---
title: "United Arab Emirates Crypto Regulation Monitor | cryptoassets.gi"
canonical: https://cryptoassets.gi/jurisdictions/united-arab-emirates/
source_html: /jurisdictions/united-arab-emirates/index.html
description: "United Arab Emirates crypto asset regulation: 9 categories, 114 sourced findings, updated 2026-11-04."
generated_at: 2026-11-07T14:19:44Z
content_sha256: fe5be5ab517746dae1ca4e4ff2098bd138651180571ec45681a8d1f082a52e51
generator: "fe-fleet/md-twin@1.0"
---
# United Arab Emirates Crypto & Digital Asset Regulation

schema crypto-v2.0.0
trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/united-arab-emirates/), [World Payments](https://payments.gi/jurisdictions/united-arab-emirates/)

Last updated 2026-11-04 · 9 categories · 114 sourced
findings · 96 sources in the cumulative register

Download report (PDF) Expand all

Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=UNITED-ARAB-EMIRATES)[Build Report](/reports/?j=UNITED-ARAB-EMIRATES)[Compare](/compare/?j=UNITED-ARAB-EMIRATES)

Framework posture In transition 8 of 9 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority VARA Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) 2027-01-01 CMA transitional migration deadline for entities under former SCA regime

Module coverage & confidence 8 / 9 modules assessed 0 Confirmed · 8 Probable · 0 Uncertain · 1 Not yet assessed

9 Categories

0 Moved this cycle 0 Key judgments 3 Open gaps 114 Findings

7 Tier-1 sources

Confidence mix 9 unpopulated
(sums to 9 rendered categories; click to filter)

No categories moved this cycle.

## Jurisdiction lead brief

###### Latest update · 4 November 2026

#### Lead Signal

The Virtual Assets Regulatory Authority's 28 October circular on public disclosure practice is the one dated development reaching the operating environment. The circular sets out the characteristics VARA regards as good practice when a licensed virtual-asset service provider communicates with the public -- the kind of disclosure VARA expects to see, rather than a new licensing condition or a new prohibited activity. What is not yet settled is whether this operates as formal guidance that licensed firms may weigh against their own judgment, or as a rule VARA will treat as enforceable in the way its existing rulebooks are. That distinction matters more than the content of the circular itself: a VASP's public-facing communications -- marketing collateral, investor updates, website disclosures -- sit at the point where VARA's consumer-facing expectations and its enforcement powers meet, and firms operating in or from Dubai outside the DIFC will want to treat the circular as operative guidance until its status is clarified one way or the other.

#### Other Developments

No other consumer-facing development reached the threshold for inclusion.

#### Cross-Monitor Connections

No overlap with adjacent monitors was flagged against this development.

#### Outlook

The open question is whether VARA converts the disclosure circular into a binding rule, folds it into an existing rulebook on its next revision cycle, or leaves it as interpretive guidance sitting alongside the formal Market Conduct and Company rulebooks. Firms already licensed by VARA should expect public disclosure practice to be an area of continuing regulatory attention, given VARA's general pattern of following guidance with firmer rule-making once practice in the market settles.

3 earlier updates not shown here.

###### Standing brief · as of 2 August 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

The UAE's crypto regulatory landscape enters a defined transition window this cycle, anchored by Federal Decree Law No. 6 of 2025, which brought virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under the authority of the Central Bank of the UAE (CBUAE) on a nationwide basis. The law entered into force on 2025-09-16 following Official Gazette publication, and existing crypto and blockchain organizations operating in or from the UAE have a one-year grace period, running to September 2026, to bring themselves into compliance with CBUAE licensing; operating without a licence after that point carries fines reportedly reaching up to AED 1 billion (roughly $272 million). This is the single most consequential development shaping the jurisdiction's status this cycle: a federal regulator asserting authority that overlays, rather than replaces, three existing sub-federal regimes -- VARA in Dubai's mainland and free zones, the DFSA in the DIFC, and the ADGM's FSRA in Abu Dhabi -- while the practical allocation of supervisory authority between them remains unresolved for at least another two quarters.

A second, unresolved thread compounds this uncertainty. Interpreter review flagged, but could not confirm to primary-source (T1-T3) standard, reports that the UAE's Capital Market Authority (CMA) may operate its own investment-related virtual-asset licensing regime in Dubai mainland, alongside VARA, under a CMA Decision reportedly dated 2026. If substantiated, this would qualify the current framing of VARA as sole licensing authority for Dubai virtual-asset activity outside the DIFC. All supporting material for this question remains secondary reporting; the question has been escalated for human and primary-source review rather than folded into the published claim set, and the composed record reflects that open status rather than resolving it either way.

#### Other Developments

Within the DIFC, the DFSA implemented a wide-ranging reset of its Crypto Token Regulatory Framework, in force from 2026-01-12. The regulator narrowed its definition of qualifying stablecoins to tokens backed by fiat currency and high-quality assets -- a change that reclassifies algorithmic tokens such as Ethena as ordinary crypto tokens rather than stablecoins -- while banning privacy-token trading, promotion, fund activity and derivatives use across DIFC-regulated venues, with private wallet holding by residents left untouched. The same reset shifts responsibility for assessing and documenting the suitability of crypto assets onto DIFC-licensed firms themselves, moving away from a DFSA-published approved-token list model. Separately, DFSA has approved Circle's USDC and EURC, and Ripple's RLUSD, as recognized tokens for use within the DIFC.

In Abu Dhabi, the ADGM's FSRA continues to build out an institutional, English-common-law-modelled virtual-asset framework spanning custody, derivatives, staking and professional-client classification. Binance received an FSRA licence enabling regulated operations from 2026-01-05, and the FSRA approved trading of Ondo Finance's tokenized stocks and ETFs on Binance's regulated Multilateral Trading Facility in March 2026 -- the first tokenized-securities approval under the ADGM framework. Tether's USDT also received recognition as an accepted fiat-referenced token across multiple blockchains within ADGM.

