The Strategic Guide to Crypto Regulation Compliance Advisory in the UAE

There is no single UAE crypto regulator. That is the first thing a business entering this market has to take in. Which authority licenses you depends on where you are set up and who your clients are. So does what your activity is called, how much capital you must hold, and how you must protect client assets. Getting that question wrong is not a technical slip. It means operating without the licence your activity needs.

This guide sets out who regulates what, what a licence application is really judged on, and the duties that carry on after it is granted. Our crypto regulation and compliance advisory team works with exchanges, brokers, custodians, token issuers and funds across all of these regimes.

Who regulates what

Four regimes run side by side. Each has its own rulebook, application process and supervisor.

• The Securities and Commodities Authority (SCA) regulates virtual asset activities at federal level, outside the financial free zones. It licenses virtual asset service providers that operate in the wider UAE market.
• The Virtual Assets Regulatory Authority (VARA) regulates virtual asset activity in the Emirate of Dubai, other than in the DIFC. Its regime is based on activity. Advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, and transfer and settlement services are each licensed separately. Each has its own rulebook.
• The Dubai Financial Services Authority (DFSA) regulates in the DIFC. Its regime is built around recognised crypto tokens. A firm may only deal in tokens the DFSA has recognised. It also offers a testing route for firms building new products under supervision.
• The Financial Services Regulatory Authority (FSRA) regulates in the ADGM under a virtual asset framework. That framework likewise limits firms to accepted virtual assets. It licenses the activity being carried on, not the technology.

The DIFC and the ADGM are common-law jurisdictions with their own courts and laws. A DFSA or FSRA licence allows activity in and from that free zone. It is not a passport into the wider UAE market. In the same way, a VARA or SCA licence does not allow activity inside the financial free zones. Groups serving several markets usually need more than one licence. They also need a clear internal split of which entity does what. We compare the options for a given business model in our crypto licensing guidance.

What the application is judged on

All four regimes judge applications on much the same things. Thin answers on any of them stall the process.

• Fitness and propriety of owners, directors and controllers (whether they are fit and proper to run the business), including source of wealth and regulatory history.
• Named individuals in control functions. Regulators expect a named senior executive, compliance officer and money laundering reporting officer. Each must be resident, reachable and able to act.
• Capital and financial resources in proportion to the activity, held as the relevant rulebook requires.
• Custody and client asset arrangements. Keeping client assets separate from the firm's own, key management, wallet design, and what happens to client assets if the firm fails.
• Technology governance. Cyber security, business continuity, incident reporting, and independent testing of the systems the business runs on.
• A written compliance and AML programme that matches the real business, not a template.

Anti-money laundering obligations

Virtual asset service providers fall under the UAE's AML and counter-terrorist financing framework. This is where enforcement concentrates in practice. The duties are familiar in form and demanding to apply. You need a documented business-wide risk assessment. You need customer due diligence (checks on who the customer is) before the relationship starts. Higher-risk customers, politically exposed persons and higher-risk jurisdictions need enhanced measures.

You must screen against the sanctions lists that apply, with a set process for a match. You must monitor transactions on an ongoing basis, tuned to the risks your assessment found. And you must report suspicious transactions to the Financial Intelligence Unit through its reporting system, without tipping off the customer.

Transfers of virtual assets carry requirements on originator and beneficiary information. Firms are expected to have a policy for transfers involving unhosted wallets, and for counterparties that cannot supply that information. Blockchain analytics tools count as part of monitoring, not a substitute for it. Records must be kept for the period the relevant law requires. The money laundering reporting officer must have direct access to the board.

Personal data collected during onboarding is subject to Federal Decree-Law No. 45 of 2021 on personal data protection. Firms set up in the DIFC and ADGM are subject to those centres' data protection regimes. Verification data and transaction records need a lawful basis, a retention period and controls on transfer. The AML file cannot simply override that.

Obligations that continue after licensing

A licence is a starting point. Firms report to their regulator at set intervals. They must notify material changes, such as new controllers, new activities or new tokens. They must get approval before offering anything the licence does not cover. Marketing and promotion of virtual assets are regulated in their own right. Content, disclaimers and the audience a promotion may reach are all limited. This catches offshore firms advertising into the UAE as much as licensed local ones. Supervisors review client-facing terms, risk disclosures and complaints handling. They are not merely filed.

Tax duties apply as they do to any other business. Corporate tax under Federal Decree-Law No. 47 of 2022 applies to financial years starting on or after 1 June 2023. The rate is 0% up to AED 375,000 of taxable income and 9% above. A Qualifying Free Zone Person may be taxed at 0% on qualifying income while it meets the conditions. VAT applies at 5%. The treatment of a given crypto activity needs to be worked out, not assumed. Our VAT and tax compliance team advises on both.

Practical guidance for firms entering the market

Define the activity before you choose the jurisdiction. Regulators license activities. So the description of what the business does, in their words, decides everything that follows. Do not incorporate first and classify later.

Where a group needs entities in more than one regime, keep the boundary clean. Document which entity contracts with which clients, where the assets are held, and which staff serve which book. It should also be visible in practice. Supervisors will test whether the paper structure matches the real one.

Build compliance functions with enough seniority to say no. Regulators look at whether the compliance officer can escalate, and whether the board acts when they do. Finally, treat the rulebooks as moving documents. Guidance, token recognition decisions and marketing rules are updated often. A firm that reads them once at licensing will fall out of compliance without noticing. Our compliance advisory and regulatory monitoring services provide continuing support on that.

Related Services: Explore our Crypto Regulation Compliance Advisory services for practical legal support in this area.

Disclaimer: The information in this article is for general information only and is not legal advice. Before you make any decision or take any action based on it, seek professional legal advice suited to your own circumstances.

Nour Attorneys Team

Additional Resources

Explore more of our insights on related topics:

• Crypto Regulation in the UAE: Your 2025 Guide to Licensing and Compliance
• The Strategic Guide to Data Regulation Compliance Advisory in the UAE
• Resolving Crypto Regulation Compliance Advisory Disputes Effectively
• Common Crypto Regulation Compliance Advisory Mistakes to Avoid in Dubai