Crypto Licensing Last updated:

Oman Crypto Licence: FSA VASP Registration and the Draft VARF

Oman regulates virtual assets through the Financial Services Authority (FSA), the body that replaced the Capital Market Authority in March 2024. As of , only an interim, AML-led VASP registration is live, under FSA Decision No. E/35/2023. The full Virtual Assets Regulatory Framework (VARF) that will license every category of VASP was announced in 2023 and consulted on, but it has not been enacted. The honest position: a firm can register on the AML/CFT basis now, but the full licence, its categories, its capital tiers and its fees, does not yet exist.

This guide covers the FSA and CBO regulatory split, the CMA-to-FSA transition, what the interim registration requires, the FSA and CBO fintech sandbox, the 15% corporate tax position, the banking friction that usually gates an Omani crypto build, and Oman’s FATF standing. Where a figure is genuinely unpublished, we say so rather than invent it. Forming the local entity is covered on the Oman company formation page; this page carries the virtual-asset licensing detail. Jagelski & Partners maps your entry against both the live registration and the forthcoming framework as one engagement.

Oman Crypto Regulation: Quick Overview
Licence TypeInterim VASP registration (AML/CFT) under FSA Decision E/35/2023, live now; full VASP licence under the VARF announced but not yet enacted
RegulatorFinancial Services Authority (FSA, formerly the CMA); Central Bank of Oman (CBO) for payments, e-money and stored value
Legal InstrumentFSA Decision E/35/2023; Royal Decree 30/2016 (AML/CFT); Royal Decree 20/2024 (FSA Law); VARF (draft)
Minimum CapitalNot yet set for VASPs. The FSA has published no VASP capital figure; the VARF, which would set capital tiers, remains in draft
Government FeesNot yet published. No VASP registration fee or VARF fee schedule has been released as of June 2026
TimelineRegistration: FSA decision within one month of a complete application. Full-licence timeline: not set (framework not enacted)
Corporate Tax15% headline (3% for qualifying small taxpayers); 5% VAT; no personal income tax; no crypto-specific tax
Local PresenceRequired: an Oman-incorporated entity with a physical place of work; Arabic-language filing expected
FATF StatusClean (monitored): MENAFATF member; Mutual Evaluation Report published December 2024; not grey-listed
Market AccessNo EU MiCA passport and no GCC-wide passport; an Oman authorisation does not reach the UAE or the EU
Best ForEarly-mover virtual-asset firms staging entry against VARF enactment; operators running the interim AML/CFT registration; mining and data-centre-adjacent operators

Why Look at Oman for Crypto Now?

Oman is an early-stage virtual-asset jurisdiction, not a settled one. The honest case for engaging now is the chance to stage entry against a framework that is coming rather than one that has arrived. A live, AML-led FSA registration already exists, the tax base is light, and demand for an Oman-specific authorisation is low and competition thin, so a well-prepared operator can be early. The trade-off is candour: the full licensing rules, capital and fees are not yet published, and banking is hard.[2]

In short: As of , Oman offers a live interim VASP registration under FSA Decision E/35/2023, but not a full VASP licence. The full Virtual Assets Regulatory Framework is still in draft. This page is honest about what you can and cannot obtain today; it is built for operators willing to enter an emerging regime early, not for those who need a finished rulebook.

Honest Differentiator: A Regime in Transition, Not a Finished Product

Most Oman crypto coverage is either a GCC round-up or a thin “is crypto legal” explainer. Few resources separate what is actually live (the AML/CFT registration) from what is merely announced (the full VARF licensing regime), and fewer still get the regulator name right after the 2024 rename. The value here is precision: the live instrument, the draft instrument, the regulator split, and the points where a figure is genuinely unknowable because the rule has not been written. An operator that understands which gate is open today, and which is not, can position ahead of a market that is still being defined.

A Light Tax Base and No Crypto-Specific Tax

Oman applies a 15% headline corporate income tax, with a 3% rate for qualifying small taxpayers, 5% VAT, and no personal income tax, so individual crypto gains are effectively untaxed.[6] There is no crypto-specific tax legislation: a virtual-asset business is taxed under the general corporate income tax and VAT rules. This is a more conventional tax position than a zero-tax offshore centre, but it pairs with onshore Gulf credibility rather than offshore reputational drag. The full taxation detail, including the Pillar Two top-up tax for large groups, is set out under Taxation below.

Mining Build-Out Signals Sovereign Commitment

Separately from VASP licensing, Oman has invested heavily in crypto mining and data-centre capacity in the Salalah Free Zone, with combined facility investment reported above USD 700 million, and on launched a national mining pool, Omanhash.om.[12] That state-backed infrastructure signals a government that views the sector as strategic, which is part of the read-through to an eventual VARF enactment. It is not, however, a VASP authorisation, and the two should never be conflated; the distinction is drawn out under Mining vs VASP Licensing below.

Where Oman Sits Against Its Gulf Peers

The realistic comparison is with the UAE, which is several years ahead with multiple live regulators, and against the EU through Cyprus for operators that need a MiCA passport. Oman is not yet competitive with the UAE for a firm that needs a full licence today. It is competitive as an early-mover position for an operator that wants an onshore Gulf footing, a clean FATF standing, and the optionality of being registered before the full framework lands. The comparison table under How Oman Compares sets the three side by side.

Is Crypto Legal in Oman?

Crypto in Oman sits in a regulated grey area: it is neither banned nor fully embraced. It is not legal tender and not protected by Omani banking law, and the Central Bank of Oman has cautioned that holders act at their own risk. At the same time, providing virtual-asset services is permitted, provided the firm registers with the FSA and meets the AML/CFT requirements. The position is permissive-but-conditional rather than prohibitionist.

