Blockchain Technology: 2025 Legal Landscape in UAE
Which regulator you answer to is settled by where you incorporate, and the federal AML rules apply either way
Federal Decree Law No. 10 of 2025 and the UAE adoption of CARF reach every licensed virtual asset business. VARA licenses virtual asset activity across Dubai outside the DIFC, while the ADGM FSRA regulates the same ground under English common law. A table sets the two regimes side by side, then the legal problems that follow from the split.
Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant
Two businesses doing the same thing — holding client crypto and matching trades — can answer to different regulators, under different legal systems, on the strength of where each one incorporated. A Dubai company deals with the Virtual Assets Regulatory Authority (VARA) under civil law. An Abu Dhabi Global Market company deals with the Financial Services Regulatory Authority (FSRA) under English common law. Whichever authority licenses them, both must adhere to the federal anti-money laundering requirements as well.
The federal AML rules apply whoever holds your licence
Federal Decree Law No. 10 of 2025 replaced the previous AML Law. It introduced stronger enforcement powers and clearer obligations for designated non-financial businesses and professions (DNFBPs), a category that includes many Virtual Asset Service Providers (VASPs). The Executive Regulations, operationalised in late 2025, supplied the granular detail needed for compliance.
The impacts on the blockchain sector include the following.
- Mandatory registration. All VASPs operating in the UAE, regardless of their specific licensing authority — SCA, VARA and others — must adhere to the federal AML/CFT requirements.
- Enhanced due diligence. Stricter requirements apply to customer due diligence (CDD) and enhanced due diligence (EDD), particularly for high-risk transactions and politically exposed persons (PEPs).
- The Travel Rule. The regulations support the requirement for VASPs to comply with the Financial Action Task Force (FATF) "Travel Rule", which means collecting and transmitting originator and beneficiary information for virtual asset transfers above a certain threshold.
Companies must proactively update their internal policies and procedures to align with the new federal mandates.
Related: Our crypto regulation compliance team advises on federal AML/CFT obligations.
CARF puts crypto transactions into the tax reporting chain
The UAE signed the Organisation for Economic Co-operation and Development's Crypto-Asset Reporting Framework (CARF) in September 2025. The signature signals an intention to integrate virtual assets into the global tax transparency framework.
The UAE does not impose federal income tax. CARF will still require VASPs to implement systems for reporting information on crypto-asset transactions to the relevant authorities, who will then exchange that information with other participating jurisdictions. This necessitates a significant overhaul of internal reporting and data management systems for all licensed entities.
Related: Our crypto regulation compliance team advises in this area.
VARA licenses seven activities in Dubai, DIFC aside
VARA operates under Law No. 4 of 2022. It is the sole authority responsible for regulating virtual asset activities in the Emirate of Dubai, including its free zones. The Dubai International Financial Centre (DIFC) is excluded.
The VARA Rulebook, updated in 2025, defines seven core Virtual Asset Activities that require a licence:
- VA advisory services
- VA broker-dealer services
- VA custody services
- VA exchange services
- VA lending and borrowing services
- VA management and investment services
- VA issuance services
An applicant works through a multi-stage process: a provisional permit first, then a preparatory licence, then a full operating licence. VARA's framework is often described as having "No Shortcuts, No Grace Periods". This rigorous process ensures that only well-capitalised and compliant entities are permitted to operate, which protects the market's reputation and investor interests.
Related: Our free zone company formation team acts for foreign investors setting up in the UAE's free zones.
Tokenised real estate came inside the perimeter, and so did advertising
In June 2025, VARA formally brought property-backed tokens under its regulatory umbrella. That gives a clear legal pathway for the tokenisation of real estate assets, and it imposes strict requirements on issuers regarding disclosure, valuation and investor protection.
VARA has also issued fines and cease-and-desist orders against unlicensed entities and against those non-compliant with its marketing and advertising rules. Any virtual asset business operating in Dubai needs the appropriate licensing.
Related: Our real estate law advisory team advises on UAE property matters. On the advertising side, see our article on influencer marketing legal issues in the UAE.
ADGM built its framework for institutions, in 2018
The Abu Dhabi Global Market is a separate financial free zone. It operates under a common law jurisdiction and has its own regulator, the FSRA. It was the first jurisdiction in the MENA region to introduce a regulatory framework for virtual assets, in 2018, and it continues to evolve its rules to attract institutional players.
The FSRA's framework covers a broad range of digital assets, including virtual assets, digital securities and other distributed ledger technology (DLT) applications. Its focus is distinctly institutional, aiming to position ADGM as a global centre for sophisticated financial services using blockchain.
Key features of the ADGM framework include the following.
- Custody rules. ADGM has some of the most stringent custody requirements globally, ensuring the safety of client assets.
- Institutional focus. The framework is tailored for large financial institutions, exchanges and custodians, fostering a high-trust environment.
- Common law. Operating under English common law provides a familiar legal foundation for international businesses.
Related: Our free zone company formation team advises on incorporation in the financial free zones.
Tokenised securities have clearer rules; staking is still out for consultation
The FSRA finalised amendments to its Digital Assets Framework in June and October 2025, detailing its approach to accepting and regulating new forms of digital assets and DLT-based financial instruments. The amendments aim to provide greater clarity on the issuance and trading of tokenised securities.
In September 2025, the FSRA published a consultation paper proposing a regulatory framework for the staking of virtual assets. That step aims to provide legal certainty for staking service providers and to protect participants in this rapidly expanding segment of the market.
VARA and ADGM side by side
Where a business incorporates decides the legal system it argues in, the rulebook it answers to, and the kind of client the framework was written for.
| Feature | Dubai (VARA) | Abu Dhabi (ADGM FSRA) |
|---|---|---|
| Jurisdiction | Onshore Dubai and most Dubai free zones (excluding DIFC) | Abu Dhabi Global Market (financial free zone) |
| Legal system | Civil law (federal and local) | Common law (English law) |
| Primary focus | Retail and institutional market protection, innovation | Institutional financial services, high-trust environment |
| Key legislation | VARA Law No. 4 of 2022, VARA Rulebook | ADGM Financial Services and Markets Regulations (FSMR) |
| Recent 2025 focus | Property tokenisation, enforcement | Staking, digital securities enhancements |
Where blockchain businesses run into difficulty
The maturity of the UAE's regulatory framework is good for market stability. It also introduces complex legal problems for the businesses inside it.
- Choosing the jurisdiction. Companies must carefully determine the most appropriate jurisdiction — VARA, ADGM or other free zones — based on their business model, target audience and operational needs. A misstep in jurisdiction can lead to licensing delays or regulatory non-compliance.
- Cross-jurisdictional compliance. For entities operating across the UAE, such as a business licensed by VARA but dealing with mainland entities, compliance with both the specific free zone rules and the overarching federal AML/CFT law is mandatory.
- Investor and consumer protection. Both VARA and the FSRA place heavy emphasis on investor protection. They require clear disclosure, risk management and segregation of client assets. Compliance in this area is non-negotiable.
- International reporting. The adoption of CARF means that international reporting obligations are now a critical compliance point, requiring sophisticated data management and legal interpretation.
Related: Group structures raise the second of these questions directly; see our article on corporate group restructuring in the UAE. Our crypto regulation compliance team advises on these obligations.
Related Services: Explore our Crypto Regulation Compliance Advisory services for practical legal support in this area.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Additional Resources
Explore more of our insights on related topics:
