What founders need to know
Key Takeaways
- The DFSA regulates financial services with crypto tokens in or from the DIFC. There is no separate crypto licence: crypto rides on existing permissions such as dealing, arranging, custody and managing assets.
- Since 12 January 2026 the DFSA no longer keeps a list of recognised crypto tokens. Each firm assesses, documents and monitors every non-stablecoin token it uses.
- Stablecoins, which the DFSA calls Fiat Crypto Tokens, stay DFSA-assessed and no firm can admit one on its own analysis. The current policy statement lists USDC, EURC and RLUSD.
- The DFSA does not regulate stablecoin issuance. An issuer looking at Dubai goes to VARA, to ADGM, or to the CBUAE for a Dirham token.
- A money services firm may use a DFSA-accepted stablecoin for money transmission and payment transactions, held in its own name. Ripple became the first blockchain payments firm licensed by the DFSA in March 2025.
- Privacy tokens and algorithmic tokens are prohibited outright in the DIFC.
- Capital follows the prudential category, from USD 30,000 for an arranger to USD 2,000,000 for dealing as principal. Any firm that holds client private keys is a custodian at USD 1,000,000.
“The DIFC rewards firms that already think like a regulated financial institution. If your plan is a retail trading app, expect a long year proving to the DFSA that you are something you are not. If you run money for funds, family offices or corporates and want common law behind every client contract, it is often the cleanest home in the UAE. Choose it because it fits the business you run.”
Regulatory Framework
The DIFC Regulatory Framework
The DIFC (Dubai International Financial Centre) is a common-law financial free zone established in 2004 and supervised by the Dubai Financial Services Authority (DFSA). Its crypto token regime took effect on 1 November 2022 and was rewritten with effect from 12 January 2026. The DIFC Courts sit outside the UAE civil law system, with English-language proceedings and a body of law modelled on English common law.
For which firms currently hold licences under each regulator, see the live UAE VASP Licence Tracker, updated monthly.
The DFSA does not issue a single “crypto licence”. It extends the same financial services permissions used for conventional investments to crypto tokens. The core permissions used in crypto mandates include:
- Operating a Multilateral Trading Facility (MTF). Running a venue where multiple parties trade crypto tokens.
- Dealing in Investments as Principal. Trading against clients as counterparty, including OTC desk and market-making activity.
- Dealing in Investments as Agent. Executing client orders as agent.
- Arranging Deals in Investments. Bringing about trades without authority to bind the client.
- Providing Custody. Safeguarding crypto tokens for clients, including holding private keys.
- Managing Assets and Managing a Collective Investment Fund. Discretionary crypto portfolios and crypto funds.
- Advising on Financial Products. Regulated advice on crypto tokens.
- Providing Money Services. Payment accounts, money transmission and payments with DFSA-accepted stablecoins.
Choose the DIFC for: institutional brokerage and custody, crypto fund management for professional investors, stablecoin-settled payments, tokenised securities under the DFSA investment regime, and groups that want common-law certainty for counterparties in London, New York or Singapore.
The January 2026 Rules
What Changed in the DFSA Crypto Token Regime in January 2026?
The DFSA moved responsibility for token due diligence from the regulator to the firm. Amendments to the GEN, COB and MKT modules took effect on 12 January 2026.
- The recognised token list is gone. Before 12 January 2026 a firm could only use tokens on the DFSA’s list. Now each firm decides, on a reasoned and documented basis, whether a token meets the DFSA’s suitability criteria.
- Stablecoins stay with the DFSA. Fiat Crypto Tokens, pegged to a single fiat currency, are still assessed by the regulator and listed in its policy statement. A token pegged to gold, a commodity or a basket of currencies is not a Fiat Crypto Token and goes through the firm’s own assessment.
- Privacy and algorithmic tokens are banned. No one in or from the DIFC may provide a financial service relating to either, promote either or offer either to the public. An algorithmic token is one that adjusts its supply to hold its price.
- Fund caps are removed. The old percentage limits on how much a DIFC fund could hold in crypto tokens no longer apply.