In short: Holding and trading crypto is not criminalised, but crypto is not legal tender and has no banking-law protection. A business that provides virtual-asset services to or from Oman must register with the FSA under Decision E/35/2023 first. Privacy coins and anonymity tools are prohibited, and gambling is separately and absolutely prohibited.

The Central Bank of Oman issued a cautionary notice in 2020, reiterated since, stating that cryptocurrencies are not legal tender, are not protected under the Banking Law (Royal Decree 114/2000), and that no entity is licensed to trade crypto, so users transact at their own risk.[7] That notice has not been repealed by the later FSA registration regime; the two coexist. The CBO statement governs the monetary and consumer-protection angle, while the FSA registration governs who may provide virtual-asset services as a business. An operator should not read the FSA registration as overriding the CBO caution: a registered VASP still cannot present crypto as legal tender or rely on banking-law protection for crypto holdings.

Regulatory Transition: From the CMA to the FSA

The single most important, and most commonly mishandled, fact about Oman’s virtual-asset regime is the regulator rename. The Capital Market Authority (CMA) no longer exists. Under Royal Decree 20/2024, in force on , the CMA was abolished and the Financial Services Authority (FSA) took over its functions in full. Every legal reference to the CMA now reads FSA.

In short: Royal Decree 20/2024 replaced the CMA with the FSA on , transferring all assets, rights and obligations, and substituting “Financial Services Authority” for “Capital Market Authority” throughout the law. The FSA, not the former CMA, is the lead virtual-asset regulator.

What the Rename Changed, and What It Did Not

The rename was an institutional reorganisation, not a reset of the crypto rules. The FSA inherited the CMA’s mandate over capital markets, insurance and the accounting and auditing profession, and added the virtual-assets brief.[13] Crucially, the interim VASP registration that the CMA introduced in 2023 under Decision E/35/2023 carried over intact and is now administered by the FSA. The forthcoming VARF, announced under the CMA in early 2023, likewise continues as an FSA workstream. So the substantive position, a live AML registration plus a draft full framework, is exactly what it was; only the name on the door changed.

Two Instruments, Two Different Statuses

The transition that matters for an operator is not really the CMA-to-FSA rename; it is the gap between the two virtual-asset instruments:

  • Live now: the interim VASP registration. FSA Decision No. E/35/2023, issued in mid-2023, imposes mandatory registration and AML/CFT obligations on virtual-asset service providers. This is operational and the FSA decides on a complete application within one month.[2]
  • Draft: the full Virtual Assets Regulatory Framework (VARF). Announced in February 2023, consulted on between and , and intended to license every VASP category with a full supervisory and market-abuse regime. As of late 2024 it remained under review and unenacted, and an independent check in mid-2026 found no final regulation, no Official Gazette publication, and no 2026 FSA decision enacting full VASP licensing.[2][16]
Caution on dates: some secondary aggregators reference a “2025 finalising consultation” for the VARF. We could not corroborate this against any primary source; it appears to be a mis-dating of the August 2023 consultation. Treat the 2023 consultation as the only confirmed one, and the framework as not yet enacted, until the FSA publishes a final regulation.

Who Regulates Virtual Assets in Oman

Three bodies share the virtual-asset perimeter: the FSA leads on virtual assets and securities, the Central Bank of Oman covers payments and e-money, and the National Centre for Financial Information is the financial intelligence unit. Getting the right regulator for a given token or activity is the first analytical step, because a payment token, a security token and a generic virtual asset land in different places.

Definition: VASP registration (Oman, FSA Decision E/35/2023)

An Oman VASP registration is the interim, AML-led authorisation the FSA grants under Decision No. E/35/2023 to a person who provides virtual-asset services in or from Oman. It is mandatory before any virtual-asset activity, and it imposes registration, customer risk assessment, transaction monitoring, suspicious-transaction reporting to the National Centre for Financial Information, governance and periodic FSA reporting.[2] It is a registration, not a full prudential licence: it does not set licence categories, minimum capital or a fee schedule, all of which are reserved for the forthcoming VARF. The FSA decides on a complete application within one month.

The FSA and CBO Split

The boundary between the two regulators turns on what the token does. The FSA regulates virtual assets and securities; the CBO retains payments, e-money and stored-value facilities. A token that functions as e-money or a payment instrument can fall under the CBO’s National Payment Systems Law (Royal Decree 8/2018 and its Executive Regulation), while a token that is a security falls under the Securities Law (Royal Decree 46/2022) and the FSA’s capital-market rules.[15] A dual-classification analysis is often needed: the same product can carry features that engage more than one regime, and the FSA registration does not pre-empt the CBO’s jurisdiction over a payment-token element.

Case Law and Property Status

No reported Omani court ruling establishing virtual assets as property, or addressing crypto recovery or enforcement, was found as of mid-2026. The absence of case law is itself a planning fact: an operator cannot rely on a settled judicial position on whether crypto is property under Omani law, and should structure custody, client-asset segregation and dispute clauses conservatively rather than assume the courts will treat tokens as they would conventional property.

Registration Categories and Activity Perimeter

The interim registration covers a defined set of virtual-asset activities. The full VARF is expected to widen and formalise the perimeter into named licence categories, but those categories do not yet exist. What follows is the live position under Decision E/35/2023, with the proposed VARF scope flagged as proposed.

Activities Covered by the Interim Registration

Decision E/35/2023 reaches the following virtual-asset activities, which mirror the FATF VASP definition:[2]

  • Exchange between virtual assets and fiat currency. Operating an on-ramp or off-ramp between crypto and fiat.
  • Exchange between forms of virtual assets. Crypto-to-crypto exchange services.
  • Transfer of virtual assets. Moving a virtual asset on behalf of another person.
  • Safekeeping and administration of virtual assets. Custody, including control of instruments enabling control over a virtual asset.
  • Participation in financial services related to virtual assets. Including issuance and sale of a virtual asset.

