Is Crypto Legal in the United Arab Emirates?

The UAE Virtual Assets Travel Rule, issued under Cabinet Resolution No. 134 of 2025, applies to VASPs across the UAE including all free zones; originator and beneficiary information must accompany VA transfers, beneficiary verification is required at daily aggregated transfers of AED 3,500 or more, and VARA Rule III.G uses the same AED 3,500 threshold.

UAE Corporate Tax under Federal Decree-Law No. 47 of 2022 applies 0% on taxable income up to AED 375,000 and 9% above it (Art. 3; Cabinet Decision No. 116 of 2022) for tax periods starting on or after 1 June 2023, and transfers and conversions of virtual assets are VAT-exempt under Art. 42(3)(e) of the VAT Executive Regulation.

Cabinet Decision No. 100 of 2024 (issued 6 September 2024, effective 15 November 2024) amended the VAT Executive Regulation so that the transfer of ownership and the conversion of virtual assets are exempt financial services, including services supplied on or after 1 January 2018 (Art. 42(3)(e)).

Federal Decree-Law No. 47 of 2022 levies Corporate Tax at 9% on taxable income above AED 375,000 and 0% up to that amount (Art. 3; Cabinet Decision No. 116 of 2022, Art. 2), applying to tax periods commencing on or after 1 June 2023 (Art. 69); Qualifying Free Zone Persons pay 0% on Qualifying Income.

VARA grants no VAT or Corporate Tax benefits: both taxes are federal (Federal Decree-Laws No. 8 of 2017 and No. 47 of 2022), and VARA's Compliance and Risk Management Rulebook Part II only obliges VASPs to meet all applicable tax reporting duties, including FATCA where applicable.

From 15 November 2024, under Cabinet Decision No. 100 of 2024, transfers and conversions of virtual assets are VAT-exempt (not zero-rated) under Art. 42(3)(e) of the VAT Executive Regulation, with the exemption reaching back to supplies made on or after 1 January 2018; custody of virtual assets is exempt only where no explicit fee is charged.

The CBUAE licenses Dirham Payment Token issuers under the Payment Token Services Regulation (Circular No. 2/2024, in force 31 August 2024), and VARA's FRVA Rules state that tokens referencing the AED remain under the sole and exclusive regulatory purview of the CBUAE.

The FSRA Accepted FRT list dated 1 September 2026 includes three Paxos-issued tokens: PYUSD (Paxos Trust Company, N.A.), USDP (Paxos Trust Company) and USDG (Paxos Digital Singapore). Acceptance permits use by ADGM Authorised Persons and is distinct from an FSRA permission to issue FRTs in ADGM.

UAE virtual-asset and stablecoin activity is not unified under VARA: VARA regulates Dubai's mainland and free zones except the DIFC, the DFSA regulates the DIFC (GEN 3A), the FSRA regulates ADGM, and the CBUAE Payment Token Services Regulation governs payment-token services onshore, including for VARA- and SCA/CMA-licensed firms.

Within Dubai, VARA is the sole virtual-asset regulator for the mainland and free zones except the DIFC, where the DFSA regulates Crypto Tokens under GEN 3A; this is not a UAE-wide framework, as the FSRA regulates ADGM and federal CMA and CBUAE rules apply onshore.

The Financial Services Regulatory Authority (FSRA) is the financial services regulator of Abu Dhabi Global Market (ADGM), the international financial centre of Abu Dhabi, and grants the Financial Services Permissions that ADGM digital asset businesses require.

VARA's governing law is Dubai Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, not federal Cabinet Resolution No. 111 of 2022; VARA regulates virtual assets across Dubai's mainland and free zones except the DIFC, and version 1 of its VA Issuance Rulebook is dated 7 February 2023.

Cabinet Decision No. 111/2022 on the Regulation of Virtual Assets and Their Service Providers is a federal instrument; the delegation of virtual-asset competencies is the subject of the separate Cabinet Decision No. 112/2022, and VARA's governing law is Dubai Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai.

ADGM states it was the first jurisdiction in the region to introduce a comprehensive regulatory framework for digital assets; the FSRA framework covers Virtual Assets, Fiat-Referenced Tokens, Digital Securities, and Derivatives and Funds of digital assets.

The DFSA's updated Crypto Token rules (GEN 3A, version in force from 12 January 2026) apply only to activities carried on in or from the DIFC; the rest of Dubai is regulated by VARA and ADGM by the FSRA.

