A firm that says it is "licensed in the UAE" has told you very little. There is no single UAE licence for digital assets. Five bodies can reach a firm or a token, and which of them applies depends on where the entity is registered, who its clients are and what it does with the asset. This piece maps them as they stood on 29 September 2026, with the status of each rule: in force, adopted, consulted on, or not yet clear. It is a guide to choosing a jurisdiction or a counterparty, and it is not legal, tax or investment advice.

Five regulators, four perimeters

The UAE has two financial free zones with their own regulators, and onshore territory where federal law applies. Dubai adds its own virtual asset regulator. Payment rules from the Central Bank cut across the onshore regimes but stop at the financial free zones.

  • Dubai outside DIFC, meaning the mainland and the non-financial free zones: the Virtual Assets Regulatory Authority (VARA).
  • Dubai International Financial Centre (DIFC): the Dubai Financial Services Authority (DFSA).
  • Abu Dhabi Global Market (ADGM): the Financial Services Regulatory Authority (FSRA).
  • Federal, onshore: the Capital Market Authority (CMA), which is what the Securities and Commodities Authority (SCA) became when the new capital markets laws took effect on 1 January 2026.
  • Payment tokens onshore: the Central Bank of the UAE (CBUAE).

Our post on why the Gulf covers who has been licensed in Abu Dhabi. This one covers the rules that decide who needs a licence.

Dubai onshore and non-financial free zones: VARA

VARA describes itself as the sole authority regulating virtual assets across Dubai's free zones and mainland, except within DIFC. Its Virtual Assets and Related Activities Regulations were published on 7 February 2023 under Dubai Law No. 4 of 2022.

The structure is activity by activity. VARA lists eight licensed activities: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and virtual asset issuance (Category 1). Issuances that are not Category 1 fall into Category 2. A custodian must be set up as a distinct legal entity with its own licence, and proprietary trading needs a no objection certificate from VARA. Four compulsory rulebooks (company, compliance and risk management, technology and information, market conduct) apply to every licensee, and each activity has its own rulebook on top.

Status. Version 2.0 of the activity rulebooks was published on 19 May 2025, with a 30-day transition and full compliance required by 19 June 2025. It tightened margin trading and token distribution and clarified collateral wallets. That is in force. VARA's news page lists no later rulebook version as of 29 September 2026; it lists supervisory notices, including one on implementing the UAE Travel Rule requirements dated 24 February 2026 (see our note on Travel Rule compliance), and its latest item is AML/CFT business risk assessment guidance dated 12 June 2026. The rulebook site's own update log shows changes within Version 2.0: a new Part V of the Exchange Services Rulebook on exchange-traded derivative services, with a revision date of 31 March 2026, under which an exchange licensee may offer those services only where its licence expressly authorises them, and revised guidance on the Virtual Asset Issuance Rulebook dated 9 April 2026. As at 29 September 2026 the log shows no rulebook change, and the news page no consultation, between June and September 2026.

DIFC: the DFSA and its token regime

The DFSA treats a crypto token as a financial instrument, like a security or a derivative. Using a token is not itself a financial service; a firm needs DFSA authorisation for the financial services it carries out with tokens. The DFSA's own release names trading, fund and asset management, custody and advisory services. A firm new to DIFC applies for authorisation; an authorised firm considers whether it needs to vary its permissions.

Status. The regime dates from 2022. Updated rules came into force on 12 January 2026 after a consultation in October 2025. This corrects a point that is still widely repeated: the DFSA no longer publishes a list of Recognised Crypto Tokens. Each firm must conclude, on reasonable grounds and on a documented basis, that a token is suitable for the activity, weighing its purpose, governance and founders, its regulatory status elsewhere, the size, liquidity and trading history of its market, its technology, and whether using it would stop the firm complying with DFSA-administered law (DFSA crypto page, archived 28 August 2026).

Fiat-backed tokens sit outside that firm-led test. The DFSA's Policy Statement on Fiat Crypto Tokens names three it has assessed as suitable: EURC, USDC and RLUSD. The statement as retrieved carries no date, so check it for changes before relying on it.

