TRW & Co · Banking, Finance & Capital Markets
Virtual Asset Regulation in the UAE
Virtual asset regulation in the UAE now runs through four perimeters: VARA in Dubai, the Capital Market Authority federally, and the ADGM and DIFC free zones, with the Central Bank covering payment tokens. Since the 2025 Central Bank Law, technology-neutral rules reach DeFi and platforms too. Choosing the right regulator and matching your licence to your product is the decision that matters.
Key pointA VASP licence does not automatically cover stablecoin conversion or stored-value services: since Federal Decree-Law No. (6) of 2025 took effect, those may need Central Bank authorisation, and its one-year alignment period ended in September 2026.
At a glance
Four regulatory perimeters
VARA licenses Dubai outside the DIFC, the Capital Market Authority (formerly the SCA) covers other emirates, and the FSRA and DFSA regulate virtual assets in ADGM and the DIFC.
2025 Central Bank Law
Federal Decree-Law No. (6) of 2025 took effect on 16 September 2025 and states that technology or business model alone does not exempt an activity.
Payment tokens
The CBUAE Payment Token Services Regulation requires licensing for issuance, conversion, custody and transfer of dirham and foreign payment tokens onshore.
VARA Rulebooks 2.0
Updated activity Rulebooks issued on 19 May 2025 tightened margin trading and token distribution controls, with compliance required by 19 June 2025.
DIFC token assessments
Since 12 January 2026 the DFSA no longer publishes a recognised token list; authorised firms must document their own ongoing suitability assessments.
Swipe or scroll →
What virtual asset regulation in the UAE covers
Virtual asset regulation in the UAE is the set of licensing, conduct and anti-money laundering rules that apply to anyone who exchanges, holds, transfers, issues, lends, manages or advises on crypto assets and tokens in or from the Emirates. It reaches exchanges and brokers, custodians, token issuers, stablecoin and payment-token businesses, asset managers with digital-asset strategies, and increasingly the technology platforms that sit behind them.
The question is rarely "is crypto legal here?" It is "which of four regulators has jurisdiction over this particular activity, and does my licence cover what my product actually does?" The UAE runs parallel regimes: a federal regime, a Dubai emirate-level regulator, and two financial free zones with their own common-law-based rulebooks. Getting the perimeter wrong is the most expensive mistake in this sector.
Virtual asset regulation in the UAE has also moved quickly. Dubai created a dedicated regulator in 2022, the federal and Dubai authorities aligned their licensing in 2024 and 2025, the DIFC overhauled its token rules in January 2026, and a new Central Bank law took effect in September 2025. Advice that was accurate two years ago may now be wrong.
It becomes a legal question earlier than founders expect. Marketing to UAE residents, onboarding a single UAE customer, holding client keys, paying staff in tokens, or accepting stablecoins for goods can all engage the rules before any exchange goes live.
Who regulates what: the four perimeters
At federal level, the Capital Market Authority (CMA), which replaced the Securities and Commodities Authority (SCA) on 1 January 2026 under Federal Decree-Law No. 32 of 2025, is the regulator for virtual asset service providers (VASPs) under a Cabinet-level regulation on virtual assets and their service providers. In Dubai, outside the DIFC, licensing and supervision of VASPs has been delegated to the Virtual Assets Regulatory Authority (VARA), created by Dubai Law No. 4 of 2022 on regulating virtual assets in the Emirate of Dubai.
The two financial free zones sit outside both. In the Abu Dhabi Global Market, the Financial Services Regulatory Authority (FSRA) has run a bespoke virtual asset framework since 2018. In the Dubai International Financial Centre, the Dubai Financial Services Authority (DFSA) regulates crypto tokens under its own rules. Separately, the Central Bank of the UAE (CBUAE) regulates payment tokens, stored value and the banking relationships every VASP depends on.
