The United Arab Emirates has made a deliberate, high-profile bet on becoming one of the world’s leading crypto hubs, and it’s largely working: global exchanges, custodians, and token projects have flocked to Dubai and Abu Dhabi. But “UAE crypto regulation” is a slightly misleading phrase, because there isn’t one regime. There are several, run by different regulators, and working out which one governs your business is the first and most consequential decision you’ll make.
This guide fully maps that landscape. We’ll go through who needs a licence, who regulates what, the free zones, the various types of licence, the fees, the application process and the compliance obligations that come with being licensed (from AML and KYC through to the Travel Rule) as well as the tax treatment of crypto and the difficulties of doing business in the region. The UAE has absolutely embraced crypto, but it hasn’t done so in a completely unregulated way and that very gap between the two is precisely what this piece is about.
The UAE’s approach to crypto regulation
The UAE position is essentially pro-innovation but very much about compliance. Rather than go the route of banning or just sitting on the sidelines they actually created the regulatory frameworks to bring crypto into the fold which is why they were so attractive to businesses that wanted certainty. The problem with that structure is that it’s a federation of emirates plus a number of financial free zones each with their own legal regime. So certainty is achieved through a multitude of regulators rather than one single national regulator.
The key thing to get to grips with initially is onshore v free zone. Most of the UAE (the mainland across the emirates) is subject to federal law and to federal or emirate level regulators. The UAE also has financial free zones (primarily the Dubai International Financial Centre and the Abu Dhabi Global Market) which have their own common law regimes and their own financial regulators. Where your business is and what it does determines which regime applies. Get that right and everything else falls into place; get it wrong and you’ve applied to the wrong regulator altogether.
Who needs a crypto licence in the UAE?
The short answer is pretty much any business providing virtual asset services to or from the UAE. It’s an activity based licence so it’s down to what you’re actually doing rather than what you’re calling yourself. You’ll need a licence if you’re operating a crypto exchange or trading platform, providing custody or wallet services, acting as a broker or dealer, providing virtual asset management or investment services, running a lending or borrowing service, providing advisory services in respect of virtual assets, facilitating transfers and settlement. Issuing a token or stablecoin has its own requirements and payment stablecoins are treated as being a central bank product.
There are very few exceptions. An individual who is simply buying, holding or trading crypto for their own account is not providing a regulated service and will not require a licence. A business whose only connection to crypto is an incidental one (e.g. occasionally taking it as payment) is a very different proposition to a business whose business is virtual assets. The line is drawn very wide and is enforced very strictly so the safe assumption for any business that is in any way built around crypto is that it will require a licence. The question to ask is straightforward: are you providing a virtual asset service to others? If the answer is yes then you very likely will need a licence.
The key regulators, and who governs what
Five regulators matter for crypto in the UAE. Here’s what each one covers.
VARA (Virtual Assets Regulatory Authority)
Established in 2022, VARA is Dubai’s dedicated virtual-assets regulator, and was one of the world’s first authorities built specifically for the job. It regulates virtual-asset activities across the Emirate of Dubai, including its free zones, with one important exception: the DIFC, which has its own regulator. VARA operates a detailed rulebook and a set of licensed activity categories, and it has become the headline regulator most people mean when they talk about getting a “Dubai crypto licence.”
SCA (Securities and Commodities Authority)
The Securities and Commodities Authority (SCA) is the federal regulator of virtual assets in the UAE (onshore, outside the financial free zones). VARA and the SCA work in conjunction and in practice a VARA licensed firm in Dubai will be SCA registered to operate throughout the wider UAE. The SCA is the federal regulator that underpins the emirate and free zone regimes.
ADGM and the FSRA
The Abu Dhabi Global Market is a financial free zone with its own common-law framework, and its Financial Services Regulatory Authority (FSRA) runs one of the region’s earliest and most respected comprehensive crypto regimes, dating back to 2018. Businesses operating within ADGM are regulated by the FSRA rather than VARA or the SCA, and the zone has become a major hub for institutional and regulated crypto activity.