VARA's existing Dubai-mainland regime continues to operate on the premise that no virtual-asset activity is exempt from licensing, registration or No Objection Certificate requirements, spanning exchanges, custody, brokerage, lending and staking, segmented across retail, qualified and institutional user categories, with prior approval required for Category 2 issuance activity such as new token releases or NFT minting. On the compliance side, VARA's Compliance and Risk Management Rulebook mandates AML/CFT controls, client due diligence, suspicious-transaction monitoring, sanctions screening and record-keeping, operating alongside the federally codified UAE Virtual Assets Travel Rule under Cabinet Resolution No. (134) of 2025 and a newly published Proliferation Financing National Risk Assessment for 2026.

The stablecoin space itself continues to broaden along parallel authorisation tracks: AE Coin, described as the UAE's first Central Bank-licensed dirham stablecoin, has moved into retail use across nearly 980 ADNOC fuel and retail locations; the DDSC dirham-backed stablecoin from International Holding Company and First Abu Dhabi Bank launched under CBUAE licence in February 2026; and Universal Digital's USD-backed USDU received CBUAE approval in January 2026 under FSRA oversight. Tether's own dirham-pegged stablecoin project, developed with Phoenix Group and Green Acorn Investments, remains a pending application under the CBUAE's Payment Token Services Regulation rather than a confirmed authorisation. On tax, the Federal Tax Authority's VAT exemption for crypto transactions, effective November 2024 and applied retrospectively to 2018, remains the clearest fiscal position; crypto-specific capital-gains or income-tax treatment has not been confirmed against a primary regulator source, and the UAE's broader reputation as a low personal-tax jurisdiction should not be read as a crypto-specific ruling.

#### Cross-Monitor Connections

Two threads in this cycle carry direct relevance beyond the crypto monitor itself. The UAE's codification of the FATF Travel Rule under Cabinet Resolution No. (134) of 2025, layered onto VARA's Compliance and Risk Management Rulebook obligations around sanctions screening and suspicious-transaction reporting, is material to financial-integrity tracking of cross-border virtual-asset transfer controls in the jurisdiction. Separately, the accelerating build-out of CBUAE-licensed and FSRA-authorised stablecoins -- AE Coin, DDSC, USDU, and the pending Tether dirham token -- alongside the VAT exemption for crypto transactions, is relevant to payments-monitor tracking of stablecoin-based settlement infrastructure entering mainstream retail and institutional use in the UAE.

#### Outlook

Two dated milestones anchor the near-term horizon. The CBUAE decree-law's one-year grace period expires in the third quarter of 2026, at which point existing crypto and blockchain operators lacking a federal licence become exposed to substantial penalties -- the practical test of how the federal regime interacts with VARA, DFSA and ADGM licensing will play out around that deadline. Separately, clarification of the jurisdictional allocation between VARA, DFSA, ADGM-FSRA, CBUAE and, if confirmed, the CMA is expected to surface over a longer half-year window running into the fourth quarter of 2026. Until the CMA question is resolved against primary sourcing, the composed record continues to carry this as an open, escalated question rather than a settled feature of the regulatory map, and the DFSA's narrowed stablecoin definition and suitability-assessment shift remain recently implemented positions whose durability against emerging hybrid or algorithmic products has not yet been tested.

Read full brief · 1295 words

Key regulatory facts for United Arab Emirates Regulatory Dimension United Arab Emirates Standing Position

Jurisdiction United Arab Emirates (AE)

Regulatory Scope Crypto & Digital Asset Regulation (9 modules, 114 sourced findings)

Crypto Licensing AE is a multi-regime jurisdiction.

Token Classification AE classification differs by regulator: VARA categorizes Virtual Assets into Category 1/2 issuance and a distinct Fiat-Referenced Virtual Asset (FRVA) class; DFSA in DIFC narrowed its stablecoin definition in January...

On-Chain Activity Regime VARA regulates staking and custody services as discrete licensable activities (segmenting retail, qualified and institutional users), and separately requires prior approval for Category 2 VA issuance (e.g., new token...

Stablecoin Regime Stablecoin (Fiat-Referenced Virtual Asset / Payment Token) issuance in AE is regulated under CBUAE's Payment Token Services Regulation (dirham-pegged tokens such as AE Coin and DDSC licensed by CBUAE), while ADGM's...

Primary Instruments Cited VARA, VARA, ADGM-FSRA, DFSA, CBUAE

Last Confirmed / Updated 2026-11-04 (96 sources in cumulative register)

9 of 9 categories

Signal
Moved
Judgment
Gap

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### United Arab Emirates: C1 Crypto LicensingAmberEnacted in forceModule confidence: Probable▾

AE is a multi-regime jurisdiction. Dubai mainland/free zones (excl. DIFC) are regulated by VARA under Law No. (4) of 2022; DIFC is regulated by the DFSA Crypto Token regime; Abu Dhabi Global Market (ADGM) operates its own FSRA virtual-asset licensing framework; and, federally, a new CBUAE decree-law (No. 6 of 2025) now asserts licensing authority over all crypto/blockchain/DeFi/stablecoin activity nationwide, with a one-year grace period to September 2026 for existing operators to come into compliance. No VA activity is treated as exempt from oversight in the VARA regime. NOTE: a Challenger-flagged, currently unresolved question (FLG-f-001) concerns whether the Capital Market Authority (CMA) constitutes a fifth AE regulator licensing investment-related virtual asset activity in Dubai mainland; this is held for human/primary-source review and not yet reflected in the four-regulator framing above.