ADGM: the FSRA framework

ADGM regulates virtual asset business as financial services inside the zone. The FSRA's guidance on virtual asset activities (version of 10 June 2025) names seven "VA Regulated Activities": dealing in investments as principal, dealing in investments as agent, advising on investments or credit, arranging deals in investments, managing assets, providing custody, and operating a multilateral trading facility. Only "Accepted Virtual Assets" may be used in those activities. Since amendments that took effect on 10 June 2025, a King & Spalding summary reports, acceptance is a notification based on the applicant's self-assessment against FSRA criteria rather than an FSRA approval. The FSRA's own guidance of the same date still refers to obtaining FSRA approval to use virtual assets in those activities, so the two sources describe the route differently. Privacy tokens and algorithmic stablecoins are expressly barred from regulated use, and the FSRA can require a firm to take specified action, or to stop a regulated activity, in respect of a particular virtual asset.

Status.

  • Fiat-referenced token amendments were finalised on 31 October 2025 and took effect on 1 January 2026, widening the regulated activities that may be carried on with such tokens.
  • A staking framework was finalised on 29 April 2026 after Consultation Paper 10 of 2025. The FSRA's notice of publication says it made and published the amending rules on 29 April 2026 and names no later effective date, unlike its fiat-referenced token notice, which was marked effective 1 January 2026. The new staking section, COBS 17.10, is in the current Conduct of Business Rulebook (version of 16 September 2026), so we read the rules as in force from 29 April 2026.
  • Between June and 29 September 2026 the FSRA published no virtual asset consultation. Its 2026 consultation papers cover its anti-money-laundering framework and transfer schemes, and the FSRA rules it made in that period, on 16 September 2026, are published under the heading "FSRA Rules (Funds)".

Federal onshore: the Capital Market Authority

Federal Decree-Laws 32 and 33 of 2025 reconstituted the SCA as the CMA and rewrote the capital markets law. A Cleary Gottlieb summary reports that both entered into force on 1 January 2026, with a one-year window, to 1 January 2027, for existing firms to regularise their position, extendable by the CMA board. The same summary reads the law as bringing virtual assets within "financial product", and as requiring a virtual asset traded in the UAE to be admitted to the list of a CMA-licensed platform and registered with the CMA. Dechert's analysis adds that the new law reaches anyone targeting UAE clients, including from a free zone or from abroad, while DIFC and ADGM keep their own regimes for activity inside them.

The CMA announced a virtual assets framework on 13 April 2026: five modules (general requirements, conduct of business, alternative trading systems, anti-money-laundering, prudential requirements) and eight regulated activities, up from three. The eight are dealing as principal, dealing as agent, providing custody, arranging custody, arranging investment deals, providing investment advice, portfolio management, and operating a multilateral trading facility. The announcement gives no decision number, effective date or transition. The instrument that carries the licensing detail is the CMA chairman's Decision 04 of 2026 on virtual asset service providers and alternative trading system operators, which the CMA's own later resolution cites by name.

That later resolution is Resolution 16 of 2026, issued on 25 June 2026 and in force on issue. It allows entities licensed by the Central Bank, other than insurers, to carry on any activity in Decision 04, which opens a route in for banks. One law-firm commentary argues that the resolution says banks may enter without yet saying how; that is opinion.

We have not given capital requirements for the CMA regime. Secondary summaries of Decision 04 quote different floors, and we could not retrieve the decision's own text.

The Central Bank: payment tokens and the dirham

The Payment Token Services Regulation (Circular 2/2024) has been in force since 31 August 2024. It licenses three services: payment token issuing, conversion, and custody and transfer. Its main rules:

  • No one may perform a payment token service within the UAE, or directed to persons in it, without CBUAE licence or registration.
  • A licensed issuer may issue dirham payment tokens only to UAE residents. Issuers must hold at least AED 15 million of capital plus a percentage of tokens outstanding. Licensed custody and conversion providers need AED 1.5 million or AED 3 million, depending on monthly transfer volume. A bank may not issue directly but can use a subsidiary or affiliate.
  • A licensed or registered provider may transfer a foreign-currency token, such as a dollar stablecoin, only when it is being used to buy a virtual asset or a virtual asset derivative.
  • A UAE merchant selling goods or services may accept a virtual asset in payment only if it is a licensed dirham payment token, or a registered foreign token used to buy a virtual asset or derivative. In practice a dollar stablecoin cannot pay for ordinary goods and services onshore.
  • Algorithmic stablecoins and privacy tokens are prohibited, including for firms licensed by the SCA (now the CMA) or a local authority.
  • For these rules "the UAE" excludes the financial free zones. An issuer of foreign-currency tokens incorporated in ADGM or DIFC is treated as a foreign issuer and applies for registration as one.