What the suitability file now has to show
The suitability assessment is now a core application document, and the DFSA’s Supervisory Guidelines on Assessing the Suitability of Crypto Tokens set the method. It covers the token’s purpose, governance and founders; its regulatory status elsewhere; the size, liquidity and trading history of its market; its technology; and whether using it could stop you meeting DFSA rules.
Once you are live, four duties follow. Publish a current list of every token you have assessed as suitable. Review each assessment at least every six months and stop using any token that fails. Be ready to justify each assessment to the DFSA. File the monthly Crypto Token return within 14 days of month end.
Prudential Categories
Which DFSA Licence Category Fits Your Crypto Business?
The DFSA licenses activities, then places your firm in a prudential category that sets your capital. Capital is the highest of the base capital requirement, the expenditure-based capital minimum and any risk capital requirement.
| Business model | DFSA activity | Prudential category | Base capital | Application fee |
|---|---|---|---|---|
| Market maker or liquidity provider | Dealing in Investments as Principal | Category 2 | USD 2,000,000; USD 500,000 if matched principal only | USD 40,000; USD 25,000 matched principal |
| Crypto broker | Dealing in Investments as Agent | Category 3A | USD 200,000 | USD 25,000 |
| Crypto exchange | Operating an MTF | Category 3A | USD 200,000 | USD 150,000 |
| Custodian, or any firm holding client private keys | Providing Custody | Category 3B | USD 1,000,000 | USD 25,000 |
| Asset manager | Managing Assets | Category 3C | USD 140,000 | USD 25,000 |
| Fund manager | Managing a Collective Investment Fund | Category 3C | USD 140,000 for public funds; USD 40,000 for QIFs and other funds | USD 10,000; USD 5,000 QIF-only |
| Arranger or adviser | Arranging Deals in Investments or Advising | Category 4 | USD 30,000 | USD 15,000 |
| Payments or money transmission business | Providing Money Services | Category 4 | USD 140,000 | USD 15,000 |
For most crypto firms the binding figure is the higher of base capital and the expenditure-based minimum, usually 13/52 of annual audited expenditure. Serving retail clients adds USD 20,000 to the application fee.
Stablecoins and Payments
How Do Stablecoins and Payments Work in the DIFC?
The DIFC lets firms use stablecoins but does not license anyone to issue them. The DFSA’s recognition criteria exist to admit stablecoins issued in comparable jurisdictions, provided they hold their peg.
Recognition, not issuance
A Fiat Crypto Token is a crypto token whose value is set by reference to a single fiat currency. The DFSA itself must be satisfied that it is suitable before any firm uses it; the firm self-assessment route does not apply. The policy statement currently lists USDC, EURC and RLUSD.
The assessment attaches to the token, not the issuer. A foreign issuer with no DIFC presence can be assessed, and setting up in the DIFC gives an issuer no advantage. The DFSA sets no reserve or redemption rules for issuers; reserves appear only as disclosure in an exchange’s key features document.
The payments licence
Accepted stablecoins have uses other crypto tokens do not. A money services firm may use one only for money transmission or executing a payment transaction, and only where the token is sent, held and received in the firm’s own name, not the client’s. It may not use any other crypto token. DIFC funds may hold accepted stablecoins and pay for fund services with them, and retail margin may be posted only in fiat or accepted stablecoins.
The permission that carries this is Providing Money Services. It covers operating payment accounts, money transmission and issuing payment instruments. Ripple’s DIFC entity holds those endorsements alongside crypto custody and arranging permissions, licensed on 11 March 2025.
Customers outside the DIFC
A DIFC licence covers the DIFC. Serving onshore UAE customers with payment tokens engages the CBUAE. A foreign-currency token issued from a free zone needs CBUAE Foreign Payment Token Issuer registration, and onshore it can only be used to buy virtual assets.
See the UAE stablecoin licence page for the full map: CBUAE payment tokens, VARA FRVA and ADGM FRT issuance, and DFSA stablecoin acceptance in one map.
