Guide
How to Set Up a Crypto Market-Making Company in the UAE
The short answer
A crypto market-making firm in the UAE is tested by what it actually does with capital and orders, not by its trading-floor title. The Virtual Assets Regulatory Authority (VARA, Dubai) decides whether the firm is dealing as principal or acting as a broker-dealer, and its Broker-Dealer Services Rulebook and Market Conduct Rulebook are the rulebooks that answer that question; the Dubai Financial Services Authority (DFSA, DIFC) runs a separate token and crypto regime for firms based in that centre. The single fact that most often decides the route is whose capital and whose tokens the strategy trades on — the firm's own book, a venue's inventory, or an issuer's.
Whose capital, whose risk: the question that sets the route
Market making covers at least four different businesses wearing the same label:
- Own-account algorithmic liquidity provider — trades its own capital, keeps the profit and loss, answers to its own risk committee.
- Contracted market maker for a venue — an exchange or platform pays fees or rebates to keep order books tight; inventory and reporting duties sit in the mandate contract.
- Token-issuer liquidity mandate — an issuer pays or allocates tokens to support trading in its own token after listing; regulators scrutinise this hardest, because supporting a price can look like manipulation if undisclosed.
- Client-facing liquidity and execution service — deals for clients as well as itself, pulling in broker-dealer obligations a pure own-account desk does not carry.
A firm running more than one of these models at once does not get to average the requirements down. VARA and the DFSA each assess a regulated function on its own terms, so bundling dealing, custody and an issuer mandate into one entity tends to multiply capital and governance requirements rather than share them.
The regulatory perimeter: VARA, the DFSA, and what actually triggers it
VARA's Broker-Dealer Services Rulebook, in force across Dubai outside the DIFC, treats dealing as principal, dealing as agent, advisory services, margin trading and licensed distribution as separate regulated functions, each with its own best-execution, margin and disclosure obligations. A firm trading only its own account, with no client money and no agency dealing, sits differently to one executing for clients or distributing an issuer's tokens.
VARA's Market Conduct Rulebook sits alongside it, covering marketing, client agreements, complaints, investor classification, public disclosure, conflicts transparency, and — specifically — a regulated entity's own-account trading. A market maker's proprietary book is exactly what this rulebook watches, because the line between supporting liquidity and manipulating a market runs through the same desk.
A firm based in the DIFC instead falls under the DFSA's crypto-token regime, run on its own recognition and licensing track. The two regimes do not overlap, and a firm cannot choose the lighter one by picking an address; which regulator applies follows from where the firm is established and what it does, and that has to be settled before an entity is formed.
None of this means every market maker needs full authorisation — it means the activity has to be mapped against the rulebooks' defined functions first. Calling the business a "technology platform" does not move it outside the perimeter if the venue relationship performs a regulated function in substance; the same confusion between an ordinary blockchain company and a licensed virtual-asset service provider is worked through in blockchain company versus VASP licensing.
How the money moves, and what a bank or counterparty checks
Banks and venue counterparties treat virtual-asset trading firms as enhanced-due-diligence clients by default, so the onboarding file has to answer questions a conventional trading company rarely faces:
- Whose capital funds the strategy, and the source of wealth and source of funds narrative behind it.
- Whether the firm is contractually supporting a token's price, and on what terms.
- Which venues and wallets it uses, and how counterparty and wallet risk is assessed before a relationship opens.
- How inventory and treasury are controlled, and who can move assets.
- What market-abuse surveillance and kill-switch procedures exist — a venue or bank will ask to see them, not just hear that they exist.
A file that says one thing about the trading model and another about the money behind it is the fastest way to stall a review. Bank-readiness work for this sector is built around keeping those two stories consistent.
Ownership, substance and the roles the regulator expects filled
A market maker dealing as principal or agent under a licensed function needs resident senior management and compliance cover matched to what it actually does — not a registered address and a nominee director. VARA's and the DFSA's rulebooks expect fit-and-proper assessment of the people running the function, and financial resources that are held and monitored, not merely referenced in a business plan. A structure built mainly to minimise setup cost reads as exactly that to an authorisation team, and to every bank reviewing the file afterwards.
A group can still separate an IP company, an algorithm-owning entity or an offshore parent from the regulated trading entity — but the customer-facing and venue-facing entity is the one that has to carry the substance. Regulated and complex ownership setup work maps which entity carries which obligation before a bank or regulator asks.
What commonly goes wrong
- Treating "we only trade our own account" as automatic proof of being outside regulation — VARA's Market Conduct Rulebook specifically restricts and monitors proprietary trading by regulated entities, so own-account activity is watched, not exempted.
- Taking undisclosed token compensation from an issuer without checking whether it reads as price support under the Market Conduct Rulebook.
- Running trading algorithms without the conduct surveillance or kill-switch procedures a venue or regulator will ask to see.
- Using client or issuer assets without first mapping custody and control — this is where "market maker" quietly becomes "custodian" without anyone deciding it should.
- Comparing routes on incorporation fees alone, when held capital, mandatory hires and ongoing supervision fees are what actually separate one route's total cost from another's.
Licence to operation: what follows authorisation
Where a licensed function applies, the sequence runs from perimeter classification through VARA or DFSA authorisation work, entity formation, application drafting and regulator review, before office, visas and operational build-out start. Authorisation runs on the regulator's timetable, not the applicant's, and incorporation is not the same date as being allowed to trade. Where the model has no licensed function in scope, the business can move faster through ordinary fintech setup and commercial registration — but that conclusion has to come from the perimeter analysis, not from choosing the cheaper-sounding route first.
