United Arab Emirates

Layered onto these three sub-federal regimes is Federal Decree Law No. 6 of 2025, which entered into force on 2025-09-16 following Official Gazette publication (a date corrected during this compilation cycle from an earlier unsupported figure of 2025-09-01, following review of the law's Article 188 commencement provisions). The decree-law brings virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under CBUAE authority nationwide, requiring all crypto and blockchain organizations operating in or from the UAE to hold a CBUAE licence. Existing operators have been given a one-year grace period, running to September 2026, to achieve compliance; fines for unlicensed operation after that point are reported to reach as high as AED 1 billion (approximately $272 million). This is a federal overlay onto, rather than an outright replacement of, the VARA/DFSA/ADGM structure, and the precise division of ongoing licensing responsibility between the federal regulator and the three existing sub-federal authorities has not yet crystallised.

A further complication, currently unresolved, concerns whether a fifth regulator -- the UAE's Capital Market Authority (CMA) -- operates its own investment-related virtual-asset licensing regime in Dubai mainland alongside VARA. This question was raised during review of the claim that VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland outside the DIFC; all supporting material for the CMA's alleged role is secondary reporting, without primary-source (T1-T3) corroboration, so the underlying claim about VARA's sole authority has been left unmutated and unqualified in this cycle's composed record, and the CMA question has instead been escalated for human review rather than folded into the licensing narrative. Readers should treat the current four-regulator framing (VARA, DFSA, ADGM-FSRA, CBUAE) as the confirmed picture for this cycle, with the possible CMA dimension held open pending confirmation.

Outlook

Two developments will determine whether this module's traffic-light amber rating tightens toward green or degrades toward continued complexity over the next two to three quarters. First, the CBUAE grace period concludes in the third quarter of 2026; how existing VARA-, DFSA- and ADGM-licensed operators are treated relative to the new federal licensing requirement at that point will be the clearest signal yet of how the overlay is meant to function in practice. Second, resolution of the CMA question -- expected, if it resolves at all, within a half-year window extending into the fourth quarter of 2026 -- will determine whether the regulator count in Dubai mainland licensing is four or five. Until both points are settled, the jurisdiction's licensing architecture should be read as a work in progress rather than a stable end-state, and any claim of a single sole authority for a given zone should be treated as provisional.

The most significant classification shift this cycle occurred within the DIFC, where the DFSA narrowed its definition of qualifying stablecoins as part of its January 2026 Crypto Token Regulatory Framework reset. Under the revised definition, only tokens backed by fiat currencies and high-quality assets qualify as stablecoins; algorithmic designs such as Ethena fall outside that definition and are instead treated as ordinary crypto tokens under the DIFC framework, with correspondingly different regulatory treatment. The same reset introduced a ban on privacy-token use across DIFC-regulated exchanges, applying broadly to trading, promotion, fund activity and derivatives conducted in or from the DIFC -- though the ban does not extend to private wallet holding by DIFC residents, which remains permitted. Both changes reflect a regulator actively recalibrating the boundary between recognised and non-recognised token categories rather than a static classification scheme.

ADGM's FSRA classification practice runs on a separate track again. It has formally recognised Tether's USDT as an accepted fiat-referenced token across multiple blockchains, permitting FSRA-licensed institutions to conduct regulated activity involving it, and it approved the trading of Ondo Finance's tokenized stocks and ETFs on Binance's FSRA-regulated Multilateral Trading Facility in March 2026 -- the first time ADGM had approved tokenized-securities trading under its own framework. DFSA separately recognised Circle's USDC and EURC, and Ripple's RLUSD, as accepted crypto tokens for use within the DIFC in an earlier approval round.

Taken together, a single token type -- a fiat-backed stablecoin, say -- can carry materially different classification status depending on whether it is assessed under VARA's FRVA category, the DFSA's newly narrowed stablecoin definition, or ADGM's fiat-referenced-token recognition process, and an algorithmic design that might be treated as a stablecoin in one framework is explicitly excluded from that category under the DFSA's current approach.

