United Arab Emirates: crypto & digital assets regulation

Regulated

UAE crypto regulation: VARA (Dubai), FSRA (ADGM), DFSA (DIFC), and Central Bank

Lead regulator
VARA (Dubai) · FSRA (ADGM) · DFSA (DIFC) · Central Bank of UAE
Also involved
Central Bank of UAE (Payment Tokens/Travel Rule) · NFIU (AML reporting) · MoCI (Federal AML enforcement)
Core law
Federal Decree-Law No. 10 of 2025 (AML/CFT) · Law No. 4 of 2022 (Dubai)
Entry capital
AED 500,000 (VARA VASP); US$2m (FSRA Category 3C)
Approval timeline
3-6 months to approval-in-principle
Customer assets
Segregated custodian required; rehypothecation prohibited
Data protection
Federal Data Protection Law · ADGM/DFSA/Dubai specific regulations
Sandbox
Yes - VARA Regulatory Sandbox
Monthly snapshots:2026-07

The UAE employs a multi-jurisdictional regulatory framework for digital assets. Dubai is regulated exclusively by the Virtual Assets Regulatory Authority (VARA) under Law No. 4 of 2022, requiring specific licenses for exchange, custody, and issuance. Abu Dhabi Global Market (ADGM) is overseen by the Financial Services Regulatory Authority (FSRA), which treats virtual assets as regulated financial services and mandates authorization for trading, custody, and staking. The Dubai International Financial Centre (DIFC) is regulated by the DFSA, which focuses on crypto tokens and digital securities. At the federal level, the Central Bank of the UAE regulates payment tokens and enforces the Travel Rule, while Federal Decree-Law No. 10 of 2025 establishes the overarching Anti-Money Laundering and Counter-Terrorism Financing framework applicable to all virtual asset service providers.

Which licence do you need?

Your activityRequirementCapitalTimelineAuthority
Exchange / trading platformLicenceVirtual Asset Service Provider (VASP) License[1][2][3]

Requires strict governance, board composition, and market conduct standards.

AED 500,000 (VARA); US$2m (FSRA Cat 3C)3-6 monthsVARA (Dubai) · FSRA (ADGM)
Custody of client assetsLicenceCustody Services License[4][5]

Strict client asset segregation and continuous operational monitoring required.

AED 500,000 (VARA); US$2m (FSRA Cat 3C)3-6 monthsVARA (Dubai) · FSRA (ADGM)
Token issuance / public offeringLicenceVirtual Asset Issuer License[6][7]

Three-tier classification; Category 1 requires reserve assets and VARA license.

AED 500,000 (VARA Cat 1)3-6 monthsVARA (Dubai)
Broker-dealer / OTC deskLicenceBroker-Dealer Services License[8]

Requires strict best execution standards and margin requirements.

AED 500,000 (VARA)3-6 monthsVARA (Dubai)
Stablecoin issuanceLicenceFiat-Referenced Token Issuer License[9][6]

Must fully back tokens with high-quality liquid assets; distinct from stored value.

AED 500,000 (VARA Cat 1)3-6 monthsVARA (Dubai) · FSRA (ADGM)
Crypto payments acceptanceLicencePayment Token Service Provider License[10]

Central Bank regulates issuance, conversion, and custody/transfer of payment tokens.

Varies by Central Bank category3-6 monthsCentral Bank of UAE
Mining / staking servicesLicenceCommercial Licence (Mining) / VA Permission (Staking)[11][12]

Mining requires commercial license; staking requires specific permission for asset holders.

Varies1-3 monthsFSRA (ADGM)
Advisory / portfolio managementLicenceAdvisory Services License[13]

Requires written internal policies and client suitability assessments.

AED 500,000 (VARA)3-6 monthsVARA (Dubai)

New — what changed recently

  • 2026-04-09VARA Guidance on Virtual Asset Issuance RulebookStandardized virtual asset issuance with a three-tier classification system requiring Category 1 issuers to secure VARA licenses and maintain reserve assets.[6]
  • 2026-03-31VARA Exchange Services RulebookEstablished comprehensive governance, operational, and market conduct standards for licensed VASPs, including strict board composition requirements.[1]
  • 2026-01-15FSRA Guidance on Crypto Mining ActivitiesMandated that all commercial crypto mining entities in ADGM obtain a Commercial Licence under the Commercial Licensing Regulations 2025.[11]
  • 2025-10-29Cabinet Resolution No. 134 of 2025Established executive regulations implementing Federal Decree-Law No. 10 of 2025 on AML/CFT, formally defining regulated entities including VASPs.[14]
  • 2025-09-30Federal Decree-Law No. 10 of 2025Established a comprehensive legal framework to combat money laundering, terrorism financing, and proliferation financing across the UAE.[15]

Market-entry checklist

  1. 1Determine JurisdictionSelect VARA (Dubai), FSRA (ADGM), or DFSA (DIFC) based on target market and entity structure.
  2. 2Secure VASP LicenseApply for the appropriate VASP license (Exchange, Custody, etc.) with minimum capital of AED 500,000 (VARA) or US$2m (FSRA).
  3. 3Implement AML/CFT FrameworkAlign with Federal Decree-Law No. 10 of 2025 and appoint a qualified Compliance Officer.
  4. 4Establish Corporate GovernanceEnsure Fit and Proper Board members and clear ownership chains as per Company Rulebook.
  5. 5Prepare Technology ComplianceImplement robust cybersecurity and data protection standards per VARA's Technology Rulebook.
  6. 6Register with NFIURegister as a reporting entity with the UAE Financial Intelligence Unit for AML/CFT obligations.
This guide is compiled automatically from 15 primary-source documents published by United Arab Emirates's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-08-01). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.