UAE Crypto Regulation: SCA Virtual Assets and Central Bank Licensing

The UAE's crypto activities are regulated by the Securities and Commodities Authority's Virtual Assets Regulations (Board Decision 3 of 2022) and the Central Bank of the UAE's Regulatory Framework for Stored Values and Electronic Payment Systems (Regulation 1 of 2023), which together establish licensing, disclosure, custody and AML rules for token offerings, exchanges and custodial services.

Related Services: Explore our Crypto Regulation & Compliance and Data Regulation & Compliance services for practical legal support in this area.

WHAT DOES THE SCA'S VIRTUAL ASSETS REGULATIONS REQUIRE FOR TOKEN OFFERINGS?

The SCA's Virtual Assets Regulations mandate that any person who offers virtual assets to the public in the UAE must first obtain a licence and disclose prescribed information. The rules apply equally to offerings initiated from within the Emirates and to those directed at UAE-based investors, regardless of where the issuer is domiciled.

Under Board Decision No. 3 of 2022, a virtual asset service provider (VASP) intending to conduct a token sale must submit a comprehensive package before commencing the offering. This includes:

• a detailed white paper describing the project, technology, use-case and tokenomics;
• a risk assessment that identifies market, operational, legal and cyber-security threats;
• a description of the offering mechanism (e.g., public sale, private placement, airdrop) and the intended use of proceeds;
• the appointment of an independent adviser who verifies the accuracy and completeness of the disclosures; and
• a record-keeping plan that retains all offering-related documents for a minimum of five years.

The SCA reviews the submission for compliance with disclosure standards. If the authority finds misleading statements, incomplete information or a failure to meet the independent adviser requirement, it may impose administrative fines not exceeding AED 5 million per violation, order disgorgement of profits obtained through the non-compliant offering, or suspend or revoke the licence. The Arabic version of the regulation, as published in the Official Gazette, prevails over any translation, ensuring uniformity in enforcement.

HOW DOES THE CENTRAL BANK LICENSE VIRTUAL ASSET SERVICE PROVIDERS?

The Central Bank of the UAE (CBUAE) licences VASPs under its Regulatory Framework for Stored Values and Electronic Payment Systems, specifically Regulation No. 1 of 2023 on Virtual Asset Service Providers. This framework targets entities that engage in custody, exchange, transfer or payment-related activities involving virtual assets within the UAE.

To obtain a CBUAE licence, an applicant must demonstrate:

• adequate capitalisation, typically evidenced by audited financial statements showing sufficient net assets to cover operational risks;
• robust governance structures, including a board with relevant expertise and clear internal controls;
• a comprehensive anti-money-laundering (AML) and combatting the financing of terrorism (CFT) programme that aligns with Federal Decree-Law No. 20 of 2018;
• the appointment of a money-laundering reporting officer (MLRO) responsible for monitoring suspicious transactions and liaising with the Financial Intelligence Unit;
• ongoing transaction monitoring, customer due diligence (CDD) procedures and enhanced due diligence (EDD) for high-risk clients; and
• a business plan outlining the proposed services, target market and compliance roadmap.

Licences are granted for an initial term of three years and are renewable upon a satisfactory review of the provider's adherence to the framework. Non-compliance can trigger financial penalties of up to AED 10 million, restrictions on permitted activities, or revocation of the licence. As with SCA rules, the Arabic text of the CBUAE regulation prevails over any translation.

WHAT COMPLIANCE STEPS ARE NEEDED FOR DIGITAL ASSET CUSTODY?

Digital asset custody is treated as a regulated activity under both the SCA and the CBUAE regimes, requiring providers to satisfy overlapping but distinct obligations.

SCA-specific custody requirements

• Segregation of client assets: custodians must maintain wallets that are legally and technically separate from the provider's own holdings.
• Annual independent audit: a qualified auditor must examine the custody controls, wallet security and reconciliation processes each year, with the audit report submitted to the SCA.
• Periodic client statements: custodians must furnish clients with regular statements detailing holdings, transactions and any fees incurred.
• Record retention: all custody-related instructions, transaction logs and communications must be preserved for at least five years.

CBUAE-specific custody requirements

• Multi-signature controls: private keys must be split across multiple signatories, reducing the risk of unilateral unauthorized transfers.
• Penetration testing: regular (typically quarterly) external security assessments must be conducted to identify vulnerabilities.
• Breach reporting: any security incident affecting client assets must be reported to the CBUAE within twenty-four hours, followed by a detailed post-incident analysis.
• AML/CTF integration: custodians must embed transaction monitoring and suspicious-activity reporting into their custody workflows, consistent with Federal Decree-Law No. 20 of 2018.

Failure to meet any of these obligations can result in administrative sanctions, suspension of the custody licence, or civil liability for loss of client assets. The dual oversight ensures that custodians adhere to both market-conduct standards (SCA) and financial-system safeguards (CBUAE).

WHAT ARE THE PENALTIES FOR NON-COMPLIANCE UNDER UAE CRYPTO REGULATION?

Violations of either the SCA Virtual Assets Regulations or the CBUAE licensing framework may attract administrative fines, licence suspension or criminal proceedings, depending on the nature and severity of the breach.

