We use cookies to provide, protect, and improve our service. By continuing to use this site, you consent to our cookies. You can manage your cookie preferences in our Cookie Settings. Learn more
Country Comparative Guides
United Arab Emirates:
Blockchain & Crypto Assets
Blockchain & Crypto Assets
The United Arab Emirates (“UAE”) has become one of the busiest blockchain and crypto markets in the world. Over the past decade, the government has treated blockchain as an industry to be built rather than a risk to be kept out. It wrote rules early, set up a dedicated crypto regulator in Dubai and invited global firms to move in. Today, almost every large crypto exchange has some presence in the country, and blockchain is used by banks, property registries, government departments and start-ups.
The market is centered on two cities. Dubai is home to the Virtual Assets Regulatory Authority (“VARA”), the world’s first regulator created only for virtual assets, and to the Dubai International Financial Centre (“DIFC”), a financial free zone with its own regulator, the Dubai Financial Services Authority (“DFSA”). Abu Dhabi hosts the Abu Dhabi Global Market (“ADGM”), the other financial free zone, whose regulator, the Financial Services Regulatory Authority (“FSRA”), has built one of the most developed crypto rulebooks in the region. At the federal level, the Capital Market Authority (“CMA”) and the Central Bank of the UAE (“CBUAE”) complete the picture. How these regulators divide the work is explained in Question 2.
The number of licensed firms keeps growing. By October 2026, VARA’s public register listed 59 licensed virtual asset service providers (“VASPs”), including Binance, Crypto.com, OKX, Deribit and Bitpanda. Many of them are also registered with the federal CMA, which lets them serve clients across the country. Beyond regulated VASPs, thousands of blockchain and Web3 companies, such as software developers, protocol foundations and game studios, operate from commercial free zones like the Dubai Multi Commodities Centre (“DMCC”), whose Crypto Centre is one of the largest clusters of its kind.
Financial services remain the largest area, where blockchain was adopted. Trading, brokerage, custody and asset management are now offered by both crypto-native firms and traditional institutions. Local banks have started to join in: Zand Bank, for example, holds a VARA licence for custody services.
Another fast-moving area is payments and stablecoins. The CBUAE gave its first approval for a dirham-backed stablecoin, AE Coin, in 2024, and banks and large corporate groups have since followed with their own dirham tokens. In January 2026, the CBUAE also registered the first US dollar stablecoin for use in the UAE. These tokens are meant for payments, trade finance and the settlement of trades in other digital assets.
Real estate is the clearest example of blockchain reaching ordinary investors. The Dubai Land Department (“DLD”) now records fractional ownership of properties as tokens linked directly to the official land registry, and since February 2026 these tokens can be resold on a licensed secondary market.
Capital markets and funds are following. Regulators in all three regimes (federal, ADGM and DIFC) treat a tokenised share, bond, sukuk (an Islamic finance certificate) or fund unit as the same financial instrument it represents, which allows these products to be issued under existing rules. In 2025, the DFSA opened a tokenisation sandbox, a supervised testing program, and received interest from close to 100 firms.
Finally, the UAE has become a base for blockchain protocol foundations and decentralised autonomous organisations (“DAOs”), which use dedicated legal structures in ADGM and in Innovation City in Ras Al Khaimah. Other areas of use include trade and logistics, supply-chain tracking and Bitcoin mining, which has been carried out on an industrial scale in Abu Dhabi.
The market is centered on two cities. Dubai is home to the Virtual Assets Regulatory Authority (“VARA”), the world’s first regulator created only for virtual assets, and to the Dubai International Financial Centre (“DIFC”), a financial free zone with its own regulator, the Dubai Financial Services Authority (“DFSA”). Abu Dhabi hosts the Abu Dhabi Global Market (“ADGM”), the other financial free zone, whose regulator, the Financial Services Regulatory Authority (“FSRA”), has built one of the most developed crypto rulebooks in the region. At the federal level, the Capital Market Authority (“CMA”) and the Central Bank of the UAE (“CBUAE”) complete the picture. How these regulators divide the work is explained in Question 2.
The number of licensed firms keeps growing. By October 2026, VARA’s public register listed 59 licensed virtual asset service providers (“VASPs”), including Binance, Crypto.com, OKX, Deribit and Bitpanda. Many of them are also registered with the federal CMA, which lets them serve clients across the country. Beyond regulated VASPs, thousands of blockchain and Web3 companies, such as software developers, protocol foundations and game studios, operate from commercial free zones like the Dubai Multi Commodities Centre (“DMCC”), whose Crypto Centre is one of the largest clusters of its kind.
Financial services remain the largest area, where blockchain was adopted. Trading, brokerage, custody and asset management are now offered by both crypto-native firms and traditional institutions. Local banks have started to join in: Zand Bank, for example, holds a VARA licence for custody services.
Another fast-moving area is payments and stablecoins. The CBUAE gave its first approval for a dirham-backed stablecoin, AE Coin, in 2024, and banks and large corporate groups have since followed with their own dirham tokens. In January 2026, the CBUAE also registered the first US dollar stablecoin for use in the UAE. These tokens are meant for payments, trade finance and the settlement of trades in other digital assets.
Real estate is the clearest example of blockchain reaching ordinary investors. The Dubai Land Department (“DLD”) now records fractional ownership of properties as tokens linked directly to the official land registry, and since February 2026 these tokens can be resold on a licensed secondary market.
Capital markets and funds are following. Regulators in all three regimes (federal, ADGM and DIFC) treat a tokenised share, bond, sukuk (an Islamic finance certificate) or fund unit as the same financial instrument it represents, which allows these products to be issued under existing rules. In 2025, the DFSA opened a tokenisation sandbox, a supervised testing program, and received interest from close to 100 firms.
Finally, the UAE has become a base for blockchain protocol foundations and decentralised autonomous organisations (“DAOs”), which use dedicated legal structures in ADGM and in Innovation City in Ras Al Khaimah. Other areas of use include trade and logistics, supply-chain tracking and Bitcoin mining, which has been carried out on an industrial scale in Abu Dhabi.
The UAE’s blockchain framework comprises federal regulation, Dubai’s virtual asset regime, specialised frameworks in certain non-financial free zones, and the separate regimes of the two financial free zones, ADGM and DIFC. Mainland businesses are subject to federal and emirate law. Non-financial free zones have their own corporate and commercial licensing rules, sometimes including specific licences for blockchain and crypto businesses, but these do not replace any required financial regulatory authorisation. ADGM and DIFC have separate civil, commercial and financial services regimes, while federal criminal and anti-money laundering laws apply throughout the UAE.
Federal regulation
Federal oversight is divided principally between the CMA (formerly the SCA), which regulates virtual asset services, and the CBUAE, which regulates payment tokens and other instruments within its remit.
The federal regime began with the SCA’s Crypto Assets Activities Regulation in 2020, covering crypto asset offerings, trading and related services. In 2023, it was replaced by a two-tier framework: Cabinet Resolution No. 111 of 2022 allocated regulatory responsibility across the UAE outside financial free zones, while separate SCA Decision No. 26/R.M/2023 set out detailed requirements for trading platforms and other virtual asset services.
In 2026, CMA Decision No. 4/R.M/2026 replaced Decision No. 26/R.M/2023 and the earlier rulebook’s virtual asset provisions with a single framework covering eight regulated activities: dealing as principal; dealing as agent; providing custody; arranging custody; arranging investment deals; investment advice; portfolio management; and operating a multilateral trading facility. It addresses general requirements, conduct of business, alternative trading systems, anti-money laundering and counter-terrorist financing (“AML/CFT”), and prudential requirements. Firms must obtain approval for each activity and meet the corresponding governance, risk management, client protection and financial resource requirements. Existing licensees have one year from the Decision’s effective date to obtain approval under the new framework.
The CBUAE, on the other hand, regulates payment tokens (i.e., fiat-referenced stablecoins) under its Payment Token Services Regulation 2024. The Regulation distinguishes dirham-denominated payment tokens from foreign payment tokens and establishes licensing or registration requirements, as applicable, for three services: payment token issuance, payment token conversion, and payment token custody and transfer. The framework also governs the management and safeguarding of reserve assets by licensed issuers and tokenholders’ right to redemption at par in the relevant fiat currency. Separately, the new Central Bank law, Federal Decree-Law No. 6 of 2025, extends the CBUAE’s licensing powers to anyone who offers or facilitates a financial activity it licenses through any technology, expressly including DeFi protocols and decentralised applications.
Dubai regulation
Dubai Law No. 4 of 2022 established VARA to regulate virtual assets and related activities across Dubai, including its free zones but excluding DIFC. The Virtual Assets and Related Activities Regulations 2023, as amended, govern licensing, supervision and enforcement, supported by four compulsory rulebooks and eight activity-specific rulebooks.
The four compulsory rulebooks cover:
Alongside the Regulations and rulebooks, the Regulations on the Marketing of Virtual Assets and Related Activities 2024 apply to marketing in or targeting the UAE by domestic and foreign entities, whether or not licensed by VARA. See further Question 16.
In addition, the CMA and VARA coordinate licensing and supervision under agreements originally concluded between VARA and the SCA, the CMA’s predecessor. Under the September 2024 agreement, VASPs operating in or from Dubai obtain a VARA licence and, on that basis, register with the federal regulator, allowing them to serve clients elsewhere in the UAE outside the financial free zones. VASPs established elsewhere in the UAE outside those zones are licensed by the CMA. The agreement also provides for coordinated supervision, enforcement and information sharing. A further agreement, announced on 7 August 2025, provides for unified VASP registration, mutual recognition of licences and cooperation on AML/CFT risk assessments and legislation.
Non-financial free zones
Non-financial free zones have their own incorporation, corporate governance and commercial licensing rules but remain within the UAE’s wider virtual asset framework. Their commercial licences do not authorise regulated virtual asset services, which require approval from the CMA or competent local regulator and may also be subject to CBUAE requirements.
In Dubai’s non-financial free zones, the relevant free zone authority handles commercial licensing, while VARA regulates virtual asset activities. DMCC, for example, supports blockchain and Web3 businesses through its Crypto Centre and issues commercial licences for approved activities, but regulated virtual asset services in or from DMCC require separate VARA authorisation.
In Ras Al Khaimah, Innovation City, formerly the Ras Al Khaimah Digital Assets Oasis, supports and commercially licenses technology businesses, including blockchain, Web3, digital assets, AI and gaming. Its Companies Regulations 2023 govern company formation, ownership and management, while its DAO Association Regulations 2024 provide a specialised incorporation and governance regime for decentralised autonomous organisations (see further Question 13). These rules operate alongside federal law and do not replace any required financial regulatory authorisation.
Financial free zones: ADGM and DIFC
ADGM and DIFC occupy a distinct position in the UAE legal system. They are exempt from federal civil and commercial legislation, while federal criminal law and AML legislation continue to apply. Both have their own laws and courts based on common law: ADGM applies English common law directly, while DIFC has enacted its own statutes based on common law principles. Their financial regulators are the FSRA in ADGM and the DFSA in DIFC. Businesses providing regulated digital asset financial services in or from either zone must therefore be authorised by the FSRA or DFSA, respectively.
In ADGM, the Financial Services and Markets Regulations 2015 (“FSMR”) and FSRA rulebooks regulate digital asset activities according to the asset’s characteristics and the services provided. Virtual assets and fiat-referenced tokens (“FRTs”) have specific frameworks, while security tokens, digital asset derivatives and funds investing in digital assets fall within the corresponding securities, derivatives and investment fund regimes. The FRT framework, introduced in December 2024 for issuance, expanded from 1 January 2026 to cover wider regulated financial services, including safeguarding client FRTs; firms must use only FSRA-accepted tokens (“Accepted FRTs”) for regulated FRT activities. Trading venues, brokers, custodians, asset managers and other firms conducting regulated digital asset activities require an appropriate FSRA Financial Services Permission and must meet requirements on governance, financial resources, financial crime prevention, technology risk and client asset protection. Trading venues face additional requirements on settlement, transaction monitoring, record-keeping and transparency.
On 29 April 2026, the FSRA also extended its framework to staking clients’ virtual assets (see Question 16). Beyond the regulation of financial services, ADGM provides a corporate framework for blockchain projects through its Distributed Ledger Technology Foundations Regulations 2023. These establish a legal structure for blockchain foundations, DAOs and other DLT projects (see Question 13).
In DIFC, the DFSA regulates digital asset financial services under the Regulatory Law 2004 and the DFSA Rulebook. Its Investment Token regime, introduced in 2021, applies securities and derivatives requirements to tokens with those characteristics, while the Crypto Token regime, introduced in 2022, covers financial services involving cryptocurrencies and other tokens within that category. The latter addresses authorisation, prudential resources, conduct, financial crime prevention, token suitability, custody, governance and disclosure, with core rules in Chapter 3A of the General Module. The token suitability rules determine which tokens firms may use in their regulated activities. Since 12 January 2026, firms have been responsible for assessing Crypto Tokens themselves, replacing the previous system of DFSA recognition. Fiat Crypto Tokens (fiat-backed stablecoins), however, remain subject to DFSA assessment and inclusion on its published list.
Beyond financial services regulation, DIFC’s Digital Assets Law (No. 2 of 2024) establishes the property-law framework for digital assets, including their legal characteristics, control and transfer. The Law of Security (No. 4 of 2024) governs their use as collateral, while the DIFC Laws Amendment Law (No. 3 of 2024) adapts contract, trust and other private-law statutes. These laws govern ownership and dealings in digital assets alongside the DFSA’s regulation of related financial services.
Federal regulation
Federal oversight is divided principally between the CMA (formerly the SCA), which regulates virtual asset services, and the CBUAE, which regulates payment tokens and other instruments within its remit.
The federal regime began with the SCA’s Crypto Assets Activities Regulation in 2020, covering crypto asset offerings, trading and related services. In 2023, it was replaced by a two-tier framework: Cabinet Resolution No. 111 of 2022 allocated regulatory responsibility across the UAE outside financial free zones, while separate SCA Decision No. 26/R.M/2023 set out detailed requirements for trading platforms and other virtual asset services.
In 2026, CMA Decision No. 4/R.M/2026 replaced Decision No. 26/R.M/2023 and the earlier rulebook’s virtual asset provisions with a single framework covering eight regulated activities: dealing as principal; dealing as agent; providing custody; arranging custody; arranging investment deals; investment advice; portfolio management; and operating a multilateral trading facility. It addresses general requirements, conduct of business, alternative trading systems, anti-money laundering and counter-terrorist financing (“AML/CFT”), and prudential requirements. Firms must obtain approval for each activity and meet the corresponding governance, risk management, client protection and financial resource requirements. Existing licensees have one year from the Decision’s effective date to obtain approval under the new framework.
