The UAE has become an increasingly important jurisdiction for businesses operating in digital assets. The regulatory environment is more developed than it was a few years ago, and a number of international businesses have established regulated operations in the country.
There is no single UAE regulator responsible for all digital-asset activity. The regulatory position depends on a combination of factors, including where the business is established, the nature of the activities it carries out, the type of digital asset involved and, in some cases, whether the business is also providing regulated payment services.
This distinction matters in practice. A business that applies for the wrong licence, assumes that an authorisation in one UAE jurisdiction applies throughout the country, or overlooks a separate regulatory requirement can find itself having to restructure its operations after the fact. For a business entering the market, understanding the regulatory perimeter should therefore form part of the initial planning process.
The five regulatory authorities relevant to digital assets
1. The Capital Market Authority (CMA) – The Federal Framework
At federal level, the Capital Market Authority (CMA) replaced the Securities and Commodities Authority (SCA) on 1 January 2026 as part of the UAE’s restructuring of its capital-markets regulatory framework.
On 13 February 2026, the CMA issued Decision No. 4/R.M/2026, establishing a new federal framework for Virtual Asset Service Providers (VASPs). The framework establishes eight regulated virtual asset activities, including dealing in virtual assets as principal or agent, custody, arranging custody, investment advice, portfolio management, arranging investment transactions and operating a multi-party trading platform.
The framework also introduces requirements relating to areas such as governance, conduct of business, anti-money laundering and counter-terrorist financing, prudential requirements and the registration or recognition of virtual assets. A business therefore needs to consider both the nature of the service it provides and the regulatory treatment of the assets with which it intends to deal.
While the CMA operates at federal level and is subject to the separate regimes that apply within the UAE’s financial free zones, its regulatory perimeter may also be relevant to businesses based outside the UAE where their activities are directed towards the UAE market.
For businesses looking at the federal regime, the key question is whether the particular activity falls within one of the regulated activities under the CMA’s framework and whether the relevant virtual assets meet the applicable requirements.
2. The Virtual Assets Regulatory Authority (VARA) – Dubai Mainland and Dubai Free Zones Outside DIFC
Dubai has its own dedicated virtual-asset framework overseen by the Virtual Assets Regulatory Authority (VARA), established under Dubai Law No. 4 of 2022.
VARA regulates virtual-asset activities across Dubai’s mainland and free zones, except for the Dubai International Financial Centre (DIFC). Its regulatory framework covers activities including exchange, custody, broker-dealer services, advisory, lending and borrowing, and management and investment services. Virtual-asset issuance is also regulated within the VARA framework.
VARA’s rules are activity-based, meaning that a business carrying out more than one regulated activity needs to consider the requirements applicable to each activity. Its Exchange Services Rulebook, for example, contains requirements specific to businesses operating exchanges and related services.
The distinction between the different Dubai jurisdictions is important. A company incorporated in the DIFC is not regulated by VARA simply because it is physically located in Dubai. The DIFC has its own financial services regulator, the Dubai Financial Services Authority.
For a business establishing itself in Dubai, the free-zone question should therefore be addressed at the outset. The location of incorporation can determine which regulatory regime applies.
3. The Dubai Financial Services Authority (DFSA) – DIFC Only
The Dubai Financial Services Authority (DFSA) regulates financial services within the Dubai International Financial Centre. The DIFC operates under its own legal and regulatory framework and is separate from both Dubai mainland and the other Dubai free zones regulated by VARA.
The DFSA’s approach to crypto tokens has also changed. Its updated Crypto Token framework came into effect on 12 January 2026. One of the significant changes was the removal of the DFSA’s prescribed list of Recognised Crypto Tokens.
Under the current framework, firms are responsible for determining, on a documented basis, whether the Crypto Tokens they intend to use meet the DFSA’s suitability criteria. The updated framework also includes requirements relating to areas such as conduct, custody, governance, and disclosure.
This means that businesses considering the DIFC needs to understand the DFSA’s current requirements and assess whether the relevant token and proposed activity fall within them.
The DIFC’s separate status also means that a business should not assume that a VARA authorisation can be used to conduct the same activity from a DIFC entity, or vice versa.
4. The Financial Services Regulatory Authority (FSRA) – ADGM Only
The Financial Services Regulatory Authority (FSRA) is the financial-services regulator within Abu Dhabi Global Market (ADGM).
Like the DIFC, ADGM is a financial free zone with its own courts and legal framework. The FSRA has operated a regulatory framework for virtual assets since 2018, covering activities such as exchanges, custody and other regulated intermediary services.
