UAE Crypto Regulation: Licensing Rules and Compliance in 2026

Roughly a third of the UAE's population (30.4%) owns virtual assets, the highest rate of any country in the world.

Unlike in Turkey or Argentina, where crypto uptake tracks inflation, the UAE's uptake is a policy outcome. Favorable regulation and institutional money did it, and 67% of UAE adults say they plan to invest in crypto within 5 years. The Sumsub State of the Crypto Industry Report ranks the UAE among the most crypto-friendly jurisdictions globally.

This article provides an overview of the UAE’s regulatory landscape, AML/KYC compliance requirements, expected developments, and the process for applying for a cryptocurrency license in the UAE.

Who regulates crypto in the UAE?

The UAE is a federal union of seven emirates, regulated at both federal and local levels. The two layers can apply together or independently depending on the subject matter, so which rules bind a crypto business depends on where it operates.

The Central Bank of the UAE (CBUAE) and the CMA govern federal monetary and capital markets, and that extends to virtual assets. In 2021, the CBUAE issued guidelines requiring virtual asset service providers (VASPs) to follow its AML regulations. The CMA licenses VASPs outside the financial free zones and supervises their customer due diligence, transaction monitoring, and suspicious activity reporting against UAE federal AML law and FATF standards.

Abu Dhabi Global Market, Dubai, and the Dubai International Financial Centre (a financial free zone inside Dubai) have each launched their own virtual asset regulations. The key regulators are now as follows.

Dubai’s Virtual Assets Regulatory Authority (VARA)

The Virtual Assets Regulatory Authority in Dubai (VARA) regulates virtual asset activities in the Emirate of Dubai (including both mainland and free zones, except within the DIFC). It oversees the issuance, trading, and provision of services related to cryptocurrency in Dubai. VARA has introduced guidelines and rulebooks to help provide a clear framework to encourage virtual asset innovation while protecting investors.

Dubai Financial Services Authority (DFSA)

The Dubai Financial Services Authority (DFSA) is the financial regulator responsible for the DIFC financial free zone. Its remit includes virtual assets.

Abu Dhabi Global Market’s Financial Services Regulatory Authority (FSRA)

The Abu Dhabi Global Market’s Financial Services Regulatory Authority (FSRA) regulates virtual assets within the Abu Dhabi Global Market (ADGM), a financial free zone. Since 2018, it has overseen crypto-related businesses, including exchanges, and has emphasized AML/KYC compliance with international standards.

Capital Market Authority (CMA)

The Capital Market Authority (CMA) is the UAE’s federal financial regulatory agency. This role was previously fulfilled by the Securities and Commodities Authority (SCA), which was reconstituted as the CMA in January 2026. In this role, it helps regulate virtual assets across the UAE outside financial free zones.

Suggested challenge: Crypto Crossword: Decrypt & Win!

Who needs a crypto license in the UAE?

Under the federal Cabinet Decision No. 111 of 2022, Dubai’s Law No. 4 of 2022, and the Abu Dhabi Global Market’s Financial Services and Markets Regulations 2015 (with amendments), any entity or individual involved in offering, promoting, or facilitating virtual asset services, including crypto trading and token issuance, must obtain a license to operate in the UAE.

VASP licensing in the UAE is jurisdiction-specific. The CMA is the federal regulator covering the mainland and commercial free zones; VARA, DFSA, and FSRA license within their own territories. Which authority applies depends on where the business operates and what it does.

Crypto licensing requirements by UAE jurisdiction

Each jurisdiction has different crypto licensing requirements:

VARA licensing requirements for Dubai excluding DIFC

Any entity engaging in virtual asset activities in Dubai (other than DIFC, application details for which can be found here) must seek authorization from VARA before doing so. The activities include advisory services, broker-dealer services, custody services, exchange services, lending and borrowing services, management and investment services, transfer and settlement services, and virtual asset issuance. 

