Why Choose the UAE for Crypto Licensing?
The United Arab Emirates offers an unusual combination for a non-EU jurisdiction in 2026: three competing crypto-specific regulators (VARA, ADGM FSRA, DFSA), each with mature rulebooks, an explicit policy commitment to virtual-asset activity, and a post-FATF, post-EU AML reputational profile that has reduced international banking friction. VARA’s public register lists 56 licensed VASPs as of , ADGM’s FSRA reported over 20 regulated firms with virtual-asset or Fiat-Referenced Token activities in , a Qualifying Free Zone Person pays 0% on its Qualifying Income, and ADGM and DIFC operate under English common law.[1][2]
Three Competing Regulators Give Operators Genuine Choice
Most jurisdictions have one crypto regulator. The UAE has five, three of which run full licensing regimes and two of which operate in adjacent perimeters.
VARA covers Dubai mainland and the Emirate’s free zones (excluding DIFC) under Dubai Law No. 4 of 2022,[3] with eight activity categories and a public register listing 56 licensed VASPs as of .[4] ADGM FSRA regulates Abu Dhabi’s free zone under the Financial Services and Markets Regulations 2015 (FSMR), with “over 20 regulated firms” operating virtual-asset or Fiat-Referenced Token activities as of per FSRA CEO Emmanuel Givanakis at Abu Dhabi Finance Week.[5]
DFSA covers DIFC under its Crypto Token regime, substantially overhauled with effect from .[6] The federal Securities and Commodities Authority (SCA), reconstituted as the Capital Market Authority (CMA) from ,[31] agreed with VARA in that Dubai-licensed VASPs can be registered with it by default to serve the wider UAE,[7] and CBUAE separately regulates payment-token issuance, conversion, custody, and transfer under the Payment Token Services Regulation, effective from .[8] The practical implication: most operators will pick one of VARA, ADGM, or DFSA, and the right pick depends on activity profile, client base, and whether AED-denominated stablecoin settlement is in scope.
Tax Position Is Exceptional Within a Tightening International Framework
The UAE corporate tax rate of 9% on profits above AED 375,000, introduced by Federal Decree-Law No. 47 of 2022 for tax periods starting on or after (the AED 375,000 band is set by Cabinet Decision No. 116 of 2022),[9][54] remains among the lowest in any jurisdiction with a credible crypto regulatory framework. Free Zone QFZPs instead pay 0% on Qualifying Income and 9% on their other taxable income, without the AED 375,000 band, subject to substance, de minimis, transfer-pricing, and audited-accounts conditions.[10] The UAE Federal Tax Authority’s Public Clarification VATP040, issued in and applying Cabinet Decision No. 100 of 2024, confirmed that the transfer and conversion of virtual assets are VAT-exempt financial services retroactively from , and that keeping and managing virtual assets, exempt from , is taxable when supplied for an explicit fee.[11]
Compare with Cyprus, where the headline corporate tax rate is 15% from ; or Hong Kong, where the standard rate is 16.5%.
The real constraint is the new DMTT of 15%, in force for fiscal years starting on or after under Cabinet Decision No. 142 of 2024. It applies only to multinational groups with consolidated revenue at or above EUR 750 million in two of four preceding years, leaving standalone UAE-domiciled operators below the threshold unaffected.[12]
Reputational Uplift from FATF and EU Delisting Is Now Banked
The UAE left the FATF “Jurisdictions under Increased Monitoring” list on and the EU AML high-risk third-country list with effect from .[13][14]
The reforms behind both decisions, the European Parliament vote, and the sources are set out under International Standing, and the Central Bank’s 2025 fines under Enforcement.
Strategic Geography and Institutional Depth
The UAE sits at the intersection of European business hours and Asian markets, with daily flight connections to London, Frankfurt, Singapore, and Hong Kong, and a deep professional-services ecosystem of tier-1 law firms, Big-Four accounting practices, and specialist compliance providers. ADGM and DIFC both operate independent English common-law courts with their own judges and arbitration centres, providing dispute resolution comparable to London, Singapore, or Hong Kong.
For operators whose investors, counterparties, or clients require a familiar legal framework, this is decisive. Experienced applicants typically structure ADGM or DIFC for institutional product lines and VARA for retail-facing Dubai operations, splitting the licensing footprint to match client geography rather than forcing one regime to cover both.
Regulatory Framework
UAE crypto regulation rests on three layers: federal authority under Cabinet Decision No. 111 of 2022, Emirate-level authority through Dubai Law No. 4 of 2022 (VARA) and ADGM’s federal free-zone regime, and payment-instrument regulation through the CBUAE Payment Token Services Regulation, issued in and effective from .[3][8][16]
Definition: VASP / Virtual Asset Service Provider (UAE)
A VASP is an entity authorised to conduct one or more Virtual Asset Activities. Under VARA in Dubai, this means the eight activity categories defined in the Virtual Assets and Related Activities Regulations 2023: Advisory, Broker-Dealer, Category 1 VA Issuance, Custody, Exchange, Lending and Borrowing, VA Management and Investment, and VA Transfer and Settlement.[3] Under ADGM FSRA in Abu Dhabi, equivalent activities are licensed as Regulated Activities under the FSMR with virtual-asset add-on permissions. Federal Cabinet Decision No. 111 of 2022 prohibits any person from conducting virtual-asset activity in the UAE without authorisation from the SCA (the Capital Market Authority since ) or a delegated local authority.[16] Under UAE Federal Tax Authority Public Clarification VATP040, the transfer and conversion of virtual assets are VAT-exempt financial services, and so is keeping and managing them where no explicit fee is charged.[11]
Regulatory History
The current framework is the product of three years of rapid build-out. Cabinet Decision No. 111 of 2022, published and in force 30 days later, established federal authority over virtual-asset activity outside the financial free zones.[16] Cabinet Decision No. 112 of 2022 delegated VARA’s powers within Dubai under Dubai Law No. 4 of 2022, which had established VARA in under the Dubai World Trade Centre Authority.[3]
VARA published the Virtual Assets and Related Activities Regulations on , along with twelve activity-specific and compulsory Rulebooks; Version 2.0 of the Rulebooks was published with a compliance deadline, materially rewriting the Compliance and Risk Management, Market Conduct, and Technology and Information rulebooks.[17]
ADGM’s framework predates the federal regime: FSRA published one of the first comprehensive frameworks for crypto-asset business in 2018, with the latest Digital Asset Updates implemented following Consultation Paper No. 11 of 2024.[18] The June 2025 amendments moved from a closed Accepted Virtual Asset list to a notification-based regime with explicit prohibitions on privacy tokens and algorithmic stablecoins.
DFSA introduced its Crypto Token regime in 2022 (a 2021 Investment Token regime preceded it) and substantially overhauled it effective , abolishing the pre-approved Recognised Crypto Token list and shifting suitability assessment onto firms.[6]
CBUAE issued the Payment Token Services Regulation as Circular No. 2/2024 in ; its rulebook lists it as effective from , with a one-year transition period under Article 40, and VARA told its licensees that the CBUAE grace period for registration expired on .[8][42]
Three federal laws reshaped the perimeter in 2025 and 2026. Federal Decree-Law No. 6 of 2025, in force since , places anyone who carries on, offers or facilitates a licensed financial activity through virtual-asset payment tokens, DeFi, or other technology within the CBUAE’s licensing jurisdiction (Article 62), outside the financial free zones and the institutions their authorities regulate, which the law excludes (Article 2), with a one-year reconciliation period (Article 184) that the CBUAE Board may extend.[32] Federal Decree-Law No. 10 of 2025 on anti-money laundering and counter-terrorist and proliferation financing entered into force on .[33] Federal Decree-Laws Nos. 32 and 33 of 2025 reconstituted the SCA as the Capital Market Authority from , keeping Cabinet Decisions Nos. 111 and 112 of 2022 on virtual assets in force.[31]
Recent Regulatory Developments
- . ADGM FSRA finalises its Virtual Asset staking framework, following Consultation Paper No. 10 of 2025 (consultation closed ).[19][48]
- . VARA adds Exchange Traded Derivative Services rules to its Exchange Services Rulebook (Part V).[37]
- . VARA sets its expectations for the UAE Virtual Assets Travel Rule issued under Cabinet Decision No. 134 of 2025, which applies to VASPs across the UAE, including the financial free zones.[34]
- . DFSA Crypto Token regime overhaul takes effect; the Recognised Crypto Token list is abolished and firms assume token suitability assessment responsibility.[6]
- . The Securities and Commodities Authority becomes the Capital Market Authority under Federal Decree-Laws Nos. 32 and 33 of 2025.[31]
- . ADGM FSRA Fiat-Referenced Token amendments take effect, expanding regulated activities permissible in FRTs.[18]
- . Federal Decree-Law No. 10 of 2025 on anti-money laundering and counter-terrorist and proliferation financing enters into force; its Executive Regulations (Cabinet Decision No. 134 of 2025) follow on .[33]
- . Federal Decree-Law No. 6 of 2025 on the Central Bank enters into force, extending CBUAE licensing to financial activity carried on through virtual-asset payment tokens and DeFi (Article 62), outside the financial free zones (Article 2).[32]
- . The CBUAE grace period for Payment Token Services registration ends, per VARA’s circular to licensees.[42]
- . Commission Delegated Regulation (EU) 2025/1184, which removes the UAE from the EU AML high-risk third-country list, enters into force after the European Parliament declined to object on .[14][41]
- . VARA Rulebook Version 2.0 compliance deadline reached (rulebooks published ).[17]
- . UAE Federal Tax Authority publishes Public Clarification VATP040 confirming the retroactive VAT exemption for virtual-asset transfer and conversion from .[11]
- . First CBUAE-licensed AED-pegged stablecoin issuer launches under the Payment Token regime.
- . SCA and VARA execute cooperation agreement: Dubai-licensed VASPs can be registered by default with the SCA (now the Capital Market Authority) to serve the wider UAE, removing the dual-application burden.[7]
- . FATF removes the UAE from “Jurisdictions under Increased Monitoring”.[13]
Regulatory Overlap
Four overlapping regimes regularly affect UAE crypto businesses. First, the federal Capital Market Authority (the SCA until 31 December 2025) retains authority over virtual-asset activity at the federal level under Cabinet Decision No. 111 of 2022, which stays in force under Federal Decree-Law No. 32 of 2025, with delegation to VARA for Dubai.[7][31] In practice, Dubai VASPs that serve clients in other Emirates need both the VARA licence and the federal registration; since the agreement that registration follows the VARA licence, and VARA’s public register shows a CMA registration number for each licensee.[4]
Second, the CBUAE Payment Token Services Regulation distinguishes general merchant payments from purchases of virtual assets. Outside the financial free zones, general merchant payments in virtual assets require Dirham Payment Tokens from a licensed issuer; Foreign Payment Tokens from a registered foreign issuer may be used to buy virtual assets or their derivatives (Article 2(7) and (13)).[8] Under Article 8, a VARA-licensed virtual asset exchange platform operator may apply for Non-Objection Registration for Payment Token Conversion, and a VARA-licensed virtual-asset custodian may apply for that registration for custody and transfer of Foreign Payment Tokens. Custody and transfer of Dirham Payment Tokens requires a CBUAE Payment Token Custodian and Transferor licence. Since , Federal Decree-Law No. 6 of 2025 also places anyone who carries on, offers or facilitates a licensed financial activity through virtual-asset payment tokens, DeFi protocols, or other technology within the CBUAE’s licensing jurisdiction (Article 62), except in the financial free zones and for the institutions their authorities regulate (Article 2); its one-year reconciliation period (Article 184) ended in mid-September 2026 unless the CBUAE Board has extended it.[32] Third, ADGM’s status as a federal financial free zone established by Federal Law No. 8 of 2004 places it outside both VARA and CMA jurisdiction.