Open gap — crypto-int-1 VARA Exchange Services Rulebook v2.1 crypto-derivatives framework (leverage caps, licensed futures/options trading, effective 31 March 2026) was flagged in research but not yet classified into a module with full obligation detail; crypto_licensing / on_chain_activity_regime coverage of derivatives trading needs further research. no under-indexing note recorded

Horizon · 2027-01-01 (± a year) CMA transitional migration deadline for entities under former SCA regime Adopted · Tier 3 source

Horizon · 2025-06 (± a year) ADGM FSRA Consultation Paper No. 11 of 2024 follow-through In force · Tier 1 source

#### Crypto Licensing

The UAE's crypto licensing landscape is best understood as four concurrent regimes operating across different territorial and functional slices of the country, now overlaid by a fifth federal layer still mid-transition. VARA, established under Law No. (4) of 2022, remains the licensing authority for virtual-asset activity across Dubai's mainland and free zones outside the DIFC; its regime treats no VA activity as exempt from oversight, requiring a licence, registration or No Objection Certificate for any VA service or activity conducted in or from Dubai. Within the DIFC, the DFSA operates a separate Crypto Token Regulatory Framework, recently reset in January 2026 to shift more responsibility onto DIFC-licensed firms for assessing product suitability while DFSA itself moves toward an enforcement-and-global-standards posture rather than maintaining an approved-token list. In Abu Dhabi, the ADGM's FSRA runs an institutional, English-common-law-based virtual-asset licensing framework covering custody, derivatives, staking and professional-client classification -- a framework concrete enough to have supported Binance's FSRA licence, effective from January 5, 2026, enabling regulated operations in the emirate.

Layered onto these three sub-federal regimes is Federal Decree Law No. 6 of 2025, which entered into force on 2025-09-16 following Official Gazette publication (a date corrected during this compilation cycle from an earlier unsupported figure of 2025-09-01, following review of the law's Article 188 commencement provisions). The decree-law brings virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under CBUAE authority nationwide, requiring all crypto and blockchain organizations operating in or from the UAE to hold a CBUAE licence. Existing operators have been given a one-year grace period, running to September 2026, to achieve compliance; fines for unlicensed operation after that point are reported to reach as high as AED 1 billion (approximately $272 million). This is a federal overlay onto, rather than an outright replacement of, the VARA/DFSA/ADGM structure, and the precise division of ongoing licensing responsibility between the federal regulator and the three existing sub-federal authorities has not yet crystallised.

A further complication, currently unresolved, concerns whether a fifth regulator -- the UAE's Capital Market Authority (CMA) -- operates its own investment-related virtual-asset licensing regime in Dubai mainland alongside VARA. This question was raised during review of the claim that VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland outside the DIFC; all supporting material for the CMA's alleged role is secondary reporting, without primary-source (T1-T3) corroboration, so the underlying claim about VARA's sole authority has been left unmutated and unqualified in this cycle's composed record, and the CMA question has instead been escalated for human review rather than folded into the licensing narrative. Readers should treat the current four-regulator framing (VARA, DFSA, ADGM-FSRA, CBUAE) as the confirmed picture for this cycle, with the possible CMA dimension held open pending confirmation.

#### Outlook

Two developments will determine whether this module's traffic-light amber rating tightens toward green or degrades toward continued complexity over the next two to three quarters. First, the CBUAE grace period concludes in the third quarter of 2026; how existing VARA-, DFSA- and ADGM-licensed operators are treated relative to the new federal licensing requirement at that point will be the clearest signal yet of how the overlay is meant to function in practice. Second, resolution of the CMA question -- expected, if it resolves at all, within a half-year window extending into the fourth quarter of 2026 -- will determine whether the regulator count in Dubai mainland licensing is four or five. Until both points are settled, the jurisdiction's licensing architecture should be read as a work in progress rather than a stable end-state, and any claim of a single sole authority for a given zone should be treated as provisional.

Read full sub-brief · 614 words Periodic update · new data 2026-10-18

#### Crypto Licensing

VARA granted Payward FZCO, the UAE entity of Kraken, Full Market Approval as a licensed virtual asset service provider. The register entry is dated 6 October 2026, with the Full Market Approval itself announced on 12 October 2026. The approval permits AED-denominated spot and margin trading, with staking, tokenised equities, and crypto payments reported as planned for launch within weeks of the approval.

The grant operates under Dubai Law No. (4) of 2022 and VARA's Virtual Assets and Related Activities Regulations, the established primary framework for exchange-level virtual-asset licensing in Dubai, with VARA as the supervisory authority. This is a continuation of an established, functioning licensing regime rather than a new regulatory development: VARA continued to process and grant full market approvals to major global exchanges within its existing framework, with Payward FZCO the latest entity to progress from provisional or limited licensing toward full market standing. The specific announcement was reported through secondary press coverage of VARA's public register rather than confirmed directly against a primary VARA register page or enforcement document this cycle, a sourcing gap worth noting given the materiality of a full market approval grant to a major global exchange.

Separately, VARA's precise enforcement-penalty provisions applicable to unlicensed virtual-asset activity were not located this cycle, as the relevant VARA rulebook enforcement chapter was not directly fetched; this is recorded as an open sourcing gap rather than an assessment of VARA's enforcement posture.

#### Outlook

Further full market approvals to other provisionally-licensed exchanges operating in Dubai under VARA's framework are a plausible continuation of this pattern. Confirmation of Payward FZCO's reported near-term product launches, including staking and tokenised equities, and primary-source verification of VARA's enforcement-penalty framework, are open items for subsequent cycles.