| Regulator | Where it applies | Core instruments | Typical activities |
|---|---|---|---|
| VARA | Emirate of Dubai, excluding the DIFC; and services provided to or from Dubai | Dubai Law No. 4 of 2022; Virtual Assets and Related Activities Regulations 2023; activity Rulebooks | Exchange, broker-dealer, custody, lending and borrowing, management and investment, transfer and settlement, advisory, issuance |
| CMA | Onshore UAE outside Dubai, plus non-financial free zones | Federal virtual asset regulation and CMA decisions | VASPs serving the other emirates; securities-like tokens |
| ADGM FSRA | Abu Dhabi Global Market | Financial Services and Markets Regulations and FSRA rules and guidance | Exchanges (MTFs), custody, brokerage, fund management, staking-related services |
| DFSA | Dubai International Financial Centre | DFSA Rulebook crypto token provisions | Dealing, custody, arranging, managing and advising on crypto tokens |
| CBUAE | Onshore UAE, including non-financial free zones | Federal Decree-Law No. (6) of 2025; Payment Token Services Regulation | Payment token issuance, conversion, custody and transfer; banking and payment rails |
How CMA and VARA fit together
Under the cooperation arrangement reported in September 2024, VASPs operating in or targeting Dubai obtain a VARA licence and are then registered with the CMA, while VASPs targeting other emirates go directly to the CMA. In August 2025 the two authorities announced a strategic partnership for a unified registration mechanism, mutual recognition of licences, information exchange and joint oversight. The practical effect is fewer duplicate filings, but firms must still map which emirates their customers are in.
The 2025 Central Bank Law and the shrinking grey zone
The most significant recent change is Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business, which replaced the 2018 Central Bank law and came into force on 16 September 2025. It brings virtual-asset payment services and stored-value services within the list of licensed financial activities.
Crucially, the new law states that using a particular technology or business model does not by itself take an activity outside the regulatory perimeter. Commentary on the law highlights that it expressly captures decentralised finance, platforms, decentralised applications and technology infrastructure that facilitates financial services. "We are only software" is no longer a reliable answer for a protocol team with UAE operations.
Persons already carrying on activities caught by the new law were given a one-year alignment period, which ran to mid-September 2026. That window has now closed unless the Central Bank's Board has granted a specific extension. Unlicensed activity exposes a business to examination, administrative sanctions and criminal fines of up to AED 500 million with possible imprisonment, and senior managers face personal consequences.
If your product touches payments, stablecoins or on-chain settlement onshore, revisit your perimeter analysis against the 2025 law even if you already hold a VARA or CMA licence. A VASP licence does not automatically cover payment-token conversion or stored-value services that now sit with the Central Bank.
Payment tokens and stablecoins
The CBUAE's Payment Token Services Regulation, issued in 2024, requires a Central Bank licence or registration for payment token issuance, conversion, and custody and transfer in the UAE or directed at UAE persons. It distinguishes Dirham Payment Tokens (pegged to the dirham) from Foreign Payment Tokens, and excludes the financial free zones. Narrow exemptions exist for loyalty-style reward points and closed-loop tokens usable only for an issuer's own non-financial goods or services.
Choosing between VARA, CMA, ADGM and DIFC
Choosing where to sit is the central strategic decision in virtual asset regulation in the UAE. It should follow the business model, the customer base and the banking plan, not the marketing headline.
Retail or institutional customers
Retail-facing exchanges and brokers usually look first at VARA in Dubai, because its activity-based Rulebooks are designed for consumer-facing VASPs and the regulator has built a large licensed population. Institutional custody, prime brokerage and fund platforms often prefer ADGM or the DIFC, where virtual asset activity is integrated with conventional securities, fund and banking regulation and disputes go to common-law courts.
Combining crypto with conventional finance
If your group also manages funds, arranges securities deals or offers tokenised securities, a financial free zone lets one regulated entity hold several permissions under one supervisor. See our pages on ADGM financial regulation and DIFC financial regulation for how those authorisations are structured.
Who decides which tokens you can list
Token selection differs sharply. In the DIFC, from 12 January 2026 the DFSA stopped publishing its list of Recognised Crypto Tokens; authorised firms must now carry out and document their own suitability assessment for each token, on an ongoing basis. ADGM's FSRA has historically controlled which virtual assets firms may deal in. VARA's issuance and exchange Rulebooks impose their own listing and token distribution controls.
The licensing process step by step
Timelines depend on the regulator, the activities and the quality of the application. No authority guarantees a decision date, and incomplete files are the main cause of delay in virtual asset regulation in the UAE. The sequence below reflects how a well-prepared VARA, CMA or free-zone application typically runs.
- Map the activities. Break the product into regulated activities (exchange, custody, transfer, lending, issuance, payment token conversion) and identify every regulator whose perimeter is engaged, including the CBUAE.