Proposed VARF Perimeter (Not Yet Enacted)

The forthcoming VARF is proposed to cover crypto assets, tokens, crypto exchanges, initial coin offerings and token issuance, custody, and broker and advisory categories, with a full supervisory and market-surveillance regime.[1] Until it is enacted, none of these proposed licence categories is available, and an operator cannot apply for a VARF licence that does not yet exist. The DeFi, DAO and NFT perimeter is not defined in any enacted Omani instrument and remains open pending the final rules.

Out of Scope and Prohibited

  • Out of scope. Digital representations of fiat currency, securities and other financial assets already covered by other frameworks; payments, e-money and stored-value facilities remain with the CBO.[15]
  • Prohibited. Privacy coins and anonymity-enhancing technology, including mixers, tumblers and privacy wallets, are prohibited under the Omani approach.[2]
  • Separate prohibition. Gambling is absolutely prohibited under Omani law, independent of the virtual-asset framework.

Requirements for FSA VASP Registration

The interim registration requires a locally incorporated Omani entity with a physical place of work, an AML/CFT programme proportionate to the activity, a named compliance and risk-management function, and the systems to monitor transactions and file suspicious-transaction reports. Because the full VARF is not yet enacted, there is no published minimum-capital or prescribed-document schedule of the kind a mature licensing regime imposes; the binding requirements are the entity, the local presence and the AML build.

In short: The two make-or-break elements are (a) a genuine Omani entity with a real place of work in Oman, and (b) a working AML/CFT programme with a named compliance function. Capital and fee schedules are not yet published, so do not budget against an FSA capital figure that does not exist.
RequirementFSA Interim VASP Registration
EntityOman-incorporated legal person (mainland LLC the usual vehicle); a natural person with a place of business in Oman is also in scope
Local presenceRequired: a physical place of work in Oman, not a virtual address
Foreign ownershipUp to 100% permitted in most sectors under the Foreign Capital Investment Law (Royal Decree 50/2019)
Minimum capitalNo published VASP minimum capital figure as of June 2026 (VARF still in draft)
Compliance functionNamed compliance / MLRO function with the seniority to operate the AML/CFT programme
AML/CFT programmeCustomer risk assessment, transaction monitoring, internal policies, STR reporting, record-keeping, governance and risk-management structures
Suspicious-transaction reportingTo the National Centre for Financial Information (the FIU)
Audited financialsIFRS financial statements for the corporate entity
Local director / nationalityReported for some regulated and payment licences; not confirmed for VASPs as of June 2026
Filing languageArabic expected for official dealings; the FSA site offers English by machine translation only

Local Entity and Substance

Decision E/35/2023 reaches legal persons incorporated in Oman and natural persons with a place of business in Oman, and the original consultation indicated that VASPs must have a local presence through a legally established entity and a physical place of work.[2] Foreign ownership of up to 100% is permitted in most sectors under the Foreign Capital Investment Law (Royal Decree 50/2019), and a standard mainland LLC needs at least one or two shareholders and a physical office.[14] Oman’s free zones (Salalah, Sohar, Duqm, Al Mazunah) offer tax holidays and 100% foreign ownership, but they are logistics and industrial zones, not crypto-financial free zones, and the FSA VASP regime is national rather than zone-specific. There is therefore no city-level or free-zone crypto carve-out, which is why this page sits at the country-level Oman URL. Entity formation is covered on the Oman company formation page.

AML/CFT Obligations

Registration must be in place before any virtual-asset activity. The substantive AML/CFT obligations are customer risk assessment, transaction monitoring, internal policies and procedures, suspicious-transaction reporting to the National Centre for Financial Information, record-keeping, and governance and risk-management structures, with periodic reporting to the FSA. Existing VASPs were required to adjust within three months of the decision taking effect. The base AML law is Royal Decree No. 30/2016 on Combating Money Laundering and Terrorism Financing, whose broad “funds” definition reaches electronic and digital forms.[2] Know-your-customer procedures are expected as part of the AML/CFT programme even though the decision does not use the term “KYC” explicitly. The compliance detail is expanded under AML/CFT Compliance below.

Application Process, Timeline and the Sandbox

For the interim registration, the FSA must decide on a complete application within one month. The real work is front-loaded into assembling a complete application: the Omani entity, the physical office, the AML/CFT policy suite and the named compliance function all need to be in place before the clock starts. There is no statutory clock for the full VARF licence, because the framework has not been enacted.

In short: The FSA decides a complete registration application within one month, but expect several months of preparation before the application is complete. The full-licence timeline is unknown until the VARF is enacted. A live product can be tested via the FSA and CBO fintech sandbox in the meantime.
Step 1 Several weeks

Oman Entity Formation

Incorporate the Omani entity (a mainland LLC is the usual vehicle) and secure a physical place of work. Foreign ownership up to 100% is available in most sectors. See Oman company formation for entity-setup detail.

Step 2 Several weeks

AML/CFT Build

Draft the AML/CFT policy suite, customer risk-assessment methodology and transaction-monitoring procedures; appoint and resource the compliance / MLRO function; stand up suspicious-transaction reporting to the National Centre for Financial Information.

Step 3 Variable

Application Assembly (Arabic Expected)

Compile the registration application, governance and risk-management documentation, and entity and beneficial-ownership records. Official dealings are conducted in Arabic, so Arabic-language documentation should be prepared rather than relying on machine translation.

Step 4 Within 1 month of a complete file

FSA Decision

The FSA must decide on a complete application within one month, entering an approved VASP into a register and issuing an approved certificate. Incomplete applications restart the effective clock.