DIFC Financial Free Zone
Who Needs a DIFC Crypto Licence?
The DFSA licenses professional-grade crypto activity carried on in or from the DIFC. The primary use-cases:
Licence required
- Crypto exchanges (professional) Operating an MTF, plus Providing Custody if you hold client keys.
- Institutional brokers and OTC desks Dealing in Investments as Agent or as Principal.
- Custodians Providing Custody, Category 3B.
- Crypto asset and fund managers Managing Assets or Managing a Collective Investment Fund.
- Payment firms using stablecoins Providing Money Services.
- Advisers and introducers Advising on Financial Products or Arranging Deals in Investments.
Likely outside the perimeter
- Retail-focused businesses in mainland Dubai VARA is the correct route.
- Stablecoin issuers The DIFC has no issuance regime; ADGM, VARA or the CBUAE apply.
- Non-custodial wallet providers No intermediary function and no control of client assets.
- Corporate treasuries Holding crypto tokens on own account only.
- Utility token and NFT projects Excluded tokens sit outside the crypto token regime unless they are in substance an investment.
If you are unsure whether the DIFC, ADGM or VARA is the right route for your model, a strategy call resolves it in 30 minutes.
Choosing Your Regulator
When Should You Choose the DIFC Over VARA or ADGM?
Activity, client base and corporate philosophy drive the decision more than headline cost. The framework below applies to most crypto licensing decisions.
-
DIFC (DFSA)
- Institutional or professional clients are the focus.
- The group already holds DFSA permissions, or its banks, brokers and fund managers sit in the DIFC.
- Crypto fund or discretionary portfolio management is the primary activity.
- Payments settle in DFSA-accepted stablecoins.
- Counterparties expect common-law contracts and the DIFC Courts.
-
ADGM (FSRA)
- You plan to issue a USD stablecoin under the FRT framework.
- Digital securities or tokenised real-world assets are central.
- An Abu Dhabi base suits the group.
-
VARA (Dubai)
- Retail clients in Dubai are central.
- The Exchange or Broker-Dealer category fits a retail-heavy model.
- ARVA-aligned token distribution is the commercial driver.
-
CMA (Federal)
- UAE federal onshore activity, tokenised securities and commodity contracts.
The DIFC and VARA can coexist: a group can hold DFSA permissions for its institutional arm and a VARA licence for its retail arm, through separate entities. The VASP licence UAE hub sets out cross-regulator decision logic for combined structures.
Regulator Comparison
DIFC vs VARA vs ADGM for Crypto
| DIFC (DFSA) | VARA (Dubai) | ADGM (FSRA) | |
|---|---|---|---|
| Legal system | Common law, DIFC Courts | Dubai law plus VARA Rulebook 2.0 | English common law |
| Primary strength | Institutional crypto, funds, stablecoin payments | Dubai retail, exchange, custody | Institutional crypto, digital securities, FRT |
| Licence structure | DFSA permissions extended to crypto tokens | Seven activity categories | Stacking FSMR permissions |
| Token approval | Firm-led suitability since 12 January 2026 | VA Standards regime | Accepted Virtual Assets and Accepted FRTs |
| Stablecoin issuance | No issuance regime | Category 1 VA Issuance licence (FRVA) | Issuing a Fiat-Referenced Token |
| Minimum capital | USD 30,000 to 2,000,000 by prudential category | AED 100,000 to 3,000,000 | USD 50,000 to 4,000,000 by prudential category |
| Client focus | Professional and institutional | Retail and professional | Professional and institutional |
| Typical timeline | 8 to 14 months | 9 to 12 months | 8 to 14 months |
| Year 1 cost | USD 300,000 to 2,000,000+ | AED 800,000 to 3,000,000 | USD 350,000 to 900,000 |
| Best suited for | Institutional brokers, custodians, fund managers, stablecoin payments | Dubai exchanges, retail brokers, custodians | Digital securities, institutional crypto, FRTs |
Cost and Timeline
How Much Does a DIFC Crypto Licence Cost?