The CBUAE, on the other hand, regulates payment tokens (i.e., fiat-referenced stablecoins) under its Payment Token Services Regulation 2024. The Regulation distinguishes dirham-denominated payment tokens from foreign payment tokens and establishes licensing or registration requirements, as applicable, for three services: payment token issuance, payment token conversion, and payment token custody and transfer. The framework also governs the management and safeguarding of reserve assets by licensed issuers and tokenholders’ right to redemption at par in the relevant fiat currency. Separately, the new Central Bank law, Federal Decree-Law No. 6 of 2025, extends the CBUAE’s licensing powers to anyone who offers or facilitates a financial activity it licenses through any technology, expressly including DeFi protocols and decentralised applications.
Dubai regulation
Dubai Law No. 4 of 2022 established VARA to regulate virtual assets and related activities across Dubai, including its free zones but excluding DIFC. The Virtual Assets and Related Activities Regulations 2023, as amended, govern licensing, supervision and enforcement, supported by four compulsory rulebooks and eight activity-specific rulebooks.
The four compulsory rulebooks cover:
- Company: ownership, organisational structure, governance, fitness and propriety of owners and management, outsourcing, prudential resources, insurance, wind-down planning and material business or control changes.
- Compliance and Risk Management: compliance, risk management, record-keeping, audit, reporting, anti-bribery controls, client due diligence, suspicious transaction monitoring and reporting, targeted financial sanctions, and the FATF Travel Rule requiring originator and beneficiary information with transfers. Client asset safeguards include reconciliation and proof of reserves to verify that assets owed to clients are held.
- Technology and Information: cybersecurity, cryptographic key and wallet management, technology testing and audit, business continuity, personal data protection and confidentiality.
- Market Conduct: written client agreements, complaints, investor classification, public disclosures of authorised activities and investment risks, market transparency, proprietary trading and virtual asset standards.
Alongside the Regulations and rulebooks, the Regulations on the Marketing of Virtual Assets and Related Activities 2024 apply to marketing in or targeting the UAE by domestic and foreign entities, whether or not licensed by VARA. See further Question 16.
In addition, the CMA and VARA coordinate licensing and supervision under agreements originally concluded between VARA and the SCA, the CMA’s predecessor. Under the September 2024 agreement, VASPs operating in or from Dubai obtain a VARA licence and, on that basis, register with the federal regulator, allowing them to serve clients elsewhere in the UAE outside the financial free zones. VASPs established elsewhere in the UAE outside those zones are licensed by the CMA. The agreement also provides for coordinated supervision, enforcement and information sharing. A further agreement, announced on 7 August 2025, provides for unified VASP registration, mutual recognition of licences and cooperation on AML/CFT risk assessments and legislation.
Non-financial free zones
Non-financial free zones have their own incorporation, corporate governance and commercial licensing rules but remain within the UAE’s wider virtual asset framework. Their commercial licences do not authorise regulated virtual asset services, which require approval from the CMA or competent local regulator and may also be subject to CBUAE requirements.
In Dubai’s non-financial free zones, the relevant free zone authority handles commercial licensing, while VARA regulates virtual asset activities. DMCC, for example, supports blockchain and Web3 businesses through its Crypto Centre and issues commercial licences for approved activities, but regulated virtual asset services in or from DMCC require separate VARA authorisation.
In Ras Al Khaimah, Innovation City, formerly the Ras Al Khaimah Digital Assets Oasis, supports and commercially licenses technology businesses, including blockchain, Web3, digital assets, AI and gaming. Its Companies Regulations 2023 govern company formation, ownership and management, while its DAO Association Regulations 2024 provide a specialised incorporation and governance regime for decentralised autonomous organisations (see further Question 13). These rules operate alongside federal law and do not replace any required financial regulatory authorisation.
Financial free zones: ADGM and DIFC
ADGM and DIFC occupy a distinct position in the UAE legal system. They are exempt from federal civil and commercial legislation, while federal criminal law and AML legislation continue to apply. Both have their own laws and courts based on common law: ADGM applies English common law directly, while DIFC has enacted its own statutes based on common law principles. Their financial regulators are the FSRA in ADGM and the DFSA in DIFC. Businesses providing regulated digital asset financial services in or from either zone must therefore be authorised by the FSRA or DFSA, respectively.
In ADGM, the Financial Services and Markets Regulations 2015 (“FSMR”) and FSRA rulebooks regulate digital asset activities according to the asset’s characteristics and the services provided. Virtual assets and fiat-referenced tokens (“FRTs”) have specific frameworks, while security tokens, digital asset derivatives and funds investing in digital assets fall within the corresponding securities, derivatives and investment fund regimes. The FRT framework, introduced in December 2024 for issuance, expanded from 1 January 2026 to cover wider regulated financial services, including safeguarding client FRTs; firms must use only FSRA-accepted tokens (“Accepted FRTs”) for regulated FRT activities. Trading venues, brokers, custodians, asset managers and other firms conducting regulated digital asset activities require an appropriate FSRA Financial Services Permission and must meet requirements on governance, financial resources, financial crime prevention, technology risk and client asset protection. Trading venues face additional requirements on settlement, transaction monitoring, record-keeping and transparency.
On 29 April 2026, the FSRA also extended its framework to staking clients’ virtual assets (see Question 16). Beyond the regulation of financial services, ADGM provides a corporate framework for blockchain projects through its Distributed Ledger Technology Foundations Regulations 2023. These establish a legal structure for blockchain foundations, DAOs and other DLT projects (see Question 13).
In DIFC, the DFSA regulates digital asset financial services under the Regulatory Law 2004 and the DFSA Rulebook. Its Investment Token regime, introduced in 2021, applies securities and derivatives requirements to tokens with those characteristics, while the Crypto Token regime, introduced in 2022, covers financial services involving cryptocurrencies and other tokens within that category. The latter addresses authorisation, prudential resources, conduct, financial crime prevention, token suitability, custody, governance and disclosure, with core rules in Chapter 3A of the General Module. The token suitability rules determine which tokens firms may use in their regulated activities. Since 12 January 2026, firms have been responsible for assessing Crypto Tokens themselves, replacing the previous system of DFSA recognition. Fiat Crypto Tokens (fiat-backed stablecoins), however, remain subject to DFSA assessment and inclusion on its published list.
Beyond financial services regulation, DIFC’s Digital Assets Law (No. 2 of 2024) establishes the property-law framework for digital assets, including their legal characteristics, control and transfer. The Law of Security (No. 4 of 2024) governs their use as collateral, while the DIFC Laws Amendment Law (No. 3 of 2024) adapts contract, trust and other private-law statutes. These laws govern ownership and dealings in digital assets alongside the DFSA’s regulation of related financial services.
The UAE government and its regulators are broadly supportive of blockchain technology as a means of improving public services, modernising financial infrastructure and attracting investment. This support is accompanied by regulatory oversight aimed at protecting investors, maintaining market integrity and preventing financial crime. Dubai’s VARA illustrates this approach: its statutory objectives combine promoting Dubai as a virtual asset hub and encouraging innovation with protecting investors and curbing illegal practices.
Government support has developed over the past decade. The Dubai Blockchain Strategy, launched in October 2016, focused on government efficiency, industry development and international leadership, with the ambition of making Dubai the first city fully powered by blockchain by 2020. The Emirates Blockchain Strategy 2021, launched in April 2018, set a federal target of transferring 50% of government transactions to blockchain platforms by 2021. These strategies led to concrete initiatives: in January 2020, Smart Dubai reported that 24 blockchain use cases were being implemented across eight sectors, including finance, real estate, health and transport, alongside the launch of a shared blockchain platform for government entities. However, official sources do not indicate that the broader targets were met in full.
More recent projects provide further evidence of practical implementation. In payments, the CBUAE is developing the Digital Dirham, the digital form of the national currency (see further Question 4).
In real estate, the DLD launched its Real Estate Tokenisation Project in March 2025 with VARA and other public-sector partners. The project allows investors to acquire fractional property ownership through digital tokens linked to Dubai’s official property registry (see Question 8).
Government support has developed over the past decade. The Dubai Blockchain Strategy, launched in October 2016, focused on government efficiency, industry development and international leadership, with the ambition of making Dubai the first city fully powered by blockchain by 2020. The Emirates Blockchain Strategy 2021, launched in April 2018, set a federal target of transferring 50% of government transactions to blockchain platforms by 2021. These strategies led to concrete initiatives: in January 2020, Smart Dubai reported that 24 blockchain use cases were being implemented across eight sectors, including finance, real estate, health and transport, alongside the launch of a shared blockchain platform for government entities. However, official sources do not indicate that the broader targets were met in full.
More recent projects provide further evidence of practical implementation. In payments, the CBUAE is developing the Digital Dirham, the digital form of the national currency (see further Question 4).
In real estate, the DLD launched its Real Estate Tokenisation Project in March 2025 with VARA and other public-sector partners. The project allows investors to acquire fractional property ownership through digital tokens linked to Dubai’s official property registry (see Question 8).
The CBUAE is developing the Digital Dirham, a CBDC intended for retail payments (by individuals and businesses), wholesale payments (settlement between banks and other financial institutions) and cross-border payments. It is a direct liability of the CBUAE, designed to be interchangeable at par (one for one) with dirham cash and bank deposits. Distribution is intermediated: the CBUAE issues the currency, while licensed financial institutions provide wallets and customer-facing services. According to the CBUAE, the Digital Dirham will pay no interest, will be subject to holding limits that differ for residents, businesses and visitors, and will protect privacy by recording users pseudonymously rather than storing personally identifiable information on the ledger.
The Digital Dirham project builds on earlier cooperation with other central banks. Project Aber, conducted with the Saudi Central Bank in 2019 (final report 2020), tested a jointly issued wholesale digital currency for interbank settlements. The UAE subsequently joined Project mBridge, a shared platform for cross-border CBDC payments developed with the BIS Innovation Hub and the monetary authorities of China, Hong Kong and Thailand. Following a real-value pilot in 2022, mBridge reached the minimum viable product stage (a basic working version available to participants) in 2024 and was handed over to the participating central banks later that year.
In March 2023, the CBUAE launched its CBDC strategy, setting out plans for cross-border payments through mBridge and domestic retail and wholesale applications. To provide a legal basis for its use, Federal Decree-Law No. 54 of 2023 recognised digital currency issued by the CBUAE as legal tender. This status is preserved under the current Central Bank law, Federal Decree-Law No. 6 of 2025, which also governs the issuance and circulation of the dirham in digital form.
The Digital Dirham has already been tested in several payment scenarios. In January 2024, the CBUAE transferred AED 50 million to China through mBridge, demonstrating its use for cross-border payments. Domestic trials explored how individuals could use it to buy tokenised assets and receive social benefits, how parents could manage wallets linked to their children’s wallets, and how visitors could make payments during their stay. Several of these trials used programmable payments, which execute automatically when predefined conditions are met. In November 2025, the Ministry of Finance and Dubai’s Department of Finance tested a payment between federal and local government entities. Completed in under two minutes, this was the first government financial transaction using the Digital Dirham and formed part of the pilot phase.
The CBUAE’s July 2025 report described preparations for wider use of the Digital Dirham by individuals and businesses, including online and in-store purchases, business payments and transfers between individuals. A cross-border application had already been launched and a domestic retail pilot completed, while further work focused on preparing the currency and supporting infrastructure for broader adoption.
A further update came in September 2026, when the CBUAE’s Chief FinTech Officer reportedly stated that four banks were working with the Central Bank on the next phase, initially covering four use cases, with more banks and fintech companies expected to join later. The report highlighted tourist wallets, which would allow visitors to convert foreign currency into Digital Dirham and make payments during their stay, but did not identify the participating banks or provide a complete list of the four use cases. The update therefore indicates preparations for a wider rollout, without confirming general public availability.
The Digital Dirham project builds on earlier cooperation with other central banks. Project Aber, conducted with the Saudi Central Bank in 2019 (final report 2020), tested a jointly issued wholesale digital currency for interbank settlements. The UAE subsequently joined Project mBridge, a shared platform for cross-border CBDC payments developed with the BIS Innovation Hub and the monetary authorities of China, Hong Kong and Thailand. Following a real-value pilot in 2022, mBridge reached the minimum viable product stage (a basic working version available to participants) in 2024 and was handed over to the participating central banks later that year.
In March 2023, the CBUAE launched its CBDC strategy, setting out plans for cross-border payments through mBridge and domestic retail and wholesale applications. To provide a legal basis for its use, Federal Decree-Law No. 54 of 2023 recognised digital currency issued by the CBUAE as legal tender. This status is preserved under the current Central Bank law, Federal Decree-Law No. 6 of 2025, which also governs the issuance and circulation of the dirham in digital form.
The Digital Dirham has already been tested in several payment scenarios. In January 2024, the CBUAE transferred AED 50 million to China through mBridge, demonstrating its use for cross-border payments. Domestic trials explored how individuals could use it to buy tokenised assets and receive social benefits, how parents could manage wallets linked to their children’s wallets, and how visitors could make payments during their stay. Several of these trials used programmable payments, which execute automatically when predefined conditions are met. In November 2025, the Ministry of Finance and Dubai’s Department of Finance tested a payment between federal and local government entities. Completed in under two minutes, this was the first government financial transaction using the Digital Dirham and formed part of the pilot phase.
The CBUAE’s July 2025 report described preparations for wider use of the Digital Dirham by individuals and businesses, including online and in-store purchases, business payments and transfers between individuals. A cross-border application had already been launched and a domestic retail pilot completed, while further work focused on preparing the currency and supporting infrastructure for broader adoption.
A further update came in September 2026, when the CBUAE’s Chief FinTech Officer reportedly stated that four banks were working with the Central Bank on the next phase, initially covering four use cases, with more banks and fintech companies expected to join later. The report highlighted tourist wallets, which would allow visitors to convert foreign currency into Digital Dirham and make payments during their stay, but did not identify the participating banks or provide a complete list of the four use cases. The update therefore indicates preparations for a wider rollout, without confirming general public availability.
The UAE takes a functional approach to the financial regulation of crypto assets, focusing on their economic characteristics and the activities conducted in relation to them, rather than the underlying technology. The CMA describes this as “same activity, same risk, same regulatory outcome”. The regulatory analysis therefore begins with the classification of the asset and the nature of the service provided.
Four token categories
Although terminology and regulatory boundaries differ between authorities, four broad categories can be identified.