Fourth, DIFC operates under its own English-common-law regime and is similarly excluded. The common mistake is committing to office space or staffing before the regulator decision is final, which forecloses the alternative regimes.
Regulatory Sandboxes
ADGM operates the RegLab, a regulatory sandbox running in themed cohorts. The fifth cohort, opened , focused on DeFi, Web3, and decentralised protocols; participants test up to two years before transitioning to full authorisation. DFSA operates the Innovation Testing Licence (ITL), in operation since 2017; per the DFSA’s published statement, “Since its inception in 2017, over 200 companies have applied to enter the programme and over 80 applicants have been accepted into the programme.”[21] Both sandboxes are restricted-scope testing environments, not substitutes for full licensing. Our dedicated Abu Dhabi (ADGM) crypto licensing guide covers the FSRA Financial Services Permission route in depth.
Experienced applicants treat the sandbox as a tool to test a novel product under regulatory oversight before committing to full authorisation, not as a market-entry shortcut. DFSA additionally opened a Tokenisation Regulatory Sandbox to expressions of interest in .[30] As of September 2026, VARA’s licence route has two stages, an Approval to Incorporate and then the VASP Licence, and no public sandbox;[36] the legacy Provisional Permit and Minimum Viable Product Operating Licence pathways used in 2022 and 2023 have been largely superseded.
License Types and Activities Covered
The UAE licences virtual-asset activity through three primary regulators with distinct scope: VARA covers eight activity categories in Dubai; ADGM FSRA permits virtual-asset Regulated Activities under FSMR including MTF operation, custody, and broker-dealing; DFSA endorses Crypto Token activities for DIFC-domiciled financial-services firms. CBUAE licenses Payment Token issuance, conversion, custody, and transfer for AED- and foreign-pegged tokens used in-country.
VARA: Eight Activity Categories
VARA’s eight Virtual Asset Activities each have a dedicated activity-specific Rulebook in addition to four compulsory Rulebooks (Company; Compliance and Risk Management; Technology and Information; Market Conduct).[22][36] The seven service activities:
- Advisory Services. Investment advice on virtual assets. Application fee AED 40,000; annual supervision fee AED 80,000; minimum paid-up capital AED 100,000.[35][27]
- Broker-Dealer Services. Reception, transmission, and execution of orders on behalf of clients. Application fee AED 100,000; annual supervision fee AED 200,000; minimum capital equal to the higher of AED 400,000 and 15% of Fixed Annual Overheads where a VARA-licensed custodian is used or VARA otherwise approves during licensing; otherwise, the higher of AED 600,000 and 25%.[35][27]
- Custody Services. Safekeeping of virtual assets and private keys. Application fee AED 100,000; annual supervision AED 200,000; minimum capital the higher of AED 600,000 and 25% of FAO. Custody activity requires a segregated legal entity.[35][27]
- Exchange Services. Operation of a Virtual Asset trading platform. Application fee AED 100,000; annual supervision AED 200,000; minimum capital AED 800,000 where a VARA-licensed custodian is used or VARA otherwise approves during licensing, otherwise AED 1,500,000, or 15–25% of FAO if higher.[35][27]
- Lending and Borrowing Services. Lending or borrowing virtual assets. Application fee AED 100,000; annual supervision AED 200,000; minimum capital is the higher of AED 500,000 and 25% of fixed annual overheads.[22][27]
- VA Management and Investment Services. Portfolio and discretionary management of virtual assets. Application fee AED 100,000; annual supervision AED 200,000; minimum capital AED 280,000–500,000 depending on custody arrangement, or 15–25% of FAO if higher.[35][27]
- VA Transfer and Settlement Services. Operating transfer or settlement infrastructure for virtual assets. Application fee AED 40,000; annual supervision AED 80,000; minimum capital the higher of AED 500,000 and 25% of FAO.[35][27]
Category 1 VA Issuance, the eighth activity, is licensed separately for Fiat-Referenced and Asset-Referenced token issuers (application fee AED 100,000; annual supervision fee AED 200,000),[35] with capital and prudential requirements set by the VA Issuance Rulebook. Capital is cumulative across multi-activity licences and is maintained at all times through the prescribed UAE-bank trust account or surety bond with VARA as beneficiary, or another arrangement VARA specifies when granting the licence; net liquid assets must equal at least 1.2 times monthly operating expenses, reconciled daily and reported to VARA monthly.[22][27]
ADGM FSRA: Virtual Asset Regulated Activities
FSRA authorises virtual-asset activity through standard FSMR Schedule 1 Regulated Activities with virtual-asset add-on permissions following the amendments.[18] The permitted activities include Dealing in Investments as Principal or Agent, Arranging Deals, Managing Assets, Providing Custody, Operating a Multilateral Trading Facility for Accepted Virtual Assets, and Operating a Clearing House.
Capital requirements follow the FSRA PRU module’s Category 1–5 system, calibrated to activity risk. Advising and arranging sit in Category 4 (USD 50,000 base capital), managing assets and custody other than for a Public Fund in Category 3C (USD 250,000), dealing as agent or matched principal in Category 3A (USD 500,000), and dealing as principal in Category 2 (USD 2 million); Category 3B (USD 4 million) covers custody for a Public Fund or acting as trustee of an Investment Trust, unless the firm falls into Category 1, 2, 3A or 5. Categories 1 and 5 have a USD 10 million base, outside this non-bank range. A firm holds its base capital or, if higher, its Expenditure-Based Capital Minimum (six months of expenditure for virtual-asset custody) or Risk Capital Requirement, and a virtual-asset MTF holds six months’ operating expenses plus a buffer of up to six more.[44][45] The Accepted Virtual Asset list now operates on a self-assessed notification basis against pre-defined FSRA criteria, replacing the previous closed list.
Privacy tokens and algorithmic stablecoins are explicitly prohibited. Application and annual supervisory fees are structured as add-on amounts on top of the base Regulated Activity fees.
DFSA: DIFC Crypto Token Regime
DFSA licenses crypto-related activities through standard Financial Services categories under the DFSA Rulebook with a Crypto Token endorsement governed by GEN Module Chapter 3A.[23] Until , the DFSA maintained a prescribed Recognised Crypto Token list that had grown to include Bitcoin, Ether, Litecoin, Toncoin, XRP, USDC, EURC, and Ripple USD (RLUSD).
Under the rules in force from that date, the prescribed list no longer exists: each DFSA-authorised firm must perform and document its own suitability assessment for each Crypto Token it engages with, against the criteria in GEN Rule 3A.2.1, and report to the DFSA via the Monthly Crypto Token Information Return.
A regulator-led approval pathway survives only for Fiat Crypto Tokens (USDC, EURC, RLUSD as at the commencement date). The DFSA charges one application fee, the highest that applies to the Financial Services sought: USD 15,000 for advising or arranging, USD 25,000 for Dealing in Investments as Agent, Managing Assets, Providing Custody, or Providing Money Services with Stored Value, and USD 40,000 for dealing as principal (USD 25,000 as a matched principal), doubled where a listed factor such as a multi-level group structure applies. A firm operating an ATS for Crypto Tokens pays a USD 150,000 application add-on and an annual fee tiered by trading volume between USD 150,000 and USD 800,000.[24]
The current Fees Module (version 35, April 2026) sets no separate token-recognition fee; annual fees are higher where the authorisation includes Crypto Tokens, for example USD 35,000 instead of USD 25,000 for dealing as agent, managing assets, or providing custody, USD 70,000 instead of USD 50,000 for dealing as principal other than as a matched principal (USD 35,000 instead of USD 25,000 as a matched principal), and USD 20,000 instead of USD 15,000 for advising or arranging.[24] Base capital runs from USD 30,000 for a Category 4 firm that only advises or arranges, through USD 200,000 for dealing as agent (Category 3A) and USD 1 million where crypto custody is the only such service (Category 3B), to USD 2 million for dealing as principal (Category 2; USD 500,000 where it deals only as a matched principal), or higher where the expenditure-based minimum or, from July 2026, the activity-based capital requirement for Categories 3A to 3C applies.[43] DFSA primarily serves DIFC-domiciled firms with professional clients. Retail business in Crypto Tokens is permitted but conditioned: the licence needs an endorsement to serve Retail Clients, and a firm must assess each retail client’s appropriateness before arranging, dealing or operating an MTF for them, may not lend to them for crypto trading, and may not offer them trading incentives.[24][49]
CBUAE Payment Token Services
The CBUAE Payment Token Services Regulation (Circular No. 2/2024) covers three activity categories: Payment Token Issuance, Payment Token Conversion, and Payment Token Custody and Transfer.[20] Dirham Payment Token Issuers must be UAE-incorporated entities (excluding DIFC and ADGM); Foreign Payment Token Issuers (entities outside the UAE) require CBUAE registration rather than full licensing.
Reserve requirements mandate 100% backing held as cash in a separate escrow account with a UAE-licensed bank outside the issuer’s group; a Dirham Payment Token Issuer that is a wholly owned bank subsidiary may instead hold at least 50% in cash and the rest in UAE government bonds and CBUAE Monetary Bills with an average duration of six months or less.[8]
Outside the financial free zones, merchants may accept Dirham Payment Tokens issued by a CBUAE licensee for general payments. Foreign Payment Tokens issued by a registered foreign issuer may be used for purchases of virtual assets or their derivatives; they are not a general merchant-payment alternative (Article 2(7) and (13)).[8]
What Does NOT Require a UAE Licence
- Pure proprietary investment without client-facing VA services. An entity in Dubai outside DIFC investing its own portfolio at or above USD 250 million during any rolling 30 calendar days must register with VARA before reaching that volume or no later than three working days afterwards. This registration is not a VASP licence (Regulation IV.A.7).[22]
- Software development and infrastructure provision where the developer does not exercise control over assets or counterparties.
- Mining of virtual assets where the miner does not provide brokerage, exchange, or custody services.
- Personal use of virtual assets by individuals not conducting a business activity.
- Activity wholly conducted from outside the UAE, by entities not incorporated in the UAE, and not targeting UAE residents through marketing, advertising, or solicitation.