1 earlier distinct update(s) Periodic update · new data 2026-10-11

#### Crypto Licensing

The UAE's crypto licensing framework underwent its most significant structural change in this cycle with the entry into force of Capital Market Authority Decision No. 4/R.M/2026. The Decision fully replaces the prior Securities and Commodities Authority regime, SCA Decision No. 26/RM of 2023, and establishes an eight-activity federal licensing framework. A central and binding feature of the new regime is the Green List mechanism: trading of any virtual asset onshore is prohibited unless that specific asset has been accepted onto an official Green List maintained by a CMA-licensed virtual asset platform operator. This is a hard gating requirement rather than a disclosure or registration formality, and it represents a materially tighter onshore trading perimeter than existed under the prior SCA framework, at least as the new regime's text has been reported by legal commentary this cycle; no primary CMA text confirming administrative fine maxima for non-compliance was located.

Running in parallel to this federal development, the Virtual Assets Regulatory Authority introduced its Exchange Services Rulebook Version 2.1, effective 31 March 2026, which for the first time gives VARA a permanent regulatory regime for exchange-traded virtual-asset derivatives, covering futures, options, contracts for difference, and perpetual products, all subject to authorisation. This is VARA's first formal derivatives framework and represents a maturation of the Dubai-specific regime independent of the CMA's federal-level reorganisation.

The combined effect of these two developments, assessed together with the CBUAE Payment Token Services Regulation, the Abu Dhabi Global Market's Financial Services Regulatory Authority regime, and the Dubai Financial Services Authority's Dubai International Financial Centre regime, is that the UAE now has five concurrent crypto licensing regimes operating at federal and emirate level simultaneously. This is the most consequential single fact for any virtual-asset business considering entry into the UAE market: regime selection, meaning the choice of which authorisation to seek and in which emirate or financial free zone to establish, is now the primary strategic and compliance decision, more consequential than the substantive content of any single regime's rules, because each regime is individually well-developed but the five do not map cleanly onto a single coherent national perimeter.

Entities previously licensed or operating under the former SCA regime are required to adjust their status to comply with the new CMA framework within a transition window reported as one year from the new framework's entry into force. The practical administration of this migration, including whether CMA will issue further implementing guidance narrowing ambiguity in the transition mechanics, was not located in primary-source form this cycle and remains a documented gap.

#### Outlook

The principal forward-looking question for crypto licensing in the UAE is whether the five concurrent regimes move toward greater mutual recognition or interoperability, or whether they continue to operate as largely separate tracks requiring firms to choose a single regime and forgo the others. The CMA's one-year migration deadline for former SCA-regime entities is the most concrete near-term milestone, and how smoothly that migration proceeds will be an early indicator of whether the broader five-regime structure is navigable in practice or whether it will continue to generate the kind of jurisdictional-mapping complexity that the UAE's crypto market currently presents to new entrants.