The FSRA also introduced a finalised framework for Fiat-Referenced Tokens (FRTs), which took effect on 1 January 2026. The framework sets out requirements for authorised persons conducting regulated activities involving FRTs and expands the regulatory framework applicable to these assets.
Capital requirements depend on the particular regulated activity. Certain Category 4 activities, including advising on investments and arranging deals in investments, have a base capital requirement of US$10,000, subject to the applicable prudential requirements.
For businesses considering ADGM, the regulatory analysis should therefore start with the proposed business model and the specific activities the business intends to undertake. The fact that a business operates in digital assets does not, on its own, determine which FSRA permission it requires.
5. The Central Bank of the UAE (CBUAE) – Payment Tokens and Payment Activities
The Central Bank of the UAE (CBUAE) has a different role from the authorities discussed above. It is not the general regulator for virtual-asset activities such as exchange, custody or investment advice. Its relevance becomes particularly important where a digital-asset business’s activities involve payment tokens or regulated payment services.
The CBUAE’s Payment Token Services Regulation establishes requirements for activities including the issuance of Payment Tokens, custody and transfer of Payment Tokens, and Payment Token conversion. The framework distinguishes between Dirham Payment Tokens and Foreign Payment Tokens and provides for licensing or registration requirements depending on the activity and the entity involved.
This creates an important regulatory distinction for businesses operating in the digital-asset sector. A company may be authorised by a virtual asset regulator to conduct certain activities, but that does not necessarily mean that it is authorised to provide a regulated payment-token service.
Businesses whose models involve stablecoins, payment functionality or the movement of payment tokens therefore need to assess the CBUAE framework alongside the rules of the relevant virtual-asset regulator.
Which regulator applies to your business?
There is no single answer that applies to every digital-asset business in the UAE.
The first question is where the business is established. A company operating from Dubai mainland will face a different regulatory analysis from one established in the DIFC or ADGM. A company established in another Dubai free zone will generally fall within VARA’s jurisdiction rather than the DIFC regime.
The next question is what the business actually does. An exchange, custodian, adviser, broker-dealer, portfolio manager, token issuer and payment-token provider do not necessarily require the same regulatory permissions. A business carrying out several of these activities may need to consider more than one regulatory permission.
The nature of the asset also matters. The regulatory treatment can differ depending on whether the business is dealing with a virtual asset, a security, a commodity, a payment token or another regulated financial instrument.
Finally, businesses operating from outside the UAE should not assume that being incorporated offshore places them outside the UAE regulatory perimeter. How the business offers its services and whether it actively targets clients in the UAE can also be relevant to the analysis.
For example, a Dubai-based virtual-asset business that also intends to provide regulated payment-token services may need to consider both VARA and the CBUAE. Similarly, a business operating under the federal framework may need to assess whether aspects of its model fall within the CBUAE’s payment-token regime.
The fact that a business has obtained a licence from one UAE authority should therefore not be treated as a blanket authorisation to conduct regulated digital-asset activities throughout the UAE.
Why the regulatory mapping matters
For businesses entering the UAE market, regulatory mapping should take place before the entity is established and before applications are submitted.
The analysis should identify the proposed entity and its jurisdiction, the activities the business intends to conduct, the nature of the digital assets involved, the location of its clients and any interaction with regulated payment services.
That exercise can also affect the commercial structure of the business. Choosing between Dubai mainland, another Dubai free zone, DIFC or ADGM is not simply a question of location or incorporation costs. The choice can determine which regulator the business deals with and which regulatory requirements apply to its proposed activities.
The same consideration applies to expansion. A licence obtained in one UAE jurisdiction should not automatically be assumed to permit the business to carry out the same regulated activity from another jurisdiction.
Conclusion
The UAE’s digital-asset regulatory environment is becoming increasingly structured, but it is not a single-regulator system.
The CMA provides the federal framework for relevant virtual-asset activities. VARA regulates virtual assets across Dubai outside the DIFC. The DFSA regulates financial services involving crypto tokens within the DIFC, while the FSRA regulates relevant financial activities within ADGM. The CBUAE has a separate and important role where digital assets intersect with payment-token services and the regulated payments sector.
For businesses looking to enter or expand in the UAE, the starting point should therefore be the business model rather than the name of a particular licence. Understanding where the business sits within the UAE’s regulatory framework can help determine the appropriate jurisdiction, regulatory permissions and compliance obligations before operations begin.
That is particularly important in a sector where the regulatory perimeter can depend as much on what the business does and where it does it as on the fact that the business describes itself as a digital asset or crypto business.
Legal review: Stella Igidi
Please contact us for more information and/or assistance with all legal matters.