- DAOs, DeFi protocols, and DEXs are not currently subject to a dedicated UAE regulatory framework, although since a licensed financial activity carried on or facilitated through DeFi outside the financial free zones falls within the CBUAE’s licensing jurisdiction (Federal Decree-Law No. 6 of 2025, Article 62).[32] In addition, any activity that meets the definition of a Virtual Asset Activity under VARA or FSMR Regulated Activity under ADGM will require licensing regardless of decentralisation framing. The common mistake is assuming a foundation structure or token vesting schedule removes the licensing trigger when the underlying activity is in scope.
Businesses in these categories still need a legal vehicle: in practice that means an ordinary free-zone commercial or technology licence (the DMCC and IFZA route referenced above), which incorporates the company for tens of thousands of dirhams but confers no authorisation to provide virtual-asset services to clients.
Tokenised securities and RWA
The defining UAE feature is that an identical token is classified differently from one regulator to the next, so the licence you hold does not settle the question of what the token is. Under VARA, asset-referenced virtual assets (ARVA), the category that covers most real-world-asset-backed tokens, are issued inside the crypto regime under the Virtual Asset Issuance Rulebook Version 2.0, effective 19 June 2025.[50][51]
Cross the border into DIFC and the same instrument is an “Investment Token” under the DFSA regime in force since 25 October 2021, with a dedicated tokenisation regulatory sandbox open since March 2025. In ADGM, a token with the features of a security is a “Digital Security” regulated under FSMR, with guidance live since 2019 and separate from ADGM’s virtual-asset framework.
Federally, outside DIFC and ADGM, SCA Decision No. 15/RM of 2025, now applied by the Capital Market Authority, treats security tokens and commodity-token contracts as regulated securities.
The practical point is that a VARA or other virtual-asset authorisation does not make a token a security, and it does not exempt a token that already is one. Where a token carries the features of a security, it falls under the DFSA, FSRA, or CMA securities regimes rather than the crypto regime, and the classification of an identical token differs by regulator.
We scope the regulator and the instrument together before any application, and route a fund vehicle through fund licensing where the structure is a fund rather than a standalone security token.
Requirements
UAE licensing requires a locally incorporated entity, UAE-resident senior officers (MLRO, Compliance Officer, Senior Executive Officer or equivalent), physical office space in the relevant jurisdiction, paid-up capital evidenced by deposit, comprehensive policy framework (AML/CFT, technology, market conduct), and pre-licensing fit-and-proper assessment of all controllers, directors, and senior officers.
| Requirement | VARA | ADGM FSRA | DFSA |
|---|---|---|---|
| Board composition | Mixed executive / non-executive board; at least one independent director for Custody entities | Board and senior management proportionate to the activity; no fixed numeric floor | 2 (independent for Authorised Firms) |
| Foreign ownership | 100% (free zone or mainland) | 100% (ADGM free zone) | 100% (DIFC free zone) |
| MLRO | UAE-resident, full-time, industry-qualified | UAE-resident, full-time | UAE-resident, full-time |
| Compliance Officer | UAE-resident, separate from MLRO for Exchange & Custody | UAE-resident | UAE-resident |
| Senior Executive Officer / Finance Officer | Required, UAE-resident | SEO required, UAE-resident | SEO + Finance Officer required |
| Physical office | Real office in Dubai, lease before licence grant | Real office in ADGM, secured as an in-principle approval condition before FSP grant | Real office in DIFC, lease before grant |
| Paid-up capital | AED 100,000–1,500,000≈ $27K–410K fixed floor by activity (Advisory a flat AED 100,000; for the other service activities, 15–25% of fixed annual overheads if higher); issuers follow the VA Issuance Rulebook[27] | USD 50,000–4 million base for PRU Categories 2/3A/3B/3C/4, or EBCM or risk capital if higher[44] | Base capital USD 30,000–2m by PIB category; higher prudential requirements may apply[43] |
| Capital deposit form | UAE-bank trust account or surety bond, VARA beneficiary, or another arrangement VARA specifies | UAE-bank or approved surety | UAE-bank or approved surety |
| Net liquid assets | ≥ 1.2× monthly operating expenses, daily reconciliation | Per PRU Category | Per Category 3C–4 rules |
| Professional indemnity insurance | Required for Advisory, Management, Custody | Required, scaled to activity | Required, scaled to activity |
| Reserve assets (Custody / Exchange / Issuance) | 100% client liability backing, 6-monthly audit[27] | Per FSRA custody rules | Per DFSA custody rules |
| AML/CFT framework | Per VARA Compliance Rulebook + Federal AML law | Per FSRA AML Rulebook + Federal AML law | Per DFSA AML module + Federal AML law |
| Travel Rule | Data on every transfer; beneficiary verified from AED 3,500 a day≈ $950[34] | UAE Travel Rule, as for VARA; FSRA AML Rulebook | UAE Travel Rule, as for VARA; DFSA AML module |
| Wind-down plan | Mandatory | Mandatory | Mandatory |
Fit-and-Proper Assessment
Controllers, directors, MLRO, Compliance Officer, Senior Executive Officer, and Finance Officer require pre-approval. ADGM FSRA and DFSA treat a holder of 10% or more of the shares or voting rights as a Controller;[55][56] VARA presumes control from 25% of the voting shares.[27] The fit-and-proper assessment covers integrity (criminal record, regulatory history, civil litigation), competence (qualifications, experience in regulated financial services or virtual-asset activity), and financial soundness (personal credit history, bankruptcy record). VARA, ADGM FSRA, and DFSA each conduct independent fit-and-proper reviews; an approval from one is not automatically recognised by another.
Experienced applicants begin the fit-and-proper process 8 to 12 weeks before the formal application, because rectifying gaps after submission delays the timeline materially. The common mistake is appointing an MLRO based on cost rather than qualification: regulators specifically test whether the MLRO has the seniority and industry knowledge to challenge the business, and reject candidates who do not.
Local Presence and Substance
UAE substance requirements operate at two layers. At the regulator layer, VARA, FSRA, and DFSA each require a real office in their respective jurisdictions with physical seating capacity for the licensed activity’s headcount, a signed lease for at least the duration of the licence application plus six months, named senior officers physically resident in the UAE, and demonstrable operating activity (board meetings held in-country, key decisions taken locally, books and records held in-country).
At the tax layer, QFZP status under the Corporate Tax Law, Cabinet Decision No. 100 of 2023 and Ministerial Decision No. 229 of 2025 requires adequate substance, qualifying income, transfer-pricing compliance, audited accounts, and continuous monitoring against the de minimis limit on non-qualifying revenue (the lower of AED 5 million or 5% of total revenue).[9][10][29] In practice, the regulator-level substance bar is easier to clear than the QFZP tax bar; operators that pass licensing but fail QFZP are taxed at the standard rates (9% on taxable income above AED 375,000) rather than the 0% Free Zone rate on Qualifying Income.[54]
AML/CFT and Travel Rule
Federal Decree-Law No. 10 of 2025, in force since , and its Executive Regulations (Cabinet Decision No. 134 of 2025, in force since ) govern the UAE’s AML/CFT/CPF regime, supplemented by VARA’s Compliance and Risk Management Rulebook, FSRA’s AML Rulebook, and DFSA’s AML module.[33] The UAE Virtual Assets Travel Rule issued under Cabinet Decision No. 134 of 2025 applies to VASPs across the UAE, including the financial free zones: originator and beneficiary information must accompany every transfer, and the beneficiary must be verified where transfers reach a daily aggregate of AED 3,500 (approximately USD 950).[34]
VARA and the FSRA require IVMS101 as the data model for originator and beneficiary information exchange. Sanctions screening must cover UN Consolidated, UAE Local Terrorist List, and OFAC SDN. Client risk assessments must be conducted at least quarterly under the VARA rules.[53] Suspicious-activity reporting is filed via the goAML platform operated by the UAE Financial Intelligence Unit. Privacy-coin transfers are prohibited under the UAE Virtual Assets Travel Rule guidance and within ADGM and DIFC regulated activity.
Application Process
UAE crypto licensing follows a two-stage regulator-led process. VARA uses an Initial Disclosure Questionnaire leading to an Approval to Incorporate, followed by the full VASP Licence application; ADGM FSRA uses Approval-in-Principle followed by Financial Services Permission; DFSA uses pre-application engagement followed by a six-step authorisation pathway. Pre-application engagement is available and used by experienced applicants in every case.
All applications, supporting documents, and regulator correspondence are in English. Arabic translations are required only for Court filings and certain federal interactions, not for the regulator submissions themselves. All three regulators engage before the full application: VARA’s Initial Disclosure Questionnaire, filed through Dubai Economy and Tourism or the free zone, leads to an Approval to Incorporate, FSRA holds informal pre-AIP meetings, and DFSA offers a pre-application meeting in the standard six-step process.[36] Forming the UAE entity, which on the VARA route follows the Approval to Incorporate, is covered in detail on the Dubai Company Formation page.
Entity Formation and Pre-Application Planning
Select the activity category and confirm the capital requirement. For DIFC, incorporate the entity in the centre. For ADGM, prepare the proposed entity and ownership structure: the FSRA application is made for the entity in formation, and the commercial licence and ADGM premises follow as conditions of in-principle approval, before the FSP is granted.[47] On the VARA route the entity is incorporated only after VARA issues an Approval to Incorporate at the end of Stage 2. Engage tier-1 legal and compliance advisers. Begin senior-officer recruitment (MLRO, Compliance Officer, SEO). See Dubai Company Formation for entity setup detail.
Regulator Pre-Engagement and IDQ Submission
Submit the Initial Disclosure Questionnaire through Dubai Economy and Tourism or the free zone and pay the initial fee, typically 50% of the application fee, to receive an Approval to Incorporate (VARA);[36] or hold the pre-AIP meeting (FSRA) or pre-application meeting (DFSA). Receive feedback on activity classification and any threshold issues.
Full Application Preparation
Compile Regulatory Business Plan, three-year financial projections, AML/CFT policy framework, technology and cybersecurity governance documentation, fit-and-proper packs for all senior officers and Controllers, board governance documentation, outsourcing register, wind-down plan, and insurance attestations. Paid-up capital is placed in a UAE-bank trust account or covered by a surety bond, unless VARA specifies another arrangement when granting the licence.
Formal Submission and Regulator Review
Application reviewed by supervisory team. Multiple rounds of questions and clarifications are typical. Site visit (VARA, FSRA) and interviews with senior officers (all regulators) follow. The compliance documentation phase is where most timelines slip; the compliance partner prepares the documentation pack to the regulator’s expectation in parallel with application drafting, which compresses Stages 3 and 4 by 4 to 8 weeks.
In-Principle Approval
Regulator issues conditional approval naming the operational-readiness conditions to be satisfied before licence grant. The licence is not yet in force.
Operational Readiness
Office fit-out, technology deployment, and penetration testing, senior-officer onboarding, AML/CFT and reporting systems operational, banking arrangements in place, professional indemnity and crime/hot-wallet insurance bound, board appointed and first meeting minuted, books and records system live. Regulator inspects operational readiness before licence grant.
