United Arab Emirates#
AE is a multi-regime jurisdiction. Dubai mainland/free zones (excl. DIFC) are regulated by VARA under Law No. (4) of 2022; DIFC is regulated by the DFSA Crypto Token regime; Abu Dhabi Global Market (ADGM) operates its own FSRA virtual-asset licensing framework; and, federally, a new CBUAE decree-law (No. 6 of 2025) now asserts licensing authority over all crypto/blockchain/DeFi/stablecoin activity nationwide, with a one-year grace period to September 2026 for existing operators to come into compliance. No VA activity is treated as exempt from oversight in the VARA regime. NOTE: a Challenger-flagged, currently unresolved question (FLG-f-001) concerns whether the Capital Market Authority (CMA) constitutes a fifth AE regulator licensing investment-related virtual asset activity in Dubai mainland; this is held for human/primary-source review and not yet reflected in the four-regulator framing above.
Layered onto these three sub-federal regimes is Federal Decree Law No. 6 of 2025, which entered into force on 2025-09-16 following Official Gazette publication (a date corrected during this compilation cycle from an earlier unsupported figure of 2025-09-01, following review of the law's Article 188 commencement provisions). The decree-law brings virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under CBUAE authority nationwide, requiring all crypto and blockchain organizations operating in or from the UAE to hold a CBUAE licence. Existing operators have been given a one-year grace period, running to September 2026, to achieve compliance; fines for unlicensed operation after that point are reported to reach as high as AED 1 billion (approximately $272 million). This is a federal overlay onto, rather than an outright replacement of, the VARA/DFSA/ADGM structure, and the precise division of ongoing licensing responsibility between the federal regulator and the three existing sub-federal authorities has not yet crystallised.
A further complication, currently unresolved, concerns whether a fifth regulator -- the UAE's Capital Market Authority (CMA) -- operates its own investment-related virtual-asset licensing regime in Dubai mainland alongside VARA. This question was raised during review of the claim that VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland outside the DIFC; all supporting material for the CMA's alleged role is secondary reporting, without primary-source (T1-T3) corroboration, so the underlying claim about VARA's sole authority has been left unmutated and unqualified in this cycle's composed record, and the CMA question has instead been escalated for human review rather than folded into the licensing narrative. Readers should treat the current four-regulator framing (VARA, DFSA, ADGM-FSRA, CBUAE) as the confirmed picture for this cycle, with the possible CMA dimension held open pending confirmation.
Outlook
Two developments will determine whether this module's traffic-light amber rating tightens toward green or degrades toward continued complexity over the next two to three quarters. First, the CBUAE grace period concludes in the third quarter of 2026; how existing VARA-, DFSA- and ADGM-licensed operators are treated relative to the new federal licensing requirement at that point will be the clearest signal yet of how the overlay is meant to function in practice. Second, resolution of the CMA question -- expected, if it resolves at all, within a half-year window extending into the fourth quarter of 2026 -- will determine whether the regulator count in Dubai mainland licensing is four or five. Until both points are settled, the jurisdiction's licensing architecture should be read as a work in progress rather than a stable end-state, and any claim of a single sole authority for a given zone should be treated as provisional.
Crypto Licensing
VARA granted Payward FZCO, the UAE entity of Kraken, Full Market Approval as a licensed virtual asset service provider. The register entry is dated 6 October 2026, with the Full Market Approval itself announced on 12 October 2026. The approval permits AED-denominated spot and margin trading, with staking, tokenised equities, and crypto payments reported as planned for launch within weeks of the approval.
The grant operates under Dubai Law No. (4) of 2022 and VARA's Virtual Assets and Related Activities Regulations, the established primary framework for exchange-level virtual-asset licensing in Dubai, with VARA as the supervisory authority. This is a continuation of an established, functioning licensing regime rather than a new regulatory development: VARA continued to process and grant full market approvals to major global exchanges within its existing framework, with Payward FZCO the latest entity to progress from provisional or limited licensing toward full market standing. The specific announcement was reported through secondary press coverage of VARA's public register rather than confirmed directly against a primary VARA register page or enforcement document this cycle, a sourcing gap worth noting given the materiality of a full market approval grant to a major global exchange.
Separately, VARA's precise enforcement-penalty provisions applicable to unlicensed virtual-asset activity were not located this cycle, as the relevant VARA rulebook enforcement chapter was not directly fetched; this is recorded as an open sourcing gap rather than an assessment of VARA's enforcement posture.