Sources and findings (29)
- T1[VARA](https://rulebooks.vara.ae/) — VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland, except within DIFC, and any entity carrying out VA activities in or from Dubai must apply for a VASP licence.
- T1[VARA](https://www.vara.ae/en/faq/) — No VA activity is exempt from regulatory supervision in the VARA regime; any VA service or activity requires a VARA licence, registration, or No Objection Certificate.
- T4 · CoinDesk[ADGM-FSRA](https://consensus.coindesk.com/site/consensus2026/images/userfiles/report/The-Global-Digital-Asset-and-Web3-Adoption-Report.pdf) — ADGM's Financial Services Regulatory Authority operates an institutional virtual-asset licensing framework covering custody, derivatives, staking and professional client classifications; Binance received an FSRA licence to begin regulated operations from January 5, 2026.
- T4 · CoinDesk[DFSA](https://www.coindesk.com/policy/2026/01/12/dubai-bans-privacy-tokens-tightens-stablecoin-rules-in-crypto-reset) — The DFSA's updated Crypto Token Regulatory Framework, in force from January 12, 2026, positions DFSA as a regulator focused on enforcing global compliance standards while shifting responsibility for crypto asset suitability approval onto DIFC-licensed firms.
- T4 · CoinDesk[CBUAE](https://www.coindesk.com/policy/2025/11/26/new-uae-sweeping-banking-decree-looks-to-cement-country-s-global-crypto-position) — Federal Decree Law No. 6 of 2025 brings virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets and bridges under CBUAE authority nationwide, requiring all crypto and blockchain organizations operating in or from the UAE to be licensed by CBUAE, with a one-year grace period to September 2026 for existing players to become compliant and fines for unlicensed operation reaching up to 1 billion dirhams (~$272 million).
- T1[Capital Market Authority (CMA)](https://uaelegislation.gov.ae/en/legislations/4001/download) — CMA established as federal public authority replacing SCA in all rights, obligations and contracts
- T3[CMA Virtual Assets Framework (CMA Decision No. 4/R.M./2026)](https://www.horizlaw.ae/insights/new-virtual-asset-regulations-a-summary-of-cma-decision-no4r.m2026) — Establishes eight licensed virtual-asset financial activities with minimum capital requirements by activity category and a 'Green List' of approved virtual assets; replaces the prior 2023 SCA virtual-asset platform operator regime
- T1[Virtual Assets Regulatory Authority](https://www.vara.ae/en/) — No person may conduct virtual-asset platform operation, exchange, transfer, safekeeping/custody, wallet, or issuance/trading-related services in or from Dubai (excl. DIFC) without a VARA permit/licence.
- T3[CMA Decision No. 4/R.M/2026](https://www.pnyxhill.co/post/uae-crypto-licensing-2026-from-sca-to-cma) — Trading of any virtual asset onshore is prohibited unless accepted onto the official Green List maintained by a CMA-licensed virtual asset platform operator.
- T3[VARA Exchange Services Rulebook Version 2.1](https://www.clydeco.com/en/insights/2026/05/uae-virtual-assets-update-q2-2026) — Permanent regulatory regime for exchange-traded virtual-asset derivatives (futures, options, CFDs, perpetuals), subject to authorisation.
- T1[Bybit Fintech FZE](https://cryptobriefing.com/bybit-secures-vara-licence-for-exchange-services-in-dubai/) — Dubai Virtual Assets Regulatory Authority (VARA) — Exchange Services, spot trading
- T3[CMA Virtual Assets Framework (CMA Decision No. 4/R.M./2026)](https://www.horizlaw.ae/insights/new-virtual-asset-regulations-a-summary-of-cma-decision-no4r.m2026) — 2026-04-13
- T3[VARA-licensed VASPs operating in Dubai](https://neolegal.ae/insights/vara-penalties-operating-without-licence) — AED 50,000,000 or 15% of revenue
- T3[Federal Decree-Law No. 33 of 2025](https://www.icon.partners/post/uae-cma-crypto-framework-what-the-1-january-2027-regularisation-date-means) — Lists virtual assets for investment purposes among regulated Financial Products, empowering CMA to regulate their trading and related activities
- T3[Cabinet Decision No. 111 of 2022](https://www.dlapiper.com/en/insights/publications/the-uae-cryptocurrency-and-digital-asset-regulation-series/2025/no-1the-regulatory-landscape-for-digital-assets-in-the-uae) — Persons operating platforms, exchanging, transferring, trading or custodying virtual assets must obtain approval/licence from SCA (now CMA) or relevant Local Licensing Authority
- T1[Dubai Law No. (4) of 2022](https://dlp.dubai.gov.ae/Legislation%20Reference/2022/Law%20No.%20(4)%20of%202022%20Regulating%20Virtual%20Assets.html) — Establishes VARA as public corporation to regulate virtual assets across Dubai excluding DIFC; VA exchange and custody services require VARA Permits
- T1[Virtual Assets and Related Activities Regulations 2023](https://rulebooks.vara.ae/) — Applies to all VASPs in Dubai; prohibits issuance of and dealing in anonymity-enhanced cryptocurrencies; VARA may conduct regular inspections and audits
- T1[DFSA Investment Token regime](https://www.dfsa.ae/news/dfsa-introduces-regulatory-framework-investment-tokens) — Carrying on a financial service relating to Investment or Crypto Tokens in/from the DIFC requires DFSA authorisation
- T1[ADGM FSRA Virtual Asset Framework](https://en.adgm.thomsonreuters.com/rulebook/va-regulated-activities) — Qualifying Applicants are granted a Financial Services Permission (FSP) under FSMR s.30 to carry on relevant VA Regulated Activity
- T3[Dubai Law No. 4 of 2022, Art 17](https://neolegal.ae/insights/vara-penalties-operating-without-licence) — Unlicensed VA Activity is a criminal offence; administrative penalties up to AED 50,000,000 or 15% of revenue, plus criminal referral
- T1[VARA Regulations 2023, Schedule 3](https://rulebooks.vara.ae/rulebook/schedule-3-fines) — Individual fines up to higher of AED 20,000,000 or 200% of profits/losses avoided; corporate fines up to higher of AED 50,000,000, 15% annual revenue or 300% of profits/losses avoided; non-payment doubles fine
- T3[VARA Company Rulebook, Part VI](https://10leaves.ae/publications/blockchain-crypto/guide-to-vara-licenses) — Paid-up capital varies by VA Activity (Advisory AED 100,000 to Exchange AED 800,000-1,500,000); expense-based capital of at least 1.2x monthly operational expenses required
- T1[VARA](https://www.vara.ae/en/regulations/regulatory-notices/vara-strengthens-enforcement-program-issues-fines-and-a-public-warning-against-engaging-with-unlicensed-virtual-asset-firms/) — VARA conducted successive enforcement rounds against unlicensed/non-compliant marketing entities: 7 entities fined AED 50,000-100,000; later round of 19 unlicensed firms fined AED 100,000-600,000; October 2025 round targeting non-compliant marketing/token announcements
- T3[VARA](https://cointelegraph.com/news/kraken-receives-vara-approval-uae-expansion) — Payward FZCO (Kraken's UAE entity) granted VASP licence and Full Market Approval
- T1[VARA](https://rulebooks.vara.ae/rulebook/schedule-3-fines) — AED 20,000,000 (individual) / AED 50,000,000 or 15% revenue or 300% profits (corporate)
- T3[Dubai Law No. 4 of 2022](https://neolegal.ae/insights/vara-penalties-operating-without-licence) — administrative fine up to AED 50,000,000 or 15% revenue plus criminal referral
- T1 · Virtual Assets Regulatory Authority (VARA)[VARA](https://rulebooks.vara.ae/rulebook/c-enforcement-fines-and-penalties) — public statement / suspension announcement requirement
- T1[VARA](https://www.vara.ae/en/regulations/regulatory-notices/vara-strengthens-enforcement-program-issues-fines-and-a-public-warning-against-engaging-with-unlicensed-virtual-asset-firms/) — fines ranging AED 50,000-600,000 per entity across rounds
- T3[VASP (VARA-licensed)](https://10leaves.ae/publications/blockchain-crypto/guide-to-vara-licenses) — 1.2x monthly operational expenses, held as liquid assets

### United Arab Emirates: C2 Token ClassificationAmberEnacted in forceModule confidence: Probable▾

AE classification differs by regulator: VARA categorizes Virtual Assets into Category 1/2 issuance and a distinct Fiat-Referenced Virtual Asset (FRVA) class; DFSA in DIFC narrowed its stablecoin definition in January 2026 to fiat/high-quality-asset backed tokens (excluding algorithmic tokens such as Ethena, which are treated as ordinary crypto tokens) and banned privacy tokens on regulated exchanges; ADGM/FSRA separately recognizes 'accepted fiat-referenced tokens' (e.g., USDT, USDC) and has approved tokenized-security products.