First, tokens representing securities or derivatives are generally subject to the requirements applicable to the underlying financial instrument. These may include tokenised shares, bonds, sukuk or fund units. Federal Decree-Law No. 33 of 2025 expressly adopts this approach: tokenisation does not alter an asset’s classification as a security. ADGM and DIFC follow a comparable approach, with DIFC using the category of “Investment Tokens”.
Second, virtual assets, such as Bitcoin or Ether that give no claim against anyone but are bought and held as investments in their own right. Services involving these assets, such as exchange operations, brokerage, custody and portfolio management, require authorisation from the relevant regulator: from VARA in Dubai, from the CMA elsewhere on the mainland, or from the FSRA in ADGM or the DFSA in DIFC. The two financial free zone regulators go one step further: firms they regulate may deal only in tokens that the regulator has accepted or that pass a suitability test.
Third, payment tokens, broadly corresponding to fiat-referenced stablecoins, fall within the CBUAE’s payment token framework, which distinguishes between dirham-denominated and foreign payment tokens and imposes licensing or registration requirements, as applicable. ADGM and DIFC maintain separate frameworks for stablecoin-related activities within their jurisdictions.
Fourth, tokens outside financial regulation. Examples include tokens used solely to access a product or service and NFTs functioning as genuine collectibles. Classification nevertheless depends on the token’s rights, functions and associated activities. Describing a token as a “utility token” or “NFT” is not decisive, and its promotion or use as an investment may affect the regulatory analysis.
Who needs a licence
Licensing requirements depend on the activities undertaken. Activities that typically require authorisation include operating a trading platform, providing brokerage, exchange or custody services, arranging transactions, managing assets or investment funds, advising on investments, and providing virtual asset lending, borrowing or transfer services. The precise scope and categories vary between regulatory regimes. A firm needs permission for each regulated activity it carries on, and a licence in one part of the UAE does not automatically allow it to operate in another.
The rules also reach businesses based abroad. The new federal capital markets law (Decision No. 4/R.M/2026) extends to persons targeting clients in the UAE from overseas where the activity falls within its scope. VARA’s marketing rules also apply to promotions in or targeting the UAE, whether or not the business is licensed by VARA. Foreign platforms must therefore assess local licensing and marketing requirements before offering or promoting services to UAE clients.
Decentralised finance
DeFi refers to financial services, such as lending, trading or earning yield, that run through smart contracts on a blockchain rather than through a company in the middle. There is no separate DeFi rulebook in the UAE. Instead, regulators ask two questions: is the DeFi arrangement performing a regulated activity, and is there a person who can be held responsible for it?
The most important recent development comes from the CBUAE. Article 62 of the new Central Bank law, Federal Decree-Law No. 6 of 2025 brings within the CBUAE’s licensing powers any person who offers or facilitates a financial activity that the CBUAE licenses, “regardless of the medium, technology, or form employed”. The article expressly names DeFi, decentralised applications, protocols and the technical infrastructure behind them, where they enable services such as payments, credit, deposits, money exchange, remittances or investment services. Firms that were already operating had one year to comply, and that period ended on 16 September 2026.
Thus, running a service through a protocol rather than through a company does not take it outside the law. Developers, front-end operators, holders of administrative keys and anyone who earns fees from a DeFi service offered to UAE users should assume that a regulator may look at them. What is less clear is where the line falls for protocols that are genuinely decentralised, where no one can change or control the code, and how Article 62 fits with the powers of the CMA and VARA over virtual asset services. The CBUAE has not yet issued detailed guidance on these points.
The other regulators reach a similar result through their existing rules. VARA licenses crypto lending and borrowing services and allows staking (locking up tokens to help run a blockchain in return for rewards) through licensed custodians. ADGM adopted a dedicated staking framework in April 2026.
Four token categories
Although terminology and regulatory boundaries differ between authorities, four broad categories can be identified.
First, tokens representing securities or derivatives are generally subject to the requirements applicable to the underlying financial instrument. These may include tokenised shares, bonds, sukuk or fund units. Federal Decree-Law No. 33 of 2025 expressly adopts this approach: tokenisation does not alter an asset’s classification as a security. ADGM and DIFC follow a comparable approach, with DIFC using the category of “Investment Tokens”.
Second, virtual assets, such as Bitcoin or Ether that give no claim against anyone but are bought and held as investments in their own right. Services involving these assets, such as exchange operations, brokerage, custody and portfolio management, require authorisation from the relevant regulator: from VARA in Dubai, from the CMA elsewhere on the mainland, or from the FSRA in ADGM or the DFSA in DIFC. The two financial free zone regulators go one step further: firms they regulate may deal only in tokens that the regulator has accepted or that pass a suitability test.
Third, payment tokens, broadly corresponding to fiat-referenced stablecoins, fall within the CBUAE’s payment token framework, which distinguishes between dirham-denominated and foreign payment tokens and imposes licensing or registration requirements, as applicable. ADGM and DIFC maintain separate frameworks for stablecoin-related activities within their jurisdictions.
Fourth, tokens outside financial regulation. Examples include tokens used solely to access a product or service and NFTs functioning as genuine collectibles. Classification nevertheless depends on the token’s rights, functions and associated activities. Describing a token as a “utility token” or “NFT” is not decisive, and its promotion or use as an investment may affect the regulatory analysis.
Who needs a licence
Licensing requirements depend on the activities undertaken. Activities that typically require authorisation include operating a trading platform, providing brokerage, exchange or custody services, arranging transactions, managing assets or investment funds, advising on investments, and providing virtual asset lending, borrowing or transfer services. The precise scope and categories vary between regulatory regimes. A firm needs permission for each regulated activity it carries on, and a licence in one part of the UAE does not automatically allow it to operate in another.
The rules also reach businesses based abroad. The new federal capital markets law (Decision No. 4/R.M/2026) extends to persons targeting clients in the UAE from overseas where the activity falls within its scope. VARA’s marketing rules also apply to promotions in or targeting the UAE, whether or not the business is licensed by VARA. Foreign platforms must therefore assess local licensing and marketing requirements before offering or promoting services to UAE clients.
Decentralised finance
DeFi refers to financial services, such as lending, trading or earning yield, that run through smart contracts on a blockchain rather than through a company in the middle. There is no separate DeFi rulebook in the UAE. Instead, regulators ask two questions: is the DeFi arrangement performing a regulated activity, and is there a person who can be held responsible for it?
The most important recent development comes from the CBUAE. Article 62 of the new Central Bank law, Federal Decree-Law No. 6 of 2025 brings within the CBUAE’s licensing powers any person who offers or facilitates a financial activity that the CBUAE licenses, “regardless of the medium, technology, or form employed”. The article expressly names DeFi, decentralised applications, protocols and the technical infrastructure behind them, where they enable services such as payments, credit, deposits, money exchange, remittances or investment services. Firms that were already operating had one year to comply, and that period ended on 16 September 2026.
Thus, running a service through a protocol rather than through a company does not take it outside the law. Developers, front-end operators, holders of administrative keys and anyone who earns fees from a DeFi service offered to UAE users should assume that a regulator may look at them. What is less clear is where the line falls for protocols that are genuinely decentralised, where no one can change or control the code, and how Article 62 fits with the powers of the CMA and VARA over virtual asset services. The CBUAE has not yet issued detailed guidance on these points.
The other regulators reach a similar result through their existing rules. VARA licenses crypto lending and borrowing services and allows staking (locking up tokens to help run a blockchain in return for rewards) through licensed custodians. ADGM adopted a dedicated staking framework in April 2026.
AML framework
The UAE applies a risk-based approach to preventing money laundering, terrorist financing and proliferation financing involving crypto assets. Firms must assess the risks associated with their customers, services and transactions and apply controls proportionate to those risks.
VASPs are expressly subject to the federal AML framework, principally Federal Decree-Law No. 10 of 2025 and its implementing regulations, Cabinet Resolution No. 134 of 2025. This framework also applies in ADGM and DIFC and operates alongside the requirements of the regulator supervising the firm.
The AML framework covers exchanges between virtual assets and fiat currencies, exchanges between virtual assets, transfers, custody and administration, and financial services connected with an issuer’s offer or sale of virtual assets. Providers must obtain the necessary authorisation from the competent regulator and maintain AML controls throughout their operations, taking account of their customers, products, delivery channels and geographical exposure.
These controls include identifying and verifying customers and their beneficial owners, understanding the purpose of business relationships, monitoring transactions, keeping records and maintaining internal policies and procedures. Higher-risk relationships require enhanced due diligence, including enquiries into the source of funds and wealth where appropriate. Where a VASP suspects, or has reasonable grounds to suspect, a connection with money laundering, terrorist financing or proliferation financing, it must report the matter without delay to the UAE Financial Intelligence Unit, generally through its online reporting platform, goAML, regardless of the amount involved. A report does not require proof of an offence, and persons reporting in good faith are protected from criminal, civil and administrative liability. Firms must also avoid “tipping off”: disclosing that a report has been submitted or that the authorities are making enquiries may itself constitute a criminal offence.
Customer due diligence and monitoring obligations also extend to virtual asset transfers through the Travel Rule, which derives from FATF standards. Like the rules governing bank wire transfers, it requires identifying information about the sender and recipient to accompany transfers between VASPs.
Article 36(2) of Cabinet Resolution No. 134 of 2025 requires the sending VASP to obtain, retain and securely transmit this information immediately to the receiving VASP or financial institution. The receiving VASP must retain it and make it available to the authorities. Article 36(4) applies these requirements to banks and other financial institutions conducting virtual asset transfers for customers. In Dubai, for example, VARA applies the Travel Rule to transfers exceeding AED 3,500 and requires due diligence on counterparty VASPs. Firms must also establish procedures for obtaining the necessary information and assessing risks where transfers involve unhosted wallets, which users control directly without an intermediary, or providers in jurisdictions that have not implemented the Travel Rule.
Sanctions
Alongside AML controls, VASPs must comply with the UAE’s targeted financial sanctions framework, which implements United Nations Security Council sanctions and the UAE Local Terrorist List. Firms must freeze affected assets without delay (defined in Cabinet Decision No. 74 of 2020 as within 24 hours of the relevant listing decision) and prevent funds or economic resources from being made available to designated persons or entities. VARA supplements these obligations by requiring real-time automated sanctions screening and immediate freezing of affected virtual assets and money.
Foreign sanctions require a separate assessment. US, UK and EU sanctions do not automatically apply as a matter of UAE law but may bind a firm or affect a transaction where there is a relevant link to those jurisdictions. Even where they do not directly apply, firms may face secondary sanctions risks or restrictions imposed by banks, counterparties and stablecoin issuers. CBUAE guidance expects licensed financial institutions to identify the sanctions regimes applicable to them and explain how they manage sanctions risks in a written sanctions risk appetite statement. Firms should, therefore, distinguish between their legal obligations and the wider commercial and operational consequences of dealing with sanctioned persons.
The UAE applies a risk-based approach to preventing money laundering, terrorist financing and proliferation financing involving crypto assets. Firms must assess the risks associated with their customers, services and transactions and apply controls proportionate to those risks.
VASPs are expressly subject to the federal AML framework, principally Federal Decree-Law No. 10 of 2025 and its implementing regulations, Cabinet Resolution No. 134 of 2025. This framework also applies in ADGM and DIFC and operates alongside the requirements of the regulator supervising the firm.
The AML framework covers exchanges between virtual assets and fiat currencies, exchanges between virtual assets, transfers, custody and administration, and financial services connected with an issuer’s offer or sale of virtual assets. Providers must obtain the necessary authorisation from the competent regulator and maintain AML controls throughout their operations, taking account of their customers, products, delivery channels and geographical exposure.
These controls include identifying and verifying customers and their beneficial owners, understanding the purpose of business relationships, monitoring transactions, keeping records and maintaining internal policies and procedures. Higher-risk relationships require enhanced due diligence, including enquiries into the source of funds and wealth where appropriate. Where a VASP suspects, or has reasonable grounds to suspect, a connection with money laundering, terrorist financing or proliferation financing, it must report the matter without delay to the UAE Financial Intelligence Unit, generally through its online reporting platform, goAML, regardless of the amount involved. A report does not require proof of an offence, and persons reporting in good faith are protected from criminal, civil and administrative liability. Firms must also avoid “tipping off”: disclosing that a report has been submitted or that the authorities are making enquiries may itself constitute a criminal offence.
Customer due diligence and monitoring obligations also extend to virtual asset transfers through the Travel Rule, which derives from FATF standards. Like the rules governing bank wire transfers, it requires identifying information about the sender and recipient to accompany transfers between VASPs.
Article 36(2) of Cabinet Resolution No. 134 of 2025 requires the sending VASP to obtain, retain and securely transmit this information immediately to the receiving VASP or financial institution. The receiving VASP must retain it and make it available to the authorities. Article 36(4) applies these requirements to banks and other financial institutions conducting virtual asset transfers for customers. In Dubai, for example, VARA applies the Travel Rule to transfers exceeding AED 3,500 and requires due diligence on counterparty VASPs. Firms must also establish procedures for obtaining the necessary information and assessing risks where transfers involve unhosted wallets, which users control directly without an intermediary, or providers in jurisdictions that have not implemented the Travel Rule.
Sanctions
Alongside AML controls, VASPs must comply with the UAE’s targeted financial sanctions framework, which implements United Nations Security Council sanctions and the UAE Local Terrorist List. Firms must freeze affected assets without delay (defined in Cabinet Decision No. 74 of 2020 as within 24 hours of the relevant listing decision) and prevent funds or economic resources from being made available to designated persons or entities. VARA supplements these obligations by requiring real-time automated sanctions screening and immediate freezing of affected virtual assets and money.
Foreign sanctions require a separate assessment. US, UK and EU sanctions do not automatically apply as a matter of UAE law but may bind a firm or affect a transaction where there is a relevant link to those jurisdictions. Even where they do not directly apply, firms may face secondary sanctions risks or restrictions imposed by banks, counterparties and stablecoin issuers. CBUAE guidance expects licensed financial institutions to identify the sanctions regimes applicable to them and explain how they manage sanctions risks in a written sanctions risk appetite statement. Firms should, therefore, distinguish between their legal obligations and the wider commercial and operational consequences of dealing with sanctioned persons.
The UAE generally applies its ordinary corporate tax and VAT rules to crypto assets and DeFi, supplemented by specific provisions and guidance concerning virtual assets. The treatment depends on the taxpayer’s status, the nature of the activity and the rights represented by the asset. There is no general exemption from taxation merely because income arises from blockchain-based transactions or a decentralised protocol.
Individuals
For individuals, the UAE does not levy personal income tax; hence, salaries and personal investment gains, including gains on crypto assets, are not taxed. However, business income may be subject to corporate tax. Under Cabinet Decision No. 49 of 2023, an individual’s personal investment income is outside the scope of UAE corporate tax, irrespective of the amount. This applies where the individual invests in a personal capacity and the investment activity is neither carried on under, nor requires, a licence from a UAE licensing authority and is not classified as a commercial business under the Commercial Transactions Law.