The FSA and CBO Fintech Co-Regulatory Sandbox

Oman runs an FSA Fintech Co-Regulatory Sandbox, operated jointly with the Central Bank of Oman, that lets a firm test a developed and operational solution under regulatory oversight. Applicants are notified within 30 working days of a complete application, and the sandbox is open to local or foreign, and to licensed or unlicensed, firms.[4][5] Separately, under the CBO’s own Fintech Regulatory Sandbox, an applicant should commence live testing within 15 days of final approval.[8] The sandbox is a route to test a genuinely developed product against regulatory expectations, not a shortcut to a full authorisation: it does not substitute for the FSA registration where the activity is in scope, and scaling commercially still routes back through the registration regime, and ultimately the VARF once enacted.

Costs, Fees and Capital: The Honest Position

The headline regulatory numbers an operator would normally compare, the registration fee, the licence fee, the minimum capital, are not published for Oman VASPs as of . We do not invent them. What can be budgeted with confidence is the cost of forming the entity, building the AML programme and reaching audit readiness. The table below states what is known and, just as importantly, what is not.

Why these cells read “not published”: the interim registration fee has not been released, and the VARF, which would set licence fees, annual fees and minimum capital, is still in draft. Any specific VASP fee or capital figure quoted elsewhere for Oman should be treated with caution until the FSA publishes a schedule. We would rather show a gap than a guess.
Cost ItemPosition as of June 2026
Interim VASP registration feeNot publicly published
VARF licence / annual feesNot set (VARF in draft)
VASP minimum capitalNot set / not published
Company formation (mainland LLC, government registration)Commercial registration and chamber membership are modest; a bundled government registration figure of around OMR 3,500 ~USD 9,100 across ministries has been reported
Legal, AML and compliance build (archetype)Meaningful advisory and AML-build spend for the policy suite, MLRO function, KYC and transaction-monitoring tooling, and audit readiness; precise figure not publishable until VARF licence requirements are set
Audit readinessIFRS audited financial statements for the corporate entity

Omani rial figures are converted at approximately OMR 1 = USD 2.60 (the rial is pegged). The OMR 3,500 government-registration figure is a reported mainland-formation cost, not a VASP regulatory fee, and is shown for context only. No VASP registration fee, VARF licence fee, or minimum-capital figure has been published by the FSA.

For context, and explicitly not as a VASP figure, the CBO’s separate payment-services and e-money licensing has been reported to carry a minimum capital of around OMR 500,000 ~USD 1.3m with an annual fee near OMR 5,000 ~USD 13,000. Those are CBO payment-licence numbers, not FSA VASP numbers, and should not be read across to a virtual-asset registration. The practical takeaway is that the certain costs are entity, AML build and audit; the regulatory fees and capital remain a known unknown until the FSA publishes them.

Taxation

Oman applies a 15% headline corporate income tax, a reduced 3% rate for qualifying small taxpayers, and 5% VAT, with no personal income tax and no crypto-specific tax. A virtual-asset business is taxed under the general corporate income tax and VAT rules. The one moving part for large groups is the OECD Pillar Two top-up tax, effective from 1 January 2025.

Tax TypeRateCrypto Application
Corporate Income Tax (headline)15%Standard rate on corporate profits, including a crypto operating company.[6]
Corporate Income Tax (qualifying SME)3%Reduced rate for qualifying small taxpayers meeting the thresholds.[9]
VAT (standard)5%Introduced 16 April 2021; financial services are often exempt or zero-rated.
Crypto-specific taxNoneNo dedicated cryptocurrency tax legislation; general CIT and VAT apply.
Personal Income Tax0%No personal income tax; individual crypto gains effectively untaxed.
Capital Gains TaxWithin CITNo separate CGT; corporate gains taxed within the 15% CIT.
Pillar Two top-up tax (IIR)15%In-scope multinational groups ≥ EUR 750 million, from 1 January 2025 (Royal Decree 70/2024).[6]
Withholding tax10%On certain royalties and service fees to foreign companies.

Corporate Tax and VAT

The 15% headline rate is the standard corporate position, and a qualifying small taxpayer can access a 3% rate. VAT was introduced on at 5%, with financial services commonly exempt or zero-rated, so the VAT treatment of a specific virtual-asset service needs a line-by-line analysis rather than a blanket assumption. There is no cryptocurrency-specific tax statute: an Omani crypto business is taxed as any other corporate, on its profits under the corporate income tax and on its taxable supplies under VAT.[6] The headline 15% rate is also what the crypto matrix carries for Oman, so it matches the company-formation record for the same jurisdiction.

No Personal Income Tax

Oman levies no personal income tax, so an individual’s crypto gains are effectively untaxed at the personal level, and corporate capital gains are taxed within the 15% corporate income tax rather than under a separate capital-gains regime.[9] A 10% withholding tax can apply to certain royalties and service fees paid to foreign companies, which is a planning point for cross-border service and licensing arrangements.

Pillar Two and CARF

Oman introduced an OECD Pillar Two top-up tax, an Income Inclusion Rule, via Royal Decree 70/2024, effective , applying only to in-scope multinational groups with consolidated revenue above EUR 750 million; standalone Omani crypto operators below that threshold are unaffected.[6] On the OECD Crypto-Asset Reporting Framework, Oman is not on the list of jurisdictions committed to first exchanges by 2027 or 2028, though it has signed the CRS 2.0 Addendum to the Multilateral Competent Authority Agreement, signalling intent to implement the updated common reporting standard.[10] CARF is therefore a probable future obligation to plan for, not a current one. DAC8 is an EU-only instrument and does not apply to Oman.

AML/CFT Compliance and Ongoing Obligations

The interim registration is, at heart, an AML/CFT regime. The continuing obligations are the AML programme itself: customer due diligence, transaction monitoring, suspicious-transaction reporting to the financial intelligence unit, record-keeping, governance, and periodic reporting to the FSA. Because there is no full prudential licence yet, there is no prudential-return or capital-monitoring overlay of the kind a mature regime imposes.

In short: Registration is the start of an ongoing AML/CFT obligation, not a one-off filing. The binding work is running a real programme: monitoring transactions, filing STRs to the National Centre for Financial Information, and reporting periodically to the FSA. Privacy coins and mixers are off-limits.