C2 · Token Classification — Full Module Record 0 sub-modules · 180 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: C3 On-Chain Activity RegimeAmberEnacted in forceModule confidence: Probable▾

VARA regulates staking and custody services as discrete licensable activities (segmenting retail, qualified and institutional users), and separately requires prior approval for Category 2 VA issuance (e.g., new token releases, NFT minting). ADGM's FSRA provides an institutional framework covering custody, derivatives and staking. Tokenization of real-world assets (equities, money-market funds, Sukuk) is an active, regulator-approved on-chain activity across both ADGM and DFSA.

C3 · On-Chain Activity — Full Module Record 0 sub-modules · 180 words · 14 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: C4 Stablecoin RegimeAmberEnacted in forceModule confidence: Probable▾

Stablecoin (Fiat-Referenced Virtual Asset / Payment Token) issuance in AE is regulated under CBUAE's Payment Token Services Regulation (dirham-pegged tokens such as AE Coin and DDSC licensed by CBUAE), while ADGM's FSRA separately authorizes stablecoin issuers (e.g., Universal Digital's USD-backed USDU) and DFSA narrowed its DIFC stablecoin definition in January 2026. Federal Decree Law No. 6 of 2025 consolidates stablecoin oversight under CBUAE nationwide, with issuance of new payment tokens historically restricted under the DFSA regime pending this consolidation.

C4 · Stablecoins & EMTs — Full Module Record 0 sub-modules · 180 words · 17 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: C5 Consumer ProtectionGreenEnacted in forceModule confidence: Probable▾

VARA imposes a dedicated Marketing Regulations regime (2024) applicable to all entities marketing virtual assets in/from Dubai, whether VARA-licensed or not, alongside VASP obligations around risk disclosure statements and whitepapers for VA issuance. DFSA's January 2026 reforms shift crypto-asset suitability assessment responsibility onto DIFC-licensed firms and restrict privacy-token marketing/trading on DIFC exchanges as a consumer/market-integrity safeguard.

#### Consumer Protection

Consumer protection in the UAE's virtual-asset space combines binding marketing and disclosure rules with a recent shift in responsibility for product suitability assessment. VARA's Regulations on the Marketing of Virtual Assets and Related Activities, in force since 2024, apply to all entities marketing virtual assets in or from Dubai, whether or not they are VARA-licensed and whether domestic or foreign, with penalties attached for non-compliance -- giving the rule an unusually broad extraterritorial-style reach for marketing conduct specifically. Separately, VARA requires that applicants for virtual-asset issuance provide a Whitepaper and Risk Disclosure Statement as part of the issuance application process, embedding investor-facing disclosure obligations directly into the licensing pipeline rather than treating them as a standalone requirement.

Within the DIFC, the DFSA's January 2026 reforms shifted responsibility for assessing and documenting the suitability of crypto assets onto DIFC-licensed firms themselves, who must keep those suitability decisions under ongoing review rather than relying on a DFSA-published approved-token list. This represents a meaningful reallocation of consumer-protection responsibility from the regulator to the regulated firm, placing greater onus on licensed intermediaries to justify product offerings on an ongoing basis. The same DFSA reset restricts privacy-token trading and marketing on DIFC exchanges, framed partly as a consumer- and market-integrity safeguard tied to AML and sanctions-compliance risk.

At the federal level, Federal Decree Law No. 6 of 2025 is reported to introduce enhanced fraud protections and a fast-track dispute-resolution mechanism for consumers, covering claims up to AED 100,000, as part of CBUAE's expanded digital-asset oversight -- a concrete consumer-redress mechanism layered onto the broader federal licensing consolidation, in force since 2025-09-16.

#### Outlook

The DFSA's suitability-assessment shift onto DIFC-licensed firms is recent enough that its practical operation -- how rigorously firms document and revisit suitability determinations -- has not yet been demonstrated over a full cycle. The federal fraud-protection and dispute-resolution mechanism under Federal Decree Law No. 6 of 2025 is worth monitoring as it moves through the CBUAE's grace-period transition to September 2026, particularly for evidence of actual consumer claims being processed under the new AED 100,000 fast-track mechanism.

Read full sub-brief · 346 words Periodic update · new data 2026-10-11

#### Consumer Protection

The clearest consumer-protection development identified in the UAE's crypto sector this cycle comes from the Virtual Assets Regulatory Authority's 2026 derivatives rules, which took effect alongside VARA's broader Exchange Services Rulebook Version 2.1 on 31 March 2026. These rules establish a 5:1 leverage cap specifically for retail investors trading exchange-traded virtual-asset derivatives, backed by a minimum 20 percent initial margin requirement. Critically, the rules also impose mandatory suitability checks that must be completed before a retail investor can open a margin account at all, meaning the protection operates as a gate at the point of account opening rather than only as an ongoing position-sizing constraint.

This is a concrete, dated retail-protection rule with a clear numeric threshold, which distinguishes it from more general or aspirational consumer-protection framing often seen in less mature crypto regulatory regimes. It applies specifically to the newly introduced derivatives products, meaning futures, options, contracts for difference, and perpetual instruments, rather than to spot trading of virtual assets more broadly, and it is tied to VARA's Dubai-specific authorisation regime rather than operating as a UAE-wide federal standard.

Beyond this derivatives-specific leverage and suitability regime, no primary-source finding on custody or client-asset segregation requirements, insolvency treatment of client assets, or sub-custody authorisation conditions was located for any of the UAE's crypto sub-regimes this cycle. This is a documented gap rather than an indication that no such requirements exist; it reflects the limits of what primary-source research surfaced this cycle rather than a finding that the UAE's crypto regimes lack custody protections altogether.

