United Arab Emirates
Overview
The UAE is not a single regime. VARA licenses virtual-asset activity in Dubai (outside the DIFC); ADGM FSRA and DIFC DFSA license firms in their financial free zones; the federal Capital Market Authority (CMA) licenses onshore virtual-asset activity. The CBUAE regulates payment tokens.
A licence is location- and activity-specific: a VARA licence does not passport to ADGM, DIFC or the federal regime. The CMA replaced the SCA on 1 January 2026 and issued Decision No. 4/R.M/2026 on 13 February 2026, moving from three broad categories to eight licensed activities.
Regulatory framework
VARA (Dubai). The Company Rulebook defines eight activities: issuance, custody, exchange, transfer and settlement, broker-dealer, lending and borrowing, advisory, and management and investment. Each needs the relevant VARA permission; the regime covers marketing and the full lifecycle.
ADGM FSRA. A financial services permission with virtual-asset permissions; the rulebook covers custody, exchange, dealing, arranging, advice and lending. The VA regime is an add-on to the underlying activity permission.
DIFC DFSA. The crypto token regime covers custody, exchange, advice, arranging and lending; the DFSA moved to a firm-led suitability model for crypto tokens in January 2026. Custody sits in Category 3B with a USD 1m base capital requirement.
Federal CMA. Decision No. 4/R.M/2026 replaced the 2023 VASP framework with five modules (general requirements, conduct, alternative trading systems, AML/CTF, prudential) and eight activities. Existing providers have a transition window; the CMA has said conduct and supervision apply from day one.
CBUAE. Payment tokens and payment-token services are regulated by the Central Bank; they sit outside the VARA/FSRA/DFSA/CMA licensing perimeter.
Licensing & authorisation
VARA. Two-stage entry (provisional, then full commercial). Application fees: AED 40,000 provisional and AED 100,000 full; annual supervision AED 80,000 and AED 200,000. Capital by activity: AED 100,000–1,500,000. No published statutory decision clock; plan 6–12 months.
ADGM FSRA. The VA add-on is USD 20,000 on application and USD 15,000 annual supervision, on top of the underlying activity fees. The FSRA’s worked example for dealing, arranging and VA totals USD 70,000 application and USD 75,000 supervision; an MTF also pays the trading levy.
DFSA. Permissions are activity-based; fees are in the DFSA Fee Rules. A crypto ATS pays a USD 150,000 application fee; custody is Category 3B with USD 1m base capital. No statutory decision clock; 6–9 months is common market practice.
CMA. Activity-based licensing under the eight categories. Capital floors are set in the prudential module and vary by activity; the public framework does not publish a fee schedule, so request the current CMA fee basis. The transition window for existing providers is time-limited.
AML & Travel Rule
The EU TFR does not apply in the UAE. Each regime applies its own AML/CFT rulebook — VARA’s Compliance and Risk Management Rulebook, the ADGM AML/CFT rules, the DFSA AML module and the federal AML/CFT framework for CMA licensees — with customer due diligence, sanctions screening and suspicious-transaction reporting.
For transfers, expect originator/beneficiary and counterparty information to be required by the applicable regime and by the UAE’s federal AML/CFT rules. Payment tokens and payment-token service providers are also subject to CBUAE requirements.
Track developments
This jurisdiction isn't yet on the live wire (its regulator doesn't publish a machine-readable feed) — follow the regulator directly.
Regulator news