Ongoing AML/CFT Obligations

A registered VASP must maintain an AML/CFT policy suite, a customer risk-assessment methodology, transaction-monitoring procedures, suspicious-transaction reporting processes, a compliance or MLRO function, and governance and risk-management frameworks, with periodic reporting to the FSA and six-year-style record-keeping consistent with the AML base law.[2] The base statute is Royal Decree No. 30/2016 on Combating Money Laundering and Terrorism Financing, whose broad “funds” definition reaches digital forms and which carries penalties under Article 52. Suspicious transactions are reported to the National Centre for Financial Information, Oman’s financial intelligence unit. Audited IFRS financial statements are expected for the corporate entity.

Travel Rule and Sanctions

FATF Recommendation 15 alignment underpins Decision E/35/2023, so a Travel Rule expectation applies in principle, although a specific Oman Travel-Rule de minimis threshold is not separately published as of June 2026. A prudent operator should build Travel Rule capability and a documented sanctions-screening process into the AML programme from the outset rather than wait for a published threshold. We treat Travel Rule tooling and a named analytics vendor as part of the baseline build, because banks and counterparties ask for them even where the local rule is silent on the figure.

Advertising and Enforcement

The FSA has publicly warned against unlicensed digital-asset, commodity and crowdfunding platforms and their marketing, and urges the public to verify firms on the FSA register. There is no dedicated VARF marketing rulebook yet, in contrast to the detailed marketing regulations some Gulf peers have issued, so the marketing perimeter for a registered VASP is governed by general conduct expectations and the prohibition on operating, or promoting, an unregistered virtual-asset business rather than by a bespoke advertising code.

Operational Resilience and Security Expectations

Oman imposes no DORA-equivalent ICT and operational-resilience statute on VASPs, and the EU’s DORA does not apply because Oman is outside the EU. The expectations that do apply flow from the general governance and risk-management duties in Decision E/35/2023 and the Central Bank of Oman’s security rules for payments, rather than from a dedicated digital-resilience rulebook.

In short: There is no Omani DORA. Operational-resilience expectations are general, drawn from the AML decision’s governance duties and CBO payment-security rules. A serious operator should still build wallet-security, incident-response and business-continuity controls to international standards, because banks and the eventual VARF will expect them.

In practical terms, a registered VASP should maintain a governance framework with named accountability for cybersecurity, key and wallet management, business continuity and third-party technology risk, even though the specifics are not prescribed by an Omani digital-resilience statute. Wallet-security design, hot and cold segregation, incident response and disaster recovery should be documented and tested to recognised international standards, partly because the forthcoming VARF is expected to add an ICT module, and partly because banking counterparties and analytics vendors assess these controls during onboarding. Building to that bar now means the firm is not re-engineering its security posture when the full framework lands. Any ICT module under the VARF remains to be confirmed once the framework is enacted.

Banking for Crypto Businesses in Oman

Banking is usually the real gating constraint for an Omani crypto build, more so than the registration itself. The Central Bank of Oman has licensed no crypto entity and has stated that crypto is not legal tender and is not protected by banking law, so Omani commercial banks approach a crypto applicant conservatively. A registration does not, by itself, secure a bank account.

In short: An FSA registration is not a bank account. Plan for heavy due diligence from domestic banks, expect a structured multi-provider approach, and prepare the banking case in parallel with the registration rather than after it.

The structural reality is the same one that constrains regulated crypto firms globally: a firm often approaches several institutions before securing one full-service relationship, and onboarding diligence can run like deal diligence over a number of weeks. In Oman specifically, a domestic commercial bank serving a locally incorporated, FSA-registered VASP applies conservative know-your-business checks, source-of-funds scrutiny and case-by-case correspondent-risk review. The harder problem is often correspondent banking: a Gulf-regional bank that reaches global payment networks through a larger correspondent may decline crypto exposure structurally, to protect that correspondent relationship, rather than on the merits of the applicant.

The workable approach pairs the Omani operating entity with banking arranged through more crypto-mature hubs. In practice that means routing fiat via a crypto-native electronic money or payment institution in a crypto-mature centre, segregating client safeguarding at a separate institution, maintaining a backup operating bank, and, where the structure supports it, pairing the Omani entity with a relationship at a regulated affiliate in a crypto-mature Gulf hub. What gets an applicant onboarded is a clean package: a regulator-recognised authorisation (the FSA registration), a documented AML programme with a named analytics vendor and Travel Rule capability, Gulf or EEA-resident key persons, and clean ultimate-beneficial-owner chains away from FATF grey-list domiciles.

Jagelski & Partners Banking Partner Network
90+Institutions
Multi-railEMI + bank stack
Pre-qualifiedBefore submission

For an emerging-regime jurisdiction like Oman, the network leans on crypto-native EMIs and payment institutions in crypto-mature hubs alongside a domestic operating relationship, configured as the multi-provider stack most early-stage Gulf crypto firms need. Placement is scoped in parallel with the registration so the banking case is ready when the entity is.

Explore Banking Solutions

A registration without banking access is a certificate on the wall: see the Banking service for the placement methodology and the high-risk-merchant pathway for adjacent operational accounts.

FATF Status and International Standing

Oman is a member of MENAFATF, the FATF-style regional body for the Middle East and North Africa, and it is not on the FATF grey list or black list. Its joint FATF and MENAFATF Mutual Evaluation Report was published on , after which Oman was placed in enhanced follow-up, a standard monitoring track that is frequently, and wrongly, conflated with grey-listing.