An individual carrying on a business in the UAE generally falls within the corporate tax regime if their total business turnover exceeds AED 1 million in a calendar year. Wages and income qualifying as personal investment or real estate investment income are excluded from this threshold. Where the threshold is exceeded, any tax payable is calculated on taxable income, rather than turnover, subject to the applicable rates and reliefs.
Companies
For companies and other taxable businesses, the governing framework is Federal Decree-Law No. 47 of 2022 (the “Corporate Tax Law”). Corporate tax is charged at 0% on taxable income up to AED 375,000 and at 9% on the excess, subject to applicable exemptions and reliefs. There are no special rules for crypto: trading profits, fees for crypto-related services and business income from DeFi are taxed in the same way as any other business income.
Incorporation in a free zone, including ADGM or DIFC, does not by itself make crypto income tax-free. A free zone company pays 0% only on its Qualifying Income, and only if it meets all the conditions for being a Qualifying Free Zone Person; its other taxable income is generally taxed at 9%. Qualifying Income is, broadly, income from activities listed as qualifying in Ministerial Decision No. 229 of 2025, together with certain transactions with other free zone businesses, while income from Excluded Activities, which include most transactions with individuals, does not qualify. For a crypto business, the answer therefore depends on what it actually does and for whom, and a virtual asset licence is not enough. Proprietary crypto trading, exchange services and custody do not appear among the listed Qualifying Activities, and income from them will generally be taxed at 9%. Investment management is treated differently. Ministerial Decision No. 336 of 2025, which applies retrospectively from 1 June 2023, recognises VARA as a competent authority for the Qualifying Activities of fund management and wealth and investment management. A free zone business providing these services under a VARA licence may therefore qualify for the 0% rate, including on income from individual clients, which is permitted for these activities. The business must also maintain adequate substance in the free zone, comply with transfer pricing rules, prepare audited financial statements and keep its non-qualifying revenue within the de minimis limit of the lower of 5% of total revenue and AED 5 million. A business that fails any condition loses the regime for that tax period and the following four.
VAT is charged in the UAE at a standard rate of 5%, but most dealings in crypto assets are exempt. Under Article 42 of the VAT Executive Regulation, as amended by Cabinet Decision No. 100 of 2024 with effect from 15 November 2024, the transfer of ownership of virtual assets and their conversion, for example into fiat currency or into other virtual assets, are exempt financial services. The exemption applies retrospectively from 1 January 2018, the date on which VAT was introduced. The Federal Tax Authority (“FTA”) confirms in Public Clarification VATP040 of 14 March 2025 that the exemption covers buying and selling cryptocurrencies such as Bitcoin. Not every crypto-related service is exempt, however. Keeping or managing virtual assets for others, including managing crypto wallets, is taxable when supplied in the UAE for an explicit fee, commission or similar charge. A business making exempt supplies does not charge VAT to its customers, but it also cannot recover the input VAT. A business making taxable supplies must charge VAT but may generally recover the related input VAT. Crypto businesses must therefore identify which of their revenue streams are exempt and which are taxable.
Proof-of-work mining is addressed separately in Public Clarification VATP039. Under proof-of-work, the mechanism used by Bitcoin, miners use computing power to validate transactions and are rewarded with newly created tokens and transaction fees. Mining for one’s own account falls outside the scope of VAT, because the miner supplies no service to an identifiable customer; as a result, input VAT on equipment, electricity and other costs generally cannot be recovered. Providing computing power to mine for another person, by contrast, is a supply of services, whose VAT treatment depends on where the customer is located; services supplied to a customer outside the UAE may qualify as zero-rated exports. The clarification concerns proof-of-work mining only and does not settle the VAT treatment of staking, under which holders lock up tokens to help validate a network in return for rewards.
In July 2026, the FTA issued Directive on Tax Transactions No. 3 of 2026, which explains how values expressed in digital currency must be converted into dirhams for VAT reporting. It applies both to supplies of digital currency and to supplies of goods or services paid for in digital currency, for example where a business accepts crypto assets as payment. The business must select three platforms from the FTA’s published list, take the exchange rate on each at the time of the supply or of receipt of the payment, apply the arithmetic average of the three rates, retain evidence of them, and use the same three platforms throughout the calendar year. The Directive is a valuation rule only: it determines the dirham value of a transaction, not whether that transaction is taxable or exempt.
Crypto-Asset Reporting Framework
Separately, the UAE will apply the OECD’s Crypto-Asset Reporting Framework (“CARF”) from 1 January 2027, having ratified the CARF Multilateral Competent Authority Agreement by Federal Decree No. 60 of 2026, with the first international exchanges of information expected in 2028. CARF introduces tax-transparency and reporting requirements rather than a new tax on crypto assets.
It covers relevant crypto-assets, including cryptocurrencies, many stablecoins and certain NFTs capable of being used for payment or investment. CBDCs, specified electronic money products and assets that cannot be used for payment or investment are excluded. Reporting obligations fall on entities and individuals that, as a business, facilitate exchanges of these assets for customers, including exchanges, brokers, dealers and certain operators of decentralised trading platforms. A provider’s reporting obligations depend on its connection to an implementing jurisdiction, such as tax residence, incorporation, management or a place of business.
Reportable transactions include crypto-to-fiat and crypto-to-crypto exchanges, transfers and, where they exceed USD 50,000, payments for goods or services. Transfers to self-hosted wallets may also be reportable when processed by a reporting provider. Providers must identify individual and entity users, establish their tax residence and tax identification numbers, and identify controlling persons where required. They report annual transaction information aggregated by user and asset type to the relevant tax authority, which exchanges it with partner jurisdictions under the applicable exchange arrangements. Consequently, a user’s transactions may be reported to their country of tax residence even where the transactions generate no tax liability in the UAE.
Individuals
For individuals, the UAE does not levy personal income tax; hence, salaries and personal investment gains, including gains on crypto assets, are not taxed. However, business income may be subject to corporate tax. Under Cabinet Decision No. 49 of 2023, an individual’s personal investment income is outside the scope of UAE corporate tax, irrespective of the amount. This applies where the individual invests in a personal capacity and the investment activity is neither carried on under, nor requires, a licence from a UAE licensing authority and is not classified as a commercial business under the Commercial Transactions Law.
An individual carrying on a business in the UAE generally falls within the corporate tax regime if their total business turnover exceeds AED 1 million in a calendar year. Wages and income qualifying as personal investment or real estate investment income are excluded from this threshold. Where the threshold is exceeded, any tax payable is calculated on taxable income, rather than turnover, subject to the applicable rates and reliefs.
Companies
For companies and other taxable businesses, the governing framework is Federal Decree-Law No. 47 of 2022 (the “Corporate Tax Law”). Corporate tax is charged at 0% on taxable income up to AED 375,000 and at 9% on the excess, subject to applicable exemptions and reliefs. There are no special rules for crypto: trading profits, fees for crypto-related services and business income from DeFi are taxed in the same way as any other business income.
Incorporation in a free zone, including ADGM or DIFC, does not by itself make crypto income tax-free. A free zone company pays 0% only on its Qualifying Income, and only if it meets all the conditions for being a Qualifying Free Zone Person; its other taxable income is generally taxed at 9%. Qualifying Income is, broadly, income from activities listed as qualifying in Ministerial Decision No. 229 of 2025, together with certain transactions with other free zone businesses, while income from Excluded Activities, which include most transactions with individuals, does not qualify. For a crypto business, the answer therefore depends on what it actually does and for whom, and a virtual asset licence is not enough. Proprietary crypto trading, exchange services and custody do not appear among the listed Qualifying Activities, and income from them will generally be taxed at 9%. Investment management is treated differently. Ministerial Decision No. 336 of 2025, which applies retrospectively from 1 June 2023, recognises VARA as a competent authority for the Qualifying Activities of fund management and wealth and investment management. A free zone business providing these services under a VARA licence may therefore qualify for the 0% rate, including on income from individual clients, which is permitted for these activities. The business must also maintain adequate substance in the free zone, comply with transfer pricing rules, prepare audited financial statements and keep its non-qualifying revenue within the de minimis limit of the lower of 5% of total revenue and AED 5 million. A business that fails any condition loses the regime for that tax period and the following four.
VAT is charged in the UAE at a standard rate of 5%, but most dealings in crypto assets are exempt. Under Article 42 of the VAT Executive Regulation, as amended by Cabinet Decision No. 100 of 2024 with effect from 15 November 2024, the transfer of ownership of virtual assets and their conversion, for example into fiat currency or into other virtual assets, are exempt financial services. The exemption applies retrospectively from 1 January 2018, the date on which VAT was introduced. The Federal Tax Authority (“FTA”) confirms in Public Clarification VATP040 of 14 March 2025 that the exemption covers buying and selling cryptocurrencies such as Bitcoin. Not every crypto-related service is exempt, however. Keeping or managing virtual assets for others, including managing crypto wallets, is taxable when supplied in the UAE for an explicit fee, commission or similar charge. A business making exempt supplies does not charge VAT to its customers, but it also cannot recover the input VAT. A business making taxable supplies must charge VAT but may generally recover the related input VAT. Crypto businesses must therefore identify which of their revenue streams are exempt and which are taxable.
Proof-of-work mining is addressed separately in Public Clarification VATP039. Under proof-of-work, the mechanism used by Bitcoin, miners use computing power to validate transactions and are rewarded with newly created tokens and transaction fees. Mining for one’s own account falls outside the scope of VAT, because the miner supplies no service to an identifiable customer; as a result, input VAT on equipment, electricity and other costs generally cannot be recovered. Providing computing power to mine for another person, by contrast, is a supply of services, whose VAT treatment depends on where the customer is located; services supplied to a customer outside the UAE may qualify as zero-rated exports. The clarification concerns proof-of-work mining only and does not settle the VAT treatment of staking, under which holders lock up tokens to help validate a network in return for rewards.
In July 2026, the FTA issued Directive on Tax Transactions No. 3 of 2026, which explains how values expressed in digital currency must be converted into dirhams for VAT reporting. It applies both to supplies of digital currency and to supplies of goods or services paid for in digital currency, for example where a business accepts crypto assets as payment. The business must select three platforms from the FTA’s published list, take the exchange rate on each at the time of the supply or of receipt of the payment, apply the arithmetic average of the three rates, retain evidence of them, and use the same three platforms throughout the calendar year. The Directive is a valuation rule only: it determines the dirham value of a transaction, not whether that transaction is taxable or exempt.
Crypto-Asset Reporting Framework
Separately, the UAE will apply the OECD’s Crypto-Asset Reporting Framework (“CARF”) from 1 January 2027, having ratified the CARF Multilateral Competent Authority Agreement by Federal Decree No. 60 of 2026, with the first international exchanges of information expected in 2028. CARF introduces tax-transparency and reporting requirements rather than a new tax on crypto assets.
It covers relevant crypto-assets, including cryptocurrencies, many stablecoins and certain NFTs capable of being used for payment or investment. CBDCs, specified electronic money products and assets that cannot be used for payment or investment are excluded. Reporting obligations fall on entities and individuals that, as a business, facilitate exchanges of these assets for customers, including exchanges, brokers, dealers and certain operators of decentralised trading platforms. A provider’s reporting obligations depend on its connection to an implementing jurisdiction, such as tax residence, incorporation, management or a place of business.
Reportable transactions include crypto-to-fiat and crypto-to-crypto exchanges, transfers and, where they exceed USD 50,000, payments for goods or services. Transfers to self-hosted wallets may also be reportable when processed by a reporting provider. Providers must identify individual and entity users, establish their tax residence and tax identification numbers, and identify controlling persons where required. They report annual transaction information aggregated by user and asset type to the relevant tax authority, which exchanges it with partner jurisdictions under the applicable exchange arrangements. Consequently, a user’s transactions may be reported to their country of tax residence even where the transactions generate no tax liability in the UAE.
The UAE is one of the few places where tokenisation has moved beyond pilots into everyday use, especially in real estate. Its approach rests on a simple rule: a token is regulated according to the asset it represents, and the blockchain wrapper does not change the legal nature of what is inside.
Retail tokenisation: real estate
The leading Real Estate Tokenisation Project, launched in March 2025, is run by the DLD, working with VARA, the CBUAE and other public bodies. It allows several investors to own shares in the same property, with their interests represented by digital tokens. Investors can acquire these interests through VARA-licensed platforms such as Prypco Mint.
The key feature is the connection to Dubai’s official property registry. Token ownership records are integrated with DLD’s systems, and transfers through the project’s infrastructure are reflected in the official records. DLD also issues Property Token Ownership Certificates to document investors’ interests. The tokens therefore represent property ownership recognised through the registration system, rather than merely a contractual promise by the platform.
The pilot ran from May 2025 to February 2026. According to the DLD, it attracted investors from more than 50 countries and raised over AED 18.5 million. On 20 February 2026, the project entered its second phase, which allows tokens to be resold on a regulated secondary market that is open around the clock. The DLD expects tokenised property to make up as much as 7% of Dubai’s real estate market by 2033.
The DLD model works because the state registry itself recognises the token as the record of ownership. Many other property projects take a different route: the property is placed in a company or fund, and investors buy tokens representing shares in that vehicle. In that case, investors own a security, not land, and the securities rules apply.
Regulatory frameworks for tokenised assets
In Dubai, VARA regulates tokens backed by real-world assets as “asset-referenced virtual assets”. Issuing them requires a specific Category 1 VARA issuance licence, together with a white paper, risk disclosures and a legal opinion on how the token is structured. Guidance on the Virtual Asset Issuance Rulebook published by VARA in April 2026 clarified that where ownership of the underlying asset passes with the token, the issuer does not need to hold separate reserve assets. The full reserve rules apply only to tokens that promise a fixed value. The guidance also accepts that a tokenised asset that qualifies as a financial instrument may fall within the CMA’s remit as well.
At the federal level, the new capital markets law (Federal Decree-Law No. 33 of 2025) treats tokenised shares, bonds, sukuk and fund units as securities. The CMA’s 2026 framework for virtual assets (Decision No. 4/R.M/2026) includes rules for trading venues, and these rules expressly cover platforms dedicated to tokenised securities. Real-world assets are excluded from the CMA’s virtual asset regime unless the token itself represents a security.
