Gulf Laws on Digital Assets: UAE Regulations Explained
Surprising fact: more than a dozen regulators in the UAE influence crypto and token activity, creating a patchwork that can change how a business is licensed and supervised.
This report defines key terms plainly: “digital assets” and “virtual assets” refer to tradable tokens and crypto units, while a “VASP” means a service provider that handles exchange, custody, or transfer. Terminology and licensing triggers vary by regulator and location.
The United Arab Emirates uses a multi-layered regulatory framework: federal civil law sits alongside emirate-level rules and two common-law free zones (DIFC and ADGM). Major authorities include the SCA, VARA, DFSA, FSRA and the UAE Central Bank for certain payment-related activity.
Readers will learn who regulates what, which licenses apply, and what legal tools exist for disputes or fraud. Expect caution about overlap, limited passporting between jurisdictions, and the need to match a business model to the right authority.
Key Takeaways
- Terminology and triggers differ by regulator and location.
- UAE regulation combines federal rules with free-zone regimes.
- SCA, VARA, DFSA, FSRA and the Central Bank each have distinct roles.
- Regulatory overlap and no automatic passporting raise compliance risk.
- Match your business model to the correct jurisdiction and license.
UAE Digital Assets Market Snapshot and Why Regulation Is Accelerating
The UAE market for token trading and related services has entered a phase of steady revenue growth and rising user adoption.
Revenue outlook: Market projections put UAE revenues above US$464 million in 2025, with a compound annual growth rate near 4.59% and almost four million users expected by 2026. These figures help explain why regulators moved from guidance to formal rules.
Revenue outlook and user growth through 2026
Faster uptake drives increased scrutiny. More retail participation raises consumer-protection checks, AML obligations, and tighter marketing limits.
Dubai’s push to become a global virtual assets hub
Dubai aims to shape the future of virtual assets globally. That ambition needs credible supervision—licensing, governance standards, tech controls and conduct rules—to support sustainable finance and innovation in a clear regulatory environment.
| Metric | 2024 | 2025 (proj.) | 2026 (users proj.) |
|---|---|---|---|
| Revenue (US$) | 445M | 464M+ | – |
| CAGR | — | ~4.59% | — |
| Users | 3.4M | 3.8M | ~4M |
| Regulatory focus | Consumer protection | Licensing & governance | Payments & custody oversight |
Practical takeaway: rapid market expansion can benefit business, but it raises the cost of misclassifying a token or choosing the wrong licensing jurisdiction. For context about the UAE’s regulatory positioning, see UAE emerges as top hub.
How the UAE’s Multi-Layered Regulatory Framework Works
Understanding structure: the UAE combines federal civil law with separate financial free zones that apply different commercial rules. This creates a multi-layered system where location matters for compliance and enforcement.
The term “onshore UAE” refers to mainland jurisdictions governed by federal civil codes and local emirate courts. Abu Dhabi, Dubai and Ras Al Khaimah keep independent judiciaries for non-federal matters, which can affect dispute outcomes and remedies.
Federal Law No. 8 of 2004 permits Financial Free Zones—notably the DIFC and ADGM—to operate with their own civil and commercial regimes. These zones are exempt from many federal civil rules but remain subject to federal criminal law, including AML obligations.
Boundary questions are common: a company incorporated in a free zone but serving customers outside that zone may trigger additional permits or supervision under onshore or federal regimes. Licensing, marketing, and conduct rules can differ materially across jurisdictions.
Practical checklist for compliance planning:
- Identify the location of activity;
- Define the customers targeted;
- Classify the service type (exchange, custody, advisory, etc.).
Key Regulators Shaping Digital Asset Compliance in the United Arab Emirates
Multiple authorities split oversight of token trading, payments and market conduct. Firms must map regulators to activities before applying for permits.
Securities and Commodities Authority (SCA)
The securities commodities authority acts as the federal regulator for many onshore market activities. It sets licensing expectations for trading platforms, custody services and public token offerings under federal decisions.
UAE Central Bank
The Central Bank supervises payment-linked services: stored value, retail payment services and fiat‑backed stablecoin arrangements. Payment approvals often sit separately from exchange or custody licenses.