VASPs are required to follow VARA’s rulebooks. For full licensing requirements, see its official website, where you can also apply for a VARA license online. 

DIFC licensing through the DFSA

Any firm operating as a VASP in the DIFC must be licensed by the DFSA and show compliance with the requirements on financial crime prevention, risk management, technology governance, and consumer protection. Applications require a business plan, an internal controls framework, and AML/CTF policies. Since January 2026, firms are no longer restricted to a pre-approved token list. They must instead document their own assessment of each token against the DFSA's criteria and defend it on request. Fiat-referenced tokens still go through the DFSA's own approval process.

FSRA licensing requirements in ADGM

ADGM was one of the first jurisdictions in the world to issue comprehensive regulations for digital asset activities. Its full rules and regulations are available on its website. Activities that require licensing in ADGM include operating a virtual asset exchange, providing custody services, and advising on virtual assets. 

Its website also provides details on how to apply for an ADGM crypto license.

CMA licensing for UAE mainland VASPs

The Capital Market Authority (CMA) regulates VASPs operating in the UAE mainland (outside of financial free zones), including exchanges, wallet services, and trading platforms. Such VASPs are subject to securities laws and regulations, including Cabinet Resolution No. 111, 2022 and the Chairman of the SCA’s Board of Directors’ Decision No. (26/Chairman), 2023. 

VASPs must obtain CMA approval before engaging in virtual asset activities. This reaches into the commercial free zones: the Dubai Multi Commodities Centre (DMCC) and Ras Al Khaimah Digital Assets Oasis (RAK DAO) both license VASPs, and those firms remain inside the federal regime the CMA administers. Only the financial free zones, the DIFC and ADGM, sit outside it.

Suggested read: The Top 10 Crypto-Friendly Countries

How to get a crypto license in the UAE

Step 1: Determine your business activity

First, identify which services you plan to offer. For example, are you operating a virtual asset exchange or issuing a token? 

Step 2: Choose your regulatory jurisdiction

The UAE is a federal country and has multiple jurisdictions. Businesses should choose the right regulator based on where they operate and which regime best supports their business model..

Step 3: Prepare the required documentation

Regulators typically require:

• A detailed business plan
• Risk management and cybersecurity policies
• AML/KYC procedures aligned with national standards
• Corporate structure and governance documents

Step 4: Meet financial and capital requirements

Minimum capital depends on the activity type and regulator. The firm may also need to show proof of operating capital and financial health. For example, under VARA, the minimum paid-up capital ranges from AED 100,000 for advisory services to AED 1.5 million or 25% of fixed annual overheads for an exchange, whichever is higher. Custody requires at least AED 600,000 or 25% of fixed annual overheads, while broker-dealer services require AED 400,000–600,000 or 15–25% of fixed annual overheads, depending on the setup. VARA also requires VASPs to maintain net liquid assets equal to at least 1.2 times monthly operating expenses.

Step 5: Submit your license application

Apply to the relevant authority with all documentation:

• VARA: Apply via VARA website
• CMA: Apply via CMA website
• ADGM: Apply via FSRA website
• DIFC: Apply via DIFC website

Expect due diligence, background checks, and potential interviews.

Step 6: Await review and approval

Regulators will assess your application, including operational suitability, as well as AML and cybersecurity compliance.

This may take some months, depending on the complexity of your application.

Step 7: Launch

After receiving your provisional or full license, you will be ready to operate in the UAE. However, remember you will have ongoing obligations, including, but not limited to:

• Regulatory reporting (financial reporting, compliance reporting, etc.)
• Audits
• Compliance with national AML/CTF requirements
• Data and consumer protection standards

AML/KYC compliance for UAE crypto businesses

Under UAE law, regulated entities must use a reliable AML/KYC framework for virtual asset activities. Non-compliance may lead to fines, license revocation, or even criminal penalties.