ADGM and DIFC follow the same logic. ADGM regulates “digital securities” under its ordinary securities rules, and DIFC has had an “Investment Token” regime since 2021. In 2025, the DFSA launched a Tokenisation Regulatory Sandbox to let firms test tokenised investment products under supervision. About 100 firms expressed interest in the first round. DIFC’s Digital Assets Law of 2024 also gives tokens a clear legal status as property, which helps answer the basic question of who owns what.
Retail tokenisation: real estate
The leading Real Estate Tokenisation Project, launched in March 2025, is run by the DLD, working with VARA, the CBUAE and other public bodies. It allows several investors to own shares in the same property, with their interests represented by digital tokens. Investors can acquire these interests through VARA-licensed platforms such as Prypco Mint.
The key feature is the connection to Dubai’s official property registry. Token ownership records are integrated with DLD’s systems, and transfers through the project’s infrastructure are reflected in the official records. DLD also issues Property Token Ownership Certificates to document investors’ interests. The tokens therefore represent property ownership recognised through the registration system, rather than merely a contractual promise by the platform.
The pilot ran from May 2025 to February 2026. According to the DLD, it attracted investors from more than 50 countries and raised over AED 18.5 million. On 20 February 2026, the project entered its second phase, which allows tokens to be resold on a regulated secondary market that is open around the clock. The DLD expects tokenised property to make up as much as 7% of Dubai’s real estate market by 2033.
The DLD model works because the state registry itself recognises the token as the record of ownership. Many other property projects take a different route: the property is placed in a company or fund, and investors buy tokens representing shares in that vehicle. In that case, investors own a security, not land, and the securities rules apply.
Regulatory frameworks for tokenised assets
In Dubai, VARA regulates tokens backed by real-world assets as “asset-referenced virtual assets”. Issuing them requires a specific Category 1 VARA issuance licence, together with a white paper, risk disclosures and a legal opinion on how the token is structured. Guidance on the Virtual Asset Issuance Rulebook published by VARA in April 2026 clarified that where ownership of the underlying asset passes with the token, the issuer does not need to hold separate reserve assets. The full reserve rules apply only to tokens that promise a fixed value. The guidance also accepts that a tokenised asset that qualifies as a financial instrument may fall within the CMA’s remit as well.
At the federal level, the new capital markets law (Federal Decree-Law No. 33 of 2025) treats tokenised shares, bonds, sukuk and fund units as securities. The CMA’s 2026 framework for virtual assets (Decision No. 4/R.M/2026) includes rules for trading venues, and these rules expressly cover platforms dedicated to tokenised securities. Real-world assets are excluded from the CMA’s virtual asset regime unless the token itself represents a security.
ADGM and DIFC follow the same logic. ADGM regulates “digital securities” under its ordinary securities rules, and DIFC has had an “Investment Token” regime since 2021. In 2025, the DFSA launched a Tokenisation Regulatory Sandbox to let firms test tokenised investment products under supervision. About 100 firms expressed interest in the first round. DIFC’s Digital Assets Law of 2024 also gives tokens a clear legal status as property, which helps answer the basic question of who owns what.
Crypto ownership and market adoption
There is no general prohibition on owning or trading crypto assets in the UAE. Crypto trading is widespread and involves both individuals and institutions. According to Chainalysis “MENA’s Divergent Crypto Paths: From Crisis to Innovation in 2025” report, the UAE received more than USD 56 billion in crypto assets in the twelve months to June 2025, around 33% more than in the previous period, making it the second-largest crypto market in the Middle East and North Africa after Türkiye. The licensed sector is also growing: at the time of writing, VARA’s public register listed 59 licensed VASPs.
Trading for own account
Individuals may buy, hold and sell crypto assets, and businesses may trade them within the applicable regulatory frameworks. The restrictions are targeted and depend on the type of asset, the activity and where in the UAE it is carried on. The key distinction is between trading and payments: permission to invest in a crypto asset does not mean that it may be used to pay for goods and services.
Trading on one’s own account is permitted, including through companies set up for proprietary trading, that is, trading with the company’s own funds rather than on behalf of clients. For example, DMCC, a non-financial free zone in Dubai, licenses the activity of Virtual Assets Proprietary Trading. Such a company does not need a VASP licence, but it must obtain a No Objection Certificate from VARA, and trading above volume thresholds set by VARA must also be registered with VARA. The licence does not cover services to clients: operating an exchange, acting as a broker or holding assets for others requires regulatory authorisation. The Dubai Court of Cassation drew the same line in a 2024 criminal case (No. 452/2024): exchanging crypto for one’s own account is not an offence, while doing so for or on behalf of others without a licence is.
Restrictions on crypto payments
Payments are regulated far more strictly. This reflects the CBUAE’s responsibility for the stability of the dirham and the financial system and for consumer protection. Investors choose to take risk, whereas widespread use of private crypto assets as money could affect monetary policy, the role of the national currency and consumers who never intended to invest. The CBUAE’s Payment Token Services Regulation, therefore, limits which crypto assets may be used for payments. It distinguishes Dirham Payment Tokens from Foreign Payment Tokens referenced to other currencies, such as the US dollar.
Under Article 2(7) of the Regulation, a business selling goods or services in the UAE may accept crypto as payment only in the form of a Dirham Payment Token issued by a CBUAE-licensed issuer. Foreign Payment Tokens from a CBUAE-registered issuer may be accepted only as payment for virtual assets or virtual asset derivatives. In practice, a shop, restaurant or property developer cannot accept Bitcoin, Ether or a US dollar stablecoin as payment. The Regulation also prohibits issuing, providing services in relation to or promoting algorithmic stablecoins (which maintain their value by adjusting supply or demand rather than by holding reserves) and privacy tokens (which conceal the identity of holders or the transaction history), as well as providing payment token services without CBUAE licensing or registration.
Token restrictions for regulated firms
Licensed providers face further restrictions on the assets they may deal in. Under the CMA’s Decision No. 4/R.M/2026, federally licensed VASPs may not deal in privacy tokens or algorithmic tokens, or provide services involving privacy devices, such as “mixers” that make transactions untraceable. They are also generally restricted from dealing in utility tokens and non-fungible tokens, although licensed custodians and trading platform operators may do so with the CMA’s prior approval. These rules restrict licensed firms; they do not prevent individuals from owning NFTs or utility tokens.
Similar restrictions apply under the other regimes. In Dubai, VARA prohibits the issuance of anonymity-enhanced cryptocurrencies and all activities relating to them, that is, assets whose transactions or ownership cannot be traced. In ADGM, rules introduced in June 2025 prohibit the use of privacy tokens and algorithmic stablecoins in regulated activities. In DIFC, the DFSA prohibits financial services, promotions and public offers involving privacy tokens or algorithmic tokens, as well as services involving privacy devices, and since 12 January 2026 these prohibitions have extended to related funds and derivatives. Since the same date, DIFC firms must themselves assess whether a Crypto Token is suitable before dealing in it, while fiat-referenced stablecoins remain subject to the DFSA’s own assessment and published list.
There is no general prohibition on owning or trading crypto assets in the UAE. Crypto trading is widespread and involves both individuals and institutions. According to Chainalysis “MENA’s Divergent Crypto Paths: From Crisis to Innovation in 2025” report, the UAE received more than USD 56 billion in crypto assets in the twelve months to June 2025, around 33% more than in the previous period, making it the second-largest crypto market in the Middle East and North Africa after Türkiye. The licensed sector is also growing: at the time of writing, VARA’s public register listed 59 licensed VASPs.
Trading for own account
Individuals may buy, hold and sell crypto assets, and businesses may trade them within the applicable regulatory frameworks. The restrictions are targeted and depend on the type of asset, the activity and where in the UAE it is carried on. The key distinction is between trading and payments: permission to invest in a crypto asset does not mean that it may be used to pay for goods and services.
Trading on one’s own account is permitted, including through companies set up for proprietary trading, that is, trading with the company’s own funds rather than on behalf of clients. For example, DMCC, a non-financial free zone in Dubai, licenses the activity of Virtual Assets Proprietary Trading. Such a company does not need a VASP licence, but it must obtain a No Objection Certificate from VARA, and trading above volume thresholds set by VARA must also be registered with VARA. The licence does not cover services to clients: operating an exchange, acting as a broker or holding assets for others requires regulatory authorisation. The Dubai Court of Cassation drew the same line in a 2024 criminal case (No. 452/2024): exchanging crypto for one’s own account is not an offence, while doing so for or on behalf of others without a licence is.
Restrictions on crypto payments
Payments are regulated far more strictly. This reflects the CBUAE’s responsibility for the stability of the dirham and the financial system and for consumer protection. Investors choose to take risk, whereas widespread use of private crypto assets as money could affect monetary policy, the role of the national currency and consumers who never intended to invest. The CBUAE’s Payment Token Services Regulation, therefore, limits which crypto assets may be used for payments. It distinguishes Dirham Payment Tokens from Foreign Payment Tokens referenced to other currencies, such as the US dollar.
Under Article 2(7) of the Regulation, a business selling goods or services in the UAE may accept crypto as payment only in the form of a Dirham Payment Token issued by a CBUAE-licensed issuer. Foreign Payment Tokens from a CBUAE-registered issuer may be accepted only as payment for virtual assets or virtual asset derivatives. In practice, a shop, restaurant or property developer cannot accept Bitcoin, Ether or a US dollar stablecoin as payment. The Regulation also prohibits issuing, providing services in relation to or promoting algorithmic stablecoins (which maintain their value by adjusting supply or demand rather than by holding reserves) and privacy tokens (which conceal the identity of holders or the transaction history), as well as providing payment token services without CBUAE licensing or registration.
Token restrictions for regulated firms
Licensed providers face further restrictions on the assets they may deal in. Under the CMA’s Decision No. 4/R.M/2026, federally licensed VASPs may not deal in privacy tokens or algorithmic tokens, or provide services involving privacy devices, such as “mixers” that make transactions untraceable. They are also generally restricted from dealing in utility tokens and non-fungible tokens, although licensed custodians and trading platform operators may do so with the CMA’s prior approval. These rules restrict licensed firms; they do not prevent individuals from owning NFTs or utility tokens.
Similar restrictions apply under the other regimes. In Dubai, VARA prohibits the issuance of anonymity-enhanced cryptocurrencies and all activities relating to them, that is, assets whose transactions or ownership cannot be traced. In ADGM, rules introduced in June 2025 prohibit the use of privacy tokens and algorithmic stablecoins in regulated activities. In DIFC, the DFSA prohibits financial services, promotions and public offers involving privacy tokens or algorithmic tokens, as well as services involving privacy devices, and since 12 January 2026 these prohibitions have extended to related funds and derivatives. Since the same date, DIFC firms must themselves assess whether a Crypto Token is suitable before dealing in it, while fiat-referenced stablecoins remain subject to the DFSA’s own assessment and published list.
The UAE saw some ICO activity but did not experience a widespread surge in offerings. Regulators initially responded through investor warnings and guidance on the application of existing financial laws. In September 2017, the DFSA warned investors about ICO risks in its General Investor Statement on Cryptocurrencies. In October 2017, ADGM’s FSRA clarified that tokens exhibiting the characteristics of securities would be regulated accordingly and that related financial services could require authorisation.
The subsequent development of dedicated digital asset frameworks has made the regulatory treatment of token offerings more explicit. The applicable requirements depend on the token’s characteristics, the activities undertaken and the jurisdiction in or from which it is offered. Issuers must therefore determine whether their offering falls within securities, virtual asset or payment token rules and comply with the relevant issuance, disclosure and marketing requirements.
Key requirements
First, classification of the token. Everything depends on what the token is. Issuers usually obtain a legal opinion that analyses the rights attached to the token. Regulators, especially the CMA, expect issuers to justify their classification and will look past labels such as “utility token”.
Second, if the token is a security, the securities rules apply. An offer of tokenised shares, bonds or fund units to the public generally requires an approved prospectus and must be made through licensed intermediaries, whether under the federal capital markets law, in ADGM or in DIFC.
Third, if the token is a virtual asset offered in or from Dubai, VARA’s Virtual Asset Issuance Rulebook applies. It distinguishes between different categories of token issuance. Issuing fiat-referenced virtual assets (i.e., stablecoins) or asset-referenced virtual assets (tokens backed by real-world assets) within VARA’s remit constitutes “Category 1 Virtual Asset Issuance” and requires a VARA licence for that activity. Dirham-referenced tokens remain within the CBUAE’s exclusive remit. Category 2 issuance covers virtual assets that are neither Category 1 nor exempt. It does not require a VARA issuance licence, but all placement and distribution must be carried out through a licensed distributor, i.e., a VARA-licensed provider of Broker-Dealer Services responsible for verifying the issuer’s compliance. The issuer must publish a white paper and a risk disclosure statement. Before placement, the distributor must submit these and supporting compliance documents to VARA, observe a 15-working-day submission period and resolve any regulatory comments or objections. Certain non-transferable and redeemable closed-loop tokens qualify as exempt virtual assets: their issuers do not require prior VARA approval or need to publish these disclosures but remain subject to general conduct rules and VARA’s supervision. VARA published guidance explaining these categories through practical examples in April 2026.
Fourth, stablecoins have their own rules. A dirham-backed token may only be issued by an issuer licensed by the CBUAE, and other stablecoins must be registered with the CBUAE before they can be used in the UAE.
Fifth, the marketing must be compliant. VARA’s marketing regulations apply to anyone who promotes virtual assets to people in Dubai, whether or not they are licensed. In addition, the federal cybercrime law (Federal Decree-Law No. 34 of 2021) makes it a crime to advertise or promote virtual currencies that are not recognised under UAE law. Influencer campaigns, airdrops (free distributions of tokens) and launch events therefore need careful review.
Finally, some zones add their own conditions. DAO associations in Innovation City need the Registrar’s prior approval before issuing a new class of tokens (see Question 13), and the financial free zone regulators restrict which tokens their licensed firms may deal in.
The subsequent development of dedicated digital asset frameworks has made the regulatory treatment of token offerings more explicit. The applicable requirements depend on the token’s characteristics, the activities undertaken and the jurisdiction in or from which it is offered. Issuers must therefore determine whether their offering falls within securities, virtual asset or payment token rules and comply with the relevant issuance, disclosure and marketing requirements.
Key requirements
First, classification of the token. Everything depends on what the token is. Issuers usually obtain a legal opinion that analyses the rights attached to the token. Regulators, especially the CMA, expect issuers to justify their classification and will look past labels such as “utility token”.
Second, if the token is a security, the securities rules apply. An offer of tokenised shares, bonds or fund units to the public generally requires an approved prospectus and must be made through licensed intermediaries, whether under the federal capital markets law, in ADGM or in DIFC.