Dubai Virtual and Free‑Zone Regulators
VARA governs onshore Dubai activity outside the DIFC. Its remit excludes the DIFC despite geographic overlap, so firms in Dubai must check whether VARA or another body is the lead regulator.
DFSA and FSRA (DIFC & ADGM)
The dubai financial services regulator (DFSA) and the ADGM financial services regulatory authority (FSRA) supervise free‑zone business inside DIFC and ADGM. Each uses distinct token classification and licensing approaches.
Practical tip: identify the primary “front door” regulator for your model, then confirm whether secondary approvals (payments, custodial permissions) are required.
Federal Rules for Virtual Assets: Cabinet Decision No. 111 of 2022 and Delegation Pathways
Federal Cabinet Decision No. 111 of 2022 made licensing a baseline requirement for most onshore virtual asset activity. No person may offer covered services in onshore UAE without approval and a licence from the Securities and Commodities Authority (SCA) or an authorised local licensing authority.
Licensing requirement for onshore virtual asset activities
The decision means firms must seek formal permission before operating. That applies to trading, custody, exchange, and related services that target UAE customers from an onshore location.
Delegation pathways and Cabinet Resolution No. 112/2022
“Delegation pathways” let federal authorities assign specific supervisory powers to an emirate-level regulator while keeping federal oversight. Cabinet Resolution No. 112/2022 delegated certain SCA competencies to VARA for emirate Dubai (excluding DIFC).
“Delegation does not remove federal authority; it clarifies which body issues licences and supervises activity within the specified jurisdiction.”
What “local licensing authority” means in practice
In practice, a local licensing authority is the named regulator that accepts applications and enforces compliance in that emirate. It is not optional—choosing the wrong touchpoint creates enforcement risk.
- If operating in Dubai onshore, VARA is typically the licensing touchpoint (DIFC excepted).
- If operating in other emirates onshore, the SCA is usually the primary contact.
- Misunderstanding delegation can lead to incorrect licensing, marketing breaches, and enforcement exposure.
| Issue | Primary Authority | Practical impact |
|---|---|---|
| Onshore Dubai (excluding DIFC) | VARA (per Cabinet Resolution No. 112/2022) | File licence with VARA; comply with VARA rulebooks and reporting |
| Other emirates onshore | SCA (Cabinet Decision No. 111 of 2022) | File with SCA; follow federal supervision and licensing tests |
| DIFC free zone | DFSA / DIFC regime | Separate licensing regime; delegation to VARA does not apply |
Securities and Commodities Authority Regulations on Crypto Assets Activities
The Securities and Commodities Authority sets clear boundaries for which token activities trigger licensing and oversight. Its Decision No. 23 of 2020 frames the core perimeter: offering, issuing, listing and trading of tokens and related regulated financial activities fall inside the SCA’s remit.
SCA Decision No. 23 of 2020 and scope
Decision No. 23 targets market-facing services—exchanges, custodial arrangements that look like financial custody, token issuances and public offerings. Informational platforms or purely open-source software generally sit outside this scope, provided they avoid custody or transactional functions.
Administrative Decision No. 11 of 2021 — practical expectations
Administrative Decision No. 11 requires firms to implement governance, risk controls, disclosure discipline and active supervisory engagement. Expect formal policies, audit trails and clear senior-manager accountability.
May 2023 platform operator updates
In May 2023 the SCA tightened rules for Virtual Assets Platform Operators and amended the rulebook. Exchanges and trading venues face higher standards for custody, market‑surveillance and participant onboarding than software or information providers.
“Only tokens on the SCA official list or licensed by VARA may be traded in the UAE.”
Operational implications are straightforward: formalize token onboarding, due diligence and listing committee sign-offs. A common pitfall is assuming foreign listings or global popularity alone permit UAE trading—local listing or VARA approval is required.
Dubai Onshore Virtual Assets Law: Law No. 4 of 2022 and VARA’s Mandate
Dubai made a major change in March 2022 when it established a single regulator for onshore virtual activity. The new framework means firms must secure permits before offering covered services in the emirate Dubai.