In this regard, local regulators have published some rulebooks and guidelines regarding AML, for example:

• Compliance and Risk Rulebook of VARA
• AML Rulebook of ADGM

A risk-based approach is fundamental to effectively implementing AML regulations in the UAE. It requires entities to identify, assess, and understand their exposure to money laundering and terrorist financing risks, and to apply the most appropriate measures to mitigate those risks, including:

• Customer Due Diligence (CDD): Identifying and verifying client identity before onboarding. Enhanced Due Diligence (EDD) may be required for higher-risk clients.
• Ongoing monitoring: Monitoring transactions throughout the whole customer lifecycle for unusual or suspicious patterns.
• Suspicious Activity Reporting (SAR): Filing Suspicious Activity Reports with the UAE Financial Intelligence Unit (via the goAML system) when suspicious activity is detected.
• Record-keeping: Maintaining customer and transaction records for at least 5 years under UAE federal AML/CTF rules, with longer retention (e.g., 6 or 8 years) where imposed by specific regulators such as VARA, DFSA, or FSRA.
• Sanctions screening: Screening clients against international sanctions lists.
• Appointing an MLRO: Designating a qualified money laundering reporting officer.
• Employee training: Conducting regular AML/KYC staff training.
• Travel Rule: VASPs must exchange verified originator and beneficiary information – name, account or wallet identifier, and address or equivalent – immediately and securely. Records must be retained for the full statutory AML period.

Note: AML/KYC requirements change over time and vary across the UAE, so check the rules that apply in your jurisdiction.

Crypto Travel Rule requirements in the UAE

The UAE enforces the Travel Rule under Federal Decree-Law No. (20) of 2018, Cabinet Decision No. (10) of 2019, and Cabinet Resolution No. (24) of 2022. These align with the FATF’s updated Recommendation 16, which now incorporates the Travel Rule requirements for VASPs.

Under the Travel Rule, VASPs must collect, verify, and transmit originator and beneficiary information when processing virtual asset transactions. This is part of the UAE’s broader AML/CTF efforts, overseen at the federal level by the CBUAE and implemented by various UAE regulators.

Jurisdiction-based requirements

The Travel Rule requirements differ across the UAE's regulatory zones. 

Thresholds and required information are subject to change; consult the latest regulator-specific documents or Sumsub documentation:

• United Arab Emirates
• Abu Dhabi – ADGM
• Dubai
• Dubai – DIFC

Stay 100% Travel Rule Compliant in Dubai

Sumsub offers a built-in Travel Rule bundle tailored to Dubai's regulatory requirements

Try it now

VARA's 2026 risk assessment and FATF rules

In June 2026, VARA published new AML/CTF guidance following its 2026 Business Risk Assessment (BRA) thematic review, setting best practices for licensed VASPs carrying out BRAs and tightening how they must manage financial crime risk.

Key provisions now include:

• building fully documented, data-driven risk assessments from real business data rather than generic templates, to score customer, product, and geographic exposure
• mapping exposure to FATF high-risk and blacklisted jurisdictions, and incorporating changes immediately
• refreshing risk assessments at least every three months, or sooner if a firm's structure, products, or partnerships change materially
• assessing money laundering, terrorist financing, proliferation financing, and sanctions risk separately rather than bundling them into one category

The move reinforces the UAE's efforts to maintain the standards that led to its removal from the FATF grey list in February 2024. For VASPs, it means analytics and governance that can produce auditable, current risk scores.

New VARA rules for crypto derivatives trading

Since March 31, 2026, Dubai has had a dedicated framework for crypto exchange-traded derivatives (ETDs) under VARA's Exchange Services Rulebook (Version 2.1).

It covers trades by VASPs in futures, options, perpetuals, and contracts for difference. Only VASPs already licensed for exchange services can apply, and derivatives activity must be written explicitly into the license.

The rules set a firm 5:1 leverage cap for retail investors, backed by a minimum initial margin of 20% of notional value, which VARA can raise where a product is unsuitable for a client.

