A founder, investor, platform, or service provider needs to know which UAE authority governs a crypto activity. The answer changes with the product, legal entity, customer, and location.
The UAE does not use one crypto law or one regulator. Applying the wrong framework can delay licensing, banking, product launch, marketing, or enforcement.
Quick Answer
crypto regulations uae. requirements operate through several frameworks. Cabinet Resolution No. 111 of 2022 regulates virtual assets and related service providers at federal level within its scope. The Capital Market Authority replaced the SCA on January 1, 2026. VARA regulates Dubai virtual asset activities outside the DIFC under Dubai Law No. 4 of 2022. The DFSA and FSRA regulate relevant activities in the DIFC and ADGM. The Central Bank’s Payment Token Services Regulation, Circular No. 2/2024, has applied since August 31, 2024. Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 provide the current AML framework. The correct authorization depends on the activity, token, location, customer, and documents.
Map every product function before selecting a company location or license. Identify who issues, markets, exchanges, transfers, holds, advises on, or accepts the asset.
Then match each function to the authority, law, rulebook, and operating controls. One authorization should never be assumed to cover every activity in a multi-service product.
Crypto regulations in the UAE: Regulator Map
Federal framework and the Capital Market Authority
Cabinet Resolution No. 111 of 2022 regulates virtual assets and related service providers within its federal scope. It should be read with later legislation and authority rules.
Federal Decree-Law No. 32 of 2025 established the Capital Market Authority as the legal successor to the Securities and Commodities Authority. It took effect on January 1, 2026.
Federal Decree-Law No. 33 of 2025 regulates capital markets and also took effect on January 1, 2026. Existing decisions remain effective to the extent they do not conflict with later legislation.
Businesses should therefore avoid outdated references to the SCA when describing a current federal application or regulator.
VARA in Dubai
Dubai Law No. 4 of 2022 regulates virtual assets in the Emirate and established VARA. The law applies across Dubai’s mainland and free zones, excluding the DIFC.
VARA licenses and supervises activities within its perimeter. Its rulebooks address authorization, market conduct, technology, compliance, and other operational requirements.
The exact license category depends on the functions performed. Exchange, broker-dealer, custody, transfer, lending, management, advisory, and issuance services require separate analysis.
DIFC and DFSA
The Dubai International Financial Centre has a separate financial services and legal framework. The Dubai Financial Services Authority regulates relevant crypto-token and financial services activities there.
A VARA license does not authorize activity in the DIFC. Likewise, a DIFC authorization does not automatically cover the rest of Dubai.
ADGM and FSRA
Abu Dhabi Global Market also has its own legal and regulatory framework. The Financial Services Regulatory Authority regulates relevant virtual asset and financial services activities.
ADGM status should not be confused with an ordinary Abu Dhabi mainland license. The legal entity, activity, customer, and operating location must match the authorization.
Central Bank payment token regulation
The Payment Token Services Regulation is Circular No. 2/2024 and has been in force since August 31, 2024.
It regulates specified payment token services, including issuance, conversion, custody, and transfer. A payment token is defined through the Regulation’s stable-value criteria.
The framework also restricts specified activities involving algorithmic stablecoins, privacy tokens, and other means of payment. A foreign token or issuer may require registration in the circumstances described by the Regulation.
VARA, CMA, DFSA, or FSRA authorization does not automatically replace Central Bank authorization. Product teams should assess the payment function separately.
Not Sure Which UAE Authority Governs Your Crypto Activity?
VARA, the CMA, the Central Bank, DFSA, and FSRA can each apply to different functions of the same product. Message Leaders Advocates on WhatsApp and we’ll help you map the correct framework.
Activity Mapping Before Licensing
List every service from the customer’s perspective.
- Who issues or creates the token?
- Who sells, exchanges, or converts it?
- Who holds the customer’s private keys or account balance?
- Who transfers the asset and on whose instructions?
- Who markets the product in or from the UAE?
- Who gives advice or manages a portfolio?
- Who sets the price or supplies liquidity?
- Can the asset be used to pay for goods or services?
- Does the business pool customer funds or promise returns?
- Which entity contracts with each customer?
Map each answer to a legal entity and regulator. A group structure can create licensing gaps when one entity signs the contract while another performs the regulated function.
Anti Money Laundering Duties
Federal Decree-Law No. 10 of 2025 is the current federal anti-money laundering framework. Cabinet Resolution No. 134 of 2025 provides the Executive Regulations.
Obligations can include:
- Enterprise and customer risk assessments.
- Customer and beneficial owner due diligence.
- Source-of-funds and source-of-wealth checks.
- Sanctions and wallet screening.
- Transaction monitoring and alert review.
- Suspicious transaction reporting.
- Recordkeeping, training, audit, and governance.
The exact duty depends on the business, authority, activity, and risk. A policy should reflect actual systems and escalation decisions.
Operating without required authorization can also create AML exposure. Cabinet Resolution No. 134 of 2025 addresses virtual asset service provider activity within the AML framework.
Marketing Rules
VARA’s Regulations on the Marketing of Virtual Assets and Related Activities 2024 took effect on October 1, 2024.