Outlook
Further full market approvals to other provisionally-licensed exchanges operating in Dubai under VARA's framework are a plausible continuation of this pattern. Confirmation of Payward FZCO's reported near-term product launches, including staking and tokenised equities, and primary-source verification of VARA's enforcement-penalty framework, are open items for subsequent cycles.
1 earlier distinct update(s)
Crypto Licensing
The UAE's crypto licensing framework underwent its most significant structural change in this cycle with the entry into force of Capital Market Authority Decision No. 4/R.M/2026. The Decision fully replaces the prior Securities and Commodities Authority regime, SCA Decision No. 26/RM of 2023, and establishes an eight-activity federal licensing framework. A central and binding feature of the new regime is the Green List mechanism: trading of any virtual asset onshore is prohibited unless that specific asset has been accepted onto an official Green List maintained by a CMA-licensed virtual asset platform operator. This is a hard gating requirement rather than a disclosure or registration formality, and it represents a materially tighter onshore trading perimeter than existed under the prior SCA framework, at least as the new regime's text has been reported by legal commentary this cycle; no primary CMA text confirming administrative fine maxima for non-compliance was located.
Running in parallel to this federal development, the Virtual Assets Regulatory Authority introduced its Exchange Services Rulebook Version 2.1, effective 31 March 2026, which for the first time gives VARA a permanent regulatory regime for exchange-traded virtual-asset derivatives, covering futures, options, contracts for difference, and perpetual products, all subject to authorisation. This is VARA's first formal derivatives framework and represents a maturation of the Dubai-specific regime independent of the CMA's federal-level reorganisation.
The combined effect of these two developments, assessed together with the CBUAE Payment Token Services Regulation, the Abu Dhabi Global Market's Financial Services Regulatory Authority regime, and the Dubai Financial Services Authority's Dubai International Financial Centre regime, is that the UAE now has five concurrent crypto licensing regimes operating at federal and emirate level simultaneously. This is the most consequential single fact for any virtual-asset business considering entry into the UAE market: regime selection, meaning the choice of which authorisation to seek and in which emirate or financial free zone to establish, is now the primary strategic and compliance decision, more consequential than the substantive content of any single regime's rules, because each regime is individually well-developed but the five do not map cleanly onto a single coherent national perimeter.
Entities previously licensed or operating under the former SCA regime are required to adjust their status to comply with the new CMA framework within a transition window reported as one year from the new framework's entry into force. The practical administration of this migration, including whether CMA will issue further implementing guidance narrowing ambiguity in the transition mechanics, was not located in primary-source form this cycle and remains a documented gap.
Outlook
The principal forward-looking question for crypto licensing in the UAE is whether the five concurrent regimes move toward greater mutual recognition or interoperability, or whether they continue to operate as largely separate tracks requiring firms to choose a single regime and forgo the others. The CMA's one-year migration deadline for former SCA-regime entities is the most concrete near-term milestone, and how smoothly that migration proceeds will be an early indicator of whether the broader five-regime structure is navigable in practice or whether it will continue to generate the kind of jurisdictional-mapping complexity that the UAE's crypto market currently presents to new entrants.
Sources and findings (29)
- T1VARA — VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland, except within DIFC, and any entity carrying out VA activities in or from Dubai must apply for a VASP licence. retrieved M5 binding in force new
- T1VARA — No VA activity is exempt from regulatory supervision in the VARA regime; any VA service or activity requires a VARA licence, registration, or No Objection Certificate. retrieved M5 binding in force new
- T4 · CoinDeskADGM-FSRA — ADGM's Financial Services Regulatory Authority operates an institutional virtual-asset licensing framework covering custody, derivatives, staking and professional client classifications; Binance received an FSRA licence to begin regulated operations from January 5, 2026. retrieved M5 binding in force new
- T4 · CoinDeskDFSA — The DFSA's updated Crypto Token Regulatory Framework, in force from January 12, 2026, positions DFSA as a regulator focused on enforcing global compliance standards while shifting responsibility for crypto asset suitability approval onto DIFC-licensed firms. retrieved M4 binding in force new