What changed for exchanges, custody, and token offerings
Law No. 4 of 2022 created VARA as the local regulatory authority. The law forbids platform operation, custody or public offerings without a permit. Exchanges, wallet providers and custodians were directly affected because their business models map to the statute’s permit triggers.
Activities requiring permits under Article 16
- Platform operation and exchange services (VA/fiat and VA/VA).
- Transfer, safekeeping and custody or managed wallet services.
- Offering, listing or trading in tokens and token distribution services.
“Covered activity in the emirate Dubai requires prior VARA approval and licensing.”
Jurisdiction boundaries: onshore Dubai versus the DIFC
VARA’s remit excludes the DIFC free zone. A VARA licence does not substitute for DFSA or DIFC permissions. Firms should confirm where staff and servers are located and where customers are marketed. Early engagement with regulators reduces enforcement risk.
| Activity | Permit needed | Practical impact |
|---|---|---|
| Spot exchange | Yes | Licensing, onboarding standards, market conduct rules |
| Custody / wallet | Yes | Technology, custody controls, segregation and audits |
| Token offering | Yes | Disclosure, token due diligence, listing approvals |
VARA Virtual Asset Framework: Regulations, Rulebooks, and VASP Licensing
The Virtual Assets and Related Activities Regulations, issued by VARA on 7 February 2023, set licensing gates for firms providing virtual asset services to or from Dubai (excluding the DIFC).
VARA groups activity into seven modular VASP categories: advisory, broker‑dealer, custody, exchange, lending/borrowing, payments/remittances, and management/investment. A single business often needs multiple permissions when it combines trading, custody or advisory functions.
Four compulsory rulebooks apply to every VASP: company governance; compliance and risk; technology and information security; and market conduct. These set baseline obligations for board oversight, AML controls, system resilience and fair dealing.
- Activity rulebooks add specific duties — an exchange faces different custody and surveillance rules than a custodian or adviser.
- Marketing, Advertising and Promotions rules govern public campaigns; penalties apply for breaches and for misleading claims.
- VARA’s 2025 supervision updates tightened margin trading controls and token distribution rules, with compliance required by 19 June 2025.
Practical takeaway: embed compliance early — policies, incident response, vendor checks and clear customer disclosures reduce licensing friction with the emirate Dubai regulatory authority.
SCA-VARA Coordination and the Evolving Unified Register of VASPs
Coordination matters because firms rarely limit customers to a single emirate. The emerging regulatory framework seeks to close visibility gaps and make supervision more predictable for operators of virtual asset services.
The cooperation agreement means a VARA licence for emirate dubai is now visible at a federal level via the securities and commodities authority registration process.
Practically, VARA remains the licensing gatekeeper for Dubai activity. The SCA keeps federal oversight and a consolidated view of who is authorised to provide virtual asset services across the country.
What the unified register aims to achieve
The register is designed to list authorised firms, the specific services they may offer, and any licence conditions. That clarity helps regulators spot overlaps and reduces the risk of unlicensed outreach across emirates.
Operational impact for expanding firms
- Internal controls must reflect local variances even with federal visibility.
- Marketing, customer onboarding and tech controls need jurisdictional checks.
- DIFC and ADGM remain separate; coordination does not replace their licences.
“A unified register gives supervisors a clearer picture — but firms must still plan licensing by emirate.”
Compliance takeaway: expansion requires a jurisdiction‑by‑jurisdiction licensing and marketing review, not just a single corporate registration. Plan early and map each service to the correct regulatory gatekeeper.
DIFC Regulation: DFSA Crypto Token Regime and Dubai Financial Services Considerations
The DIFC sits apart as a common‑law free zone that targets institutional finance and bespoke market infrastructure. Its separate courts and the DFSA regulator make the centre attractive for certain financial services and institutional models.
DFSA Crypto Token Regime
The DFSA moved from consultation to a formal Crypto Token Regime, effective 1 November 2022. That shift created a rules‑based authorization path for regulated token activity inside the DIFC.
Tokenisation and the sandbox pathway
DIFC initiatives include tokenisation pilots and a Tokenisation Regulatory Sandbox. These allow controlled testing, regulator engagement, and stronger evidence for full licencing decisions.