- Choose the vehicle and location. Select a Dubai mainland or free zone company for VARA, an onshore or free zone entity for the CMA, or an ADGM or DIFC entity, and confirm that the commercial licence permits the activity.
- Prepare the business plan and governance. Draft the regulatory business plan, financial projections, capital and insurance analysis, organisational chart, and the fitness and propriety files for directors, senior management and controllers.
- Build the compliance framework. Produce the AML/CFT and sanctions manual, travel rule procedures, custody and key-management policies, technology and cybersecurity documents, market abuse controls and client-money arrangements.
- Submit and respond. File the application and work through regulator queries. Expect detailed questions on wallet architecture, conflicts of interest, outsourcing and the banking relationship.
- Satisfy pre-operational conditions. Many approvals are staged: an initial approval, then conditions to meet (capital, hires, audits, systems testing) before the full operational licence is issued.
- Go live and stay licensed. Launch only the activities licensed, file the required periodic returns, and notify or seek approval for changes in control, key persons and new products.
Ongoing obligations after licensing
A licence is the start of supervision, not the end of the project. Supervisors expect the firm described in the application to be the firm that operates.
AML, sanctions and the travel rule
VASPs are financial institutions for AML purposes and must apply customer due diligence, transaction monitoring, suspicious transaction reporting through goAML, targeted financial sanctions screening, and travel-rule data transfers for virtual asset transfers. Our AML compliance practice covers the federal framework and how supervisors test it.
Rulebook updates
VARA issued Version 2.0 of its activity Rulebooks on 19 May 2025, tightening controls over margin trading and token distribution, clarifying collateral wallet arrangements and harmonising requirements across activities; full compliance was required by 19 June 2025 according to VARA's announcement. The current texts are published on the VARA Rulebooks portal. Treat rulebook changes as a standing compliance workstream, with a named owner, a gap analysis for each update and board-level sign-off on implementation.
Reporting and changes to the business
Licensed firms file periodic regulatory returns, audited financial statements and incident notifications. New products, new token types, outsourcing of critical functions and changes in shareholders or senior management usually require prior notification or approval. Launching a new feature without checking it against your permissions is one of the commonest supervisory findings.
Marketing and promotions
Virtual asset marketing aimed at UAE residents is regulated by the relevant authority and, for social media, also engages the federal media regime, including the Advertiser Permit for creators who promote products. See financial promotions in the UAE for the controls on campaigns, influencers and risk warnings.
In the UAE the question is never simply whether crypto is allowed. It is which regulator owns each activity your product performs, and whether your licence matches what the product actually does.
Documents regulators expect
Applications succeed or stall on the quality of their documents. Before filing, assemble a pack that a sceptical supervisor can test against the product demonstration. Under virtual asset regulation in the UAE, supervisors routinely ask to see the platform working and compare it line by line with the policies submitted.
- A regulatory business plan describing every product, customer type, jurisdiction served and revenue line.
- Three-year financial projections with capital, liquidity and insurance calculations tied to the regulator's rules.
- Group structure chart showing ultimate beneficial owners, controllers and intra-group service arrangements.
- Fitness and propriety files, CVs, references and regulatory histories for directors and key persons, including the compliance officer and MLRO.
- AML/CFT business risk assessment, policies, onboarding flows and blockchain analytics arrangements.
- Custody architecture: wallet structure, key generation and storage, signing policies, reconciliation and proof-of-reserves approach.
- Technology governance, penetration tests, business continuity and incident response plans, and outsourcing agreements.
- Client terms, risk disclosures, complaints procedure and conflicts-of-interest policy.
Risks and common mistakes
Operating on a commercial licence that says "blockchain" or "IT"
A trade licence describing technology or consultancy activity does not authorise regulated virtual asset services. Many founders discover this when a bank closes an account or a regulator asks how UAE customers were onboarded. The licensing authority that issues your trade licence is not the financial regulator. Before launching, obtain a written perimeter analysis that maps each feature to a regulated activity, and keep it updated as the product changes. If a gap exists, regularise it early: a voluntary approach is treated very differently from an enforcement referral, and remediation usually costs far less than a forced shutdown.