DIFC and the DFSA
The Dubai International Financial Centre is a separate financial free zone within Dubai, and the Dubai Financial Services Authority (DFSA) regulates crypto-token activities conducted within it. This is the exception carved out of VARA’s remit: a crypto business inside the DIFC answers to the DFSA, not VARA, which is a distinction that catches newcomers out.
The Central Bank of the UAE
The CBUAE is the one that sits over all of this with regard to payment tokens and stablecoins. Its Payment Token Services Regulation (2024) covers AED backed stablecoins and payment token services and brings crypto that is effectively money within the CBUAE’s sphere of influence. Any business that is engaged in stablecoins as a means of payment will need to know where the CBUAE’s jurisdiction kicks in.
So the practical question for any crypto business is where are you going to operate (which Emirate or free zone) and what are you going to do (what activities)? The answer to that leads you to a regulator and in some cases more than one. A firm in Dubai doing exchange and custody goes to VARA. The same firm in the DIFC goes to the DFSA. The same firm in ADGM goes to the FSRA. If you’re issuing or dealing with payment stablecoins then the Central Bank is also in the mix.
Key crypto-focused free zones
The UAE’s free zones are a big part of its crypto appeal, but they’re a frequent source of confusion, so it’s worth being clear about how they relate to the regulators. There are two very different kinds of free zone in play, and mixing them up is a common and costly mistake.
The financial free zones, the DIFC and ADGM, have their own financial regulators (the DFSA and FSRA) and their own crypto frameworks, as covered above. A crypto business set up in one of these is regulated by that zone’s authority. The commercial free zones are a different animal: zones such as the Dubai Multi Commodities Centre (DMCC), with its dedicated Crypto Centre, the International Free Zone Authority (IFZA), the Dubai World Trade Centre (DWTC), and Ras Al Khaimah’s Digital Assets Oasis (RAK DAO) offer company formation and a commercial licence, but they are not financial regulators.
The practical point is that setting up in a commercial free zone and being licensed to provide virtual-asset services are two separate steps. A business can incorporate in DMCC or RAK DAO, but to carry out regulated virtual-asset activities it still needs the appropriate regulatory licence, from VARA in Dubai, for example. The commercial free zone gives you a home; VARA (or the relevant regulator) gives you permission to operate. Businesses that conflate the two can find they’ve formed a company but can’t legally do the thing they formed it for, so it pays to understand which zone offers what before committing.
Types of crypto licence and regulated activities
Across all of these regimes licences are granted by activity rather than as a single overarching licence so a business will need to hold the licence or authorisation that corresponds to what it actually does. VARA is the clearest example of this with its seven categories of licensed virtual asset activity:
- Advisory services (giving advice on virtual assets)
- Broker dealer services. Facilitating the buying and selling of virtual assets.
- Custody services. Safeguarding clients’ virtual assets.
- Exchange services. Running a platform for trading virtual assets.
- Lending and borrowing services. Facilitating lending or borrowing of virtual assets.
- Virtual asset management and investment services. Managing client assets or investments.
- Virtual asset transfer and settlement services. Enabling the transfer and settlement of virtual assets.
A business that, say, runs an exchange and also holds customer assets needs both the exchange and the custody licence. The free-zone regulators, the FSRA and the DFSA, authorise a comparable range of activities under their own frameworks. The principle is consistent everywhere: you’re licensed for what you do, and doing an activity you aren’t licensed for is a serious breach.
Fees and minimum capital requirements
The cost of a UAE crypto licence comes in two main parts: the fees paid to the regulator and the capital the business must hold. Both vary considerably by regulator and by the activities licensed, so exact figures should be confirmed with the regulator directly, but the shape is consistent.