Status as of June 2026: Oman is a MENAFATF member, not grey-listed and not black-listed. Following its December 2024 Mutual Evaluation Report, it was placed in enhanced follow-up and reports back to MENAFATF, a routine post-evaluation track. On technical compliance it was rated Compliant on 23 and Largely Compliant on 16 of the 40 FATF Recommendations.[3]

The FATF noted that Oman had significantly improved its legal, operational and supervisory AML/CFT framework in recent years, with robust technical compliance, and on that basis placed the country in enhanced follow-up rather than under increased monitoring.[3] Enhanced follow-up means Oman reports back to MENAFATF on continued improvements; it is not the “Jurisdictions under Increased Monitoring” grey list and does not carry the enhanced-due-diligence consequences of grey-listing. For a crypto operator, the practical read is positive: an Oman authorisation does not sit behind a grey-list reputational discount, which matters for correspondent banking and counterparty onboarding. FATF Recommendation 15 alignment underpins the Omani VASP registration, which is why a Travel Rule expectation applies even though a specific threshold is not separately published.

Market Access: No EU or GCC Passport

An Oman authorisation is a domestic permission. Oman is outside the EU, so there is no MiCA passport, and there is no GCC-wide crypto passport, so each Gulf state licenses separately. An Oman registration does not let a firm serve clients in the UAE, Bahrain or the EU without obtaining separate local authorisation in those markets.

In short: Oman is outside the EU, so there is no MiCA passport, and no GCC-wide crypto passport exists. An Oman authorisation does not permit cross-border service into the UAE, Bahrain or the EU without separate local licensing there.

For an operator with a material EU client base, the route is a separate MiCA CASP authorisation in an EU member state; Cyprus is a common choice for that. MiCA contains no third-country equivalence regime, so an Oman registration cannot be passported into the EU, and the only narrow non-licensed channel is the reverse-solicitation exemption under MiCA Article 61, which ESMA restricts to isolated, genuinely unsolicited contacts; see Reverse Solicitation Under MiCA for what counts as solicitation. Decision E/35/2023 itself reaches persons who offer or provide a virtual-asset service in Oman, so providing into Oman triggers the registration regardless of where the demand originates. An operator targeting the UAE market should look at the UAE regimes directly, including ADGM, VARA in Dubai and the federal framework, covered in the Abu Dhabi (ADGM) and Dubai and UAE guides.

Mining vs VASP Licensing: A Critical Distinction

Oman actively hosts crypto mining, and it is easy to mistake a mining approval for a virtual-asset-services authorisation. They are entirely separate. A mining authorisation, or participation in the national mining pool, does not authorise exchange, custody, transfer or any other VASP activity, and a VASP registration does not authorise mining.

In short: Mining and VASP licensing are different things. Oman has built licensed mining capacity in the Salalah Free Zone and launched a national mining pool, but running an exchange, custody or transfer business still needs the FSA registration under Decision E/35/2023, and ultimately a VARF licence once enacted.

Oman has invested heavily in mining and data-centre infrastructure in the Salalah Free Zone, with reported investment across the principal facilities exceeding USD 700 million, and a designated “first licence for sustainable crypto-mining in Oman” allocated substantial electricity capacity.[11] On , the Ministry of Transport, Communications and Information Technology launched Omanhash.om as the official and sole legal mining pool for licensed miners operating in Oman, with Oman reported to hold roughly 3% of global hashrate.[12]

This mining build-out is governed by national mining policy and free-zone arrangements, not by the FSA virtual-asset registration. The practical consequence is that a miner who also wants to operate an exchange, custody or transfer business needs to register with the FSA separately for the VASP activity. Treating a mining approval as a VASP authorisation is one of the more common and costly errors in this market, and is listed under Common Mistakes below.

How Oman Compares

The honest comparison places Oman against the UAE, which is several years ahead with multiple live regulators, against Cyprus as the EU MiCA route for operators that need a passport, and against the BVI as a low-cost offshore registration regime. Oman’s distinguishing feature in this set is that its full licensing regime is not yet live, which is a real disadvantage today and the source of its early-mover opportunity.

FactorOman (FSA)UAE (VARA / ADGM)Cyprus (CySEC)BVI (FSC)
Licence TypeInterim VASP registration; full VASP licence under VARF (draft)VARA VASP licence / ADGM FSPMiCA CASPVASP registration (VASP Act 2022)
RegulatorFSA (+ CBO for payments)VARA, ADGM FSRA, SCACySECBVI FSC
StatusEmerging (full framework pending)Live, multi-regulatorLive (MiCA)Live
Min. CapitalNot set / not publishedVARA regulatory capital ~USD 11k–408k by activityEUR 50k / 125k / 150k by classNo fixed floor (6–12m opex)
Application / Gov FeeNot publishedVARA AED 40k–100k~USD 10,900–27,200EUR 10k examination feeUSD 5k–10k
Timeline~1 month (registration decision)~4–8 months~3–6 months~4–6 months
Corporate Tax15% (3% SME)9% (0% qualifying free-zone)15% (from 1 Jan 2026)0%
Market AccessNone (no EU, no GCC passport)None (GCC licenses separately)EU passport (MiCA)None
FATF StatusClean (monitored)Clean (off grey list 2024)Clean (MONEYVAL)Grey-listed
Best ForEarly-mover, staged Gulf entryScaled MENA hub, live nowEU market access via passportTax-neutral offshore registration

Compare every crypto jurisdiction side by side →

UAE figures cover the VARA and ADGM regimes; see the Abu Dhabi (ADGM) and Dubai and UAE guides for the full picture. The BVI sits on the FATF grey list as of early 2026, which is reflected in the warn cell above; the others are clean, with Oman in MENAFATF enhanced follow-up, a monitoring track that is not grey-listing.

When Oman Is the Right Choice

Consider Oman if: (a) you want an onshore Gulf footing with a clean FATF standing and are willing to enter an emerging regime early; (b) the interim AML/CFT registration is sufficient for your near-term activity and you value being registered before the full framework lands; (c) you are mining or data-centre-adjacent and want to be in a jurisdiction making sovereign-scale infrastructure commitments; (d) a 15% headline corporate tax and no personal income tax suit your structure.