Assuming one licence covers every emirate and free zone
A VARA licence covers Dubai, not the DIFC; an ADGM permission covers ADGM, not onshore Abu Dhabi. Serving customers across the UAE from one entity requires careful analysis of where services are provided and to whom. The CMA and VARA coordination reduces duplication between the federal and Dubai regimes, but it does not merge the free zones into that system. Firms with group entities in more than one zone should document which entity contracts with which customers and keep marketing, onboarding and custody aligned with that allocation.
Ignoring the Central Bank perimeter
Stablecoin issuance, conversion between fiat and payment tokens, merchant acceptance and wallet top-ups can fall within the Central Bank's payment token and stored-value regime rather than, or in addition to, the VASP regime. Since the 2025 Central Bank Law, technology-neutral drafting makes it harder to argue that a decentralised or software-based model sits outside regulation. Map every flow of fiat and payment tokens and test it against the CBUAE rules before you design the user journey.
Weak custody and key-management documentation
Regulators focus intensely on how client assets are segregated and how private keys are generated, stored and used. Applications fail when the policy describes multi-party signing but the demonstration shows a single administrator, or when reconciliation between on-chain balances and client ledgers is manual and infrequent. Draft custody policies with the engineering team, not around them, and make sure third-party custody contracts give you the audit, segregation and insolvency protections the regulator expects.
Treating token listings as a commercial decision only
Listing decisions carry legal risk: a token may be a security, a payment token, or subject to sanctions exposure through its issuer. In the DIFC the firm now bears the full assessment burden. Build a documented token admission process with legal, compliance and technical review, keep evidence of the analysis, and revisit tokens when facts change. Delisting procedures and customer communications should be ready before you need them.
Cross-border angle
Most UAE virtual asset businesses serve customers abroad, and the foreign regime often decides whether that is possible. Virtual asset regulation in the UAE does not authorise you to solicit customers in another country.
United Kingdom. The UK applies a financial promotions regime to cryptoassets, so marketing to UK consumers from Dubai needs a compliant route. Singapore. Singapore restricts digital token service providers that operate from Singapore but serve only overseas customers, which affects groups splitting functions between the two hubs. India. Offshore VASPs serving Indian users face registration expectations with India's Financial Intelligence Unit and Indian tax withholding rules on virtual digital assets.
Bangladesh. Bangladesh Bank has repeatedly warned against virtual currency dealings and foreign exchange controls restrict outward remittance, so UAE platforms must not assume Bangladeshi residents can lawfully fund accounts. China. Mainland China prohibits crypto trading services, while Hong Kong operates its own licensing system. Saudi Arabia and the GCC. Neighbouring states take varied and generally more restrictive approaches, so geo-blocking and onboarding rules must reflect each market.
TRW & Co coordinates with counsel in these markets through our network, and our fintech regulation and payment services teams handle the adjacent licensing questions.
How TRW & Co helps
We advise founders, financial institutions and investors on virtual asset regulation in the UAE from first perimeter analysis to supervision and investigations. Where representation before UAE onshore courts or the DIFC/ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners.
Perimeter and structuring
We map your product to VARA, CMA, FSRA, DFSA and CBUAE activities and recommend the entity and location. The output is a written analysis your board and banks can rely on.
Licence applications
We prepare and project-manage applications, business plans and policy suites, and manage regulator queries through to operational approval.
Compliance frameworks
We draft AML/CFT, travel rule, custody, token admission, conflicts and marketing policies, and test them against the current Rulebooks.
Transactions and investment
We conduct regulatory due diligence for investors and acquirers, including change-in-control approvals, as part of our venture capital work.
Investigations and enforcement
When a regulator raises concerns, we coordinate the response, internal review and remediation, drawing on our regulatory investigations practice.
Tax and accounting interface
We work with tax advisers on corporate tax treatment of token holdings and the VAT position of virtual asset transfers, which was amended in 2024.
To discuss a project, contact our Dubai team or browse all our practices.
Checklist for decision-makers
Use this list to test whether your business is ready for virtual asset regulation in the UAE.
- Have we mapped every product feature to a regulated activity and named the regulator for each?
- Have we checked our model against the 2025 Central Bank Law now that its alignment period has ended?
- Does our entity's location match the customers we serve and the regulator we want?
- Are our custody, key-management and reconciliation processes documented and tested?
- Do we have a documented token admission and delisting process?
- Are AML, sanctions screening and travel-rule controls operating, not just written?