Regulators charge an application fee for each licence and an annual supervision fee to keep it going, and these fees are all activity dependent so a full exchange licence is going to be a lot more expensive than, for example, an advisory licence. On top of the fees there are minimum capital (or paid up capital) requirements which the business must maintain, again these are activity and risk dependent with capital intensive activities such as custody and exchange having the highest requirements. You need to factor in both the initial application costs and the ongoing annual fees and capital commitment as together these make a UAE licence a very serious financial commitment rather than just a nominal registration. The exact figures are updated from time to time so the regulator’s current fee schedule is the only definitive source.
How to get a crypto licence in the UAE: step by step
Getting a licence is a serious business and the regulators will look at the business and the people behind it as much as the application form itself. The specifics will vary from regulator to regulator but the general process will be the same.
- Choose your jurisdiction and regulator, based on where you’ll operate (which emirate or free zone) and what activities you’ll perform.
- Prepare your application and documentation: corporate structure, ownership and beneficial owners, key personnel, a business plan, and financials.
- Submit the initial application and pay the applicable fees.
- Undergo the regulator’s assessment of fit-and-proper standards, ownership, source of funds, capital, governance, and your compliance and technology arrangements.
- Meet the conditions of initial approval, building out the required compliance infrastructure and controls.
- Receive the full licence, and begin operating under its conditions.
- Maintain ongoing compliance, paying annual fees, meeting capital requirements, and satisfying supervisory obligations.
The throughline is that the UAE regulators want to know precisely who is behind the business and that they want to be absolutely certain of the controls before they will allow it to operate. That makes the ownership, source of funds and compliance groundwork the most difficult and most important element of any application.
Cancellation of incomplete applications
One practical warning to bear in mind: the regulators don’t leave incomplete applications open forever. VARA can cancel an application for any number of reasons including that it’s not complete in the time allowed or that it fails to provide the information they’ve requested. If you’re going to apply you need to be ready to do so and you need to be ready to do so with all the ownership, source of funds and compliance docs in place. A complete, properly prepared application is not only quicker, it’s the difference between getting through and being sent back to square one.
Compliance requirements for crypto companies in the UAE
Getting the licence is the beginning not the end. Licensed VASPs have a significant and ongoing compliance burden and are subject to active regulatory oversight. The principal obligations are:
- A full AML/CTF programme. Risk assessment, policies, controls, and a compliance officer, proportionate to the business’s risks.
- KYC and customer due diligence. Verifying customers at onboarding, and identifying the beneficial owners behind corporate clients.
- Sanctions screening. Checking customers and counterparties against sanctions lists and watchlists.
- The Travel Rule. Collecting and transmitting required information about the parties to virtual-asset transfers.
- Transaction monitoring. Watching activity for suspicious patterns on an ongoing basis.
- Suspicious transaction reporting. Reporting suspicious activity to the UAE’s Financial Intelligence Unit through the goAML system.
On top of these sit market-conduct, consumer-protection, and technology-risk requirements. The point to absorb is that a UAE crypto licence is a commitment to run a proper financial-crime compliance operation, indefinitely, not a one-time hurdle to clear.
AML and KYC compliance for UAE crypto businesses
AML and KYC are absolutely fundamental to UAE crypto compliance and there’s a very good reason for that. The UAE’s federal AML regime (Federal Decree-Law No. 20 of 2018 and the implementing regulations) applies to crypto businesses in exactly the same way as it does to any other financial institution. The UAE was on the FATF grey list in 2022 for AML deficiencies and responded with a very significant programme of reform and enforcement which saw it removed from the list in February 2024. That experience has led to a very high bar for compliance and the regulators are extremely protective of the credibility they’ve regained.