#### Outlook

The introduction of a dated, numeric leverage cap and mandatory suitability-check regime for retail derivatives trading is a meaningful floor for consumer protection in the UAE's crypto derivatives market, but it leaves open how comparable protections, if any, apply to spot virtual-asset trading, to products offered under the CMA's parallel federal framework, or to custody arrangements generally across the UAE's various crypto sub-regimes. Closing the custody and segregation gap identified this cycle would materially improve the completeness of the consumer-protection picture for the UAE crypto market in a future research cycle.

Sources and findings (18)
- T1[VARA](https://rulebooks.vara.ae/entiresection/10) — All market participants must adhere to VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024, which apply to all entities, domestic or foreign, whether or not licensed by VARA, with penalties for non-compliance.
- T4 · CoinDesk[DFSA](https://www.coindesk.com/policy/2026/01/12/dubai-bans-privacy-tokens-tightens-stablecoin-rules-in-crypto-reset) — Under DFSA's revised framework, licensed firms in DIFC must assess and document whether the crypto assets they offer are suitable, keeping those decisions under ongoing review, rather than relying on a DFSA-published approved-token list.
- T1[VARA](https://rulebooks.vara.ae/) — VA issuance applicants under VARA must provide a Whitepaper and Risk Disclosure Statements as part of the issuance application process.
- T4 · CoinDesk[CBUAE](https://www.coindesk.com/policy/2025/11/26/new-uae-sweeping-banking-decree-looks-to-cement-country-s-global-crypto-position) — Federal Decree Law No. 6 of 2025 introduces enhanced fraud protections and fast-track dispute resolution up to AED 100,000 for consumers as part of the CBUAE's expanded digital-asset oversight.
- T1[Virtual Assets Regulatory Authority](https://www.vara.ae/en/) — Circular: Good practices for VASP's public disclosures, illustrating characteristics of good practice for licensed VASPs' public disclosure practices.
- T3[VARA 2026 Derivatives Rules](https://sumsub.com/blog/crypto-in-the-uae-regulation-licensing/) — 5:1 leverage cap for retail investors backed by minimum 20% initial margin, with mandatory suitability checks before margin account opening.
- T1[VARA Market Conduct Rulebook](https://rulebooks.vara.ae/rulebook/h-market-manipulation) — VARA Market Conduct Rulebook — prohibits any Entity from engaging or attempting to engage in Market Manipulation in the Emirate: true
- T1[VARA Marketing Regulations for Virtual Assets and Related Activities 2024](https://rulebooks.vara.ae/entiresection/337) — All marketing of or relating to any VA Activity in or targeting the UAE must be carried out only by a VARA-licensed VASP or on its behalf with its approval, subject to journalistic, educational and limited physical-event exemptions
- T3[VARA Marketing Regulations 2024, Schedule 1](https://www.leadsdubai.com/crypto-marketing-in-dubai-allowed-or-not/) — Fines up to AED 10,000,000 per violation for breach of marketing rules; platform record-keeping failures up to AED 500,000; penalties doubled for repeat offences within a year
- T3[Virtual Assets and Related Activities Regulations 2023 (Market Offences)](https://cms-lawnow.com/en/ealerts/2023/02/vara-issues-regulations-for-dubai-virtual-assets-regime) — Crypto-specific market-abuse regime covers insider dealing, unlawful disclosure and market manipulation of virtual assets, applying where conduct is engaged in Dubai or affects VA prices traded in Dubai
- T1[VARA Market Conduct Rulebook, Regulation VIII.H.1](https://rulebooks.vara.ae/rulebook/h-market-manipulation) — No Entity may engage in or attempt to engage in Market Manipulation in the Emirate, including false signals, artificial price effects, wash trading, layering/spoofing, with Accepted Practice carve-out; parallel insider dealing prohibition applies
- T1[VARA Market Conduct Rulebook, Regulation VIII.H](https://rulebooks.vara.ae/entiresection/50) — VASPs must report to UAE FIU and VARA upon reasonable suspicion of a Market Offence; VASPs must maintain insider lists
- T3[Virtual Assets and Related Activities Regulations 2023](https://www.simmons-simmons.com/en/publications/cldyc9b5i00z4u7l0teus0qm5/dubai-s-vara-publishes-full-market-product-regulations) — VASPs and group members in Dubai generally prohibited from own-account trading; proprietary traders above AED 1 billion rolling 30-day volume outside the VASP perimeter must register with VARA and obtain a No-Objection Certificate
- T1[VARA Virtual Asset Issuance Rulebook](https://rulebooks.vara.ae/rulebook/whitepapers) — Entities issuing a Virtual Asset in the Emirate must publish a Whitepaper and a Risk Disclosure Statement before issuance, except Issuers of Exempt VAs
- T1[VARA Market Conduct Rulebook (Complaints Handling)](https://rulebooks.vara.ae/rulebook/complaints-handling-requirements) — VASPs must acknowledge client complaints within one week and resolve within four weeks absent extraordinary circumstances; no fee may be charged
- T1[VARA Custody Services Rulebook](https://rulebooks.vara.ae/entiresection/257) — Safekeeping virtual assets for or on behalf of another, acting on verified client instructions, is a licensed VA Activity (Custody Services) requiring a VARA Licence
- T3[VARA Custody Services Rulebook](https://gcc-lexai.0xkaz.com/docs/9733d3f8-4222-45f0-a1d3-07978ed5cf25) — Custodians must segregate and control client virtual assets to prevent commingling and unauthorised use, including private-key protection and transaction monitoring
- T3[VARA Company/Market Conduct Rulebook (2025 update)](https://techinsights.linklaters.com/post/102kd40/virtual-assets-regulation-in-dubai-vara-issues-updates-to-its-rulebooks) — Client money and virtual assets held by a VASP for clients are not owned by the VASP and do not form part of its insolvency estate; VASPs must state this in the Client Agreement and label separate wallets 'Client VA Wallet'

### United Arab Emirates: C6 Tax TreatmentAmberEnacted in forceModule confidence: Probable▾

The UAE Federal Tax Authority exempted crypto transactions (transfer and conversion) from the 5% VAT, effective November 15, 2024, applied retrospectively to January 1, 2018. The UAE is separately known as a low-tax jurisdiction for individuals more broadly (no federal personal income tax), though a crypto-specific personal income/capital-gains tax ruling was not independently located in this pass and is flagged for primary-source confirmation.