- Have we confirmed which foreign markets we may lawfully market to and onboard from?
- Is there a banking relationship, and does the bank understand our licence?
- Who owns regulatory change monitoring, and how are Rulebook updates implemented?
The UAE rewards firms that engage early and accurately with its regulators. A clear map of virtual asset regulation in the UAE, matched to your real product, is the foundation for licensing, banking and investment.
Frequently asked questions
01Do I need a licence to run a crypto business from Dubai?
If you provide virtual asset services in or from Dubai outside the DIFC, you generally need a VARA licence for each activity, such as exchange, broker-dealer, custody or transfer services. A general trade licence for IT or consultancy is not enough. If you operate from the DIFC, the DFSA regime applies instead. Some activities involving payment tokens or stored value may also require Central Bank authorisation. A written perimeter analysis before launch is the safest way to confirm what you need.
02What is the difference between VARA and the CMA?
The Capital Market Authority (CMA), which succeeded the SCA on 1 January 2026, is the federal regulator for virtual asset service providers and covers the emirates other than Dubai, along with non-financial free zones. VARA was created under Dubai Law No. 4 of 2022 and licenses VASPs in Dubai outside the DIFC. Under their cooperation arrangements, VARA licensees are registered with the CMA, and in 2025 the two announced a unified registration mechanism and mutual recognition of licences. Neither covers the ADGM or DIFC, which have their own regulators.
03How does the 2025 Central Bank Law affect crypto and DeFi projects?
Federal Decree-Law No. (6) of 2025 came into force on 16 September 2025. It lists virtual-asset payment services and stored-value services among licensed activities and states that using a particular technology or business model does not take an activity outside the perimeter. Commentators note that it expressly reaches DeFi, platforms and decentralised applications that facilitate financial services. Existing businesses had a one-year alignment period ending in September 2026, so anyone still unlicensed should take advice promptly.
04Can I issue a dirham-backed stablecoin in the UAE?
Issuing a payment token onshore requires a licence under the Central Bank of the UAE Payment Token Services Regulation, which separately addresses Dirham Payment Tokens and Foreign Payment Tokens. The regime covers issuance, conversion, and custody and transfer, and excludes the ADGM and DIFC, which have their own rules for fiat-referenced tokens. Expect detailed requirements on reserve assets, redemption, governance and disclosure. Plan the banking and reserve custody arrangements before approaching the regulator.
05Should we choose ADGM or the DIFC rather than VARA?
It depends on your customers and product mix. ADGM and the DIFC suit institutional custody, fund management and groups that also carry on conventional regulated finance, because one supervisor can grant several permissions and disputes go to common-law courts. VARA is often the first choice for retail-facing exchanges and brokers serving Dubai. Banking access, capital requirements, the token admission approach and where your team will be based should drive the decision.
06Can a UAE-licensed platform onboard customers from India or Bangladesh?
A UAE licence does not authorise solicitation in another country. India expects offshore VASPs serving Indian users to engage with its Financial Intelligence Unit and applies tax withholding to virtual digital asset transfers. Bangladesh Bank has warned against virtual currency dealings and foreign exchange controls restrict outward remittance. Platforms should adopt market-by-market onboarding and marketing rules, and take local advice before accepting customers from restrictive jurisdictions.
07What happens if we have been operating without the right licence?
Unlicensed activity can lead to regulatory investigation, fines, account closures and orders to stop serving customers, and the 2025 Central Bank Law provides for substantial penalties and personal consequences for responsible managers. The best course is usually to stop the unlicensed activity, assess exposure with counsel, and plan a regularisation approach. Regulators tend to treat a prompt, transparent approach more favourably than issues discovered through complaints or bank reports.
Sources and official materials
- Virtual Assets Regulatory Authority (VARA) — Dubai virtual asset regulator, licensing and news
- VARA Rulebooks — Regulations and activity Rulebooks for Dubai VASPs
- Capital Market Authority (formerly SCA) — Federal regulator for VASPs outside Dubai
- Central Bank of the UAE: Legislation — Central Bank laws and regulations including payment tokens
- UAE Legislation: New Central Bank Decree-Law — Announcement of Federal Decree-Law No. (6) of 2025
- Dubai Financial Services Authority — DIFC crypto token regime
- Abu Dhabi Global Market — ADGM and FSRA virtual asset framework
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