For a treasurer, the text turns on use: investment and trading on one side, payment on the other. Article 40 disapplied the core prohibitions for one year, extendable by the Central Bank; a VARA circular of 23 July 2025 told licensees the grace period would end on 20 August 2025. Our earlier post records that Central Bank approval of the DDSC dirham token was reported in February 2026; we could not retrieve a CBUAE register, so we cannot list every licensed issuer.

The wider Central Bank law

Federal Decree-Law 6 of 2025 has been in force since 16 September 2025. Article 61 makes payment services using virtual assets a Central Bank licensed activity. Article 62 goes further: anyone carrying on, offering, issuing or facilitating a licensed activity, directly or indirectly and whatever the medium, falls within the Central Bank's jurisdiction, and it names DeFi, dApps, protocols and platforms. Article 187 carves out virtual assets held for investment, exchanged for one another, or swapped for trading, which stay under other legislation. Article 184 gave everyone subject to the law one year to reconcile their position, extendable by the Central Bank's board. On the text, that year ended on 16 September 2026. As at 29 September 2026 we found no general extension: the Central Bank rulebook's update log records none between June and September 2026, and a Hadef & Partners note of 26 August 2026 said none had been announced. The Central Bank's news pages blocked our retrieval, so an extension announced only there cannot be ruled out. The law does not apply inside the financial free zones.

What is unresolved

How the regimes interact, and whether anything passports

In September 2024 the SCA and VARA announced that VARA-licensed firms could be registered by default with the SCA to serve the wider UAE, and spoke of "passportability" of regulated services. The CMA's open-data page still describes a list of VARA-licensed companies registered with the SCA. But the April 2026 CMA announcement does not mention VARA, and we found no text confirming that default registration survives Decision 04. If a counterparty relies on a VARA licence to serve clients in other emirates, ask what it is relying on.

Between the free zones, we found nothing that amounts to mutual recognition: nothing lets an ADGM licence stand in DIFC or onshore Dubai, or the reverse. Nor does a free-zone licence necessarily cover onshore clients: as Dechert reads it, the federal law reaches firms that target onshore clients from a free zone. There is nothing like the EU passport described in our note on MiCA authorisation. For the same question across other jurisdictions, see what regulators actually permitted in 2026.

Consulted on, or not yet final

  • The Central Bank law's one-year window closed on 16 September 2026 on its face, and as at 29 September 2026 we found no published general extension. Nor did we find an implementing rule defining what "facilitating" means for a protocol or front end. The Central Bank's FAQs on the law, as reported by Pinsent Masons on 14 April 2026, say only that a technology provider serving licensed institutions exclusively does not by that alone carry on or facilitate a licensed activity. What "facilitating" covers is the open question that bears most on anyone building rather than trading.
  • VARA's news page carries a notice, dated 10 October 2025, of a public consultation on the UAE's implementation of the Crypto-Asset Reporting Framework. The page records no outcome. The tax side is in our CARF and DAC8 note.
  • The CMA framework's effective date and transitional terms are not in its announcement.

Where sources disagree

The CMA announced its framework on 13 April 2026, but a legal database lists Decision 04 of 2026 on the same subject with an issue date of 13 February 2026, and secondary summaries give different effective dates. We have used 13 April only as the date of the announcement and left the effective date open.

Choosing a jurisdiction or a counterparty

  1. Ask which entity holds which licence, from which regulator, and check the regulator's public register. A group name is not a licensee.
  2. Ask whether the licence covers the activity you are buying. VARA licenses per activity, and the DFSA grants permissions per financial service.
  3. Ask how the tokens involved are cleared for use: firm self-assessment at the DFSA, Accepted Virtual Assets at ADGM, and onshore, on Cleary Gottlieb's reading, admission by a CMA-licensed platform and registration with the CMA.
  4. For any stablecoin exposure, ask which token, which issuer and whether the use is investment or payment, because onshore the answer changes the rule.
  5. If the counterparty touches payment tokens, ask for its CBUAE licence or registration, not only its VARA or CMA one.

Proof of Talk Abu Dhabi is at Louvre Abu Dhabi, Saadiyat Cultural District, on 3–4 December 2026; admission is by application and review. Positions here are as of 29 September 2026 and several may move before then; see the Abu Dhabi page for the programme.