Legal Insights
Reading Time: 15 min.
The United Arab Emirates (UAE) has rapidly emerged as a global leader in the adoption and regulation of cryptocurrencies and virtual assets. The country’s progressive stance is facilitated by a multi-layered regulatory framework that combines federal oversight with specific regulations at the emirate level. This approach ensures that innovation in the fintech sector is balanced with robust regulatory oversight to protect investors and maintain financial stability.
All onshore virtual asset activities in the UAE fall under the purview of the SCA or Central Bank, with specific exceptions where authority has been delegated:
- Emirate of Dubai (excluding DIFC): Regulated by VARA.
- Financial Free Zones:
- DIFC: Regulated by the DFSA.
- ADGM: Regulated by the FSRA.
Entities must ensure they are compliant with the regulations of the specific jurisdiction in which they operate, in addition to adhering to federal laws. This multi-jurisdictional approach requires businesses to carefully navigate the regulatory landscape, particularly if they operate across multiple emirates or free zones.
Federal Regulators
Securities and Commodities Authority (SCA)
The Securities and Commodities Authority (SCA) is the primary federal body responsible for regulating the UAE’s securities and commodities markets, including virtual assets for investment purposes. The SCA sets overarching policies and regulatory frameworks that govern virtual asset activities across the UAE, except in jurisdictions where authority has been delegated to emirate-level regulators.
Regulatory Framework:
In December 2022, the UAE government issued Cabinet Resolution No. 111 of 2022, establishing a comprehensive regulatory framework for Virtual Assets and Virtual Asset Service Providers (VASPs). This resolution specifies the role of the regulator(s) and mandates that no entity can engage in virtual asset-related activities without obtaining the necessary approval and license from the SCA or its designated regulatory body within the relevant emirate.
The SCA’s Virtual Asset Framework outlines licensing requirements, compliance standards, and operational guidelines for entities operating in the virtual asset space. Entities seeking an SCA license must adhere to strict requirements related to technology infrastructure, cybersecurity measures, and anti-money laundering (AML) compliance. The SCA Rulebook provides detailed guidance on these requirements.
The SCA’s regulatory framework does not apply to:
- Digital Securities
- Digital Commodity Derivatives Contracts
- Digital Service Tokens
- Non-Fungible Tokens (NFTs)
- Virtual Assets used for payment purposes
Licensing and Activities:
The SCA issues various licenses for entities operating in the virtual asset sector, including:
- Virtual Asset Platform Operator
- Safe Custody of Virtual Assets
- Financial Consulting in Virtual Assets
- Managing a Portfolio of Virtual Assets
- Virtual Asset Broker
- Virtual Asset Dealer
Entities holding an SCA license can operate throughout the UAE.
Non-compliance with the UAE’s virtual asset regulations can result in severe penalties, including:
- Fines: Up to AED 10 million (~USD 2.7 million).
- Disgorgement of Profits: Requiring entities to surrender profits earned from unlawful activities.
- Criminal Investigations: Initiated by the Public Prosecutor, potentially leading to criminal charges.
Central Bank of the UAE
The Central Bank of the UAE is responsible for regulating the country’s monetary policy and payment systems, including those involving cryptocurrencies. Its primary focus is on ensuring the stability and integrity of payment mechanisms, including those that involve digital currencies like stablecoins backed by the UAE Dirham (AED).
Regulatory Framework:
In recent developments, the Central Bank introduced the Payment Token Services Regulation (PTSR), which specifically addresses the regulation of stablecoins and sets strict controls on activities and promotions related to payment token services.
Under the PTSR, payment tokens are classified into two categories:
- Dirham Payment Tokens: These are stablecoins fully backed by the AED and can be used for any lawful purpose within the UAE.
- Foreign Payment Tokens: These are stablecoins backed by foreign currencies and are restricted to being used for purchasing virtual assets or their derivatives but are not allowed for general payment use within the UAE.
Licensing and Compliance:
Companies providing payment token services must obtain specific licenses from the Central Bank based on their activities:
- Dirham Payment Token Issuer
- Payment Token Custodian and Transferor
- Payment Token Converter
Businesses in the UAE are prohibited from accepting virtual assets as payment unless they are Dirham-backed payment tokens. The PTSR also imposes restrictions on promoting certain types of tokens, such as algorithmic stablecoins and privacy tokens, to maintain financial stability and ensure compliance with AML and Counter-Terrorism Financing (CFT) regulations.
Payment tokens used in reward and bonus point schemes are exempt from the scope of these regulations, recognizing the lower risk associated with such programs.
Emirate-Level Regulators
Dubai Virtual Assets Regulatory Authority VARA
Dubai has taken significant strides in establishing itself as a global hub for virtual assets by creating the Virtual Assets Regulatory Authority (VARA). Established under Dubai’s Virtual Assets Law No. 4 of 2022, VARA is responsible for regulating virtual asset activities in Dubai, including its economic free zones (excluding the Dubai International Financial Centre).
Regulatory Framework:
VARA has developed a comprehensive set of regulations and guidelines that entities must follow to operate within Dubai’s virtual asset ecosystem. This includes the Virtual Assets and Related Activities Regulations 2023, which set out licensing requirements, compliance obligations, and operational standards for VASPs. VARA has also issued Marketing Regulations which are applicable to all market participants in Dubai, regardless of whether they are directly licensed by VARA. Additionally, VARA has released both general rulebooks and activity-specific rulebooks to provide detailed guidance for compliance in various virtual asset activities.