Licence Grant and Post-Licensing Supervision
Final fee paid, licence issued. Day-one supervision begins: first regulatory filings, ongoing capital, and net-liquid-asset monitoring, reserve-asset audits (6-monthly for Custody and Exchange).[27]
Required Documents
UAE applications require a document pack covering corporate structure, beneficial ownership, senior-officer fit-and-proper, business plan, and financials, comprehensive AML/CFT and technology governance frameworks, capital deposit evidence, and signed office lease. ADGM and DFSA require additional common-law-specific documents (constitutional documents in ADGM form, DIFC-compliant articles).
| Document | VARA | ADGM FSRA | DFSA |
|---|---|---|---|
| Certificate of incorporation + memorandum and articles | Required | Draft articles (ADGM form); certificate after in-principle approval | Required (DIFC form) |
| Corporate structure chart with all entities to ultimate beneficial owner | Required | Required | Required |
| Ultimate Beneficial Owner identification + source-of-funds attestation | Required for all 10%+ holders | Required for all 10%+ holders | Required for all 10%+ holders |
| Fit-and-proper questionnaire + CV for each director, senior officer, MLRO | Required | Required | Required |
| Regulatory Business Plan (operating model, governance, risk) | Required | Required | Required |
| Three-year financial projections (P&L, balance sheet, cash flow) | Required | Required | Required |
| Audited group financial statements (latest 2 years) | Required if group exists | Required if group exists | Required if group exists |
| AML/CFT policy + Business Risk Assessment + KYC/CDD procedures | Required | Required | Required |
| Technology and cybersecurity governance framework + pen-test evidence | Required | Required | Required |
| Outsourcing register + critical-third-party contracts | Required | Required | Required |
| Wind-down plan + business continuity / disaster recovery plan | Required | Required | Required |
| Professional indemnity insurance + D&O + crime/hot-wallet attestations | Required (binders pre-grant) | Required (binders pre-grant) | Required (binders pre-grant) |
| Signed office lease in relevant jurisdiction | Required before licence grant | Required before FSP grant, as an in-principle approval condition | Required before grant |
| Paid-up capital evidence: UAE-bank trust account statement, surety bond, or another arrangement VARA specifies | Required | Required (or approved surety) | Required (or approved surety) |
| Board governance documentation (terms of reference, charters) | Required | Required | Required |
| Compliance Manual + Reg Reporting Manual + Treasury Manual | Required | Required | Required |
Professional indemnity insurance for crypto-asset activity in the UAE is typically priced between USD 25,000 and USD 150,000 per year depending on activity scope, AUM/AUC, and history; D&O scales by board size. Hot-wallet crime cover is the most expensive line: in 2026 it is regularly the largest single insurance cost.
Costs and Pricing
The general VARA Year-1 benchmark is AED 1.33 million to 7.26 million≈ $360K–2M across activities, combining first-year regulatory fees with indicative build costs. It excludes paid-up capital, which is held rather than spent. Build work is quoted per case. The ADGM FSRA and DFSA routes have separate budgets and activity requirements, detailed below. Fee schedules are published by each regulator and refreshed annually.
Government and Regulator Fees
| Activity / Category | Regulator | Application Fee | Annual Supervision Fee | Min. Paid-Up Capital |
|---|---|---|---|---|
| Advisory Services[35][27] | VARA | AED 40,000≈ $11K | AED 80,000≈ $22K | AED 100,000≈ $27K |
| Broker-Dealer[35][27] | VARA | AED 100,000≈ $27K | AED 200,000≈ $54K | AED 400,000–600,000 (or 15–25% FAO)≈ $110K–160K |
| Custody[35][27] | VARA | AED 100,000≈ $27K | AED 200,000≈ $54K | AED 600,000 or 25% FAO≈ $160K |
| Exchange[35][27] | VARA | AED 100,000≈ $27K | AED 200,000≈ $54K | AED 800,000–1,500,000 (or 15–25% FAO)≈ $220K–410K |
| Lending & Borrowing[35][27] | VARA | AED 100,000≈ $27K | AED 200,000≈ $54K | AED 500,000 or 25% FAO≈ $140K |
| VA Management & Investment[35][27] | VARA | AED 100,000≈ $27K | AED 200,000≈ $54K | AED 280,000–500,000 (or 15–25% FAO)≈ $76K–140K |
| Category 1 VA Issuance[35] | VARA | AED 100,000≈ $27K | AED 200,000≈ $54K | Set by the VA Issuance Rulebook |
| VA Transfer and Settlement[35][27] | VARA | AED 40,000≈ $11K | AED 80,000≈ $22K | AED 500,000 or 25% FAO≈ $140K |
| Crypto-asset Regulated Activity (PRU Categories 2/3A/3B/3C/4)[46][44] | ADGM FSRA | Base fee + USD 20,000 VA add-on (USD 125,000 with an MTF) | Base + USD 15,000 VA add-on (USD 60,000 with an MTF) | USD 50,000–4 million base for PRU Categories 2/3A/3B/3C/4 |
| Dealing as agent or matched principal / Managing / Custody[24][43] | DFSA | USD 25,000 | USD 35,000 with Crypto Tokens | Highest of base capital, EBCM and the applicable Activity Based Capital Requirement |
| Dealing as principal (other than matched)[24][43] | DFSA | USD 40,000 | USD 70,000 with Crypto Tokens | Base capital USD 2 million (Category 2) |
| Advisory / Arranging[24][43] | DFSA | USD 15,000 | USD 20,000 with Crypto Tokens | Base capital USD 30,000 (Category 4) |
| ATS / Exchange[24] | DFSA | USD 150,000 add-on (Crypto Tokens) | USD 150,000–800,000 (volume-tiered) | Per PIB category |
| Payment Token Issuance / Conversion / Custody | CBUAE | Per CBUAE schedule | Per CBUAE schedule | Reserve-asset model |
Late-payment penalties at DFSA: greater of USD 1,000 or 3% of fee plus 1% per month.[57] VARA fees are payable in AED; FSRA and DFSA fees in USD.[46] A DFSA applicant pays the single highest application fee that applies to the services it seeks, not one fee per activity.[24] Extension fee for each additional VARA activity equals 50% of the lower application fee.[35]
Statutory Cost (VARA routes)
| Statutory item | Advisory or VA Transfer (AED) | Broker-Dealer, Custody, Lending or VA Management (AED) | Exchange (AED) |
|---|---|---|---|
| VARA application fee (single payment on filing)[35] | AED 40,000≈ $11K | AED 100,000≈ $27K | AED 100,000≈ $27K |
| VARA supervision fee, first year (annual)[35] | AED 80,000≈ $22K | AED 200,000≈ $54K | AED 200,000≈ $54K |
| Statutory cost, Year 1[35] | AED 120,000≈ $33K | AED 300,000≈ $82K | AED 300,000≈ $82K |
From Year 2 the statutory cost is the supervision fee alone: AED 80,000 for Advisory or VA Transfer and Settlement, AED 200,000 for every other VARA activity, with an extension fee of 50% of the lower application fee for each activity added; VARA may also impose additional supervision fees based on a VASP’s risk profile.[35] Neither ADGM FSRA nor DFSA publishes a single figure that can be summed the same way.
FSRA charges a base fee plus a virtual-asset add-on for both application and supervision, and its Year-1 charge, the application fee plus the pro-rated first-year supervision fee, runs USD 35,000 to 255,000 by activity tier and month of grant, with an MTF operator at the top of the band.[46] DFSA charges one application fee, the highest that applies to the services sought: USD 15,000 for advising or arranging, USD 25,000 for dealing as agent, managing assets or custody, and USD 40,000 for dealing as principal (USD 25,000 as a matched principal), plus USD 20,000 for a retail endorsement and USD 150,000 for a Crypto Token ATS; a listed factor such as a multi-level group structure doubles the base fee.[24]
The DFSA’s initial annual fee is that application fee, without the supplement for listed factors, pro-rated to the whole calendar months left in the year of grant. For a single-activity firm with no endorsement, trading venue or applicable factor under FER 2.1.1(3), the application fee plus the initial annual fee therefore comes to at most USD 30,000 for advising or arranging, USD 50,000 for dealing as agent, managing assets or custody, and USD 80,000 for dealing as principal (USD 50,000 as a matched principal). From the next calendar year the annual fee follows the Crypto Token rates in the fee table, with additions such as USD 4,000 for each further service, up to USD 4,000 for each endorsement, an expenditure-based amount and, for an ATS, USD 150,000 to 800,000 by trading volume.[24]
Typical Build Cost (quoted per case)
| Cost Item | VARA Advisory-Only | VARA Broker-Dealer / Custody | VARA Exchange | ADGM FSRA Broker-Dealer / Custody | DFSA Crypto Token |
|---|---|---|---|---|---|
| Paid-up capital (locked in trust)[27][44][43] | AED 100,000≈ $27K | AED 600,000≈ $160K | AED 1,500,000≈ $410K | USD 250,000–4 million (including PRU Category 3B; higher EBCM or risk capital may apply) | USD 30,000–2 million by PIB category |
| Company formation (entity + setup) | AED 30,000–60,000≈ $8,200–16K | AED 30,000–60,000≈ $8,200–16K | AED 30,000–60,000≈ $8,200–16K | USD 15,000–30,000 | USD 25,000–50,000 |
| Legal advisory (application drafting + regulator engagement) | AED 200,000–400,000≈ $54K–110K | AED 400,000–700,000≈ $110K–190K | AED 600,000–1,000,000≈ $160K–270K | USD 200,000–400,000 | USD 200,000–400,000 |
| Compliance documentation (AML manual, risk assessment, sanctions framework, Travel Rule, ICT governance) | AED 150,000–300,000≈ $41K–82K | AED 250,000–500,000≈ $68K–140K | AED 350,000–700,000≈ $95K–190K | USD 100,000–200,000 | USD 100,000–200,000 |
| Technology / ICT documentation (cybersecurity, BCP/DR, pen testing) | AED 100,000–200,000≈ $27K–54K | AED 200,000–400,000≈ $54K–110K | AED 300,000–600,000≈ $82K–160K | USD 100,000–200,000 | USD 80,000–150,000 |
| Senior personnel (MLRO + CO + SEO + Finance, Year 1 salaries) | AED 500,000–800,000≈ $140K–220K | AED 900,000–1,500,000≈ $250K–410K | AED 1,500,000–2,500,000≈ $410K–680K | USD 400,000–700,000 | USD 400,000–800,000 |
| Office lease + fit-out + utilities | AED 150,000–400,000≈ $41K–110K | AED 300,000–700,000≈ $82K–190K | AED 500,000–1,200,000≈ $140K–330K | USD 80,000–200,000 | USD 80,000–250,000 |
| Insurance (PI + D&O + crime/hot-wallet) | AED 80,000–150,000≈ $22K–41K | AED 200,000–500,000≈ $54K–140K | AED 400,000–900,000≈ $110K–250K | USD 80,000–250,000 | USD 80,000–200,000 |
| Typical build, Year 1 (quoted per case) | AED 1.21–2.31m≈ $330K–630K | AED 2.28–4.36m≈ $620K–1.2M | AED 3.68–6.96m≈ $1M–1.9M | USD 0.98–1.98m | USD 0.97–2.05m |
| Senior personnel: MLRO, CO, SEO and Finance (annual salaries) | AED 500,000–800,000≈ $140K–220K | AED 900,000–1,500,000≈ $250K–410K | AED 1,500,000–2,500,000≈ $410K–680K | USD 400,000–700,000 | USD 400,000–800,000 |
| Office lease and utilities (annual) | AED 150,000–400,000≈ $41K–110K | AED 300,000–700,000≈ $82K–190K | AED 500,000–1,200,000≈ $140K–330K | USD 80,000–200,000 | USD 80,000–250,000 |
| Insurance: PI, D&O and crime or hot-wallet cover (annual premiums) | AED 80,000–150,000≈ $22K–41K | AED 200,000–500,000≈ $54K–140K | AED 400,000–900,000≈ $110K–250K | USD 80,000–250,000 | USD 80,000–200,000 |
| Typical build, annual ongoing from Year 2 (quoted per case) | AED 0.73–1.35m≈ $200K–370K | AED 1.4–2.7m≈ $380K–740K | AED 2.4–4.6m≈ $650K–1.3M | USD 0.56–1.15m | USD 0.56–1.25m |
The real constraint on cost is not the regulator fees; it is the senior-officer payroll and insurance lines, both of which are non-negotiable and both of which scale with activity scope. Cost optimisation is achieved by tightening activity scope at application, not by cutting on people or insurance, both of which the regulators inspect at supervisory visits.