Plan for 8 to 14 months from the first DFSA meeting to licence, depending on category and how complete your file is at submission. Advisers and arrangers sit at the shorter end; custodians, principal dealers and venues at the longer end.
Timeline is within your control. A well-prepared application with substantive pre-application engagement runs significantly faster than one filed without specialist preparation.
Why timeline and cost are connected
A 10-month DIFC process and a 16-month process do not cost the same. The difference in legal fees is typically smaller than the cumulative cost of extra months of operational delay, capital tied up before launch, query responses requiring specialist input, and rebuilding compliance infrastructure that was not operational at submission.
Key figures
- DIFC well-prepared: 8 to 14 months from first DFSA meeting to final licence.
- DIFC standard: 14 to 16 months.
- DIFC poorly prepared: 16 to 20 months or more.
Your budget has five parts:
- DFSA application fee by activity: USD 15,000 for arranging, USD 25,000 for agency dealing, custody or asset management, USD 40,000 for principal dealing and USD 150,000 for a crypto MTF, plus USD 20,000 if you serve retail clients
- Base capital for your prudential category, held from authorisation
- DIFC registration and office, with physical premises in the centre
- Resident control functions: Senior Executive Officer, Compliance Officer, MLRO and Finance Officer
- Annual DFSA fees, higher once the licence covers crypto tokens: USD 35,000 instead of USD 25,000 for agency dealing, custody or asset management, USD 70,000 for principal dealing and USD 150,000 for a crypto MTF, plus audit
An existing DFSA firm adding crypto pays a one-off variation fee of USD 5,000 to USD 40,000, depending on the activity.
DIFC incorporation costs
- Physical office in the DIFC: required for every authorised firm, priced at the top of the Dubai market.
- All DFSA capital must be unencumbered and maintained at all times. It is not a one-time deposit at application.
Legal fees
NeosLegal works on fixed-fee, milestone-based engagements. Fees depend on permissions sought, business model complexity, application readiness at engagement start, and scope of ongoing post-authorisation support.
Common Pitfalls
Where Do DIFC Crypto Applications Go Wrong?
Most delays trace back to five choices made before the application is filed.
- The wrong prudential category. A model described as brokerage that actually takes principal risk lands in Category 2 and needs USD 2,000,000 instead of USD 200,000.
- Holding client keys without a custody permission. A broker or exchange that controls client private keys is Providing Custody, Category 3B at USD 1,000,000, unless it uses a third-party wallet provider.
- A thin suitability file. Since January the token assessment is yours to defend, with six-monthly reviews and a monthly return behind it.
- Assuming the licence reaches onshore. A DIFC permission does not cover payments to customers on the mainland. That is CBUAE territory.
- Planning to issue a stablecoin from the DIFC. There is no route. The issuer belongs in ADGM, Dubai under VARA, or with the CBUAE for Dirham tokens.
“Most founders who ask us about the DIFC have already decided they want the address. The better question is what the business does with tokens every day. If you hold client assets, deal as principal or move stablecoins for payments, that choice fixes your capital and your timeline before the DFSA reads a word of your business plan. Since January the suitability file is yours to defend, so we write it as if the regulator will read every line. It will.”
Engagement Model
How Does NeosLegal Structure a DIFC Engagement?
The NeosLegal engagement model below is what we do before and around the DFSA process to make sure your application reaches the authorisation team in the right shape. Most DFSA delays start with missing or weak steps before the first DFSA meeting: work that should already be done by the time you sit across from the authorisation team.
NeosLegal advises on DIFC and DFSA mandates across brokerage, custody, fund management and payments.
- 01
Activity-to-permissions mapping
Business plan translated into DFSA permissions and a prudential category. This is the decision the entire application is built on: under-scoping it surfaces later as a costly variation, and over-scoping it inflates capital and staffing you do not yet need. Output: written memo with capital, timeline and staffing plan.
- 02
Token suitability framework
The assessment method, token list and monitoring process the DFSA now expects, built to its Supervisory Guidelines on Assessing the Suitability of Crypto Tokens.