Third, if the token is a virtual asset offered in or from Dubai, VARA’s Virtual Asset Issuance Rulebook applies. It distinguishes between different categories of token issuance. Issuing fiat-referenced virtual assets (i.e., stablecoins) or asset-referenced virtual assets (tokens backed by real-world assets) within VARA’s remit constitutes “Category 1 Virtual Asset Issuance” and requires a VARA licence for that activity. Dirham-referenced tokens remain within the CBUAE’s exclusive remit. Category 2 issuance covers virtual assets that are neither Category 1 nor exempt. It does not require a VARA issuance licence, but all placement and distribution must be carried out through a licensed distributor, i.e., a VARA-licensed provider of Broker-Dealer Services responsible for verifying the issuer’s compliance. The issuer must publish a white paper and a risk disclosure statement. Before placement, the distributor must submit these and supporting compliance documents to VARA, observe a 15-working-day submission period and resolve any regulatory comments or objections. Certain non-transferable and redeemable closed-loop tokens qualify as exempt virtual assets: their issuers do not require prior VARA approval or need to publish these disclosures but remain subject to general conduct rules and VARA’s supervision. VARA published guidance explaining these categories through practical examples in April 2026.
Fourth, stablecoins have their own rules. A dirham-backed token may only be issued by an issuer licensed by the CBUAE, and other stablecoins must be registered with the CBUAE before they can be used in the UAE.
Fifth, the marketing must be compliant. VARA’s marketing regulations apply to anyone who promotes virtual assets to people in Dubai, whether or not they are licensed. In addition, the federal cybercrime law (Federal Decree-Law No. 34 of 2021) makes it a crime to advertise or promote virtual currencies that are not recognised under UAE law. Influencer campaigns, airdrops (free distributions of tokens) and launch events therefore need careful review.
Finally, some zones add their own conditions. DAO associations in Innovation City need the Registrar’s prior approval before issuing a new class of tokens (see Question 13), and the financial free zone regulators restrict which tokens their licensed firms may deal in.
Yes, and the answer depends heavily on where in the UAE the question arises. DIFC has a modern statute written specifically for digital assets. ADGM relies on English common law, which already treats crypto assets as property. The mainland has no specific statute, so parties must rely on general civil law and on court decisions, which leaves more room for uncertainty.
Mainland UAE
Mainland UAE has no law that says when ownership of a crypto asset passes or how a security interest over it should be created. The general rules come from the new Civil Transactions Law (Federal Decree-Law No. 25 of 2025), which took effect on 1 June 2026 and replaced the civil code of 1985. Like the old code, it treats as property anything of value that can be dealt in, and crypto assets fit that idea. The courts have been willing to treat crypto assets as things of value that can be owned, owed and transferred.
Security over crypto assets raises further questions. The federal law on security over movable property (Federal Law No. 4 of 2020) allows security to be taken over many kinds of intangible assets and registered in a central electronic registry. Whether, and how, it applies to crypto assets has not been tested. Lenders therefore usually rely on control: the collateral is moved to a wallet controlled by the lender, by a custodian or by several parties jointly (a “multi-signature” wallet), and the loan agreement allows the lender to sell it if the borrower defaults. In Dubai, lending against crypto is itself a regulated activity under VARA’s lending and borrowing rules, and some licensed custodians offer dedicated collateral wallets.
DIFC
DIFC offers the clearest legal framework in the region. Its Digital Assets Law (DIFC Law No. 2 of 2024) confirms that digital assets are a distinct type of property, separate from both physical goods and contractual rights. It explains what it means to “control” a digital asset, sets out how title passes and protects a good-faith buyer who pays for a token without knowing of competing claims. The Law of Security (DIFC Law No. 4 of 2024) allows security over digital assets to be created, and to gain priority, through control, which reflects how the market already works.
The DIFC courts have applied these ideas in practice. In Gate MENA DMCC v Tabarak Investment Capital, the DIFC Court of Appeal confirmed in 2024 that Bitcoin is property. At a retrial in 2026, the Digital Economy Court held that an intermediary holding Bitcoin during a transaction owed only a duty of reasonable care, not an absolute duty to return the coins, when they were lost to a third-party fraud.
ADGM
ADGM applies English common law directly. English courts have repeatedly held that crypto assets are property that can be owned, traced and frozen, and ADGM courts can follow that case law. In practice, security over crypto assets in ADGM is usually taken by giving the lender or a custodian control, under documents governed by English law principles.
Mainland UAE
Mainland UAE has no law that says when ownership of a crypto asset passes or how a security interest over it should be created. The general rules come from the new Civil Transactions Law (Federal Decree-Law No. 25 of 2025), which took effect on 1 June 2026 and replaced the civil code of 1985. Like the old code, it treats as property anything of value that can be dealt in, and crypto assets fit that idea. The courts have been willing to treat crypto assets as things of value that can be owned, owed and transferred.
Security over crypto assets raises further questions. The federal law on security over movable property (Federal Law No. 4 of 2020) allows security to be taken over many kinds of intangible assets and registered in a central electronic registry. Whether, and how, it applies to crypto assets has not been tested. Lenders therefore usually rely on control: the collateral is moved to a wallet controlled by the lender, by a custodian or by several parties jointly (a “multi-signature” wallet), and the loan agreement allows the lender to sell it if the borrower defaults. In Dubai, lending against crypto is itself a regulated activity under VARA’s lending and borrowing rules, and some licensed custodians offer dedicated collateral wallets.
DIFC
DIFC offers the clearest legal framework in the region. Its Digital Assets Law (DIFC Law No. 2 of 2024) confirms that digital assets are a distinct type of property, separate from both physical goods and contractual rights. It explains what it means to “control” a digital asset, sets out how title passes and protects a good-faith buyer who pays for a token without knowing of competing claims. The Law of Security (DIFC Law No. 4 of 2024) allows security over digital assets to be created, and to gain priority, through control, which reflects how the market already works.
The DIFC courts have applied these ideas in practice. In Gate MENA DMCC v Tabarak Investment Capital, the DIFC Court of Appeal confirmed in 2024 that Bitcoin is property. At a retrial in 2026, the Digital Economy Court held that an intermediary holding Bitcoin during a transaction owed only a duty of reasonable care, not an absolute duty to return the coins, when they were lost to a third-party fraud.
ADGM
ADGM applies English common law directly. English courts have repeatedly held that crypto assets are property that can be owned, traced and frozen, and ADGM courts can follow that case law. In practice, security over crypto assets in ADGM is usually taken by giving the lender or a custodian control, under documents governed by English law principles.
Mainland UAE law has no specific rules on smart contracts; their legal effect is assessed under general contract law and the rules on electronic transactions. A smart contract is a computer program, typically deployed on a blockchain, that automatically performs specified actions when predefined conditions are met. The term describes the technology: not every smart contract constitutes a legally binding agreement. The new Civil Transactions Law (Federal Decree-Law No. 25 of 2025) sets out the basic requirements for a contract: an offer, an acceptance, a lawful object and parties with legal capacity. The law on electronic transactions (Federal Decree-Law No. 46 of 2021) confirms that a contract cannot be denied effect merely because it was made electronically, that offer and acceptance can be expressed electronically, and that contracts may be formed through automated systems. Electronic records can also be used as evidence in UAE courts. A smart contract can therefore create or perform binding obligations if the applicable requirements for contract formation, validity and any prescribed formalities are satisfied.
DIFC has gone further. Amendments made to its Contract Law in 2024 recognise “coded contracts”, meaning agreements written entirely in code and carried out by a computer program, with no version in ordinary language. They also recognise “hybrid contracts”, which combine terms expressed in ordinary language with coded terms. The law addresses interpretation and mistakes in this setting. In particular, where the parties’ common intention cannot be established, a coded or hybrid contract is interpreted from the perspective of a reasonable person with a competent understanding of the relevant code, taking the surrounding circumstances into account. ADGM relies on English law, under which a smart contract can be legally binding if the usual tests for a contract are met, as the Law Commission of England and Wales concluded in 2021.
Enforceability issues specific to smart contracts
The principal enforceability issues arising from smart contracts in the UAE are broadly similar to those encountered elsewhere: automated execution does not establish that the underlying agreement is legally valid or enforceable, and blockchain architecture can make disputes harder to resolve. A hybrid approach can help address these issues by combining code that performs the agreed steps with a written agreement identifying the parties, specifying the governing law and dispute resolution mechanism, and allocating responsibility for coding errors and security breaches. The following issues illustrate why these contractual safeguards matter and where difficulties may arise.
First, discrepancies between the code and the parties’ agreement may create uncertainty over the applicable contractual terms, particularly where their relationship is not expressly addressed in the accompanying documentation. Expert evidence may be required to establish how the code operates and whether its execution reflects the agreed obligations.
Second, automated performance makes mistakes harder to undo. A traditional contract can be suspended, varied or set aside by a court before harm is done. A smart contract will run regardless, especially where the code provides no mechanism for intervention. UAE civil law gives courts important powers to protect parties, for example in cases of mistake, unforeseen hardship or unfair terms, but with a smart contract these remedies usually come after the transfer has already happened. The injured party must then try to recover the assets from someone, which may not be possible.
Third, as parties transact through pseudonymous wallet addresses, additional difficulties may arise in establishing identity, consent, authority and legal capacity, as well as serving proceedings and enforcing judgments. Control of a wallet does not, by itself, conclusively identify the person legally bound by a transaction. Reliance on external data sources, or “oracles”, creates further questions about the allocation of liability for inaccurate data, manipulation or technical failure.
Fourth, cross-border arrangements also require careful consideration of governing law, jurisdiction and enforcement. The use of a distributed blockchain does not resolve these questions. Where proceedings are brought before mainland UAE courts, Arabic is generally the language of proceedings, which may require translations of contractual documents and technical evidence explaining the code’s operation.
These general considerations must be assessed alongside applicable UAE mandatory rules. For example, Article 9 of Federal Decree-Law No. 14 of 2023 concerning modern technology-based trade prohibits arbitration clauses in digital contracts valued below AED 50,000 that fall within its scope. This restriction applies to covered digital contracts generally, rather than specifically to blockchain-based smart contracts.
DIFC has gone further. Amendments made to its Contract Law in 2024 recognise “coded contracts”, meaning agreements written entirely in code and carried out by a computer program, with no version in ordinary language. They also recognise “hybrid contracts”, which combine terms expressed in ordinary language with coded terms. The law addresses interpretation and mistakes in this setting. In particular, where the parties’ common intention cannot be established, a coded or hybrid contract is interpreted from the perspective of a reasonable person with a competent understanding of the relevant code, taking the surrounding circumstances into account. ADGM relies on English law, under which a smart contract can be legally binding if the usual tests for a contract are met, as the Law Commission of England and Wales concluded in 2021.
Enforceability issues specific to smart contracts
The principal enforceability issues arising from smart contracts in the UAE are broadly similar to those encountered elsewhere: automated execution does not establish that the underlying agreement is legally valid or enforceable, and blockchain architecture can make disputes harder to resolve. A hybrid approach can help address these issues by combining code that performs the agreed steps with a written agreement identifying the parties, specifying the governing law and dispute resolution mechanism, and allocating responsibility for coding errors and security breaches. The following issues illustrate why these contractual safeguards matter and where difficulties may arise.
First, discrepancies between the code and the parties’ agreement may create uncertainty over the applicable contractual terms, particularly where their relationship is not expressly addressed in the accompanying documentation. Expert evidence may be required to establish how the code operates and whether its execution reflects the agreed obligations.
Second, automated performance makes mistakes harder to undo. A traditional contract can be suspended, varied or set aside by a court before harm is done. A smart contract will run regardless, especially where the code provides no mechanism for intervention. UAE civil law gives courts important powers to protect parties, for example in cases of mistake, unforeseen hardship or unfair terms, but with a smart contract these remedies usually come after the transfer has already happened. The injured party must then try to recover the assets from someone, which may not be possible.
Third, as parties transact through pseudonymous wallet addresses, additional difficulties may arise in establishing identity, consent, authority and legal capacity, as well as serving proceedings and enforcing judgments. Control of a wallet does not, by itself, conclusively identify the person legally bound by a transaction. Reliance on external data sources, or “oracles”, creates further questions about the allocation of liability for inaccurate data, manipulation or technical failure.
Fourth, cross-border arrangements also require careful consideration of governing law, jurisdiction and enforcement. The use of a distributed blockchain does not resolve these questions. Where proceedings are brought before mainland UAE courts, Arabic is generally the language of proceedings, which may require translations of contractual documents and technical evidence explaining the code’s operation.
These general considerations must be assessed alongside applicable UAE mandatory rules. For example, Article 9 of Federal Decree-Law No. 14 of 2023 concerning modern technology-based trade prohibits arbitration clauses in digital contracts valued below AED 50,000 that fall within its scope. This restriction applies to covered digital contracts generally, rather than specifically to blockchain-based smart contracts.
UAE federal law does not provide a uniform framework for DAOs. However, ADGM and Innovation City have developed their own frameworks. Each enables a decentralised project to acquire legal personality and to establish governance arrangements, and so addresses the principal legal difficulty associated with DAOs: the absence of an entity capable of holding rights and bearing obligations. The two regimes nevertheless differ materially in how they allocate decision-making authority between the governing body and the tokenholders.
ADGM: DLT foundations
ADGM’s Distributed Ledger Technology Foundations Regulations 2023, as amended, allow DAOs, blockchain protocols and other DLT projects to establish a legal entity. A DLT foundation can own assets, enter into contracts, issue tokens and assume obligations in its own name. The framework has already attracted several major blockchain ecosystems. In November 2023, the IOTA Ecosystem DLT Foundation became the first foundation registered under ADGM’s DLT Foundations Regulations. Subsequent examples include the TON DLT Foundation, Stacks Asia DLT Foundation and Avalanche DLT Foundation.
The governance model combines tokenholder participation with oversight by a council of two to sixteen members. The foundation’s charter defines tokenholders’ voting rights, which may cover changes to its structure, the appointment and removal of council members, and token issuance. Where tokenholders have the right to decide a matter, their decision takes effect only after the council confirms it. The council also retains statutory veto powers to block decisions that breach legal obligations, public order or morality, the charter or white paper principles, or could cause harm through an attack on the DLT framework. Tokenholders can therefore participate in decision-making, while the council remains responsible for legal oversight.
The charter may provide for distributions to designated beneficiaries, including tokenholders, although token ownership alone does not create a right to receive them. A foundation cannot itself conduct financial services requiring FSRA authorisation. The 2026 amendments also exclude charitable fundraising and similar activities falling within the Regulations’ specific definition of a “Non-Profit Organisation”; they do not require all DLT foundations to operate for profit.