Consider alternatives if: (a) you need a full operating licence today (the live UAE regimes, via ADGM or VARA, are several years ahead); (b) you need EU market access (Cyprus offers a MiCA passport); (c) cost and speed are the binding constraints and a low-fee offshore registration like the BVI serves the same non-EU market; (d) you cannot accept the uncertainty of unpublished capital and fee schedules.

Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.

Common Mistakes in Oman Crypto Planning

Because Oman is an emerging regime undergoing a regulator transition, the recurring errors here are different from those in a mature market. They cluster around mistaking what is live for what is merely announced, and around confusing the several authorities and authorisations involved.

  • Assuming a full VASP licence is available now. Only the interim AML/CFT registration is live; the full VARF is not yet enacted, so there is no full VASP licence to apply for. Plan against the registration, with the VARF as a future upgrade.
  • Confusing the CMA with the FSA. The CMA was abolished and replaced by the FSA under Royal Decree 20/2024 on 25 March 2024, and the FSA is now the crypto regulator.
  • Treating a crypto-mining approval as a VASP authorisation. Mining approvals in the Salalah Free Zone, and participation in the Omanhash.om national pool, are separate from VASP licensing; running an exchange, custody or transfer business still needs the FSA registration.
  • Assuming the CBO licenses crypto. It does not. The Central Bank of Oman warns that crypto is not legal tender and regulates only payments, e-money and stored value; the FSA is the virtual-asset regulator.
  • Planning to issue or service privacy coins. Privacy coins and anonymity tools (mixers, tumblers, privacy wallets) are prohibited under the Omani approach, so building a product around them is a dead end.
  • Expecting an Oman authorisation to passport into the UAE or wider GCC. There is no GCC crypto passport; each state licenses separately, so cross-border GCC or EU service needs separate local authorisation.
  • Underestimating banking friction. A registration does not guarantee an Omani bank account; the banking case is the constraint that most often determines whether the build is viable, and it should be prepared in parallel, not after.

Frequently Asked Questions

Status & Regulator

Not yet a full one. As of June 2026, the Financial Services Authority (FSA) operates an interim anti-money-laundering VASP registration under Decision No. E/35/2023, which is live and mandatory before any virtual-asset activity. The full Virtual Assets Regulatory Framework (VARF), which is intended to license every category of VASP, was announced in 2023 and went out to public consultation in mid-2023, but it has not been enacted. So a firm can register with the FSA on the AML/CFT basis today, but it cannot yet hold a full VASP licence, because that licence does not yet exist.

The Financial Services Authority (FSA), which replaced the Capital Market Authority (CMA) under Royal Decree 20/2024 on 25 March 2024. Every reference that older sources make to the CMA now means the FSA, and the FSA is the lead virtual-asset regulator. The Central Bank of Oman (CBO) sits alongside it with jurisdiction over payments, e-money and stored-value facilities, and the CBO has stated that crypto is not legal tender and is not protected by banking law. The National Centre for Financial Information is the financial intelligence unit that receives suspicious-transaction reports.

It sits in a regulated grey area rather than being either banned or fully embraced. Crypto is not legal tender and is not protected by Omani banking law, and the CBO has cautioned the public that holders act at their own risk. At the same time, providing virtual-asset services is permitted provided the firm registers with the FSA under Decision E/35/2023 and meets the AML/CFT obligations. Privacy coins and anonymity tools such as mixers and tumblers are prohibited. Gambling is separately and absolutely prohibited under Omani law.

Registration, Process & Cost

An Omani-incorporated entity with a physical place of work in Oman, plus a working AML/CFT programme: a customer risk-assessment methodology, transaction monitoring, suspicious-transaction reporting to the National Centre for Financial Information, internal policies and procedures, record-keeping, a compliance and risk-management function, and periodic reporting to the FSA. Registration is mandatory before any virtual-asset activity begins, and existing operators were given three months from the decision taking effect to bring themselves into line. The registration is an AML/CFT gate, not a full prudential licence.

The FSA is required to decide on a complete application within one month. In practice the binding constraint is assembling a complete application: the Omani entity, the physical office, the AML/CFT policy suite and the named compliance function all need to be in place first, which typically takes several months of preparation. The timeline for the full VARF licence is not set, because the framework has not been enacted. Firms that want to test a live product can also use the FSA and CBO fintech sandbox, which notifies applicants within 30 working days of a complete application.

The honest answer is that the headline regulatory figures are not published. The FSA has not published a VASP registration fee, and the full VARF, which would set licence fees, annual fees and any minimum capital, is still in draft, so no fee schedule or capital tier exists to quote as of June 2026. We do not invent these numbers. What a firm can budget for with confidence is the Omani entity formation, the legal and AML build (policy suite, MLRO function, KYC and transaction-monitoring tooling) and audit readiness, all of which are substantial for an emerging Gulf regime.

Tax, Banking & Prohibitions

Oman applies a 15% headline corporate income tax, with a reduced 3% rate for qualifying small taxpayers, and 5% VAT, where financial services are often exempt or zero-rated. There is no personal income tax, so individual crypto gains are effectively untaxed, and there is no crypto-specific tax legislation: crypto businesses are taxed under the general corporate income tax and VAT rules. Oman introduced an OECD Pillar Two top-up tax (an Income Inclusion Rule) via Royal Decree 70/2024, effective 1 January 2025, but this applies only to in-scope multinational groups with consolidated revenue above EUR 750 million.

With difficulty, and this is usually the real gating constraint. The CBO has licensed no crypto entity and has stated that crypto is not legal tender, so Omani commercial banks apply conservative know-your-business diligence, source-of-funds scrutiny and case-by-case correspondent-risk review to a crypto applicant, and a registration does not by itself secure an account. A workable approach pairs the Omani operating entity with banking through crypto-native payment institutions or electronic money institutions in more crypto-mature hubs, segregates client safeguarding, and keeps a backup operating relationship. We prepare the banking approach as part of the engagement rather than leaving it to chance.