- 03
Introductory meetings
The applicant meets DIFC Business Development and the DFSA authorisation team before a formal application opens. NeosLegal prepares and attends with the permissions map and capital model in hand, so the meeting confirms scope.
- 04
Regulatory Business Plan and application pack
Three-year Regulatory Business Plan, financial model, policies and procedures, technology and cyber architecture and AML programme, drafted to DFSA standard and filed with the application fee.
- 05
DFSA review to in-principle approval
The DFSA reviews the file, typically for up to four months, and may hold interviews. NeosLegal handles every DFSA query until the DFSA issues in-principle approval with conditions.
- 06
DIFC incorporation to final licence
The entity is registered with the DIFC Registrar of Companies, office space is leased and capital is deposited. The DFSA issues the final licence once its conditions are met.
- 07
Go-live and ongoing retainer
Permissions activated and the business launches. The retainer covers token suitability reviews, the monthly Crypto Token return, rulebook updates, new permissions and marketing compliance.
WHY CHOOSE NEOSLEGAL
Why Founders and Institutions Choose NeosLegal
NeosLegal has worked only on crypto and Web3 since 2016, before VARA existed, before ADGM had a crypto framework, and before most UAE firms understood what Bitcoin was. That head start shows in the track record, the recognition, and the way engagements run.
Track Record
- 350+ UAE Web3 and crypto projects structured and 750+ founders advised since 2016, with zero client enforcement actions in ten years.
- USD 500 billion in transactions advised and deals closed.
- 20+ VASP licence applications advised across the UAE regulators.
- 250+ Tier-1 exchange legal opinions at a 100% acceptance rate, a commercially verifiable outcome across hundreds of submissions.
Independent Recognition
- Best UAE Crypto Law Firm 2026, UAE Business Awards Middle East.
- Middle East Technology Legal Team of the Year, The Oath Middle East, November 2025.
- Authors the UAE chapters of the Chambers Blockchain and Crypto Assets guide, 2025 and 2026.
- Irina Heaver ranked as Recommended Blockchain Lawyer in the UAE 2025 and 2026, Lexology.
Regulatory Coverage
- All five UAE regulatory pathways, VARA, ADGM (FSRA), DIFC (DFSA), the federal CMA and CBUAE, handled within a single firm, with no coordination overhead between separate advisers.
- 60+ jurisdictions covered in total for cross-border structuring since 2016.
- Federal CMA Category RWA Tokenization Exchange, broker-dealer and OTC dealing desk licences delivered end to end, including the full policy suite, AML risk and controls register, and Approved Persons submissions the regulator requires.
Every engagement is fixed-fee with defined milestones confirmed before work begins. Direct access to Irina Heaver and senior associates throughout, not associates managing the relationship.
Founder differentiator
Founded by Irina Heaver, a former co-founder of a UAE crypto exchange (later exited), NeosLegal operates with founders’ commercial realities in mind. Irina has also drafted crypto laws and advised on virtual asset policy for multiple regulators and governments, including UAE regulators, helping shape the frameworks her clients are now licensed under.
Track record
Representative DIFC Cases
-
VASP Licensing & Regulatory
Global Payment Network – All Five UAE Regimes
Advised a leading global payment network across all five UAE VASP regimes (VARA, ADGM, DIFC, CMA/SCA and CBUAE), benchmarking each against the client's activities and delivering a jurisdiction-selection matrix that anchored a multi-entity licensing strategy.
-
Crypto Custody
Custody Licence – Regulator Selection
Advised an institutional custodian comparing VARA, ADGM/FSRA and DIFC/DFSA custody permissions, mapping capital, asset-segregation and reporting requirements across the four UAE routes to select the optimal licensing path.
-
VASP Licensing & Regulatory
Stablecoin Issuer – CBUAE
Advised a banking and technology consortium on CBUAE Payment Token Services licensing for an AED-backed stablecoin, designing the issuance, redemption and reserve/risk-management framework to meet the Central Bank's regulations.
Browse 100+ Representative Case Studies
View All Case Studies