Innovation City: DAO Associations
Innovation City, formerly known as Ras Al Khaimah Digital Assets Oasis, offers a membership-based structure under the DAO Association Regulations 2024. A DAO association has legal personality separate from its members and tokenholders, allowing it to own assets, enter into contracts and assume obligations in its own name. Its liabilities generally belong to the association rather than its members or officers, subject to statutory exceptions.
Applicants choose between Startup and Alpha DAO Association status, with Startup eligibility determined by implementing regulations. In practice, the Startup model is intended for emerging projects whose governance and operations remain under development, and the Alpha model for more established projects with more complex organisational and financial arrangements. Only Alpha associations may establish Sub DAO Associations with the Registrar’s written approval. These segregate assets and liabilities for particular projects but are not separate legal entities, and creditors may claim against the association’s general assets if the relevant Sub DAO’s assets are insufficient.
A DAO association’s members comprise founders, council members and tokenholders, with further categories permitted by its constitution. At least two founders are required at incorporation, and no more than ten may hold that status at any time. Each must guarantee a specified contribution towards liabilities that cannot otherwise be met on liquidation. Tokenholders hold Governance Tokens, which every association must issue, or optional Miscellaneous Tokens, which may grant access to services, record contributions or confer other constitutional rights. These categories may overlap: founders may hold tokens or serve on the council, while council members need not hold tokens unless the constitution requires it.
Governance is shared between Governance Token holders and a council of at least two natural persons, whose appointments require the Registrar’s approval and registration. Tokenholders elect and remove council members; the constitution must define their rights over changes to smart contracts and the constitution, and may extend their powers to treasury management, protocol development and annual accounts. They vote through governance proposals, electronically with or without a general meeting, following the applicable procedures. Subject to the constitution, the council acts as the executive and supervisory body, managing assets and operations, representing the association off-chain, entering into contracts, engaging service providers and overseeing compliance. Some decisions require combined approval: changing the association’s purpose requires unanimous council approval, an approving governance proposal and the Registrar’s approval.
Unlike the ADGM model, a DAO association must have a non-profit purpose. It cannot distribute profits to members or officers or pay dividends to tokenholders; those assets must instead support its purposes. Lawful commercial activities are permitted within its trade licence, provided they are not regulated financial services. The association must operate on a permissionless distributed ledger and make its entire software code publicly available in open-source form.
Token issuance remains subject to regulatory oversight. Before issuing a new token class, the association must submit a white paper or equivalent document, a legal opinion confirming compliance of the tokens and activities with applicable law and that the tokens are not security tokens under federal law, and a cybersecurity audit of the relevant smart contracts and any additional matters required by the Registrar. The Registrar’s prior no-objection certificate is required both for issuing a new token class and for listing tokens on a regulated market or exchange in any jurisdiction.
ADGM: DLT foundations
ADGM’s Distributed Ledger Technology Foundations Regulations 2023, as amended, allow DAOs, blockchain protocols and other DLT projects to establish a legal entity. A DLT foundation can own assets, enter into contracts, issue tokens and assume obligations in its own name. The framework has already attracted several major blockchain ecosystems. In November 2023, the IOTA Ecosystem DLT Foundation became the first foundation registered under ADGM’s DLT Foundations Regulations. Subsequent examples include the TON DLT Foundation, Stacks Asia DLT Foundation and Avalanche DLT Foundation.
The governance model combines tokenholder participation with oversight by a council of two to sixteen members. The foundation’s charter defines tokenholders’ voting rights, which may cover changes to its structure, the appointment and removal of council members, and token issuance. Where tokenholders have the right to decide a matter, their decision takes effect only after the council confirms it. The council also retains statutory veto powers to block decisions that breach legal obligations, public order or morality, the charter or white paper principles, or could cause harm through an attack on the DLT framework. Tokenholders can therefore participate in decision-making, while the council remains responsible for legal oversight.
The charter may provide for distributions to designated beneficiaries, including tokenholders, although token ownership alone does not create a right to receive them. A foundation cannot itself conduct financial services requiring FSRA authorisation. The 2026 amendments also exclude charitable fundraising and similar activities falling within the Regulations’ specific definition of a “Non-Profit Organisation”; they do not require all DLT foundations to operate for profit.
Innovation City: DAO Associations
Innovation City, formerly known as Ras Al Khaimah Digital Assets Oasis, offers a membership-based structure under the DAO Association Regulations 2024. A DAO association has legal personality separate from its members and tokenholders, allowing it to own assets, enter into contracts and assume obligations in its own name. Its liabilities generally belong to the association rather than its members or officers, subject to statutory exceptions.
Applicants choose between Startup and Alpha DAO Association status, with Startup eligibility determined by implementing regulations. In practice, the Startup model is intended for emerging projects whose governance and operations remain under development, and the Alpha model for more established projects with more complex organisational and financial arrangements. Only Alpha associations may establish Sub DAO Associations with the Registrar’s written approval. These segregate assets and liabilities for particular projects but are not separate legal entities, and creditors may claim against the association’s general assets if the relevant Sub DAO’s assets are insufficient.
A DAO association’s members comprise founders, council members and tokenholders, with further categories permitted by its constitution. At least two founders are required at incorporation, and no more than ten may hold that status at any time. Each must guarantee a specified contribution towards liabilities that cannot otherwise be met on liquidation. Tokenholders hold Governance Tokens, which every association must issue, or optional Miscellaneous Tokens, which may grant access to services, record contributions or confer other constitutional rights. These categories may overlap: founders may hold tokens or serve on the council, while council members need not hold tokens unless the constitution requires it.
Governance is shared between Governance Token holders and a council of at least two natural persons, whose appointments require the Registrar’s approval and registration. Tokenholders elect and remove council members; the constitution must define their rights over changes to smart contracts and the constitution, and may extend their powers to treasury management, protocol development and annual accounts. They vote through governance proposals, electronically with or without a general meeting, following the applicable procedures. Subject to the constitution, the council acts as the executive and supervisory body, managing assets and operations, representing the association off-chain, entering into contracts, engaging service providers and overseeing compliance. Some decisions require combined approval: changing the association’s purpose requires unanimous council approval, an approving governance proposal and the Registrar’s approval.
Unlike the ADGM model, a DAO association must have a non-profit purpose. It cannot distribute profits to members or officers or pay dividends to tokenholders; those assets must instead support its purposes. Lawful commercial activities are permitted within its trade licence, provided they are not regulated financial services. The association must operate on a permissionless distributed ledger and make its entire software code publicly available in open-source form.
Token issuance remains subject to regulatory oversight. Before issuing a new token class, the association must submit a white paper or equivalent document, a legal opinion confirming compliance of the tokens and activities with applicable law and that the tokens are not security tokens under federal law, and a cybersecurity audit of the relevant smart contracts and any additional matters required by the Registrar. The Registrar’s prior no-objection certificate is required both for issuing a new token class and for listing tokens on a regulated market or exchange in any jurisdiction.
Yes, and enforcement has become noticeably more active since 2024. Most actions so far have targeted firms that offer crypto services, or advertise them, without a licence. The regulators have also begun to act against licensed firms for weak anti-money laundering controls.
VARA’s enforcement actions
VARA publishes its enforcement decisions on its website, and by mid-2026 the list included around 50 cases. The typical case involves a local or foreign company that offered crypto trading or exchange services to people in Dubai, or promoted them, without a VARA licence. The usual result is a cease-and-desist order, which requires the firm to stop the activity, together with a fine. In October 2025, for example, VARA announced fines of between AED 100,000 and AED 600,000 against 19 firms for unlicensed activity and marketing breaches.
Some cases show that enforcement can also extend to founders and senior management personally. In May 2023, VARA fined OPNX AED 10 million for a market offence under its Virtual Assets and Related Activities Regulations. It also imposed separate fines of AED 200,000 each on founders Kyle Davies, Su Zhu and Mark Lamb, and CEO Leslie Lamb, for breaches of its marketing rules.
In May 2025, VARA also took action against Singapore-based Triple A Technologies Pte Ltd for conducting unlicensed virtual asset activities in Dubai, imposing financial penalties and cease-and-desist orders. The case illustrates that foreign incorporation does not shield a firm from enforcement over its activities in Dubai.
Recent cases also show that VARA is prepared to act against large international platforms and against licensed firms, not only small local operators. In June 2026, VARA took action against the operators of two global exchanges, KuCoin and MEXC, for providing virtual asset services in Dubai without a licence. In the case of MEXC, VARA also found that users had been onboarded without the identity checks required by UAE law. In June 2026, VARA fined CoinMENA, a licensed firm, for failures in its anti-money laundering controls, governance and internal systems. Earlier, in August 2025, VARA fined Fuze, another licensed firm, for anti-money laundering failures, for carrying on activities outside its licence and for failing to disclose material information to the regulator. VARA also appointed an independent expert, known as a “skilled person”, to review the firm. In July 2025, VARA fined The Open Network Foundation, the organisation behind the TON blockchain, for breaching its marketing regulations.
VARA also keeps a public list of unlicensed firms and can order websites and promotional material to be taken down.
Other regulatory actions and AML enforcement
Beyond VARA, the DFSA and the FSRA have regularly issued public warnings about firms falsely claiming to be authorised or impersonating licensed entities.
UAE authorities have also taken action against money laundering networks using crypto assets. In December 2024, Dubai authorities announced that they had disrupted an alleged AED 180 million money laundering network involving 30 individuals and three companies. According to investigators, the network used unlicensed cryptocurrency intermediaries in the UK and Dubai to launder funds. Dubai Public Prosecution referred the case to the Money Laundering Court at Dubai Courts.
VARA’s enforcement actions
VARA publishes its enforcement decisions on its website, and by mid-2026 the list included around 50 cases. The typical case involves a local or foreign company that offered crypto trading or exchange services to people in Dubai, or promoted them, without a VARA licence. The usual result is a cease-and-desist order, which requires the firm to stop the activity, together with a fine. In October 2025, for example, VARA announced fines of between AED 100,000 and AED 600,000 against 19 firms for unlicensed activity and marketing breaches.
Some cases show that enforcement can also extend to founders and senior management personally. In May 2023, VARA fined OPNX AED 10 million for a market offence under its Virtual Assets and Related Activities Regulations. It also imposed separate fines of AED 200,000 each on founders Kyle Davies, Su Zhu and Mark Lamb, and CEO Leslie Lamb, for breaches of its marketing rules.
In May 2025, VARA also took action against Singapore-based Triple A Technologies Pte Ltd for conducting unlicensed virtual asset activities in Dubai, imposing financial penalties and cease-and-desist orders. The case illustrates that foreign incorporation does not shield a firm from enforcement over its activities in Dubai.
Recent cases also show that VARA is prepared to act against large international platforms and against licensed firms, not only small local operators. In June 2026, VARA took action against the operators of two global exchanges, KuCoin and MEXC, for providing virtual asset services in Dubai without a licence. In the case of MEXC, VARA also found that users had been onboarded without the identity checks required by UAE law. In June 2026, VARA fined CoinMENA, a licensed firm, for failures in its anti-money laundering controls, governance and internal systems. Earlier, in August 2025, VARA fined Fuze, another licensed firm, for anti-money laundering failures, for carrying on activities outside its licence and for failing to disclose material information to the regulator. VARA also appointed an independent expert, known as a “skilled person”, to review the firm. In July 2025, VARA fined The Open Network Foundation, the organisation behind the TON blockchain, for breaching its marketing regulations.
VARA also keeps a public list of unlicensed firms and can order websites and promotional material to be taken down.
Other regulatory actions and AML enforcement
Beyond VARA, the DFSA and the FSRA have regularly issued public warnings about firms falsely claiming to be authorised or impersonating licensed entities.
UAE authorities have also taken action against money laundering networks using crypto assets. In December 2024, Dubai authorities announced that they had disrupted an alleged AED 180 million money laundering network involving 30 individuals and three companies. According to investigators, the network used unlicensed cryptocurrency intermediaries in the UK and Dubai to launder funds. Dubai Public Prosecution referred the case to the Money Laundering Court at Dubai Courts.
Beyond sector-specific digital asset regulation, the use of blockchain technology in the UAE raises questions under generally applicable laws, particularly those governing data protection, insolvency, criminal liability and intellectual property.
Data protection
VASPs must comply with applicable data protection requirements when collecting and using customer information, including identity documents, contact details and transaction records obtained through KYC and AML checks. Depending on the jurisdiction and scope of application, the relevant framework is the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the DIFC Data Protection Law of 2020 or the ADGM Data Protection Regulations of 2021.
In practice, VASPs need a lawful basis for processing personal data, must explain how it is used, implement appropriate security measures and comply with applicable retention and cross-border transfer requirements. These obligations are particularly relevant where customer information is shared with other service providers, overseas group companies or counterparties for Travel Rule compliance.
Data protection obligations must also be reconciled with AML record-keeping requirements. A customer’s request to delete their data does not necessarily require a VASP to erase records it is legally required to retain. Where personal data is recorded directly on a blockchain, the difficulty of correcting or deleting those records creates an additional compliance consideration.
Insolvency
There is no special insolvency regime for crypto businesses. The insolvency of a VASP is governed by the applicable general insolvency framework, alongside regulatory requirements protecting client assets. Relevant legislation includes Federal Decree-Law No. 51 of 2023 on Financial Restructuring and Bankruptcy, the DIFC Insolvency Law and the ADGM Insolvency Regulations 2022, depending on the entity and jurisdiction concerned.
A central issue is whether customers retain ownership of assets held by the VASP or have contractual claims against it. Within VARA’s jurisdiction, the rules expressly provide that clients’ virtual assets are not owned by the VASP and must not form part of its insolvency estate. VASPs must hold these assets in wallets separate from their own and comply with VARA’s requirements for demonstrating reserve coverage of liabilities relating to Client VAs.
DIFC’s Digital Assets Law provides further clarity on the legal status, control and ownership of digital assets (see Question 11). In an insolvency, the recovery of client assets will also depend on the applicable client asset protections, the contractual and custody arrangements, and the firm’s records. Practical difficulties may include identifying and tracing client assets, determining how and when crypto-denominated claims should be valued under the applicable insolvency rules, and recovering assets held through overseas custodians or affiliates.
Criminal law
The federal cybercrime law (Federal Decree-Law No. 34 of 2021) makes it an offence to promote or deal in virtual currencies that are not recognised under UAE law, and it also covers online fraud. Under the anti-money laundering legislation, providing virtual asset services without a licence or registration is a criminal offence.
Intellectual property
Many blockchain projects use open-source code, and NFT projects raise questions about who owns the underlying artwork. The Dubai courts have recently ruled on copyright in NFT artwork for the first time, confirming that it is protected under UAE copyright law.