Timeline
Realistic UAE licensing timelines range from 6 to 12 months for VARA (12 months or longer for Exchange and multi-activity licences), 9 to 19 months for ADGM FSRA, and about 11 to 22 months for DFSA applications. On the VARA route stages overlap: the entity is incorporated after the Approval to Incorporate, alongside application preparation, and parallel compliance drafting shortens Stages 3 and 4, so the VARA total is shorter than the sum of its stage ranges below. The ADGM FSRA and DFSA totals are the sums of their stage ranges. The cumulative column adds the stage mid-points in sequence and averages them across the three regimes, without allowing for overlap. The variance is driven by application quality, complexity of activity (Exchange and Custody take longer than Advisory), and operational-readiness execution speed after conditional approval.
| Stage | VARA Duration | ADGM FSRA Duration | DFSA Duration | Cumulative (sequential mid-points, three-regime average) |
|---|---|---|---|---|
| Entity formation + pre-application planning | 4–8 weeks | 4–8 weeks | 4–8 weeks | 6 weeks |
| Regulator pre-engagement / IDQ | 4–8 weeks | 4–8 weeks (pre-AIP) | 4–8 weeks | 12 weeks |
| Full application preparation | 8–16 weeks | 8–16 weeks | 12–20 weeks | 25 weeks |
| Formal review + Q&A rounds | 8–16 weeks | 12–24 weeks | 16–32 weeks | 43 weeks |
| In-principle approval | Issued at end of review | AIP issued | In-principle issued | week 43 |
| Operational readiness (post-conditional approval) | 8–16 weeks | 12–24 weeks | 12–24 weeks | 59 weeks |
| Licence grant | 1–2 weeks | 1–2 weeks | 1–2 weeks | 61 weeks |
| Total realistic (end-to-end) | 6–12 months | 9–19 months | about 11–22 months | n/a |
VARA’s two-stage process is the fastest of the three regimes for straightforward activities (Advisory, Transfer/Settlement), where a well-prepared application can move from IDQ to licence grant in 6 to 9 months. Exchange and Custody applications are materially slower because of the additional rulebook scope (Market Conduct, Custody Services) and the segregated-entity requirement for Custody.
FSRA timelines have lengthened modestly since the June 2025 amendments as the regulator processes the wave of applications under the expanded framework. DFSA is the slowest of the three because the Crypto Token endorsement is layered on top of standard DFSA authorisation, which has its own multi-month process.
What VARA’s published guidance does not cover is the typical regulator-Q-and-A cycle, which adds 6 to 12 weeks per round and is best compressed by submitting an application that anticipates every reasonable supervisory question on first filing.
Taxation
The UAE is a low-tax jurisdiction operating a 9% federal corporate tax above an AED 375,000 threshold for ordinary taxable persons. Free-zone entities meeting substance, de minimis, and audit conditions can instead hold QFZP status, taxed at 0% on Qualifying Income and 9% on other taxable income. Virtual-asset transfer and conversion are VAT-exempt financial services retroactively from , and keeping and managing virtual assets is exempt from unless supplied for an explicit fee. No personal income tax; no withholding tax.
| Tax Type | Rate | Crypto Application |
|---|---|---|
| Corporate Income Tax (federal) | 9% above AED 375,000; 0% below | Applies to ordinary taxable persons; threshold per tax period. A Qualifying Free Zone Person pays 0% on Qualifying Income and 9% on other taxable income, without this threshold.[9][54] |
| Corporate Income Tax (Qualifying Free Zone Person) | 0% on Qualifying Income | Free-zone VASPs meeting QFZP conditions retain 0% on Qualifying Income; non-qualifying income subject to 9%.[10] |
| Domestic Minimum Top-up Tax (Pillar Two) | 15% | Multinational groups with consolidated revenue ≥ EUR 750 million, fiscal years from .[12] |
| VAT (standard) | 5% | Standard rate, applies to most goods and services. |
| VAT on virtual-asset transfer and conversion; custody (no fee) | 0% (Exempt) | Per UAE FTA Public Clarification VATP040: transfer and conversion retroactively from ; keeping and managing from .[11] |
| VAT on crypto-asset services charged for explicit fee | 5% | Brokerage, management, custody services charged for an explicit fee or commission. |
| Withholding tax (dividends, interest, royalties) | 0% | Corporate Tax Law Article 45: 0% on State-sourced income of non-residents not attributable to a UAE permanent establishment; the Cabinet may set another rate.[9] |
| Personal Income Tax | 0% | No personal income tax. |
| Capital Gains Tax | 0% | No CGT for individuals; corporate gains taxed at 9% CIT rate. |
| Stamp Duty | None | No federal stamp duty. As of . |
Qualifying Free Zone Person (QFZP) Status
QFZP status under the Corporate Tax Law, Cabinet Decision No. 100 of 2023 and Ministerial Decision No. 229 of 2025 preserves the 0% corporate-tax rate for free-zone entities on Qualifying Income, provided five conditions are continuously met: adequate substance in the free zone, deriving qualifying income, de minimis test (non-qualifying revenue not exceeding AED 5 million or 5% of total revenue, whichever is lower), no election to be taxed at the standard rates, and compliance with arm’s-length transfer pricing with audited accounts.[9][10][29] Virtual-asset trading, exchange and custody are not on the published list of Qualifying Activities.
Revenue a free-zone VASP earns from mainland or non-UAE clients for trading, exchange or custody is non-qualifying revenue, because those services are not Qualifying Activities: the 0% rate reaches it only while total non-qualifying revenue stays within the de minimis limit, and above that limit the entity loses QFZP status.[10][29] Income from other free-zone persons that are the beneficial recipients can qualify in its own right, and the position must be advised on case by case;[10][29] the Federal Tax Authority has not published a virtual-asset-specific Qualifying Activities clarification as of . The common mistake is assuming free-zone incorporation alone secures the 0% rate. It does not.
CRS / CARF Reporting
The UAE is a participating CRS jurisdiction. It has ratified the CARF Multilateral Competent Authority Agreement by Federal Decree No. 60 of 2026 and enacted the implementing instrument with effect from ; the Ministry of Finance expects the first automatic exchange with partner jurisdictions in 2028, covering the 2027 reporting year.[28] CRS reporting applies to financial accounts maintained for non-UAE residents, including accounts held by crypto businesses.
Pillar Two (Global Minimum Tax)
Cabinet Decision No. 142 of 2024 introduces a 15% DMTT for in-scope multinational groups with consolidated revenue at or above EUR 750 million in two of four preceding years, applying to fiscal years starting on or after .[12] The DMTT is closely aligned with the OECD GloBE Model Rules.
Standalone UAE crypto firms below the EUR 750 million threshold remain outside DMTT scope; for in-scope groups, the DMTT applies first against UAE-sourced profits before any foreign Income Inclusion Rule top-up.[12]
Ongoing Compliance & Post-Registration
A VARA licence is an annual licence renewed every 12 months; ADGM and DFSA authorisations continue until withdrawn. All three generate continuous compliance obligations: annual audited financials, regulatory reporting, capital, and net-liquid-asset monitoring, AML/CFT operations, technology resilience attestations, regulator inspections, and ongoing fit-and-proper maintenance for senior officers. Annual ongoing compliance cost runs about AED 1.4 to 2.7 million for a broker-dealer or custody VASP, AED 0.73 to 1.35 million for advisory and AED 2.4 to 4.6 million for an exchange, per the cost table.
Annual Reporting Obligations
VARA-licensed VASPs file annual audited financial statements, an annual Compliance Officer Report, an annual MLRO Report to the UAE Financial Intelligence Unit, quarterly prudential returns (capital adequacy, net liquid assets, client-asset reconciliation), and a real-time incident reporting obligation for material operational events. Reserve assets for Custody and Exchange activities must be audited semi-annually and reconciled to client liabilities daily.
FSRA equivalents follow the FSRA Recognised Reporting Schedule (RRS) plus virtual-asset-specific returns. DFSA reporting follows DFSA Rulebook PIN module quarterly returns plus Crypto Token endorsement returns.
Renewal and Supervision Fees
A VARA licence is an annual licence: it renews for 12 months at a time, VARA sends the renewal notification 90 days in advance, and the annual supervision fee for each licensed activity is paid at renewal (see the fee table).[36] FSRA and DFSA permissions have no fixed term but carry annual fees. Late payment triggers escalating penalties and, if unpaid, suspension of activity. Recurring operating costs (office, technology, audit, advisers) typically equal or exceed annual supervision fees and should be planned for accordingly.
Regulatory Inspections
VARA, FSRA, and DFSA conduct routine supervisory engagement (typically annual desk-based reviews with periodic on-site inspections), thematic reviews on emerging risks (custody resilience, sanctions compliance, market conduct), and event-driven examinations following material incidents or complaints. Inspections require production of board minutes, governance records, AML/CFT files, technology audit reports, customer records, and reserve-asset documentation.
Inspection notice periods range from 14 days (routine) to zero notice (event-driven). In practice, the FSRA’s expectations on board minute granularity and challenge documentation exceed what most non-UAE founders are accustomed to.
Enforcement
Operating without authorisation is a federal offence under Cabinet Decision No. 111 of 2022, with penalties including fines up to AED 10 million, imprisonment, and asset forfeiture.[16] Compliance breaches by licensed entities attract administrative penalties under the relevant regulator’s enforcement powers; VARA, FSRA, and DFSA each publish annual enforcement summaries. The Central Bank of the UAE imposed more than AED 370.3 million in fines on banks, money exchange houses, insurers, and a finance company between and , demonstrating the supervisory tempo across the wider regulated financial sector.[15] Regulatory enforcement is real and active, not nominal.