Licensing and Activities:
All VASPs and traditional businesses must obtain a license from VARA before initiating any virtual asset-related activities within Dubai or offering such services from Dubai to local or, where allowed, international customers.
VARA issues licenses for a range of activities, including:
- Advisory Services
- Broker-Dealer Services
- Custody Services
- Exchange Services
- Lending and Borrowing Services
- Management and Investment Services
- Transfer and Settlement Services
- Virtual Asset Issuance
VASPs licensed by VARA must comply with four compulsory rulebooks:
- Company Rulebook
- Compliance and Risk Management Rulebook
- Technology and Information Rulebook
- Market Conduct Rulebook
In addition to these, VASPs must adhere to activity-specific rulebooks relevant to the services they offer.
A VASP can obtain licenses for multiple activities under one overarching license, except for Virtual Asset Custody Services, which must remain separate from other virtual asset categories. Any entity licensed for multiple activities must comply fully with the requirements for each service and maintain this compliance continuously.
VARA regulates the issuance of virtual assets, requiring approval for token offerings that meet certain criteria, such as exceeding specified transaction thresholds or involving a large number of participants. Issuers of utility tokens must register their whitepapers with VARA at least seven working days before publication and must comply with all virtual asset issuance rules.
Abu Dhabi Global Market (ADGM): Financial Services Regulatory Authority (FSRA)
The Abu Dhabi Global Market (ADGM) is a financial free zone that operates under its own legal system based on English common law principles. The Financial Services Regulatory Authority (FSRA) is the independent regulator of financial services within the ADGM.
Regulatory Framework:
In 2018, the FSRA became one of the pioneering regulators worldwide to create a comprehensive framework for virtual assets by amending its Financial Services and Markets Regulations 2015 (FSMR). Since then, the FSRA has consistently updated its regulations to keep pace with the rapidly evolving virtual asset landscape. To ensure a robust regulatory environment, the FSRA has issued detailed regulations and guidance notes covering various aspects of virtual assets, including the regulation of digital securities and their offerings, the regulation of virtual assets and related activities, and provisions for DLT (Distributed Ledger Technology) foundations.
Classification & Treatment of Digital Assets:
- Virtual Assets: Treated as commodities (e.g., cryptocurrencies like Bitcoin and Ethereum) and not classified as specified investments under the FSMR. Activities involving virtual assets require licensing or approval from the FSRA. Only “Accepted Virtual Assets” that meet the FSRA’s criteria are permitted for use within the ADGM.
- Digital Securities: Digital tokens that exhibit characteristics of securities (e.g., shares, bonds). These are classified as securities under the FSMR, and all financial services related to digital securities are subject to the same regulatory requirements as traditional securities.
- Fiat Tokens (Stablecoins): Recognized as a digital representation of fiat currency when fully backed by underlying fiat currencies. The FSRA has specific regulations governing the issuance and use of fiat tokens within the ADGM.
Licensing and Compliance:
Market intermediaries such as broker-dealers, custodians, asset managers dealing with or managing virtual assets, and multilateral trading facilities must be licensed or approved by the FSRA. Entities must meet stringent requirements related to capital adequacy, governance, systems and controls, and AML/CFT compliance.
Dubai International Financial Centre (DIFC): Dubai Financial Services Authority (DFSA)
The Dubai International Financial Centre (DIFC) is a leading financial hub in the Middle East, Africa, and South Asia region. It operates under an independent legal and regulatory framework consistent with English common law. The Dubai Financial Services Authority (DFSA) is the independent regulator of financial services conducted in or from the DIFC.
Regulatory Framework:
The DFSA has taken a cautious yet progressive approach to regulating cryptocurrencies and digital assets. In 2024, the DIFC introduced Digital Assets Law No. 2 of 2024, which established a comprehensive legal framework for digital assets. This law defines digital assets as a type of property, providing clear rules for ownership, control, and transfer.
Similar to FSRA, the DFSA maintains a list of Recognized Crypto Tokens, which are approved for use within the DIFC. The process for recognizing crypto tokens involves a thorough assessment to ensure they meet criteria related to security and resilience, transparency, and AML/CFT compliance.
Licensing and Compliance:
The DFSA issues licenses for companies providing services related to crypto tokens, including custody, exchange, advisory, and investment services. Businesses operating in these areas must comply with stringent requirements on governance, risk management, systems and controls, and AML/CFT obligations ensuring a high standard of regulatory oversight. They must also ensure consumer protection measures are in place.
Conclusion
By fostering a regulatory environment that balances innovation with robust oversight, the UAE continues to solidify its position as a global leader in the cryptocurrency and virtual asset sector. The country’s progressive policies and comprehensive regulations attract businesses and investors while ensuring the protection of consumers and the integrity of the financial system.
Entities looking to operate within this ecosystem must navigate the regulatory landscape carefully, ensuring full compliance with both federal and local regulations. This includes obtaining the necessary licenses, adhering to stringent compliance requirements, and staying updated on regulatory developments.
Contact us today for a strategic legal session and let us help you successfully enter the UAE crypto business market.
