Cryptocurrency Compliance in Dubai Mainland: Complete Guide
The regulator looks at what the token does, not at what the whitepaper calls it.
Two questions set the licensing path for a crypto business in Dubai — what the token is in regulatory terms, and what activity the firm carries on with it — and this guide answers both before turning to the rest. It explains when VARA supervises, and when the Central Bank, the Securities and Commodities Authority, the DFSA or ADGM's FSRA come into the picture; how VARA licenses activity by activity and what an application is actually assessed on; and the duties that follow the licence, covering financial crime controls and the travel rule, client asset segregation, marketing and influencer promotion, and continuing reporting. It closes with the UAE obligations that apply regardless, including personal data and corporate tax.
Two questions decide almost everything about a crypto business in Dubai, and both should be answered before a company is incorporated or a bank account is opened. What is the token, in regulatory terms? And what activity is the business carrying on with it? Get those right and the licensing path, the regulator and the rulebook follow. Get them wrong and the result is a company holding the wrong licence, marketing it cannot lawfully run, and a banking relationship that closes without explanation.
Which regulator you are dealing with
Virtual asset activity in the Emirate of Dubai, including its free zones but excluding DIFC, falls to the Virtual Assets Regulatory Authority (VARA). A mainland Dubai business dealing in virtual assets deals with VARA, alongside the licensing authority that issues its commercial licence.
VARA is not the only regulator in the picture. Tokens that function as payment instruments or stablecoins engage the Central Bank of the UAE. Tokens with the characteristics of securities or investment products engage the Securities and Commodities Authority at federal level. DIFC firms answer to the Dubai Financial Services Authority, and firms in Abu Dhabi Global Market to the Financial Services Regulatory Authority. The classification of the token is therefore not an academic exercise: it determines who supervises you. Obtain a written analysis of the token's characteristics before you decide where to apply, and expect the regulator to look at economic substance rather than at what the whitepaper calls it.
Licensing is granted by activity
VARA licenses by activity rather than issuing a single blanket permission. The categories cover the recognisable business models — exchange services, broker-dealer activity, custody, transfer and settlement, virtual asset management and investment services, and lending and borrowing — and each carries its own rulebook of conditions on top of the requirements that apply to every licensee. A business that runs an exchange and also holds client assets is carrying on more than one activity and needs permission for each.
What an application actually turns on is unglamorous: the corporate structure and the identity of the ultimate beneficial owners; the fitness and propriety of the proposed senior managers and the compliance and risk functions; a business plan the regulator can test; financial resources and a wind-down plan; technology and cyber controls; and the governance documents that show who decides what. Applications commonly go through stages, with permission to operate only after conditions are satisfied, so treat the licence as a process rather than a document to be collected.
The obligations that come with the licence
Financial crime
This is where enforcement concentrates. Expect a documented business risk assessment, customer due diligence proportionate to risk, enhanced measures for higher-risk relationships, sanctions screening against the applicable lists, a named money laundering reporting officer with real authority, staff training, and reporting of suspicion to the UAE Financial Intelligence Unit through its reporting portal. Virtual asset businesses also have to handle originator and beneficiary information for transfers — the travel rule — and to have a policy for transfers to and from unhosted wallets. Blockchain analytics tooling is expected, but the tooling is not the control; the control is the documented decision someone makes when it produces an alert.
Client assets
Where a business holds virtual assets or fiat for clients, segregation is the point everything else hangs from. Client assets must be identifiable as client assets, held separately from the firm's own, reconciled regularly, and covered by key management and custody arrangements that survive the loss of any single individual. Records must show what belongs to whom at any moment. Firms that cannot answer that question during an inspection do not get time to build the answer.
Marketing and promotion
Marketing rules catch businesses that assume promotion is a commercial matter. Communications aimed at the Dubai market are within the regulator's remit, must be fair and not misleading, must carry the required risk warnings, and may need approval before they are published. This extends to influencer arrangements, paid social campaigns, airport and roadside advertising and referral programmes. A firm that has not yet obtained its licence must be particularly careful about promoting a service it is not yet permitted to provide.
Disclosure, reporting and technology
Licensees report to the regulator on a continuing basis, notify material changes, and maintain the technology and cybersecurity controls the rulebooks require, including incident reporting. Outsourcing key functions does not transfer responsibility for them.
Rules that apply because you are a UAE business
A virtual asset licence sits on top of ordinary UAE obligations rather than replacing them.
- Personal data. Federal Decree-Law No. 45 of 2021 governs customer and employee data, including onboarding records and identity documents. DIFC and ADGM maintain their own separate regimes.
- Corporate tax. Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023: no tax on taxable income up to AED 375,000, and 9% above that. The claim that crypto businesses in the UAE are tax-free is simply wrong, and it appears in enough pitch decks to be worth correcting.
- VAT. The 5% rate under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022, applies to supplies within its scope, and the treatment of different token services needs specific advice rather than assumption.
- Company law and employment. A mainland entity is formed under Federal Decree-Law No. 32 of 2021, which replaced Federal Law No. 2 of 2015, and staff are employed under Federal Decree-Law No. 33 of 2021, which replaced Federal Law No. 8 of 1980. Foreign ownership restrictions on mainland companies were removed by Federal Decree-Law No. 26 of 2020, subject to a strategic-impact list, so a foreign founder generally no longer needs a local partner to hold shares.
Banking, and why applications fail
Opening and keeping a bank account is the practical constraint most crypto businesses underestimate. Banks conduct their own diligence, and they decide on the quality of the file: a clear ownership chart with no unexplained layers, verifiable source of funds, a licence that matches the activity actually carried on, a compliance officer they can speak to, and an explanation of transaction flows that matches what the account then does. Build that file for the bank at the same time as the licence application, not afterwards.
Where disputes come from
The recurring flashpoints are predictable: platform terms that let a firm suspend withdrawals or liquidate positions, and whether those terms were properly incorporated; custody arrangements after a loss of keys or a security incident; token sale documents that promised more than the issuer delivered; and disputes between founders about vesting and treasury control. Draft the terms of service as the operative contract they are, choose the governing law and forum deliberately, and keep the records that will support your version of events. Where matters do escalate, our team advises on technology dispute resolution for platforms, issuers and investors.
For advice on token classification, a VARA application, or the compliance framework behind it, contact the Nour Attorneys team.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
Explore more of our insights on related topics:
- AI Regulations Compliance Requirements in the UAE
- Blockchain Legal Defense Strategies for Dubai Businesses
- Cryptocurrency Compliance Guidelines for UAE Operators
- Data Privacy Laws for Multinational Entities