Privacy coins and anonymity-enhancing technology, including mixers, tumblers and privacy wallets, are prohibited under the Omani approach, which follows the consultation position on anonymity tools. Digital representations of fiat currency, securities and other financial assets already covered by other frameworks fall outside the virtual-asset perimeter: a payment or e-money token can engage the CBO regime, and a security token can engage the Securities Law and FSA capital-market rules. Gambling is separately and absolutely prohibited under Omani law, independent of the virtual-asset framework.

Mining & Cross-Border

Mining is allowed and actively hosted, but it is a separate matter from VASP licensing. Oman has built out licensed crypto-mining and data-centre capacity in the Salalah Free Zone, and on 17 June 2026 the Ministry of Transport, Communications and Information Technology launched Omanhash.om as the official and sole legal mining pool for licensed miners. A mining authorisation, or participation in the national pool, does not authorise exchange, custody, transfer or other VASP activity. Firms that want to operate an exchange or custody business still need to register with the FSA under Decision E/35/2023, and ultimately to license under the VARF once it is enacted.

No. Oman is outside the EU, so there is no MiCA passport, and no GCC-wide crypto passport exists, so each Gulf state licenses separately. An Oman authorisation does not permit cross-border service into the UAE, Bahrain or the EU without separate local licensing there. Operators with a material EU client base should obtain a separate CASP authorisation in an EU member state, and operators targeting the UAE retail or institutional market should look at the UAE regimes directly. We map which authorisations a target client base actually requires before any entity is formed.

Map your Oman virtual-asset entry

Oman’s virtual-asset regime is emerging. We map your entry against the FSA’s interim registration and the forthcoming framework, structure your entity and AML programme, and prepare your banking approach. Book a free assessment and we will scope the route.

Not ready to book? Ask Emma first. She answers now, and if it needs a human she takes your details so the consultation starts ahead.

References

Show all references
  1. Financial Services Authority (Oman), Virtual Assets Regulatory Framework announcement (proposed VARF perimeter; advisers XReg Consulting and SASLO), fsa.gov.om, 2023, accessed .
  2. Financial Services Authority (Oman), Instructions for Registration of VASPs and Implementation of AML/CFT Requirements (Decision No. E/35/2023), fsa.gov.om, June 2023 (overview: Addleshaw Goddard, Overview of Crypto in Oman, 16 January 2025), accessed .
  3. FATF / MENAFATF, Anti-money laundering and counter-terrorist financing measures: Oman, Mutual Evaluation Report (Oman placed in enhanced follow-up; Compliant on 23 and Largely Compliant on 16 of 40 Recommendations), fatf-gafi.org, 19 December 2024, accessed .
  4. Financial Services Authority (Oman), Fintech Co-Regulatory Sandbox (joint with the Central Bank of Oman): application and notification within 30 working days, e.fsa.gov.om, 2025, accessed .
  5. Financial Services Authority (Oman), Fintech Co-Regulatory Sandbox: terms and conditions of application, fsa.gov.om, 2025, accessed .
  6. PwC, Worldwide Tax Summaries: Oman, Taxes on corporate income (15% headline CIT; 5% VAT; Pillar Two top-up tax via Royal Decree 70/2024 effective 1 January 2025), taxsummaries.pwc.com, 2024–2025, accessed .
  7. Central Bank of Oman, Cautionary Notice on Cryptocurrencies (crypto not legal tender; not protected under the Banking Law, Royal Decree 114/2000; users act at own risk), cbo.gov.om, 2020, accessed .
  8. Central Bank of Oman, Fintech Regulatory Sandbox Framework (live testing within 15 days of final approval), cbo.gov.om, accessed .
  9. Moore Global, Oman Tax Guide (3% reduced rate for qualifying small taxpayers; no personal income tax; corporate gains within CIT), moore-global.com, 2025, accessed .
  10. OECD, Crypto-Asset Reporting Framework: jurisdictions committed to first exchanges by 2027 and 2028 (Oman not on the 2027/2028 first-exchange list; CRS 2.0 Addendum to the MCAA signed), oecd.org, 2025, accessed .
  11. Times of Oman / Oman News Agency, Salalah Free Zone crypto-mining and data-centre build-out (Exahertz Blockchain Data Centre; Green Data City sustainable mining licence; combined facility investment above USD 700 million), timesofoman.com, 2023–2024, accessed .
  12. Bitcoin.com / Enegix Global, Oman launches Omanhash.om as the official and sole legal mining pool for licensed miners (Ministry of Transport, Communications and Information Technology; ~3% of global hashrate), news.bitcoin.com, 17 June 2026, accessed .
  13. Trowers & Hamlins, Establishment of the Financial Services Authority of Oman (Royal Decree 20/2024) (FSA supersedes the Capital Market Authority, in force 25 March 2024; all references to the CMA replaced by the FSA), trowers.com, March 2024, accessed .
  14. PwC, Doing Business in Oman 2025 (up to 100% foreign ownership under the Foreign Capital Investment Law, Royal Decree 50/2019; mainland LLC requirements), pwc.com, 2025, accessed .
  15. Addleshaw Goddard, Overview of Crypto in Oman (FSA / CBO regulatory split; National Payment Systems Law, Royal Decree 8/2018; Securities Law, Royal Decree 46/2022; dual classification), addleshawgoddard.com, 16 January 2025, accessed .
  16. Library of Congress, Falqs: Cryptocurrency Regulation in GCC Countries (VARF announced 2023, public consultation 27 July–17 August 2023, framework remains under review and not formally finalised), blogs.loc.gov, January 2025, accessed .