They apply to marketing of virtual assets or related activities in or targeting the UAE, subject to their scope and exemptions. The rules can apply to licensed and unlicensed entities.
Marketing must be fair, clear, and not misleading. Required records must be retained, and the VARA framework specifies an eight-year retention period for relevant marketing records.
Review:
- Website, application, and social media claims.
- Influencer, affiliate, and referral content.
- Yield, return, and capital protection statements.
- Risk warnings and performance data.
- Event, sponsorship, and outdoor promotion.
- Customer targeting and geographic access.
Marketing compliance does not authorize the underlying service. Both the promotion and activity must be lawful.
Cybercrime and Criminal Exposure
Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes may apply when electronic systems are used for fraud, unlawful fundraising, or dealings with illicit funds.
Article 40 addresses internet fraud. It provides for imprisonment of at least one year, a fine from AED 250,000 to AED 1,000,000, or both.
Article 41 addresses specified unauthorized fundraising and electronic investment conduct. It permits imprisonment of up to five years, a fine from AED 250,000 to AED 1,000,000, or both.
Article 30 addresses specified transfer, possession, use, or acquisition of illicit financial proceeds through electronic means. The formal allegation and evidence must be reviewed carefully.
Article 48 addresses specified promotion or dealing in virtual or digital currencies, stored value, or payment units that lack required official recognition or licensing. It should not be read as a general ban on licensed virtual assets.
Tax Treatment
Tax treatment depends on the transaction, person, and business model.
Cabinet Decision No. 100 of 2024 amended the VAT Executive Regulation, including treatment of specified virtual asset transfers and conversions. Related services and fees require separate analysis.
The FTA’s VAT Public Clarification VATP039 specifically addresses proof-of-work mining. Own-account mining falls outside VAT, while mining for another person for a fee is a service.
Corporate tax applies to businesses within its scope. Tax advice should address revenue recognition, valuation, expenses, related parties, permanent establishments, and transfer pricing where relevant.
Documents Needed for Regulatory Analysis
- Group and legal entity chart.
- Product description and customer journey.
- Token rights, economics, and technical paper.
- Asset, money, and data flow diagrams.
- Customer types and target jurisdictions.
- Custody, wallet, and key-management arrangements.
- Terms, disclosures, privacy, and marketing materials.
- Banking, payment, exchange, and liquidity agreements.
- AML risk assessment, policies, and system description.
- Existing licenses and regulator correspondence.
Regulators assess actual activity, not only the wording of a business plan. Documents and technology should describe the same operating model.
Practical Compliance Steps
- Map every function and responsible legal entity.
- Identify the location and customer for each activity.
- Classify the token and any payment function.
- Confirm the regulator and authorization category.
- Align incorporation, banking, contracts, and technology.
- Build AML and sanctions controls into operations.
- Review marketing before public release.
- Prepare evidence for regulator questions and testing.
- Train staff and document approvals.
- Reassess the perimeter before adding services or jurisdictions.
Common Mistakes and Risks
Assuming one license covers everything
A product can involve virtual asset, payment token, capital market, AML, and marketing rules at the same time.
Treating VARA as the DIFC regulator
VARA excludes the DIFC. The DFSA regulates relevant financial services in the DIFC.
Using outdated authority names
The Capital Market Authority replaced the SCA from January 1, 2026.
Launching marketing before authorization
Marketing rules apply separately. Promotion cannot be used to test a product that is not authorized.
Copying an AML policy
Regulators expect controls that match customers, assets, transactions, wallets, geography, and delivery channels.
Need Your AML and Marketing Controls Reviewed?
Compliance gaps in AML or marketing can delay a license or trigger enforcement. Send us your setup on WhatsApp for a focused compliance review.
How a Lawyer Can Help
Counsel can map the product, identify the regulator, prepare applications, draft contracts, and build operating controls. A lawyer can also coordinate tax, technology, cybercrime, and dispute specialists.
Faris Raian‘s contribution in the original article identifies a recurring mistake. Businesses often assume one authorization covers every function, although one product can touch several regulatory perimeters.
His practical recommendation is to map each function before incorporation and launch. That review exposes gaps while the structure can still be changed efficiently.
Relevant Legal Services
The closest services for this matter are crypto lawyer services in Dubai, civil lawyer services in Dubai, and criminal defense lawyer services in Dubai. The suitable service depends on the facts, documents, regulator, forum, procedural stage, and requested remedy.
Relevant Success Story
The firm publishes selected completed matter examples in its Success Stories archive. A prior result does not guarantee a similar outcome. Every matter depends on its facts, documents, evidence, procedure, and legal circumstances.
Ready to Confirm Your Regulatory Position?
A documented activity map is the safest way to avoid licensing gaps. Contact Leaders Advocates on WhatsApp for a focused assessment.
FAQs
Final Takeaway
Crypto regulations UAE. compliance begins with activity mapping. The federal framework, VARA, DFSA, FSRA, Central Bank, AML, marketing, cybercrime, and tax rules may overlap.
The safest next step is to review the product and documents before selecting a license or launching. The correct framework depends on the facts, entities, customers, and services.