Outlook

The DFSA's narrowed stablecoin definition and privacy-token ban are recent (January 2026) and have not yet been tested against a broad range of emerging hybrid or algorithmic products beyond the Ethena case cited in the reset; whether the boundary holds as new token designs emerge is an open question for the coming cycles. Continued divergence in classification terminology and thresholds across VARA, DFSA and ADGM is likely to persist as each regulator continues to refine its own framework independently rather than converging on a single UAE-wide taxonomy in the near term, keeping this module's traffic-light rating at amber.

Tokenization of real-world assets has become an active, regulator-approved on-chain activity across multiple UAE venues this cycle. The DFSA granted regulatory approval to the QCD Money Market Fund, the first tokenized money-market fund with an official DIFC set-up, and ADGM's FSRA approved trading of Ondo Finance's tokenized stocks and ETFs on Binance's regulated Multilateral Trading Facility in March 2026 -- both signals of an on-chain tokenization market moving from pilot to operating status under direct regulatory sign-off rather than remaining purely experimental.

Decentralized activity is the area where the regime is least settled. Federal Decree Law No. 6 of 2025, in force from 2025-09-16, brings DeFi protocols, decentralized exchanges, wallets and bridges under CBUAE's federal regulatory authority for the first time, placing them alongside virtual assets and stablecoins within a single federal licensing perimeter. Because this is a newly asserted federal authority still within its transitional grace period running to September 2026, how CBUAE intends to apply licensing requirements to genuinely decentralized, non-custodial protocols and infrastructure -- as distinct from the centrally operated exchanges and custodians VARA and FSRA already license -- has not yet been demonstrated in practice.

Outlook

Expect continued build-out of tokenized real-world-asset products under VARA, DFSA and ADGM approval processes over the coming cycles, building on the QCD Money Market Fund and Ondo Finance precedents. The more consequential open question is how CBUAE's newly asserted authority over DeFi protocols, decentralized exchanges, wallets and bridges will be operationalised once the federal grace period concludes in the third quarter of 2026 -- particularly whether licensing requirements designed for centrally operated custodial businesses can be meaningfully applied to non-custodial, decentralized infrastructure, or whether a distinct compliance pathway will be defined for that category.

Federal Decree Law No. 6 of 2025, in force from 2025-09-16, formally brings stablecoins under CBUAE's federal regulatory authority alongside virtual assets and DeFi, intended to replace the prior fragmented Central Bank framework with a single consolidated regime. Because this consolidation is still within its transitional window -- running to September 2026 -- full harmonisation of redemption rights and reserve requirements across the CBUAE Payment Token Services Regulation, ADGM FSRA stablecoin guidance and DFSA's Crypto Token Regulatory Framework has not yet been confirmed.

The DFSA's own January 2026 reset narrowed the DIFC's stablecoin definition to fiat- and high-quality-asset-backed tokens, which affects which stablecoin products can be marketed and traded as such within DIFC specifically, even as CBUAE-licensed dirham tokens and ADGM-regulated USD tokens continue operating under their own separate authorisation tracks elsewhere in the country. A further stablecoin project -- Tether's planned dirham-pegged token, developed with Phoenix Group and Green Acorn Investments -- remains at the application stage under the CBUAE's Payment Token Services Regulation rather than a confirmed authorisation, illustrating that the CBUAE pipeline for new stablecoin issuers remains active alongside the federal consolidation effort.

Outlook

Watch for further CBUAE-licensed stablecoin launches as the federal consolidation under Federal Decree Law No. 6 of 2025 proceeds toward the September 2026 grace-period deadline, and for whether Tether's pending dirham-pegged application receives formal CBUAE authorisation in that window. The degree to which redemption-right and reserve-requirement standards converge across CBUAE, ADGM and DFSA stablecoin pathways -- rather than continuing to operate as three parallel regimes -- is the key structural question for this module over the coming cycles.

Within the DIFC, the DFSA's January 2026 reforms shifted responsibility for assessing and documenting the suitability of crypto assets onto DIFC-licensed firms themselves, who must keep those suitability decisions under ongoing review rather than relying on a DFSA-published approved-token list. This represents a meaningful reallocation of consumer-protection responsibility from the regulator to the regulated firm, placing greater onus on licensed intermediaries to justify product offerings on an ongoing basis. The same DFSA reset restricts privacy-token trading and marketing on DIFC exchanges, framed partly as a consumer- and market-integrity safeguard tied to AML and sanctions-compliance risk.