• SCA penalties - The authority may levy a fine not exceeding AED 5 million for each violation of disclosure or licensing obligations. In cases where the breach involves misleading information that leads to investor profit, the SCA can order disgorgement of those profits. Repeated or egregious violations may lead to licence suspension or revocation.
• CBUAE penalties - For breaches of AML/CFT obligations, operational standards or capital adequacy requirements, the Central Bank can impose fines up to AED 10 million per violation. It may also restrict the VASP's ability to conduct virtual-asset activities, suspend the licence, or revoke it entirely.
• Criminal liability - If the non-compliant conduct constitutes fraud, money laundering or terrorism financing, the Public Prosecution may pursue charges under Federal Decree-Law No. 20 of 2018. Convictions can result in imprisonment and substantial fines, in addition to any administrative sanctions.

Again, the Arabic texts of the relevant regulations prevail over translations, ensuring consistent application of penalties across the Emirates.

FREQUENTLY ASKED QUESTIONS

What licence is required to operate a virtual asset exchange in the UAE?
A virtual asset exchange must secure two distinct licences:

1. An SCA licence under the Virtual Assets Regulations, which governs market conduct, disclosure obligations and investor protection.
2. A CBUAE licence under the Virtual Asset Service Provider framework, which covers AML/CFT controls, capital adequacy, custody safeguards and operational standards.

If the exchange also provides custody or payment services, both licences are mandatory before commencing operations. The SCA licence focuses on transparency and fair trading, whereas the CBUAE licence addresses financial-system integrity.

How long does the SCA take to review a token offering application?
The SCA does not publish a fixed timeline for reviewing token offering applications. The duration hinges on the completeness of the submitted documentation, the clarity of the white paper and risk assessment, and the quality of the independent adviser's report. Applicants should anticipate a review period of several months, as the authority may request revisions or additional information. No statutory deadline is prescribed in the Virtual Assets Regulations for the SCA to issue a decision.

Can a foreign virtual asset service provider offer services to UAE residents without a local licence?
No. Both the SCA and the CBUAE require any entity that offers virtual-asset services to persons residing in the UAE to hold the appropriate licence issued by the respective authority. Operating without a licence constitutes an unregulated activity and may trigger administrative penalties, orders to cease operations, or civil liability for losses incurred by UAE-based clients.

Do I need a VARA license for crypto in Dubai?
The Virtual Assets Regulatory Authority (VARA) oversees virtual-asset activities in designated free zones such as Dubai World Trade Centre and Dubai Multi Commodities Centre. If your business operates within a VARA-regulated free zone, you must obtain a VARA licence in addition to, or instead of, the SCA/CBUAE licences depending on the zone's specific rules. For mainland operations, the SCA and CBUAE frameworks apply directly.

What is the role of an independent adviser under the SCA Virtual Assets Regulations?
The independent adviser must be a qualified professional (e.g., a licensed auditor, lawyer or financial consultant) who is not affiliated with the issuer. Their duty is to verify the accuracy, completeness and fairness of the disclosures contained in the white paper, risk assessment and offering documentation. The adviser's report forms part of the application package submitted to the SCA and is subject to the authority's scrutiny.

How does the Central Bank's Regulation 1 of 2023 interact with Federal Decree-Law No. 20 of 2018 on AML/CFT?
Regulation 1 of 2023 explicitly incorporates the AML/CFT obligations set out in Federal Decree-Law No. 20 of 2018. VASPs must implement a compliance programme that meets the law's standards, appoint an MLRO, conduct customer due diligence, monitor transactions and report suspicious activities to the Financial Intelligence Unit. The regulation thus operationalises the broader AML/CFT legal framework within the virtual-asset sector.

What record-keeping periods apply under the UAE crypto regulations?
Both the SCA and the CBUAE require retention of key records for a minimum of five years. This includes offering documents, adviser reports, client instructions, transaction logs, AML/CTF files and audit reports. The five-year period aligns with the UAE's general commercial record-keeping requirements and ensures regulators can conduct effective investigations.

Are there any exemptions for small-scale token offerings?
The SCA Virtual Assets Regulations do not provide a blanket exemption for small-scale offerings. Any public offer of virtual assets, regardless of size, triggers the licensing and disclosure requirements. Private placements directed exclusively to qualified investors may be subject to different thresholds, but even those offerings must comply with anti-money-laundering and custodial obligations if they involve VASP services.

How does the prevailing Arabic text rule affect compliance?
UAE legislation, including the SCA Virtual Assets Regulations and CBUAE Regulation 1 of 2023, is published in Arabic in the Official Gazette. In the event of any discrepancy between the Arabic version and a translation, the Arabic text prevails. Consequently, compliance programmes must be based on the Arabic original, and any internal policies or client communications should reflect the authoritative Arabic wording to avoid regulatory challenges.

What steps should a business take to ensure ongoing compliance?
A robust compliance programme should include:

• periodic gap analyses against SCA and CBUAE requirements;
• regular training for staff on AML/CFT, data-protection and market-conduct rules;
• independent audits of custody controls and transaction monitoring systems;
• maintenance of up-to-date licences and timely renewal applications;
• engagement of qualified independent advisers for any new token offering; and
• documentation of all compliance activities to demonstrate adherence during regulator inspections.

By integrating these practices, businesses can navigate the dual regulatory landscape with confidence, mitigate risk and position themselves for sustainable growth in the UAE's evolving crypto market.

If your matter involves crypto regulation in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.