Data protection
VASPs must comply with applicable data protection requirements when collecting and using customer information, including identity documents, contact details and transaction records obtained through KYC and AML checks. Depending on the jurisdiction and scope of application, the relevant framework is the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the DIFC Data Protection Law of 2020 or the ADGM Data Protection Regulations of 2021.
In practice, VASPs need a lawful basis for processing personal data, must explain how it is used, implement appropriate security measures and comply with applicable retention and cross-border transfer requirements. These obligations are particularly relevant where customer information is shared with other service providers, overseas group companies or counterparties for Travel Rule compliance.
Data protection obligations must also be reconciled with AML record-keeping requirements. A customer’s request to delete their data does not necessarily require a VASP to erase records it is legally required to retain. Where personal data is recorded directly on a blockchain, the difficulty of correcting or deleting those records creates an additional compliance consideration.
Insolvency
There is no special insolvency regime for crypto businesses. The insolvency of a VASP is governed by the applicable general insolvency framework, alongside regulatory requirements protecting client assets. Relevant legislation includes Federal Decree-Law No. 51 of 2023 on Financial Restructuring and Bankruptcy, the DIFC Insolvency Law and the ADGM Insolvency Regulations 2022, depending on the entity and jurisdiction concerned.
A central issue is whether customers retain ownership of assets held by the VASP or have contractual claims against it. Within VARA’s jurisdiction, the rules expressly provide that clients’ virtual assets are not owned by the VASP and must not form part of its insolvency estate. VASPs must hold these assets in wallets separate from their own and comply with VARA’s requirements for demonstrating reserve coverage of liabilities relating to Client VAs.
DIFC’s Digital Assets Law provides further clarity on the legal status, control and ownership of digital assets (see Question 11). In an insolvency, the recovery of client assets will also depend on the applicable client asset protections, the contractual and custody arrangements, and the firm’s records. Practical difficulties may include identifying and tracing client assets, determining how and when crypto-denominated claims should be valued under the applicable insolvency rules, and recovering assets held through overseas custodians or affiliates.
Criminal law
The federal cybercrime law (Federal Decree-Law No. 34 of 2021) makes it an offence to promote or deal in virtual currencies that are not recognised under UAE law, and it also covers online fraud. Under the anti-money laundering legislation, providing virtual asset services without a licence or registration is a criminal offence.
Intellectual property
Many blockchain projects use open-source code, and NFT projects raise questions about who owns the underlying artwork. The Dubai courts have recently ruled on copyright in NFT artwork for the first time, confirming that it is protected under UAE copyright law.
Several further issues deserve attention: restrictions on marketing, the scope of VARA’s Sponsored VASP regime, and the distinct treatment of mining and staking. Practitioners should also monitor emerging proposals, as UAE regulators continue to develop and update their rules at a rapid pace.
Marketing and promotional activities
Marketing requires a separate assessment from the underlying service. VARA’s Marketing Regulations 2024 cover promotions in or targeting the UAE, including social media, endorsements, events and airdrops. Subject to limited exceptions, marketing of regulated virtual asset activities must be carried out by, or on behalf of and approved by, a VARA-licensed provider authorised for the relevant activity. An overseas licence does not satisfy this requirement.
Whether a campaign targets the UAE depends on its overall content and distribution. VARA’s guidance identifies factors such as prices in dirhams, Dubai imagery, UAE-focused social media channels and personalities with substantial local followings. Campaigns targeting the Gulf generally are presumed to include the UAE. Describing a campaign as “global” therefore does not settle whether the rules apply.
Communications must be fair, clear and not misleading. Anyone paid to promote a crypto product, or service must make that commercial relationship clear. Advertisements must not promise guaranteed returns or pressure people to invest quickly to avoid missing an opportunity. Where the marketing concerns a particular token, it must not directly encourage people to buy or sell that token and must prominently explain the risks, including the possibility of losing the entire investment. Promotional rewards, such as referral bonuses or sign-up gifts, require confirmation from VARA that they comply with its rules. Free tokens must not be sent to a person’s wallet unless that person has agreed or clearly expressed an interest in receiving them. A firm remains responsible for advertisements published on its behalf by a marketing agency and must keep copies of its marketing materials and records of their distribution for eight years.
Genuine educational or journalistic content may fall outside the marketing rules, but only if it meets specific conditions. In particular, its overall purpose must not be promotional, relevant commercial interests must be disclosed, and references to buying virtual assets must carry a risk warning. Influencers and other “key opinion leaders” cannot rely on these exemptions merely by describing their content as educational.
Sponsored VASPs
VARA’s framework allows a Dubai entity to conduct approved virtual asset activities as a “Sponsored VASP” under the oversight of a “Regulated Sponsor”. The sponsor must be a VARA-licensed provider separately approved to act in that capacity. It must control the sponsored entity or share the same controlling entity with it, and VARA must approve each sponsorship arrangement before activities begin. The regime therefore provides a route for related businesses to operate within a supervised group structure. The sponsor remains responsible for the sponsored entity’s regulatory compliance and must meet the applicable capital and prudential requirements for each Sponsored VASP. Each sponsored entity must appoint a VARA-approved Responsible Officer. Its marketing must identify its sponsored status and name the sponsor, rather than present it as an independently licensed VASP.
In principle, this route could help start-ups that lack the resources to obtain a standalone licence, provided they meet the control requirements linking them to the sponsor. In practice, however, the regime does not yet appear to be widely used.
Crypto mining
At the federal level, there is no dedicated licensing regime for crypto mining itself. The SCA, the CMA’s predecessor, expressly stated that it did not directly regulate mining operations. Mining businesses must nevertheless obtain the appropriate commercial licence and assess the requirements applicable to their premises, equipment and electricity supply. In Dubai, for example, DMCC offers licensed activities covering proprietary crypto mining and the operation of mining facilities. A commercial mining licence does not authorise custody, exchange or investment services for customers, which require a separate regulatory assessment.
In January 2026, ADGM’s Registration Authority published Discussion Paper No. 1 of 2026, proposing guidance on mining conducted in or from ADGM. The proposal treats mining as a commercially licensed activity rather than a financial service and addresses governance, beneficial ownership and operational controls, including where an ADGM company manages mining operations overseas. The consultation closed on 20 March 2026. These proposals should be distinguished from the FSRA’s separate rules on staking clients’ assets.
Staking
Staking generally involves committing crypto assets to support a blockchain’s operation in return for rewards. The legal analysis depends on how the service works, particularly whether a provider holds or controls clients’ assets. Products marketed as “staking” may instead involve lending or other investment arrangements, so the label alone does not determine the applicable rules.
At the federal level, the CMA’s Virtual Asset Service Providers Rulebook expressly regulates staking. Under Articles 91–94 of its Business Regulation Module, staking services may be provided only through a custodian or a multilateral trading facility operator that provides custody services. Providers must include staking terms in the client agreement and explain price volatility, potential slashing penalties and restrictions on withdrawals during the lock-up period. They must also disclose how rewards are calculated and paid, the fees deducted, how validators are selected and the conditions for early withdrawal. Compliance records must be retained for at least six years.
In Dubai, VARA permits licensed custodians to provide “Staking from Custody Services” only where this is expressly authorised in their licence. Clients must specifically opt in, and their assets must remain segregated. Providers must obtain separate acceptance of a risk disclosure statement and explain the rewards, fees, withdrawal restrictions and potential losses. These include “slashing”, where the blockchain reduces staked assets as a penalty for failures or misconduct by the validator responsible for processing transactions.
In ADGM, the FSRA finalised its framework for staking clients’ virtual assets on 29 April 2026. It specifies which authorised firms may provide these services and imposes requirements on client terms, disclosures and reporting. The framework covers proof-of-stake arrangements and other staking models with materially similar characteristics. Rewards paid to clients are restricted to Accepted Virtual Assets and Accepted Fiat-Referenced Tokens. Practitioners should therefore assess both the staking arrangement and the assets distributed as rewards.
ADGM’s proposed DeFi risk management guidance
On 6 October 2026, the FSRA published Consultation Paper No. 5 of 2026 on proposed DeFi Risk Management Guidance, with comments due by 30 November 2026. It addresses how Authorised Persons and Recognised Bodies should manage risks arising from their engagement with DeFi. It does not propose a separate licensing regime for DeFi protocols, expand the regulatory perimeter or change the classification of digital assets.
The proposal focuses on governance, due diligence, ongoing monitoring, financial crime controls and client asset safeguards. Firms would be expected to assess the particular risks of their arrangements, including dependencies on smart contracts, oracles, bridges, governance mechanisms and third-party infrastructure. Wrapped assets, tokenised claims and synthetic exposures would require separate assessment under the existing rules. For practitioners, the proposal highlights the need to connect legal analysis with a detailed understanding of how the protocol operates and who can influence it.
Marketing and promotional activities
Marketing requires a separate assessment from the underlying service. VARA’s Marketing Regulations 2024 cover promotions in or targeting the UAE, including social media, endorsements, events and airdrops. Subject to limited exceptions, marketing of regulated virtual asset activities must be carried out by, or on behalf of and approved by, a VARA-licensed provider authorised for the relevant activity. An overseas licence does not satisfy this requirement.
Whether a campaign targets the UAE depends on its overall content and distribution. VARA’s guidance identifies factors such as prices in dirhams, Dubai imagery, UAE-focused social media channels and personalities with substantial local followings. Campaigns targeting the Gulf generally are presumed to include the UAE. Describing a campaign as “global” therefore does not settle whether the rules apply.
Communications must be fair, clear and not misleading. Anyone paid to promote a crypto product, or service must make that commercial relationship clear. Advertisements must not promise guaranteed returns or pressure people to invest quickly to avoid missing an opportunity. Where the marketing concerns a particular token, it must not directly encourage people to buy or sell that token and must prominently explain the risks, including the possibility of losing the entire investment. Promotional rewards, such as referral bonuses or sign-up gifts, require confirmation from VARA that they comply with its rules. Free tokens must not be sent to a person’s wallet unless that person has agreed or clearly expressed an interest in receiving them. A firm remains responsible for advertisements published on its behalf by a marketing agency and must keep copies of its marketing materials and records of their distribution for eight years.
Genuine educational or journalistic content may fall outside the marketing rules, but only if it meets specific conditions. In particular, its overall purpose must not be promotional, relevant commercial interests must be disclosed, and references to buying virtual assets must carry a risk warning. Influencers and other “key opinion leaders” cannot rely on these exemptions merely by describing their content as educational.
Sponsored VASPs
VARA’s framework allows a Dubai entity to conduct approved virtual asset activities as a “Sponsored VASP” under the oversight of a “Regulated Sponsor”. The sponsor must be a VARA-licensed provider separately approved to act in that capacity. It must control the sponsored entity or share the same controlling entity with it, and VARA must approve each sponsorship arrangement before activities begin. The regime therefore provides a route for related businesses to operate within a supervised group structure. The sponsor remains responsible for the sponsored entity’s regulatory compliance and must meet the applicable capital and prudential requirements for each Sponsored VASP. Each sponsored entity must appoint a VARA-approved Responsible Officer. Its marketing must identify its sponsored status and name the sponsor, rather than present it as an independently licensed VASP.
In principle, this route could help start-ups that lack the resources to obtain a standalone licence, provided they meet the control requirements linking them to the sponsor. In practice, however, the regime does not yet appear to be widely used.
Crypto mining
At the federal level, there is no dedicated licensing regime for crypto mining itself. The SCA, the CMA’s predecessor, expressly stated that it did not directly regulate mining operations. Mining businesses must nevertheless obtain the appropriate commercial licence and assess the requirements applicable to their premises, equipment and electricity supply. In Dubai, for example, DMCC offers licensed activities covering proprietary crypto mining and the operation of mining facilities. A commercial mining licence does not authorise custody, exchange or investment services for customers, which require a separate regulatory assessment.
In January 2026, ADGM’s Registration Authority published Discussion Paper No. 1 of 2026, proposing guidance on mining conducted in or from ADGM. The proposal treats mining as a commercially licensed activity rather than a financial service and addresses governance, beneficial ownership and operational controls, including where an ADGM company manages mining operations overseas. The consultation closed on 20 March 2026. These proposals should be distinguished from the FSRA’s separate rules on staking clients’ assets.
Staking
Staking generally involves committing crypto assets to support a blockchain’s operation in return for rewards. The legal analysis depends on how the service works, particularly whether a provider holds or controls clients’ assets. Products marketed as “staking” may instead involve lending or other investment arrangements, so the label alone does not determine the applicable rules.
At the federal level, the CMA’s Virtual Asset Service Providers Rulebook expressly regulates staking. Under Articles 91–94 of its Business Regulation Module, staking services may be provided only through a custodian or a multilateral trading facility operator that provides custody services. Providers must include staking terms in the client agreement and explain price volatility, potential slashing penalties and restrictions on withdrawals during the lock-up period. They must also disclose how rewards are calculated and paid, the fees deducted, how validators are selected and the conditions for early withdrawal. Compliance records must be retained for at least six years.
In Dubai, VARA permits licensed custodians to provide “Staking from Custody Services” only where this is expressly authorised in their licence. Clients must specifically opt in, and their assets must remain segregated. Providers must obtain separate acceptance of a risk disclosure statement and explain the rewards, fees, withdrawal restrictions and potential losses. These include “slashing”, where the blockchain reduces staked assets as a penalty for failures or misconduct by the validator responsible for processing transactions.
In ADGM, the FSRA finalised its framework for staking clients’ virtual assets on 29 April 2026. It specifies which authorised firms may provide these services and imposes requirements on client terms, disclosures and reporting. The framework covers proof-of-stake arrangements and other staking models with materially similar characteristics. Rewards paid to clients are restricted to Accepted Virtual Assets and Accepted Fiat-Referenced Tokens. Practitioners should therefore assess both the staking arrangement and the assets distributed as rewards.
ADGM’s proposed DeFi risk management guidance
On 6 October 2026, the FSRA published Consultation Paper No. 5 of 2026 on proposed DeFi Risk Management Guidance, with comments due by 30 November 2026. It addresses how Authorised Persons and Recognised Bodies should manage risks arising from their engagement with DeFi. It does not propose a separate licensing regime for DeFi protocols, expand the regulatory perimeter or change the classification of digital assets.
The proposal focuses on governance, due diligence, ongoing monitoring, financial crime controls and client asset safeguards. Firms would be expected to assess the particular risks of their arrangements, including dependencies on smart contracts, oracles, bridges, governance mechanisms and third-party infrastructure. Wrapped assets, tokenised claims and synthetic exposures would require separate assessment under the existing rules. For practitioners, the proposal highlights the need to connect legal analysis with a detailed understanding of how the protocol operates and who can influence it.