Firms must run suitability checks before opening margin accounts, covering a client's financial position, objectives, and trading experience. They must segregate client assets, settle trades within 24 hours, and maintain market surveillance. VASPs are also barred from trading against their own book in ETDs they offer.

VARA can suspend trading or adjust margin requirements during market stress, extending Dubai's regulatory reach beyond spot markets into leveraged and derivative products for the first time.

Real-world asset tokenization in Dubai

Launched on March 19, 2025, Dubai's real estate tokenization pilot, run by the Dubai Land Department with VARA, the Dubai Future Foundation, and the CBUAE, entered its second phase on February 20, 2026. Tokenization splits ownership rights and economic interests in a physical asset into smaller units, each represented by a digital token on a blockchain.

On February 19, 2026, VARA issued guidance on the regulatory status of participants, clarifying that real estate tokenization in Dubai falls under VARA's rulebooks and that participating VASPs must be licensed or approved by VARA and by any other relevant authority.

Firms planning Real-World Asset services should track phase two, since the pilot is where the compliance requirements for this activity are being set.

Dirham stablecoins and the payment token rules

Stablecoin services in the UAE are governed by the CBUAE's Payment Token Services Regulation, which specifies that:

• only dirham-backed stablecoins such as AE Coin and DDSC can be used for everyday retail payments on the UAE mainland
• providers of dirham-backed stablecoins must be licensed by, or registered with, the CBUAE
• foreign currency-backed stablecoins can be used to pay for other virtual assets, provided the issuer is CBUAE-registered

DFSA drops its pre-approved crypto token list

On January 12, 2026, the Dubai Financial Services Authority overhauled its Crypto Token Regulatory Framework for the DIFC, scrapping the list of "Recognised Crypto Tokens" that firms previously had to rely on before offering a token-related service. 

Under the new regime, DIFC-authorized firms must instead make their own reasoned, documented assessment of whether a token meets the DFSA's suitability criteria, covering governance, risk, and business model factors, and be ready to justify that decision to the regulator. 

A three-month transition period, running to April 12, 2026, gave VASPs time to review previously recognized tokens against the new standard. The change doesn't apply to fiat-referenced tokens, where the DFSA still runs its own approval process.

Recent updates to UAE crypto regulations

Key developments for UAE crypto regulations in 2026 include:

VARA

• Clarified guidance on when tokenized real-world assets fall under CMA securities rules instead of VARA's Asset-Reference Virtual Asset regime (February 12, 2026)
• Launched Version 2.1 of its Exchange Services Rulebook, creating a clear framework for exchange-traded derivatives (March 31)
• Introduction of tighter Business Risk Assessment guidance, including for AML/CTF (June)

DFSA

• Replacement of its pre-approved crypto token list with a firm-led suitability model (January 12, 2026) 

SCA/CMA

• Reconstituted as the Capital Market Authority (CMA) under Federal Decree-Laws No. 32 and 33 of 2025, becoming the primary federal regulator for market-services activities and security tokens (effective from January 1, 2026) 

Challenges for UAE crypto companies

The UAE's regulatory environment is favorable but not frictionless. Three problems recur.

• Regulators do not always align. A compliance approach built for VARA's rulebooks will not transfer cleanly to ADGM, and a firm licensed in both runs two programs against two sets of rules.
• Entry costs are material. VARA's initial application fee alone runs from roughly AED 40,000 to AED 100,000 depending on activity, with annual supervision fees from around AED 80,000 to AED 200,000. These figures are provided as a VARA reference point; fees vary by regulator, activity, and authorization, so they should not be read as a UAE-wide licensing cost.
• The rules keep moving. Three regulators made substantive changes in 2026 alone, and staying current across stablecoin rules, token classification, and AML expectations is a standing resource commitment rather than a one-off project.

Crypto regulation in the UAE – 2027 forecast

Three separate 2026 changes pointed the same way. 