- T4 · CoinDeskCBUAE — Federal Decree Law No. 6 of 2025 brings virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under CBUAE authority nationwide, requiring all crypto and blockchain organizations operating in or from the UAE to be licensed by CBUAE, with a one-year grace period to September 2026 for existing players to become compliant and fines for unlicensed operation reaching up to 1 billion dirhams (~$272 million). retrieved M5 binding in force new
- T1Capital Market Authority (CMA) — CMA established as federal public authority replacing SCA in all rights, obligations and contracts retrieved M5 binding in force new
- T3CMA Virtual Assets Framework (CMA Decision No. 4/R.M./2026) — Establishes eight licensed virtual-asset financial activities with minimum capital requirements by activity category and a 'Green List' of approved virtual assets; replaces the prior 2023 SCA virtual-asset platform operator regime retrieved M5 binding in force new
- T1Virtual Assets Regulatory Authority — No person may conduct virtual-asset platform operation, exchange, transfer, safekeeping/custody, wallet, or issuance/trading-related services in or from Dubai (excl. DIFC) without a VARA permit/licence. retrieved M5 binding in force
- T3CMA Decision No. 4/R.M/2026 — Trading of any virtual asset onshore is prohibited unless accepted onto the official Green List maintained by a CMA-licensed virtual asset platform operator. retrieved M5 binding in force
- T3VARA Exchange Services Rulebook Version 2.1 — Permanent regulatory regime for exchange-traded virtual-asset derivatives (futures, options, CFDs, perpetuals), subject to authorisation. retrieved M4 binding in force
- T1Bybit Fintech FZE — Dubai Virtual Assets Regulatory Authority (VARA) — Exchange Services, spot trading retrieved M4 binding in force new
- T3CMA Virtual Assets Framework (CMA Decision No. 4/R.M./2026) — 2026-04-13 retrieved
- T3VARA-licensed VASPs operating in Dubai — AED 50,000,000 or 15% of revenue retrieved
- T3Federal Decree-Law No. 33 of 2025 — Lists virtual assets for investment purposes among regulated Financial Products, empowering CMA to regulate their trading and related activities retrieved M5 binding in force new
- T3Cabinet Decision No. 111 of 2022 — Persons operating platforms, exchanging, transferring, trading or custodying virtual assets must obtain approval/licence from SCA (now CMA) or relevant Local Licensing Authority retrieved M4 binding in force
- T1Dubai Law No. (4) of 2022 — Establishes VARA as public corporation to regulate virtual assets across Dubai excluding DIFC; VA exchange and custody services require VARA Permits retrieved M5 binding in force
- T1Virtual Assets and Related Activities Regulations 2023 — Applies to all VASPs in Dubai; prohibits issuance of and dealing in anonymity-enhanced cryptocurrencies; VARA may conduct regular inspections and audits retrieved M5 binding in force
- T1DFSA Investment Token regime — Carrying on a financial service relating to Investment or Crypto Tokens in/from the DIFC requires DFSA authorisation retrieved M4 binding in force
- T1ADGM FSRA Virtual Asset Framework — Qualifying Applicants are granted a Financial Services Permission (FSP) under FSMR s.30 to carry on relevant VA Regulated Activity retrieved M4 binding in force
- T3Dubai Law No. 4 of 2022, Art 17 — Unlicensed VA Activity is a criminal offence; administrative penalties up to AED 50,000,000 or 15% of revenue, plus criminal referral retrieved M5 binding in force
- T1VARA Regulations 2023, Schedule 3 — Individual fines up to higher of AED 20,000,000 or 200% of profits/losses avoided; corporate fines up to higher of AED 50,000,000, 15% annual revenue or 300% of profits/losses avoided; non-payment doubles fine retrieved M5 binding in force
- T3VARA Company Rulebook, Part VI — Paid-up capital varies by VA Activity (Advisory AED 100,000 to Exchange AED 800,000-1,500,000); expense-based capital of at least 1.2x monthly operational expenses required retrieved M3 binding in force
- T1VARA — VARA conducted successive enforcement rounds against unlicensed/non-compliant marketing entities: 7 entities fined AED 50,000-100,000; later round of 19 unlicensed firms fined AED 100,000-600,000; October 2025 round targeting non-compliant marketing/token announcements retrieved M3 non-binding new
- T3VARA — Payward FZCO (Kraken's UAE entity) granted VASP licence and Full Market Approval retrieved M4 binding in force
- T1VARA — AED 20,000,000 (individual) / AED 50,000,000 or 15% revenue or 300% profits (corporate) retrieved
- T3Dubai Law No. 4 of 2022 — administrative fine up to AED 50,000,000 or 15% revenue plus criminal referral retrieved
- T1 · Virtual Assets Regulatory Authority (VARA)VARA — public statement / suspension announcement requirement
- T1VARA — fines ranging AED 50,000-600,000 per entity across rounds retrieved
- T3VASP (VARA-licensed) — 1.2x monthly operational expenses, held as liquid assets retrieved