In practice AML and KYC for a UAE crypto business means running a full risk based AML programme with robust CDD at its heart. That means identity verification of every customer prior to onboarding (KYC), identification of the beneficial owners of any corporate customer, application of enhanced due diligence to higher risk customers (e.g. PEPs, customers from high risk jurisdictions), screening against sanctions and watchlists, ongoing transaction monitoring and reporting of any suspicious activity to the UAE FIU via the goAML portal. The regulator message is very clear on this: AML and KYC in the UAE are actively supervised and it’s not a box to be ticked.
Crypto Travel Rule requirements in the UAE
The Travel Rule is a specific and increasingly scrutinised piece of UAE crypto compliance. Derived from FATF’s standards, it requires virtual-asset service providers to collect and transmit identifying information about both the originator and the beneficiary of a virtual-asset transfer, so that the people on each end of a transaction travel with it, exactly as they do with a traditional bank wire.
Under VARA’s rules, and the UAE framework more broadly, licensed VASPs must obtain and hold required information about the sender and recipient, pass it to the counterparty VASP on qualifying transfers, and screen that information against sanctions lists. Transfers to or from unhosted (self-custody) wallets, and to VASPs in other jurisdictions, carry their own handling requirements. The Travel Rule is operationally demanding, because it requires interoperable systems between VASPs, and it’s an area regulators examine closely, since it’s central to preventing crypto being used to move value anonymously. For a UAE VASP, having a working Travel Rule solution is not optional.
VARA’s risk-based approach and FATF rules
VARA’s supervisory approach is risk based. Firms are expected to understand and manage their own specific money laundering and terrorist financing risks rather than simply apply a generic set of controls. The level of VARA’s own supervision is then appropriately calibrated to the risk that the firm poses. This is of course in line with the FATF risk based approach which underpins AML worldwide and is reflected throughout the VARA rulebook.
VARA has continued to refine and sharpen its rules and its adherence to FATF standards is very clear. The guidance on enhanced measures in relation to high risk jurisdictions is a case in point. In keeping with the FATF lists of high risk and monitored jurisdictions, VARA requires firms to apply enhanced due diligence and in some cases countermeasures to businesses and transactions which are connected to those jurisdictions. For a licensed firm this means that you have to keep your own risk assessment up to date, you have to be monitoring the FATF lists and you have to be adjusting your controls as a result. The trend is clearly one of greater alignment with international standards and more active, risk sensitive supervision. Firms should therefore treat their risk assessment as a living document which VARA will expect to see reflected in the way they actually operate rather than some form which you just complete and file away.
Taxation of cryptocurrencies in the UAE
Tax is a huge part of the UAE’s appeal when it comes to crypto and the headline is very much in that spirit. It’s absolutely true though and there are a number of caveats to bear in mind. This is general information only and not tax advice. Any specific position would need to be confirmed with the UAE Federal Tax Authority or a qualified advisor as the rules are very specific and are subject to change.
The UAE has no personal income tax and no capital gains tax so individuals buying, holding and selling crypto for themselves are generally not subject to tax on their gains. For businesses the situation has changed with the introduction of a 9% federal corporate tax from June 2023 on business profits in excess of a threshold (AED 375,000), crypto businesses being no exception. The free zone regime does however provide a major benefit in that a Qualifying Free Zone Person can pay 0% corporate tax on qualifying income (subject to meeting the substance and other requirements) and the FTA have made it clear that holding crypto for investment can be considered a qualifying activity. On VAT the UAE has amended its rules in 2024 to exempt the transfer and conversion of virtual assets from the 5% VAT with the exemption being retrospective to January 2018 (a very significant relief for crypto businesses). Looking forward the UAE is expected to adopt the international crypto tax reporting standards (e.g. the OECD’s Crypto Asset Reporting Framework) so the reporting burden (if not the tax itself) is set to increase.
Challenges for UAE crypto companies
For all its advantages, operating a crypto business in the UAE comes with real challenges, and it’s worth being honest about them:
- Regulatory complexity. The multi-regulator structure, VARA, the SCA, the free-zone authorities, and the Central Bank, means working out which regime applies, and sometimes dealing with more than one, is genuinely demanding.
