Cryptocurrency under UAE law is regulated through several connected frameworks rather than one license administered by one authority. The relevant regulator depends on the activity, the place where the business is licensed, and the jurisdiction in which it plans to operate.
A founder therefore needs to classify the service before choosing a location or filing an application. An exchange, custody provider, trading platform, and individual holder do not raise the same licensing question, and a license in one jurisdiction should not be assumed to cover every other part of the UAE.
How Is Cryptocurrency Regulated Under UAE Law?
Cryptocurrency under UAE law is regulated, not banned, through a layered system. Cabinet Decisions No. 111 and No. 112 of 2022 established the federal framework for virtual assets and service providers, with the Securities and Commodities Authority, now the Capital Market Authority, holding federal oversight.
Dubai’s Virtual Assets Regulatory Authority covers Dubai’s mainland and free zones outside DIFC. ADGM operates through the Financial Services Regulatory Authority, while DIFC uses the Dubai Financial Services Authority framework.
Licensing applies to businesses providing exchange, transfer, custody, trading-platform, or similar virtual asset services, not to an individual merely holding or trading for themselves. The correct starting point is to map the proposed activity and operating jurisdiction before determining which authority or licence applies.
About the Legal Team
Faris Raian
Faris Raian is the Founder, Managing Partner, and Senior Legal Consultant at Leaders Advocates. He brings more than 15 years of experience across corporate, commercial, real estate, family, and criminal law in UAE courts, including work relevant to virtual asset businesses, commercial structuring, regulatory questions, and related disputes.
Ekaterina Butseva
Ekaterina Butseva is the Founder and Partner at Leaders Advocates. She is a member of the International Bar Association and a foreign member of the American Bar Association, with a practice focused on complex litigation, dispute resolution, arbitration, and cross-border commercial matters.
The Federal Layer
Cabinet Decision No. 111 of 2022 and its companion, No. 112 of 2022, established the UAE’s core legal definitions for virtual assets and virtual asset service providers, and set licensing as mandatory for anyone operating an exchange, custody service, or trading platform. The Securities and Commodities Authority held federal oversight of this framework, and has since been rebranded the Capital Market Authority.
Dubai’s Own Regulator: VARA
Dubai created its own dedicated authority, the Virtual Assets Regulatory Authority, with its own legal personality and financial autonomy, linked to the Dubai World Trade Centre Authority. VARA licenses and supervises virtual asset activity across Dubai’s mainland and free zones, DIFC excepted, and works alongside the federal regulator and the Central Bank on coordinated oversight.
Planning a UAE Virtual Asset Business?
Get legal guidance on your proposed crypto activity, licensing jurisdiction, regulatory framework, and business structure before launch.
Four Regulators, Not One
- Capital Market Authority (formerly SCA): Federal-level oversight of virtual asset activities across the UAE mainland
- VARA: Licensing and supervision within Dubai’s mainland and free zones, excluding DIFC
- ADGM / FSRA: Abu Dhabi Global Market’s own separate token and digital asset framework
- DIFC / DFSA: The Dubai International Financial Centre’s own regulatory regime for digital assets
What Actually Requires a License
Operating a platform that offers trading, exchange, transfer, or custody services involving virtual assets requires licensing under the applicable regulator, whichever one actually governs the jurisdiction the business operates in. This applies to businesses, not individuals simply holding or trading crypto for themselves.
A Genuinely Recent Development
In early 2026, the Ministry of Finance issued Ministerial Decision No. 336 of 2025, formally designating VARA as a competent authority for purposes connected to the UAE’s corporate tax regime. It doesn’t create new prudential rules for crypto itself, but it confirms VARA’s role is now woven into the broader tax and regulatory framework, not sitting apart from it.
A Real, Concrete Example of Where This Is Heading
The Central Bank of the UAE approved Zand Bank to issue the country’s first regulated, multichain AED-backed stablecoin on public blockchains, a genuine sign of how far the regulatory framework has moved from simply permitting crypto activity toward actively building regulated products around it.
How Cryptocurrency Under UAE Law Uses Multiple Regulators
Start with three facts: what the business will do, where the legal entity will be licensed, and where it will offer the service. Those facts should be written down separately. A broad statement such as ‘we are a crypto company’ is not detailed enough to identify whether the proposed activity involves exchange, transfer, custody, trading-platform operations, or another business model.
Next, match the location to the regulatory map. The federal framework covers mainland activity under the Capital Market Authority, while VARA covers Dubai’s mainland and free zones outside DIFC. ADGM and DIFC maintain separate frameworks through FSRA and DFSA. The location name alone is not a substitute for confirming the actual legal jurisdiction of the licence.
Finally, test whether the business plans to operate beyond that jurisdiction. A licence should not be treated as a general passport for activity across the UAE. If the business will market, contract, hold assets, or provide services through more than one jurisdiction, each part of the model should be checked before launch.
- Describe each virtual asset activity in plain operational language.
- Identify the legal entity and the exact licensing jurisdiction.
- List where customers, systems, assets, and decision-makers will be located.
- Confirm whether another UAE jurisdiction is involved in the planned service.
