#
AE is a multi-regime jurisdiction. Dubai mainland/free zones (excl. DIFC) are regulated by VARA under Law No. (4) of 2022; DIFC is regulated by the DFSA Crypto Token regime; Abu Dhabi Global Market (ADGM) operates its own FSRA virtual-asset licensing framework; and, federally, a new CBUAE decree-law (No. 6 of 2025) now asserts licensing authority over all crypto/blockchain/DeFi/stablecoin activity nationwide, with a one-year grace period to September 2026 for existing operators to come into compliance. No VA activity is treated as exempt from oversight in the VARA regime. NOTE: a Challenger-flagged, currently unresolved question (FLG-f-001) concerns whether the Capital Market Authority (CMA) constitutes a fifth AE regulator licensing investment-related virtual asset activity in Dubai mainland; this is held for human/primary-source review and not yet reflected in the four-regulator framing above.
Layered onto these three sub-federal regimes is Federal Decree Law No. 6 of 2025, which entered into force on 2025-09-16 following Official Gazette publication (a date corrected during this compilation cycle from an earlier unsupported figure of 2025-09-01, following review of the law's Article 188 commencement provisions). The decree-law brings virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under CBUAE authority nationwide, requiring all crypto and blockchain organizations operating in or from the UAE to hold a CBUAE licence. Existing operators have been given a one-year grace period, running to September 2026, to achieve compliance; fines for unlicensed operation after that point are reported to reach as high as AED 1 billion (approximately $272 million). This is a federal overlay onto, rather than an outright replacement of, the VARA/DFSA/ADGM structure, and the precise division of ongoing licensing responsibility between the federal regulator and the three existing sub-federal authorities has not yet crystallised.
A further complication, currently unresolved, concerns whether a fifth regulator -- the UAE's Capital Market Authority (CMA) -- operates its own investment-related virtual-asset licensing regime in Dubai mainland alongside VARA. This question was raised during review of the claim that VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland outside the DIFC; all supporting material for the CMA's alleged role is secondary reporting, without primary-source (T1-T3) corroboration, so the underlying claim about VARA's sole authority has been left unmutated and unqualified in this cycle's composed record, and the CMA question has instead been escalated for human review rather than folded into the licensing narrative. Readers should treat the current four-regulator framing (VARA, DFSA, ADGM-FSRA, CBUAE) as the confirmed picture for this cycle, with the possible CMA dimension held open pending confirmation.
Outlook
Two developments will determine whether this module's traffic-light amber rating tightens toward green or degrades toward continued complexity over the next two to three quarters. First, the CBUAE grace period concludes in the third quarter of 2026; how existing VARA-, DFSA- and ADGM-licensed operators are treated relative to the new federal licensing requirement at that point will be the clearest signal yet of how the overlay is meant to function in practice. Second, resolution of the CMA question -- expected, if it resolves at all, within a half-year window extending into the fourth quarter of 2026 -- will determine whether the regulator count in Dubai mainland licensing is four or five. Until both points are settled, the jurisdiction's licensing architecture should be read as a work in progress rather than a stable end-state, and any claim of a single sole authority for a given zone should be treated as provisional.
Crypto Licensing
VARA granted Payward FZCO, the UAE entity of Kraken, Full Market Approval as a licensed virtual asset service provider. The register entry is dated 6 October 2026, with the Full Market Approval itself announced on 12 October 2026. The approval permits AED-denominated spot and margin trading, with staking, tokenised equities, and crypto payments reported as planned for launch within weeks of the approval.
The grant operates under Dubai Law No. (4) of 2022 and VARA's Virtual Assets and Related Activities Regulations, the established primary framework for exchange-level virtual-asset licensing in Dubai, with VARA as the supervisory authority. This is a continuation of an established, functioning licensing regime rather than a new regulatory development: VARA continued to process and grant full market approvals to major global exchanges within its existing framework, with Payward FZCO the latest entity to progress from provisional or limited licensing toward full market standing. The specific announcement was reported through secondary press coverage of VARA's public register rather than confirmed directly against a primary VARA register page or enforcement document this cycle, a sourcing gap worth noting given the materiality of a full market approval grant to a major global exchange.
Separately, VARA's precise enforcement-penalty provisions applicable to unlicensed virtual-asset activity were not located this cycle, as the relevant VARA rulebook enforcement chapter was not directly fetched; this is recorded as an open sourcing gap rather than an assessment of VARA's enforcement posture.