- A very high and rising compliance bar. Post-grey list the AML, KYC, Travel Rule and reporting requirements are all significant and actively monitored, which in turn requires a genuine investment in both people and systems.
- Cost. Licensing fees, capital requirements and the cost of a proper compliance operation make the UAE a serious commitment rather than a cheap place to set up.
- Keeping pace with change. The rules are evolving quickly, so firms have to track rulebook updates, new regulations, and shifting FATF-driven requirements continuously.
- Banking and operational friction. Even licensed crypto businesses can face challenges securing and maintaining banking relationships, a common pain point in the sector globally.
None of that is a reason to shun the UAE (it’s still one of the most attractive regulated crypto markets in the world). They are reasons to enter with a clear head, with the appropriate resources and with the full appreciation of the compliance commitment that the market will require in return for all its benefits.
Recent developments
The UAE’s crypto regime is still evolving quickly, and a few developments stand out:
- The Central Bank’s Payment Token Services Regulation (2024) which brings stablecoins and payment tokens (including AED stablecoins) into a formal regulatory framework.
- The UAE’s removal from the FATF grey list in February 2024 as a result of its AML reforms.
- The 2024 VAT exemption for virtual asset transfers and conversions (applied retrospectively) has simplified the tax position for crypto businesses.
- Ongoing updates to the VARA rulebook and active enforcement (including action against unlicensed operators and marketing breaches).
The rules are in a state of flux so any business operating here would be well advised to check with the appropriate regulator to confirm the current position. The details set out above are as at 2026.
Penalties for non-compliance
The UAE regulators have real bite and they use it. Running a virtual asset business without the requisite licence or breaching the terms of a licence can result in significant financial penalties, suspension or revocation of the licence and enforcement action against the individuals involved. VARA in particular has publicly imposed fines on entities for operating or marketing without authorisation.
Beyond the direct penalties there’s a reputational aspect which is particularly important in this case. The UAE has spent a lot of money on building the image of itself as a clean, well-governed crypto jurisdiction and it has very little appetite for any business that in any way compromises that reputation. For an operator the breach of the rules doesn’t just equate to a fine, it can equate to being excluded from one of the most attractive crypto markets in the world. In a jurisdiction which has worked so hard to establish its credibility that’s the price of admission.
Where Beady fits
Beady doesn’t apply for your VARA, SCA, ADGM or DIFC licence and it’s not a blockchain analytics tool that traces on-chain flows. What it does is take a large chunk of the AML and due diligence burden that every UAE crypto regime has to bear on the business and ownership side (where compliance is the most difficult and the regulators are the most watchful).
For a licensed UAE VASP that means KYB automation on institutional clients, partners and the corporate counterparties behind the wallets in order to satisfy the beneficial ownership that the regulators require you to establish. It means screening those entities and the people who control them against sanctions and watchlists and adverse media with every finding back to its source so that a decision can be evidenced to a regulator. It means ongoing monitoring so that if a counterparty or owner becomes a problem after onboarding that is picked up at the point it happens. Beady is the entity and people intelligence layer that enables a UAE crypto licence; it works alongside your licensing advisers and your blockchain analytics tools rather than in place of either of those.
Welcome, but not unregulated
The UAE’s real achievement in crypto has been to make it a genuinely welcome industry without in any way making it a free-for-all. The outcome is a market with real regulatory certainty, provided you’re prepared to meet a fairly high compliance bar and are able to navigate a regulator who will reward you for getting the details spot on. The licence is the pass to get in, the ongoing compliance is what keeps you in the room.
At the centre of that compliance, across every one of the UAE’s regimes, is the same question: who are you really dealing with? If you’d like to see how Beady answers it, verifying who sits behind a counterparty or partner and keeping watch after onboarding, book a Beady demo and we’ll walk through it on a company of your choosing.