The DFSA scrapped its “Recognised Crypto Tokens” list in January and told DIFC firms to assess tokens themselves. VARA's June guidance required risk assessments built from a firm's own business data rather than templates, and its derivatives rulebook put suitability checks for margin accounts on the firm. In each case, the regulator stopped pre-approving and started expecting a documented decision the firm can defend, which means 2027 is the year those decisions first get examined. The findings from the earliest supervisory reviews will set the standard everyone else works to.

Crypto Asset Reporting Framework systems go live by January 2027, with the first automatic exchange of crypto tax data in 2028. The sequencing matters more than the deadline: data gathered through 2027 is the data that gets exchanged, so wallet attribution and residence determination need to work in production well before the exchange itself.

VARA's quarterly refresh requirement also makes 2027 the first full year of four BRA cycles, plus unscheduled refreshes whenever a firm's products or partnerships change materially. Each cycle covers money laundering, terrorist financing, proliferation financing and sanctions separately, so firms that budgeted for an annual assessment have badly underestimated the workload.

The next phase of the real estate tokenization pilot may also produce new rules for VASPs in that sector.

How the regulators converge remains a challenge. VARA, the DFSA, the FSRA and the CMA each moved independently in 2026, and a firm licensed in both Dubai mainland and ADGM still runs two compliance programs against two rulebooks.

UAE crypto license FAQ

• Is cryptocurrency legal in the UAE?

  Yes, cryptocurrency is legal in the UAE. Trading and holding virtual assets are permitted but regulated.

• How is crypto regulated in Dubai?

  The Virtual Assets Regulatory Authority (VARA) monitors virtual asset activities in Dubai. VARA issues licenses while ensuring compliance with AML and consumer protection standards. Virtual assets have a different regulator in the Dubai International Financial Centre (DIFC).

• What is a crypto license?

  A crypto license is a legal authorization from a financial regulator for a business to offer services involving cryptocurrencies or other virtual assets. It is also sometimes called a virtual asset service provider (VASP) license. This license confirms that a business has met a regulator's requirements around governance, capital adequacy, cybersecurity, and AML/CTF controls.

• Who needs a crypto license in the UAE?

  Individuals trading crypto for personal investment do not need a license, but businesses offering virtual asset trading services must obtain a license from a relevant authority.

• When do you need a crypto license?

  You need a crypto license in the UAE if your business offers, promotes, or facilitates virtual asset services to others. You do not need one simply to hold or trade crypto on your own account. Situations where a license would be required include running an exchange, providing custody or wallet services, brokering or dealing in crypto on behalf of clients, issuing tokens or NFTs, offering crypto-related investment advice or portfolio management, providing crypto lending, borrowing, or staking services, or operating as a market maker or liquidity provider.

• How do you get a crypto license in Dubai?

  To get a crypto license in Dubai (excluding the DIFC free financial zone), you must apply to the Virtual Assets Regulatory Authority (VARA). The application requires you to specify the licensable activity you intend to carry out and provide key operational details, including your business plan, AML/KYC and risk management policies, cybersecurity controls, and corporate governance and ownership structure documents. You must also meet capital requirements, which vary by license category.

• How much does a crypto license cost?

  VARA licensing costs in Dubai vary significantly by activity, and no single fixed number applies across all business types. As a baseline, VARA's initial application fee ranges from roughly AED 40,000 to AED 100,000, depending on the licensed activity, with annual supervision fees running from around AED 80,000 up to AED 200,000.

• What is VARA in Dubai?

  The Virtual Assets Regulatory Authority (VARA) is Dubai's independent regulator for virtual assets. Established in 2022, VARA oversees virtual asset activities across Dubai's free zones and the mainland, excluding the Dubai International Financial Centre.

• Can foreigners open a crypto company in the UAE?

  Yes, foreigners can operate a virtual asset company in the UAE. The UAE’s free zones allow for 100% foreign ownership.