No passporting and dual licensing
No passporting means a DIFC licence does not automatically permit activity in onshore Dubai. Firms may need dual licences—DFSA for DIFC institutional work and VARA for retail or onshore marketing.
- Example: institutional token issuance in DIFC plus VARA permission to offer retail wallets in Dubai.
- Risk note: inconsistent disclosures or custody setups across licences can create conduct and compliance failures; central governance is essential.
DIFC Digital Assets Law No. 2 of 2024 and the Legal Definition of a Digital Asset
DIFC Digital Assets Law No. 2 of 2024 gives tokens a clear statutory identity. Section 8 defines a “digital asset” as a notional unit created by software or network data that exists independently, cannot be duplicated and is exclusively usable. This wording intentionally captures cryptocurrencies, NFTs and related tokens.
Why Section 8 matters
The definition is technology-aware. It focuses on exclusive control and non-duplication, mirroring how blockchain tokens operate.
Article 9 — property treatment
Article 9 classifies these units as intangible property. The law frames them as a “third class of property” — neither a physical thing nor a mere claim — which affects ownership and transfer mechanics.
Practical effects and legislative updates
- Remedies: Property status expands enforceable options such as possession-based remedies and valuation orders.
- Transactions: New contract and security law language supports tokenised collateral and custody agreements.
- Trusts & foundations: Amendments enable digital holdings to sit in fiduciary structures.
“Within DIFC, token-based holdings are placed into a clear legal box that supports enforceable rights.”
| Issue | Statutory effect | Practical impact |
|---|---|---|
| Definition (Section 8) | Notional, exclusive, non-duplicable unit | Identifies which units trigger regulatory and contractual regimes |
| Property status (Article 9) | Intangible property / third class | Permits property-based remedies and security interests |
| 2024 legislative updates | Contract, remedies, trust, security reforms | Enables tokenised collateral, clearer default rules, and custody law fit |
ADGM Virtual Asset Regime: FSRA Rules, FSMR 2015, and Common Law Foundations
Abu Dhabi Global Market (ADGM) built one of the region’s earliest spot trading rulebooks for tokens and updated it as markets matured.
Early framework and updates: The Financial Services Regulatory Authority (FSRA) launched a bespoke spot virtual asset framework in 2018. That framework was revised in September 2022 to reflect market evolution and supervisory learning.
How FSMR 2015 defines a virtual asset
Definition: FSMR describes a virtual asset as a digital representation of value that can be traded and that serves as a medium of exchange, unit of account, or store of value without legal tender status.
“The FSMR definition distinguishes virtual asset forms from fiat and e-money while guiding which instruments fall inside regulated scope.”
Exclusions and permissioned activities
Certain items are excluded from the definition: specified investments, fiat-referenced tokens, and spot commodities where applicable. Classification matters because it determines which rulebook applies.
Financial Services Permission (FSP): Activities that require permission include dealing, advising, arranging, managing assets, custody, and operating an MTF. Each activity needs an FSP that matches the exact service model.
| Issue | Regime | Practical effect |
|---|---|---|
| Spot trading | FSRA framework (2018; updated 2022) | Requires MTF or exchange permission, market rules, surveillance |
| Custody | FSMR-based classification | Separate custody FSP; tech and segregation controls |
| Advisory / managing | Financial services permission | Suitability, disclosure and governance expectations |
Practical takeaway: ADGM’s common-law foundations help structuring and dispute remedies, but firms must secure the correct FSP before launching. Align product design—exchange, custody, or brokerage—to the permissioned scope to avoid supervisory gaps.
Legal Status of Digital Assets as Property Across UAE Jurisdictions
Courts across UAE jurisdictions are increasingly treating tokens as recognisable property, not mere contractual promises. This shift matters because many recovery tools—freezing, tracing and enforcement—depend on a court accepting ownership as property.
DIFC: Huobi v Tabarak (June 2024)
Key ruling: the DIFC Court of Appeal held that Bitcoin is intangible personal property — a “third class of property.” The court stressed that control of private keys is central to title.