Outlook
Further full market approvals to other provisionally-licensed exchanges operating in Dubai under VARA's framework are a plausible continuation of this pattern. Confirmation of Payward FZCO's reported near-term product launches, including staking and tokenised equities, and primary-source verification of VARA's enforcement-penalty framework, are open items for subsequent cycles.
1 earlier distinct update(s)
Crypto Licensing
The UAE's crypto licensing framework underwent its most significant structural change in this cycle with the entry into force of Capital Market Authority Decision No. 4/R.M/2026. The Decision fully replaces the prior Securities and Commodities Authority regime, SCA Decision No. 26/RM of 2023, and establishes an eight-activity federal licensing framework. A central and binding feature of the new regime is the Green List mechanism: trading of any virtual asset onshore is prohibited unless that specific asset has been accepted onto an official Green List maintained by a CMA-licensed virtual asset platform operator. This is a hard gating requirement rather than a disclosure or registration formality, and it represents a materially tighter onshore trading perimeter than existed under the prior SCA framework, at least as the new regime's text has been reported by legal commentary this cycle; no primary CMA text confirming administrative fine maxima for non-compliance was located.
Running in parallel to this federal development, the Virtual Assets Regulatory Authority introduced its Exchange Services Rulebook Version 2.1, effective 31 March 2026, which for the first time gives VARA a permanent regulatory regime for exchange-traded virtual-asset derivatives, covering futures, options, contracts for difference, and perpetual products, all subject to authorisation. This is VARA's first formal derivatives framework and represents a maturation of the Dubai-specific regime independent of the CMA's federal-level reorganisation.
The combined effect of these two developments, assessed together with the CBUAE Payment Token Services Regulation, the Abu Dhabi Global Market's Financial Services Regulatory Authority regime, and the Dubai Financial Services Authority's Dubai International Financial Centre regime, is that the UAE now has five concurrent crypto licensing regimes operating at federal and emirate level simultaneously. This is the most consequential single fact for any virtual-asset business considering entry into the UAE market: regime selection, meaning the choice of which authorisation to seek and in which emirate or financial free zone to establish, is now the primary strategic and compliance decision, more consequential than the substantive content of any single regime's rules, because each regime is individually well-developed but the five do not map cleanly onto a single coherent national perimeter.
Entities previously licensed or operating under the former SCA regime are required to adjust their status to comply with the new CMA framework within a transition window reported as one year from the new framework's entry into force. The practical administration of this migration, including whether CMA will issue further implementing guidance narrowing ambiguity in the transition mechanics, was not located in primary-source form this cycle and remains a documented gap.
Outlook
The principal forward-looking question for crypto licensing in the UAE is whether the five concurrent regimes move toward greater mutual recognition or interoperability, or whether they continue to operate as largely separate tracks requiring firms to choose a single regime and forgo the others. The CMA's one-year migration deadline for former SCA-regime entities is the most concrete near-term milestone, and how smoothly that migration proceeds will be an early indicator of whether the broader five-regime structure is navigable in practice or whether it will continue to generate the kind of jurisdictional-mapping complexity that the UAE's crypto market currently presents to new entrants.
Sources and findings (5)
- T1 · VARAVARA — VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland, except within DIFC, and any entity carrying out VA activities in or from Dubai must apply for a VASP licence.retrieved M5bindingin forcenew
- T1 · VARAVARA — No VA activity is exempt from regulatory supervision in the VARA regime; any VA service or activity requires a VARA licence, registration, or No Objection Certificate.retrieved M5bindingin forcenew
- T4 · CoinDeskADGM-FSRA — ADGM's Financial Services Regulatory Authority operates an institutional virtual-asset licensing framework covering custody, derivatives, staking and professional client classifications; Binance received an FSRA licence to begin regulated operations from January 5, 2026.retrieved M5bindingin forcenew
- T4 · CoinDeskDFSA — The DFSA's updated Crypto Token Regulatory Framework, in force from January 12, 2026, positions DFSA as a regulator focused on enforcing global compliance standards while shifting responsibility for crypto asset suitability approval onto DIFC-licensed firms.retrieved M4bindingin forcenew
- T4 · CoinDeskCBUAE — Federal Decree Law No. 6 of 2025 brings virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under CBUAE authority nationwide, requiring all crypto and blockchain organizations operating in or from the UAE to be licensed by CBUAE, with a one-year grace period to September 2026 for existing players to become compliant and fines for unlicensed operation reaching up to 1 billion dirhams (~$272 million).retrieved M5bindingin forcenew