C6 · Tax Treatment — Full Module Record 0 sub-modules · 180 words · 9 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: C7 Cross-Border TransferAmberEnacted in forceModule confidence: Probable▾

Cross-border virtual-asset transfers in AE are governed principally through the FATF Travel Rule as codified in the UAE Virtual Assets Travel Rule (Cabinet Resolution No. (134) of 2025) and VARA's Compliance and Risk Management Rulebook, which requires travel-rule compliance and sanctions screening for VASP transactions. A specific outbound-restriction or reporting-threshold regime distinct from the travel rule was not independently confirmed in this pass.

C7 · Cross-Border & Travel Rule — Full Module Record 0 sub-modules · 180 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: C8 AML/CFT RegimeGreenEnacted in forceModule confidence: Probable▾

VASPs under VARA are subject to a Compliance and Risk Management Rulebook covering AML/CFT controls, risk assessments, client due diligence, suspicious-transaction monitoring/reporting, the FATF Travel Rule, targeted financial sanctions compliance, and record keeping. The UAE Virtual Assets Travel Rule is codified federally under Cabinet Resolution No. (134) of 2025, which applies alongside federal AML/CFT laws referenced in the VARA rulebook.

C8 · AML/CFT Regime — Full Module Record 0 sub-modules · 180 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: C9 Commercial Activity limited signal unpopulated ▾

## Commercial Activity

Two dated commercial events occurred in the UAE's crypto and digital-asset market in October 2026. Payward FZCO, Kraken's UAE entity, received VARA Full Market Approval on 12 October 2026, completing a licensing process VARA's register shows began in May 2026, with the exchange's parent Payward Inc. domiciled in the United States. Kraken is reported to plan an AED-denominated spot and margin trading launch, alongside staking, tokenised equities, and crypto payments, within weeks of the approval. Separately, Standard Chartered, a UK-domiciled global bank, launched live institutional custody of Ripple's RLUSD stablecoin via its DIFC branch regulated by the Dubai Financial Services Authority, also dated 12 October 2026, with a planned collateral-mirroring link to LMAX Group reported as not yet live. Neither event discloses a transaction value.

Both events represent market entry or product-line expansion by firms headquartered outside the UAE into the UAE's licensed digital-asset market, consistent with the jurisdiction's posture of actively courting major global exchanges and banks into its regulatory perimeter. The two events sit on separate regulatory tracks, VARA for exchange licensing and the DFSA for the Standard Chartered custody product, but both were reported and corroborated through multiple independent press sources, giving reasonable confidence in the underlying commercial facts even though neither was separately confirmed against a primary regulator source this cycle. — Outlook: Continued commercial market entry and product expansion by globally-domiciled exchanges and banks into the UAE's crypto and digital-asset market is a plausible continuation of this cycle's pattern. Whether Kraken's reported near-term product launches proceed as described, and whether Standard Chartered's planned LMAX collateral-mirroring link becomes operational, remain open items.

Open gap — crypto-int-3 No mutual-recognition or passporting mechanism between VARA, CMA, ADGM FSRA and DIFC DFSA was identified in sources reviewed; confirmation of this negative finding from a primary regulator statement would strengthen the cross_border_transfer claim. no under-indexing note recorded

Periodic update · new data 2026-10-23

#### Commercial Activity

Bybit Fintech FZE, the Dubai-domiciled unit of the Bybit exchange group, secured a Virtual Asset Service Provider licence from Dubai's Virtual Assets Regulatory Authority for Exchange Services, covering spot trading. The grant was reported on 21-22 October 2026 and is treated as a completed market-entry event: the licence has been issued and the regulatory review by the Authority is recorded as cleared, with Bybit Fintech FZE named as licensee and the broader Bybit group named as a related party.

No financial terms attach to this event, as a licence grant rather than a commercial transaction. The scope of authorisation is specific: Exchange Services covering spot trading, rather than a broader suite of virtual-asset activities. The event confirms Bybit's formal entry into the Dubai-licensed virtual asset exchange market under the Authority's existing supervisory framework, rather than reflecting any change to that framework.

#### Outlook

The licence positions Bybit Fintech FZE to operate spot trading exchange services from Dubai under the Authority's supervision going forward. Whether the scope of authorisation is later extended to additional service categories, and whether Bybit's Dubai operations scale materially following the grant, are the points worth tracking next; neither is indicated one way or the other by the available reporting to date.

Sources and findings (4)
- T4[Binance](https://buycrypto.asia/en/countries/uae) — Expanded from VARA Dubai licence to global ADGM licence, effective 5 January 2026, the first exchange to receive one.
- T3[Payward FZCO](https://cointelegraph.com/news/kraken-receives-vara-approval-uae-expansion) — Payward FZCO (Kraken) received VARA Full Market Approval on 12 October 2026, completed final stage begun May 2026
- T3[Standard Chartered](https://www.coindesk.com/business/2026/10/12/standard-chartered-offers-rlusd-custody-in-dubai-and-plans-lmax-collateral-link) — Standard Chartered launched live institutional custody of Ripple's RLUSD stablecoin via its DIFC branch regulated by the DFSA
- T3[CBUAE-licensed banks, finance companies, exchange houses and payment service providers](https://neolegal.ae/insights/cbuae-resolution-16-virtual-assets) — May now undertake virtual asset activities regulated under CMA Resolution 04/2026, opening the federal onshore market to bank-led crypto activity