Advertising and Promotion Rules
VARA’s Marketing Rulebook regulates all virtual-asset marketing addressed to or accessible from Dubai, including social media, influencer engagements, geo-targeted advertising, and event sponsorships. Marketing must carry risk warnings, must not include misleading performance claims, and must not target retail clients with high-risk products without pre-approval. FSRA and DFSA apply equivalent restrictions under their respective Conduct of Business rulebooks. Breach penalties range from administrative fines to public censure and, in serious cases, suspension of activity.
ICT Risk Management & Operational Resilience
UAE regulators impose comprehensive ICT and operational-resilience requirements through dedicated rulebook modules. VARA’s Technology and Information Rulebook, FSRA’s Conduct of Business and General modules, and DFSA’s GEN and PIB modules each require governance, risk identification, incident reporting, testing, wallet management, and third-party risk management proportionate to activity scope.
The VARA Technology and Information Rulebook requires every licensed VASP to maintain a governance framework with named accountabilities for cybersecurity, business continuity, change management, and third-party ICT risk. Identification and classification of critical information assets is mandatory. Incident reporting is event-driven: a material cybersecurity event, or an event that triggers the business-continuity and disaster-recovery plan and materially affects operations, must be reported to VARA as soon as reasonably practicable and no later than 72 hours from detection, and an incident affecting or potentially affecting personal data as soon as possible and within 24 hours of notifying a data regulator or the data subject.[52]
Penetration testing is required at least annually and must cover all client-facing systems and key custody infrastructure. Business continuity and disaster-recovery planning must be documented, tested, and reviewed annually.
For Custody licensees specifically, wallet management requires segregation of hot, warm, and cold wallets, key management procedures meeting industry standards (typically multi-signature or MPC with hardware-security-module backing), and explicit handling of key compromise scenarios in the wind-down plan. Third-party ICT risk is governed by the outsourcing register, which must list all material providers, the services they perform, and the fallback arrangements in the event of provider failure or termination.
FSRA’s expectations are broadly equivalent. The real constraint for most operators is not designing the framework but evidencing its operation: regulators inspect minutes, test results, and incident logs at supervisory visits.
Banking
UAE banking access for licensed VASPs is materially better in 2026 than in 2024, but it remains a structured process rather than a default outcome. The combination of regulatory clarity, FATF and EU delisting, and the CBUAE Payment Token Regulation has expanded bank risk appetite, and most UAE national banks now operate dedicated VASP onboarding desks.
UAE banking accessibility for licensed VASPs sits between the friction of pre-2024 offshore licences and the relative ease of MiCA-licensed EU entities. UAE national banks (the largest commercial banks domiciled in the UAE) now operate VASP onboarding desks with bespoke documentation requirements and processing teams familiar with the licence-and-Travel-Rule combination. International banks with UAE branches and subsidiaries follow group-level policies, which range from broadly supportive to selective depending on parent institution.
Specialist digital banks and EMIs that accept crypto businesses, licensed in the GCC, the EU, and Switzerland, are increasingly active in the UAE market for VASP operational accounts, paid-up-capital trust accounts, and reserve-asset segregation.
Onboarding for a licensed VASP typically takes 3 to 6 months and requires the licence itself, audited financial statements (or projections for newcos), full beneficial-ownership transparency, AML/CFT policy manuals, blockchain analytics contract evidence, wallet disclosure schedules, and source-of-wealth evidence. The Travel Rule compliance pack is increasingly requested at onboarding.
EMI and payment-institution licences within the UAE under CBUAE’s Retail Payment Services regime are gradually integrating into the VASP banking stack, providing complementary fiat rails to traditional bank accounts. In DIFC and ADGM, custodial money-services-provider arrangements provide additional fiat options for institutional operators.
The partner network spans UAE national banks, international banks with UAE branches, GCC EMIs, and EU and Swiss correspondent rails. Configured for the multi-provider structure most VASPs need, with placement coordinated in parallel to the licence application so banking is in place at operational readiness rather than after grant.
Explore Banking SolutionsA licence without banking access is a certificate on the wall: see the Banking service for the placement methodology and the high-risk-merchant pathway for adjacent operational accounts.
FATF Status & International Standing
The UAE was removed from the FATF “Jurisdictions under Increased Monitoring” list on and from the EU AML high-risk third-country list with effect from . Its 2023 follow-up report rates it compliant with 15 and largely compliant with 24 of the 40 FATF Recommendations, and partially compliant with one; the FATF assessment calendar lists its next mutual evaluation, by the FATF and MENAFATF, with a possible on-site visit in and plenary discussion in .[38][39]
The UAE was added to the FATF “Jurisdictions under Increased Monitoring” list on due to strategic deficiencies in its AML/CFT framework. It was removed on following reforms including the Executive Office to Combat Money Laundering and Terrorist Financing, a specialist financial-crimes court, enhanced beneficial-ownership transparency, the updated Federal Penal Code under Federal Decree-Law No. 36 of 2022, and intensified enforcement action.[13]
On the European Commission adopted Delegated Regulation (EU) 2025/1184 removing the UAE from the EU AML high-risk third-country list, aligning the EU list with FATF; it was published on and entered into force on .[14]
On the European Parliament did not object: the objection motion received 264 votes in favour, 369 against and 55 abstentions, short of the absolute majority of 361 needed to block the Commission’s delegated act. The Parliament had objected to an earlier Commission delegated regulation, which would also have removed the UAE, on , by 490 votes to 64 with 56 abstentions.[41]
In practice, EU-based correspondent banks and counterparties no longer apply blanket enhanced due diligence to UAE counterparties, materially reducing onboarding friction and settlement timelines.
EU Market Access
A UAE entity does not confer EU passporting rights. MiCA contains no third-country equivalence regime, and no UAE-MiCA Memorandum of Understanding exists. ESMA’s Guidelines on Reverse Solicitation under MiCA (ESMA35-1872330276-2030, published and applied from ) interpret solicitation broadly and technology-neutrally: they list signs that a firm is likely to be regarded as soliciting, such as EU-targeted advertising, EU-based influencers, EU country-code domains, geo-targeted search, and a website in an EU official language that is not customary in international finance; the assessment turns on all the facts of each case.[26] A firm that solicits EU clients cannot rely on the exemption. The exemption applies only to crypto-assets and services of the same type the client initially requested and is policed by national competent authorities monitoring online activity. For full detail on what constitutes solicitation and the documentation requirements, see Reverse Solicitation Under MiCA →.
Advantages and Limitations
The UAE offers a unique combination of regulatory clarity, tax efficiency, common-law optionality, and post-delisting reputational durability. The trade-offs are premium cost relative to MiCA jurisdictions, real substance and physical-presence requirements, a steep regulator-specific learning curve, and the absence of EU passporting.
- Three competing crypto-specific regulators. Operators can match regime to activity (VARA for Dubai retail and MENA reach, FSRA for institutional common-law product, DFSA for DIFC professional clients).
- 9% federal corporate tax, 0% only on Qualifying Income. Licensed virtual-asset activities are not Qualifying Activities and no virtual-asset QFZP guidance exists, so plan on 9% for the core business.
- 100% foreign ownership in free zones and most mainland activities since the 2021 Commercial Companies Law reforms.
- Post-FATF, post-EU AML delisting removed the automatic EU enhanced-due-diligence trigger for UAE relationships; banks still run their own checks on virtual-asset business.
- English common law in ADGM and DIFC with independent courts and arbitration centres of international standing.
- Strategic geography with deep professional-services ecosystem and time-zone overlap with both Europe and Asia.
- Premium cost relative to MiCA jurisdictions. VARA-route Year-1 totals run roughly 1.5–3.8× a comparable Cyprus MiCA Year-1 total (before Cyprus’s pro-rata annual fees) and 2.4–5.6× an Estonian one, comparing low ends with low ends and high ends with high ends. Mitigation: tighten activity scope at application to reduce capital, supervision-fee, and senior-officer overhead; phase additional activities through extensions rather than at launch.
- Physical-presence and substance requirements are real and enforced. Registered addresses without operations fail at both licensing and QFZP tax assessment. Mitigation: budget for full office and senior-team buildout from day one; do not attempt a virtual presence.
- Steep regulator-specific learning curve. Each regulator has its own rulebook, terminology, and supervisory style. Mitigation: engage advisers with named experience at the specific regulator chosen; do not assume regulator portability of compliance frameworks.
- No EU passporting. UAE licences do not authorise active marketing or solicitation to EU clients post-MiCA. Mitigation: operators targeting EU clients can obtain a separate CASP authorisation in an EU member state (full market access via passporting) or, for services provided at the client’s own exclusive initiative only, may fall within the narrow reverse solicitation exemption under MiCA Article 61.
- AED-pegged stablecoin restrictions. Assess Dirham Payment Token issuance and related services under the CBUAE licensing perimeter. Article 2 excludes financial free zones; a VARA or FSRA permission does not itself authorise mainland payment-token activity.[8] Mitigation: map the issuer, service and place of activity before selecting the permission.
How the UAE Compares
The UAE competes with Hong Kong and Singapore as Asia-Pacific crypto hubs and with Cyprus as the natural EU alternative for operators that need passporting. Hong Kong runs a stricter, exchange-led regime under the SFC; Singapore prioritises payment-services-led authorisation under the MAS; Cyprus offers MiCA passporting at roughly 27–68% of the VARA-route Year-1 cost.
| Factor | UAE (VARA / FSRA) | Hong Kong (SFC) | Singapore (MAS) | Cyprus (CySEC) |
|---|---|---|---|---|
| Licence Type | VASP Licence (VARA) / FSP (ADGM FSRA) | VATP Licence (Type 1+7) | Major Payment Institution + DPT service | MiCA CASP |
| Regulator | VARA · ADGM FSRA | SFC | MAS | CySEC |
| Timeline | 6–12 months (VARA) / 9–19 months (FSRA) | 12–18 months | More than a year before MAS review; total longer | 8–14 months |
| Capital / prudential safeguards | AED 100k–1.5m≈ $27K–410K (VARA); USD 50k–4m base for PRU Categories 2/3A/3B/3C/4 (FSRA) | HKD 5m paid-up; required liquid capital is the higher of HKD 3m and the basic amount≈ $640K paid-up; $380K liquid floor | SGD 250k≈ $200K | Annex IV class floors: EUR 50k–150k |
| Year 1 all-in | AED 1.33–7.26m≈ $360K–2M | HKD 6.39m–17.25m≈ $810K–2.2M | SGD 1.03m–2.7m≈ $810K–2.1M | EUR 217k–462k + pro-rata annual fees |
| Corporate Tax | 9% federal / 0% QFZP on qualifying income | 16.5% | 17% | 15% (from 1 Jan 2026) |
| Local Presence | UAE-resident MLRO + CO + SEO + office | HK-resident ROs + office | SG-resident officers + office | Cyprus office; locally resident MLRO and CO (CySEC practice) |
| EU Passporting | No | No | No | Yes (via MiCA passport) |
| FATF Status | Cleared | Member; no adverse listings | Member; no adverse listings | MONEYVAL-assessed; no adverse listings |
| Best For | MENA + Asia + global non-EU markets | APAC exchanges + institutional | APAC payments + DPT services | EU market access via passport |
For MiCA CASPs, the amounts shown are Annex IV class floors. Prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).