- Record which regulator has been identified for each activity before applying.
Turning a Crypto Business Model Into a Licensing Map
A licensing map connects every customer-facing promise to the activity that makes it possible. If the business says users can buy, sell, transfer, or store virtual assets, the legal review should identify which company performs that step, which platform or custodian controls it, and which regulator is expected to supervise the service.
This exercise also separates the applicant’s own work from outsourced functions. A technology vendor, liquidity provider, custodian, or group company may perform part of the process, but outsourcing does not answer which regulated activity the UAE entity is offering to customers. The contracts and operating description should tell the same story.
The result should be specific enough for management, advisers, and application teams to use consistently. If the website describes one service, the corporate documents describe another, and the licensing application describes a third, the business has not yet reached a reliable regulatory position.
- Customer onboarding and the point at which an account is opened.
- How orders, transfers, exchange functions, or custody are performed.
- Which entity contracts with the user and receives any fee.
- Which third parties control technology, assets, or transaction execution.
- The jurisdictions in which each operating company is licensed.
Preparing the File Before a Virtual Asset Licence Application
A licence application is easier to manage when the legal and operating materials are prepared around one agreed model. The starting file should include the corporate structure, ownership information, business description, proposed customer terms, material supplier arrangements, and a clear statement of the jurisdictions in which services will be offered.
Management should review the file for internal consistency before it is used. Names, responsibilities, service descriptions, and territorial scope should match across the application, agreements, policies, and public materials. This does not replace the regulator’s review; it reduces preventable confusion about what the applicant is asking permission to do.
The filing plan should also identify open questions instead of hiding them in broad language. If custody, transaction execution, or customer access depends on another entity, record that dependency and the contract that supports it. A complete issue list makes legal advice more useful and gives the business a realistic sequence for resolving gaps.
- Corporate structure and the identity of each operating entity.
- Detailed activity and customer journey descriptions.
- Draft customer terms and important supplier agreements.
- A jurisdiction map covering licensing and planned operations.
- A list of assumptions that still require confirmation from the relevant authority.
Unsure Which UAE Crypto Licence Applies?
Our legal team can help map your virtual asset activities to the appropriate UAE jurisdiction and regulatory authority.
Keeping Marketing, Contracts, and Operations Aligned
Public claims about a crypto service should reflect the regulatory position actually obtained. A website, pitch deck, customer agreement, and platform interface can each create a different impression about who provides the service and where it is available. Those materials should be checked together rather than approved in separate teams.
The customer contract should identify the contracting entity and describe the service accurately. It should not imply that a group company, technology vendor, or licence in another jurisdiction automatically extends rights to the UAE business. Clear drafting is especially important where several companies contribute to one user experience.
Operational changes should return to the same review process. Adding custody, a new transfer function, a different customer group, or another operating location can change the activity map on which the original assessment was based. The business should identify the change before presenting it as an available service.
How Recent Developments Fit Into the Existing Framework
Ministerial Decision No. 336 of 2025, issued in early 2026, designated VARA as a competent authority for purposes connected to the UAE corporate tax regime. The source development does not create a separate set of prudential crypto rules. It shows that VARA’s role is being connected to the broader regulatory and tax structure.
The Central Bank’s approval for Zand Bank to issue the first regulated multichain AED-backed stablecoin on public blockchains is another concrete example of the direction of travel described in the source material. It reflects movement from basic permission toward regulated products operating within defined institutional oversight.
These developments should not be read as a shortcut around the jurisdiction analysis. A regulated product or a new institutional role does not remove the need for each business to identify its own activity, authority, licence, and operating boundaries.
Building or investing in a UAE virtual asset business? Faris Raian, Ekaterina Butseva, and the team at Leaders Advocates can map the activity, jurisdiction, contracts, and regulatory questions before the structure is put into operation.
Common Mistakes
- Assuming a single license covers activity across the entire UAE, when Dubai, Abu Dhabi’s free zones, and DIFC each run separate regimes.
- Not confirming whether SCA or VARA actually holds jurisdiction before applying for a license.
- Treating individual crypto holding the same as operating a licensed virtual asset business.
- Using the word crypto as a substitute for describing the exact exchange, transfer, custody, or platform activity.
- Allowing public materials and customer contracts to describe a broader service than the licensing plan supports.
- Changing the operating model without checking whether the original regulatory assessment still fits.
Relevant Legal Services
A Corporate Lawyer in Dubai can structure the UAE entity and regulatory workstream. A Contract Lawyer in Dubai can align customer and supplier agreements with the operating model. A Litigation Lawyer in Dubai can advise if a virtual asset matter develops into contested proceedings.
People Also Ask
Cryptocurrency under UAE law requires a business to match its actual service to the correct jurisdiction and regulator before launch. A clear activity map, consistent contracts, and disciplined operating boundaries are more reliablethan assuming one licence covers every virtual asset plan across the UAE.
Get Your UAE Crypto Structure Right Before Launch
Leaders Advocates can assist with virtual asset licensing questions, corporate structuring, contracts, and regulatory planning across UAE jurisdictions.