Onshore Dubai: Practical remedies
The Dubai Court of First Instance (Case No. 1872/2024) ordered return of 29 Bitcoin and 102 Ethereum in kind, or payment of the cash equivalent at current market rates. That shows onshore courts will compel either physical return of tokens or fiat compensation tied to market value.
- Why it matters: recognition as property unlocks civil remedies and enforcement tools.
- Investor signal: courts treat crypto and virtual asset holdings as enforceable rights.
- Risk control: custody arrangements, key management and transaction records are critical evidence in disputes.
Takeaway: across UAE forums, the trend strengthens recovery options. Forum selection still shapes available remedies and the speed of enforcement.
Enforcement and Recovery Tools for Virtual Assets in the UAE
Recognising the speed of blockchain transfers, DIFC and ADGM courts offer swift injunctive relief to preserve contested holdings. Freezing injunctions and Worldwide Freezing Orders (WFOs) prevent disposal or movement of value while proceedings continue.
Freezing orders and “Persons Unknown”
Courts can name unnamed or pseudonymous wallet holders as Persons Unknown. That allows immediate relief where wrongdoers are not yet identified.
How exchanges and banks respond
Where orders are valid and jurisdictionally proper, exchanges and banks usually comply. They implement account holds, wallet freezes, or withdrawal blocks to meet court demands.
Service challenges and on‑chain notices
Traditional service can be slow. Emerging strategies include blockchain-based service of process and tokenised notices tied to wallet addresses to increase visibility.
- Preserve transaction IDs, wallet addresses, and timestamps immediately.
- Collect exchange account identifiers and KYC summaries to speed enforcement.
- Work with forensic tracing providers to map transfers before further dissipation.
“Speed matters: early preservation and clear evidence improve the chance of recovery.”
Cross-Border Enforcement Challenges for Gulf Laws on Digital Assets
The mechanics of freezing and recovering token value across jurisdictions are complex and often counterintuitive. A “worldwide” freezing order does not itself move funds or compel third-party intermediaries in another legal forum; recognition or fresh relief is usually required where the asset, account, or intermediary sits.
Why foreign freezing orders are not automatically binding onshore
Jurisdictional reach matters: DIFC or English WFOs rely on court authority within their territorial remit. Onshore UAE institutions and courts may not treat those orders as self-executing. Parties must follow local recognition or enforcement routes to make relief effective.
Local enforcement routes across onshore UAE, DIFC, ADGM, and other territories
Practically, claimants must often re‑apply for interim relief where custodians, exchanges, or banks operate. That can mean separate urgent applications in onshore UAE courts, DIFC courts, ADGM courts, or foreign forums.
- Register judgments where treaties or procedures permit registration.
- Seek fresh freezing or injunctive relief in the forum holding the asset.
- Engage exchanges and banks early—some will comply voluntarily after assessing reputational and regulatory risk.
Parallel relief strategy: using UK section 25 support for DIFC proceedings where applicable
A coordinated plan often works best: select a lead forum (for example DIFC or ADGM) and pursue supportive interim relief in other jurisdictions where value is likely to surface.
“Cross-border recovery is a process, not a single order.”
UK section 25 of the Civil Jurisdiction and Judgments Act 1982 is an example: where a sufficient connection to England exists, English courts can grant interim measures in aid of foreign proceedings such as DIFC claims. This can bolster preservation efforts while local enforcement steps proceed.
Takeaway: budget time and costs for multiple filings, gather chain-of-title evidence early, and plan parallel actions in courts and with intermediaries to reduce the risk of dissipation.
Conclusion
The UAE has created a layered regulatory framework that supports innovation while controlling market conduct and financial-crime risk.
Practical compliance: licences depend on activity and location—onshore UAE, Dubai, DIFC and ADGM follow different rulebooks. Firms offering virtual asset services must match permits to each jurisdiction.
Courts now treat many holdings as property, strengthening remedies such as freezing orders, but cross-border recovery still needs local enforcement steps and careful evidence preservation.
For businesses the message is clear: governance, custody design, token listing standards and marketing reviews are essential. Before launching any virtual assets service, confirm the regulator, classification pathway and the compliance program required to operate sustainably in the UAE environment.