Compare every crypto jurisdiction side by side →
When the UAE Is the Right Choice
Choose the UAE if: (a) your primary market is MENA, broader Asia, or non-EU global; (b) you need a 0% effective tax rate on qualifying income with a credible substance story; (c) your counterparties or investors value English-common-law structures (ADGM or DIFC); (d) you can absorb the premium cost relative to MiCA jurisdictions because the brand value of the chosen regulator matters to your distribution.
Consider alternatives if: (a) more than 30% of revenue is or will be EU-sourced (consider Cyprus for MiCA passporting at roughly 27–68% of the VARA-route Year-1 cost); (b) APAC institutional positioning is the priority and Hong Kong’s SFC brand carries more weight with your investors than ADGM’s; (c) cost is the binding constraint (consider Cyprus or Lithuania for MiCA at lower total cost); (d) your product is primarily Dirham-denominated payment infrastructure (consider the CBUAE perimeter directly).
Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.
Common Mistakes in UAE Applications
Most failures originate before the formal submission, in the planning and personnel decisions taken in the first 90 days of the project. The errors below are recurring causes of refusal or extended review.
- Picking the regulator after office signing. Committing to office space, staffing, or entity formation before the regulator decision is final forecloses the alternative regimes (VARA, FSRA, DFSA each require their own incorporation and substance footprint). The correct sequence is regulator decision first, entity formation second, office lease third.
- Underestimating substance and physical-presence requirements. Registered addresses without genuine operations consistently fail at both authorisation and QFZP tax assessment. Regulators inspect office occupancy and resident-officer attendance at supervisory visits.
- Appointing the MLRO and Compliance Officer for cost reasons. Regulators specifically test whether senior officers have the seniority and industry knowledge to challenge the business; junior or part-time candidates are routinely rejected at fit-and-proper stage, delaying the timeline by months.
- Treating ADGM RegLab or DFSA ITL as a shortcut to full licensing. Both sandboxes are restricted-scope testing environments with customer and transaction caps, not substitutes for FSP or full authorisation. Sandbox participation is appropriate when testing a novel product under regulatory oversight, not when scaling commercially.
- Assuming the federal registration without checking it. Since the SCA–VARA agreement, Dubai-licensed VASPs can be registered by default with the federal regulator, now the Capital Market Authority, and VARA’s public register shows each licensee’s CMA registration number; a VASP serving clients in other emirates should confirm that its entry covers that service.[7][4]
- Operating Dirham-denominated payment infrastructure without CBUAE authorisation. Outside the financial free zones, issuing Dirham Payment Tokens requires a CBUAE licence; custody, transfer and conversion require the applicable CBUAE licence or registration. A VARA licence alone does not authorise those payment-token services.[8]
Frequently Asked Questions
VARA suits operators targeting Dubai’s mainland and free-zone retail and institutional market with the broadest single-licence reach: eight activity categories, public register of 56 licensed VASPs as of , AED-denominated capital, and dedicated Marketing and Compliance Rulebooks. ADGM FSRA suits institution-focused and common-law-preferred firms, particularly broker-dealers, custodians, and asset managers seeking a regime aligned with English law and an established international financial-centre brand.[36][4]
In the FSRA reported over 20 regulated firms conducting virtual-asset or Fiat-Referenced Token activities.[5] The choice depends on activity profile, client base, and whether English common law matters to investors and counterparties.
No. ADGM and DIFC offer 100% foreign ownership by default, and mainland virtual-asset activities under Dubai Economy and Tourism are generally 100% foreign-ownable since the 2021 Commercial Companies Law reforms placed VA activities on the permitted list. UAE-resident senior officers (MLRO, Compliance Officer, Senior Executive Officer) are required and must hold UAE residence visas, typically sponsored by the licensed entity.
Foreign-ownership rules at the corporate level and residency requirements at the personnel level are separate considerations, and both must be planned for from incorporation.
Only within the sandbox’s restricted scope, customer caps, and transaction limits, for the duration of the cohort or testing period. The sandbox is not a substitute for full Financial Services Permission or Authorised Firm status; scaling commercially requires a transition to full licensing. The DFSA has run the ITL as its regulatory sandbox since 2017.[21] Treating the sandbox as a shortcut to full licensing is a recurring application error.
It depends on which regulator classifies the token, and the same instrument is classified differently across the UAE. Asset-referenced virtual assets (ARVA), the usual home for real-world-asset-backed tokens, sit inside VARA’s crypto regime under the Virtual Asset Issuance Rulebook Version 2.0, effective 19 June 2025.[50][51]
A token with the features of a security is something else: an “Investment Token” under the DFSA regime in force since 25 October 2021 in DIFC, a “Digital Security” under FSMR in ADGM with guidance live since 2019, or a regulated security under SCA Decision No. 15/RM of 2025 federally (the SCA has been the Capital Market Authority since 1 January 2026). A VARA or other virtual-asset authorisation does not turn a token into a security, nor exempt one that already is. Where the structure is a fund, we route it through fund licensing instead.
For Advisory and VA Transfer and Settlement, realistically 6 to 9 months from Initial Disclosure Questionnaire to licence grant if the application is well-prepared at first submission. For Broker-Dealer, Custody, Lending, and Management activities, plan for 8 to 12 months. Exchange and multi-activity licences take 12 months or longer because of additional rulebook scope and the segregated-entity requirement for Custody. The bottleneck is typically the operational-readiness phase after conditional approval, not the regulator review itself; office fit-out, hiring, system testing, and policy finalisation routinely add 3 to 6 months.
VARA’s legacy Provisional Permit (issued 2022 to 2023) and Minimum Viable Product Operating Licence pathways have largely been superseded by the current two-stage VARA application process. Legacy operators were migrated through the Legacy Operating Permit programme. New entrants follow the two-stage VARA route for new firms: an Initial Disclosure Questionnaire leading to an Approval to Incorporate, then the full VASP Licence application, with In-Principle Approval as the conditional step before grant, under the current VARA Rulebooks Version 2.0 in force since .
Senior officers (MLRO, Compliance Officer, SEO) must be UAE-resident by the time of licence grant; in practice, residency setup begins during the application phase. The application itself can be coordinated remotely with named advisers and the regulator portal, but in-person engagement is required for site visits and senior-officer interviews at the conditional-approval stage. Founders are typically not required to relocate; senior officers are.
Two figures, not one. The statutory cost is what VARA charges under its published schedule: AED 120,000 in Year 1 for Advisory or VA Transfer and Settlement, AED 300,000 for every other activity, being the application fee plus the first-year supervision fee. ADGM FSRA and DFSA publish no single figure. At ADGM FSRA the application fee plus the pro-rated first-year supervision fee runs USD 35,000 to 255,000 by activity tier and month of grant. At DFSA the application fee plus the pro-rated initial annual fee comes to at most USD 50,000 for dealing as agent, managing assets or custody and USD 80,000 for dealing as principal (USD 50,000 as a matched principal), before endorsements, a trading venue or the supplement for listed factors such as a multi-level group structure.[35][46][24]
The build is everything else and is quoted per case: AED 1.21 to 2.31 million for a VARA Advisory-only build, AED 2.28 to 4.36 million for Broker-Dealer or Custody, AED 3.68 to 6.96 million for an Exchange or multi-activity licence, USD 0.78 to 2.69 million at ADGM FSRA depending on the permission (0.98 to 1.98 million for a broker-dealer or custody firm) and USD 0.97 to 2.05 million for a DFSA Crypto Token endorsement. Those figures cover company formation, office, senior-officer payroll, advisers, technology, compliance documentation and insurance. Neither figure includes paid-up capital, which is locked in trust rather than spent.
No. Under the VARA Company Rulebook, paid-up capital must be held at all times in a UAE-bank trust account or a surety bond with VARA as beneficiary, or in another manner VARA specifies on granting the licence, so it remains locked while the licence is in force. Capital may not be deployed for operating expenses. Net liquid assets (at least 1.2 times monthly operating expenses, reconciled daily and reported to VARA monthly) are an additional buffer above the regulatory minimum capital.[27]
Operators routinely underestimate the working-capital requirement because they conflate paid-up capital with operating cash; in practice, the two are separate budgetary lines.
Not automatically. Qualifying Free Zone Person status requires continuous compliance with five conditions: adequate substance, deriving qualifying income, de minimis test (non-qualifying revenue not exceeding AED 5 million or 5% of total revenue, whichever is lower), no election to be taxed at the standard rates, and arm’s-length transfer pricing with audited accounts.[9][10][29] Virtual-asset trading, exchange and custody are not on the published list of Qualifying Activities, so revenue from mainland or foreign clients for those services is non-qualifying revenue: it stays at 0% only while it is within the de minimis limit, and above that limit the entity loses QFZP status.[10][29] Income from other free-zone persons that are the beneficial recipients can qualify in its own right, and the position must be advised case by case.[10][29] The Federal Tax Authority has not published virtual-asset-specific QFZP guidance as of . Engage a tier-1 tax adviser before incorporation, not after.
Not through active marketing or solicitation post-MiCA. UAE licences do not confer EU passporting rights, and MiCA contains no third-country equivalence regime. Without an EU authorisation, the only basis is the MiCA Article 61 reverse solicitation exemption, which covers only services provided at the client’s own exclusive initiative. ESMA Guidelines ESMA35-1872330276-2030 (published ) list signs that a firm is likely to be regarded as soliciting, judged on all the facts, and a firm that solicits EU clients cannot rely on the exemption.[26] In practice, operators geo-block EU users, avoid EU-targeted marketing, sponsorships, and influencers, and keep evidence that each EU client initiated contact.
Operators with a material EU client base should consider a parallel CASP authorisation in an EU member state; Cyprus, Lithuania, and Estonia are the common choices.
Issuance of AED Payment Tokens requires a CBUAE licence under the Payment Token Services Regulation, effective since . A VASP licence alone does not authorise services within the CBUAE payment-token perimeter; the applicable CBUAE licence or registration is also required. Article 2 excludes the financial free zones. Elsewhere in the UAE, general merchant payments in virtual assets require Dirham Payment Tokens from a licensed issuer; Foreign Payment Tokens from a registered foreign issuer may be used to buy virtual assets or their derivatives.[8] The first CBUAE-licensed AED-pegged stablecoin issuer launched in .
Start your UAE crypto licence application
Jagelski & Partners scopes your written brief and introduces an independent specialist who runs the licensing application and banking work. Book a free assessment and we'll map your route to approval.
Not ready to submit a brief? Ask Emma first. She answers now and can collect your written brief for a specialist introduction.
References
Show all references
- VARA (Virtual Assets Regulatory Authority), VASP Public Register (56 licensed VASPs), vara.ae, accessed .
- ADGM, ADGM FSRA Presents Key Enhancements to its Digital Assets Framework at Abu Dhabi Finance Week 2025, adgm.com, accessed .