At the federal level, Federal Decree Law No. 6 of 2025 is reported to introduce enhanced fraud protections and a fast-track dispute-resolution mechanism for consumers, covering claims up to AED 100,000, as part of CBUAE's expanded digital-asset oversight -- a concrete consumer-redress mechanism layered onto the broader federal licensing consolidation, in force since 2025-09-16.

Outlook

The DFSA's suitability-assessment shift onto DIFC-licensed firms is recent enough that its practical operation -- how rigorously firms document and revisit suitability determinations -- has not yet been demonstrated over a full cycle. The federal fraud-protection and dispute-resolution mechanism under Federal Decree Law No. 6 of 2025 is worth monitoring as it moves through the CBUAE's grace-period transition to September 2026, particularly for evidence of actual consumer claims being processed under the new AED 100,000 fast-track mechanism.

Beyond VAT, the picture is considerably less settled. No primary-source confirmation of a crypto-specific capital-gains or income-tax treatment has been located; this is recorded as an open sourcing gap rather than a confirmed absence of tax liability, and should not be read either way as a settled ruling. Separately, the UAE's broader characterisation as a low-tax centre for expatriate workers -- often cited in commentary on its growing crypto-hub status -- reflects the UAE's general personal-tax policy (no federal personal income tax) rather than any crypto-specific ruling, and the two should not be conflated: the absence of a general personal income tax is a longstanding, non-crypto-specific feature of UAE tax policy, not evidence of a dedicated crypto capital-gains or income-tax position.

Outlook

The capital-gains and income-tax treatment of crypto assets in the UAE remains an open sourcing gap pending primary-source confirmation from the Federal Tax Authority, and should continue to be tracked as a distinct question from the confirmed VAT exemption and from the UAE's general absence of personal income tax. Any future primary-source clarification on crypto-specific capital-gains or income-tax treatment would be a material development for this module.

Beyond the Travel Rule itself, however, no numeric cross-border reporting threshold or outbound-transfer restriction specific to virtual assets has been confirmed against a primary source in this research pass. This is recorded as an open sourcing gap: the absence of a confirmed numeric threshold does not necessarily mean no such threshold exists, only that one has not yet been located and verified against primary regulatory text. Readers should treat the cross-border regime as confirmed with respect to travel-rule and sanctions-screening obligations, but unconfirmed with respect to any additional quantitative reporting or outbound-restriction rule.

Outlook

The Travel Rule obligation under Cabinet Resolution No. (134) of 2025 is well established and unlikely to change materially in the near term. The open question for this module is whether a distinct numeric reporting threshold or outbound-restriction regime exists beyond the Travel Rule -- this remains an active sourcing gap to close against primary regulatory text in future cycles, rather than a settled absence of such a rule.

Beyond the VASP-facing rulebook, there is evidence of an active federal-level financial-crime risk-assessment cycle feeding into these obligations: VARA has published a UAE Proliferation Financing National Risk Assessment (PF NRA) for 2026 together with required actions, indicating that AML/CFT compliance expectations for VASPs are being informed by a broader, periodically updated national risk-assessment process rather than a static rulebook alone.

This module's claims all derive from VARA's own binding rulebook text and a named federal Cabinet Resolution, giving the regime a comparatively mature and clearly codified character relative to some of the jurisdiction's other modules. That said, the equivalent DFSA- and ADGM-specific AML/CFT particulars for DIFC- and Abu Dhabi-licensed entities were not independently verified in this research pass, so the full picture across all licensing zones is not yet confirmed to the same standard.

Outlook

The Travel Rule and VARA's Compliance and Risk Management Rulebook appear stable and unlikely to see near-term structural change; the more active area to watch is how the 2026 Proliferation Financing National Risk Assessment's required actions feed into updated VASP compliance expectations over the coming cycles, and whether DFSA and ADGM publish or clarify their own AML/CFT particulars in parallel with VARA's existing framework.