, Class 2/3 capital and Art. 67 overheads are funded, EU substance is real, and dossier owners are named.
- Go – single VARA if Dubai/MENA (or Asia corridor with Dubai base) is core, you will not solicit EU clients, and Responsible Individuals / office are funded.
- Go – dual structure if both EU and Dubai revenue are material within about 12 months.
- Wait if you lack counsel, capital proof, substance, banking LOIs, or a wind-down plan.
- Reject offshore-as-EU-workaround after 1 July 2026 – serving EU clients without MiCA is a breach.
- Revisit banking LOIs before announcing launch geos.
Do this: record go / wait / dual in a dated memo. Do not announce EU or UAE markets your entity is not authorized to serve.
What to do next
Freeze the map, fill the table and scorecard, pick single / dual / wait, then open the dossier with named owners. More guides on the White Label Exchange blog. When the path is set and you need KYC/AML, Travel Rule, and multi-entity support, talk via whitelabelexchange.io.
Reviewed by: White Label Exchange Editorial (practitioners in white-label exchanges, exchangers, P2P, and compliance-ready launch stacks).
Data integrity: capital floors and passporting cite EUR-Lex MiCA (Annex IV, Art. 67), ESMA on the 1 July 2026 transitional cut-off, official VARA licence pages and Company Rulebook capital table, and Seychelles VASP Act 2024 timing via counsel summaries. Timeline ranges are industry estimates – confirm with counsel. RU Wordstat proxies checked 2026-07-22; English primary volumes were not invented.
Frequently asked questions
Is MiCA better than VARA for a new crypto exchange?
Neither is universally better. If core users are in the EU/EEA, choose MiCA. If core users and banking are MENA/Asia with a Dubai base, choose VARA. Pick on market access, not tax headlines.
Can one license cover the EU and the UAE?
No. VARA does not passport into the EU; MiCA does not authorize Dubai VA activity. Groups that need both markets commonly run a dual structure (EU CASP + VARA VASP).
What documents do founders need before a CASP or VARA application?
UBO/fit-and-proper packs, regulatory business plan, AML/Travel Rule policies, custody and ICT controls, financial projections, proof of capital, wind-down plan, and local substance evidence. Start the dossier before application fees.
How much capital for an exchange under MiCA?
Trading-platform operators plan for Class 3 at EUR 150,000 minimum. Custody/exchange without a platform often sits at Class 2 EUR 125,000. Then take the higher of that floor or one quarter of the preceding year’s fixed overheads (Article 67).
What are VARA Exchange official fees?
Commonly cited: AED 100,000 application plus AED 200,000 annual supervision – before capital, office, staff, and systems. Confirm live Schedule B. Year-1 all-in cost is often a multiple of official fees.
Is offshore still viable in 2026?
Only for non-EU / non-UAE markets with real substance and a banking plan. Seychelles requires a formal VASP licence (Act in force 1 September 2024). Do not use offshore to solicit EU clients after the MiCA cliff.