- Government of Dubai, Dubai Law No. 4 of 2022 Concerning the Regulation of Virtual Assets in the Emirate of Dubai, rulebooks.vara.ae, accessed .
- VARA, VASP Public Register (56 licensed VASPs as of 27 September 2026, each with a CMA registration number), vara.ae, accessed .
- ADGM, FSRA CEO statement at Abu Dhabi Finance Week, December 2025, adgm.com, accessed .
- DFSA, DFSA Implements Major Updates to Crypto Token Regulatory Framework, dfsa.ae, accessed .
- UAE Securities and Commodities Authority, SCA and VARA set regulatory framework for the UAE’s virtual assets sector, sca.gov.ae, accessed .
- Central Bank of the UAE, Payment Token Services Regulation (Circular No. 2/2024) (effective from 31 August 2024; Article 40 transition period; Article 22 reserve), rulebook.centralbank.ae, accessed .
- UAE Ministry of Finance, Federal Decree-Law No. 47 of 2022 on the Taxation of Corporations and Businesses, mof.gov.ae, accessed .
- UAE Ministry of Finance, Cabinet Decision No. 100 of 2023 on Determining Qualifying Income for the Qualifying Free Zone Person (which repealed Cabinet Decision No. 55 of 2023), mof.gov.ae, accessed .
- UAE Federal Tax Authority, VAT Public Clarification VATP040: Amendments to the Executive Regulation of Federal Decree-Law No. 8 of 2017 on Value Added Tax (Cabinet Decision No. 100 of 2024), 14 March 2025, tax.gov.ae, accessed .
- UAE Cabinet, Cabinet Decision No. 142 of 2024 on the Imposition of Top-up Tax on Multinational Enterprises (Article 2: Fiscal Years beginning on or after 1 January 2025; Annex Articles 1.1.1 and 18: EUR 750 million in at least two of the four preceding Fiscal Years, 15% Minimum Rate), tax.gov.ae, accessed .
- FATF, Jurisdictions under Increased Monitoring, 23 February 2024 (United Arab Emirates removed), fatf-gafi.org, accessed .
- European Commission, Commission Delegated Regulation (EU) 2025/1184 of 10 June 2025 amending Delegated Regulation (EU) 2016/1675 (United Arab Emirates removed; OJ L, 16 July 2025; in force 5 August 2025), eur-lex.europa.eu, accessed .
- The Digital Banker, UAE Central Bank imposes over AED370 million in fines on banks, exchange firms, and insurers, thedigitalbanker.com, accessed .
- UAE Cabinet, Cabinet Decision No. 111 of 2022 Regulating Virtual Assets and Their Service Providers, sca.gov.ae, accessed .
- VARA, VARA Rulebook (Version 2.0, in force 19 June 2025), rulebooks.vara.ae, accessed .
- ADGM FSRA, Digital Asset Updates implemented 10 June 2025 (Consultation Paper No. 11 of 2024), adgm.com, accessed .
- ADGM FSRA, Consultation Paper No. 10 of 2025: Virtual Asset Staking Framework, adgm.com, accessed .
- Pinsent Masons, End of Payment Tokens Regulation transition period signals new phase for UAE digital asset regulation, pinsentmasons.com, accessed .
- DFSA, Innovation Testing Licence Explainer (2025; the ITL, the DFSA’s regulatory sandbox, launched in 2017), DFSA, accessed .
- VARA, Virtual Assets and Related Activities Regulations 2023, rulebooks.vara.ae, accessed .
- DFSA, DFSA Rulebook GEN Module Chapter 3A (Crypto Tokens), dfsaen.thomsonreuters.com, accessed .
- DFSA, Fees Module (FER), VER35/04-26, Rules 2.1.1, 2.1.5, 2.1.6, 3.1.1 and 3.2.1–3.2.4, dfsaen.thomsonreuters.com, accessed .
- Lexology / Charles Russell Speechlys, The new CBUAE Payment Token Services Regulation: 10 things you need to know, lexology.com, accessed .
- ESMA, Guidelines on Reverse Solicitation under MiCA (ESMA35-1872330276-2030), esma.europa.eu, accessed .
- Virtual Assets Regulatory Authority, Company Rulebook, Parts VI.B.1–3 (Paid-Up Capital) and VI.C.1–3 (Net Liquid Assets), rulebooks.vara.ae, accessed .
- UAE Ministry of Finance, Automatic Exchange of Information (AEOI) – Crypto-Asset Reporting Framework (CARF), mof.gov.ae, accessed .
- UAE Ministry of Finance, Ministerial Decision No. 229 of 2025 Regarding Qualifying Activities and Excluded Activities, mof.gov.ae, accessed .
- DFSA, The DFSA seeks expressions of interest for Tokenisation Regulatory Sandbox (expression-of-interest window 17 March to 24 April 2025, within the Innovation Testing Licence programme), , dfsaen.thomsonreuters.com, accessed .
- UAE Government, Federal Decree-Law No. (32) of 2025 on the Capital Market Authority (Articles 2, 27 and 30: the Capital Market Authority replaces the Securities and Commodities Authority from 1 January 2026; Cabinet Decisions Nos. 111 and 112 of 2022 stay in force), uaecma.gov.ae, accessed .
- Central Bank of the UAE, Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business (effective 16 September 2025; Articles 62 and 184), rulebook.centralbank.ae, accessed .
- VARA, Publication of UAE Federal Decree-Law on AML/CFT/CPF (2025): Mandatory GAP Assessment for VASPs (circular, 24 November 2025) and Implementation of the UAE Anti-Money Laundering, Counter-Terrorism Financing and Proliferation Financing Requirements Applicable to VASPs (circular, 4 March 2026), vara.ae, accessed .
- VARA, Implementation of the UAE Virtual Assets Travel Rule Requirements (circular, 24 February 2026), media.umbraco.io, accessed .
- VARA, Virtual Assets and Related Activities Regulations 2023, Schedule 2: Supervision and Authorisation Fees, rulebooks.vara.ae, accessed .
- VARA, Licence Applications (two-stage process for new firms: Approval to Incorporate, then VASP Licence) and FAQ (the VA licence is an annual licence renewed for 12 months), vara.ae, accessed .
- VARA, Exchange Services Rulebook, Part V: Exchange Traded Derivative Services Rules (revision of 31 March 2026), rulebooks.vara.ae, accessed .
- FATF, The United Arab Emirates’ progress in strengthening measures to tackle money laundering and terrorist financing (enhanced follow-up report, 2023), fatf-gafi.org, accessed .
- FATF, Global Assessment Calendar (United Arab Emirates, FATF-MENAFATF: possible on-site visit June 2026, plenary discussion February 2027), fatf-gafi.org, accessed .
- FATF, Jurisdictions under Increased Monitoring, 19 June 2026, fatf-gafi.org, accessed .
- European Parliament roll-call votes as published by HowTheyVote.eu, Objections pursuant to the Rules of Procedure, B10-0318/2025 (9 July 2025) and B9-0210/2024 (23 April 2024), howtheyvote.eu, accessed .
- VARA, Compliance with CBUAE PTSR: Non-Objection Registration Requirement (circular, 23 July 2025; grace period ending 20 August 2025), media.umbraco.io, accessed .
- DFSA, Prudential Investment, Insurance Intermediation and Banking Module (PIB), Rules 3.5.2 and 3.6.2, dfsaen.thomsonreuters.com, accessed .
- ADGM FSRA, Prudential – Investment, Insurance Intermediation and Banking Rulebook (PRU), VER21.160926 (Rule 1.3: Categories; Rule 3.3.2: Base Capital Requirement, Category 4 USD 50,000, 3C USD 250,000, 3A USD 500,000, 2 USD 2 million, 3B USD 4 million; Rules 3.4 and 3.6: Capital Requirement; Rule 3.7.1: Expenditure Based Capital Minimum, 26/52 for virtual-asset custody), adgm.thomsonreuters.com, accessed .
- ADGM FSRA, Conduct of Business Rulebook (COBS), VER24.160926, Chapter 17 (Rule 17.3: a virtual-asset MTF holds capital under MIR Rule 3.2, six months’ operational expenses plus a buffer of up to six more), adgm.thomsonreuters.com, accessed .
- ADGM FSRA, Fees Rulebook (FEES), VER20.010126, in force (Rules 1.2.2 and 1.2.5: the first annual supervision fee is pro-rated and fees are paid in USD; Rules 3.4–3.10: base fees; Rules 3.17–3.18: virtual-asset add-ons), adgm.thomsonreuters.com, accessed .
- ADGM FSRA, FSRA General Application Process (eight steps; the in-principle approval pre-conditions include obtaining a Commercial Licence from the Registration Authority, securing premises in ADGM, opening bank accounts, and capitalising the entity), adgm.com, accessed .
- ADGM, ADGM FSRA Finalises Regulatory Framework for the Staking of Virtual Assets (; follows Consultation Paper No. 10 of 2025), adgm.com, accessed .
- DFSA, Conduct of Business Module (COB), VER51/07-26, Section 15.6 (Rule 15.6.2: appropriateness assessment before arranging, dealing or operating an MTF in Crypto Tokens for a Retail Client; Rules 15.6.3 and 15.6.4: no credit and no trading incentives for Retail Clients), dfsaen.thomsonreuters.com, accessed .
- Virtual Assets Regulatory Authority, VARA Issues Updated Activity Rulebooks to Strengthen Market Integrity and Risk Oversight (Version 2.0 of the activity-based Rulebooks and the Virtual Asset Issuance Rulebook; full compliance required by 19 June 2025), , vara.ae, accessed .
- Virtual Assets Regulatory Authority, Virtual Asset Issuance Rulebook (effective from 19 June 2025), rulebooks.vara.ae, accessed .
- Virtual Assets Regulatory Authority, Technology and Information Rulebook, Rules I.K.1 (as soon as reasonably practicable, no later than 72 hours from detection) and II.C.2 (as soon as possible and within 24 hours of notifying a data regulator or data subject of an incident affecting or potentially affecting personal data), rulebooks.vara.ae, accessed .
- Virtual Assets Regulatory Authority, Compliance and Risk Management Rulebook, Rule III.D.8 (client risk assessments at intervals no longer than three months), rulebooks.vara.ae, accessed .
- UAE Cabinet, Cabinet Decision No. 116 of 2022 on the Determination of Annual Income Subject to Corporate Tax (Articles 2 and 3: 0% up to AED 375,000, 9% above), mof.gov.ae, accessed .
- ADGM FSRA, General Rulebook (GEN), Rule 8.8.2 (a Controller holds 10% or more of the shares or voting rights), en.adgm.thomsonreuters.com, accessed .
- DFSA, General Module (GEN), Rule 11.8.2 (a Controller holds 10% or more of the shares or voting rights), dfsaen.thomsonreuters.com, accessed .
- DFSA, Fees Module (FER), Rule 1.2.9 (late payment: the greater of $1,000 or 3% of the fee, plus 1% per calendar month), dfsaen.thomsonreuters.com, accessed .