The FSRA 'Guidance – Regulation of Virtual Asset Activities in ADGM' is in version VER07.100625 (10 June 2025) and covers the Virtual Asset Framework, Accepted Virtual Assets, capital, AML/CFT, technology governance, Fiat-Referenced Tokens and other stablecoins.

VARA's rulebook framework comprises Compulsory Rulebooks and activity Rulebooks for Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, VA Transfer and Settlement, and VA Issuance, issued under the Virtual Assets and Related Activities Regulations 2023.

Financial services entities that wish to carry on Virtual Asset, Fiat-Referenced Token, Digital Securities or digital-asset derivative and fund activities in ADGM must apply to the FSRA for a Financial Services Permission.

In ADGM, a Fiat-Referenced Token (FRT) is a digital asset meeting the FRT definition in the Financial Services and Markets Regulations: it references a fixed amount of a single fiat currency and is redeemable from its issuer on demand. Issuing an FRT is a distinct FSRA Regulated Activity (FSRA Guidance VER07.100625).

Under ADGM COBS 17.2A.1, an Authorised Person carrying on a Regulated Activity involving an FRT may use only Accepted FRTs approved by the FSRA; the list dated 1 September 2026 accepts nine FRTs (EURC, PYUSD, RLUSD, USD1, USDC, USDG, USDP, USDT, USDU), each only on specified networks.

An ADGM Authorised Person seeking inclusion of an FRT on the FSRA Accepted FRT list submits the request to its firm supervisor. The FSRA states the list may change from time to time; the consolidated list dated 1 September 2026 accepts nine FRTs.

The FSRA regulates spot virtual asset activities in ADGM, including those of multilateral trading facilities, brokers, custodians, asset managers and other intermediaries, all of which require FSRA authorisation.

The FSRA states it was the first regulator globally to regulate Virtual Asset trading platforms as Multilateral Trading Facilities, which must meet requirements on market surveillance, settlement, transaction monitoring and recording, transparency and other systems and controls.

In ADGM, any digital token that exhibits the characteristics of a Security is deemed and regulated as a Security by the FSRA, so its issuance and trading fall under the ADGM securities regime for Digital Securities.

In ADGM, Derivatives over Digital Assets and Collective Investment Funds investing in Digital Assets are regulated by the FSRA as Derivatives and Units in a Fund, and market operators and intermediaries dealing in them must be licensed by the FSRA.

Virtual asset service providers in Dubai's mainland and free zones other than the DIFC need a VARA licence for any of eight activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, and VA Issuance Category 1.

For FSRA authorisation in ADGM, applicants submit the prescribed forms; the FSRA Authorisation Team assesses the operational, financial and regulatory track record of the entity and shareholders, the fitness and propriety of senior management and key appointment holders, and the entity's resources, systems and controls.

ADGM describes its DLT Foundations Framework as the world's first framework for Blockchain Foundations and Decentralised Autonomous Organisations (DAOs), providing a governance vehicle while minimising centralisation.

Circle Internet Group announced on 9 December 2025 that it holds an FSRA Financial Services Permission in ADGM to operate as a Money Services Provider; that permission is not an ADGM FRT-issuance licence. Circle-issued USDC and EURC appear on the FSRA Accepted FRT list dated 1 September 2026.

VARA's public register listed 59 licensed VASPs, all with status Active, on 14 October 2026; the most recent licences, to Payward FZCO and Rain MENA FZE, were issued in October 2026.

ADGM states that the FSRA's spot virtual asset framework addresses the full range of associated risks, including market abuse and financial crime, investor protection, technology governance, and custody and exchange operations.

VARA's Rulebooks are issued under Dubai Law No. (4) of 2022 and the Virtual Assets and Related Activities Regulations 2023; Cabinet Decision No. 111/2022 is a federal instrument that VARA lists separately among Cabinet Resolutions.

The FSRA's Guiding Principles to Virtual Asset Regulation and Supervision set out its expectations and risk appetite through six pillars: regulation; authorisation; preventing financial crimes; supervision; enforcement; and international cooperation.

UAE federal tax law addresses virtual assets: Corporate Tax under Federal Decree-Law No. 47 of 2022 applies from tax periods starting on or after 1 June 2023, and Cabinet Decision No. 100 of 2024 added a VAT exemption for transfers and conversions of Virtual Assets to the VAT Executive Regulation (Art. 42).

ADGM and DIFC entities fall within the federal Corporate Tax Law (Federal Decree-Law No. 47 of 2022): a Qualifying Free Zone Person pays 0% only on Qualifying Income and 9% on other taxable income, and the amended VAT Executive Regulation exempts transfers and conversions of Virtual Assets.

The UAE federal Corporate Tax Law, Federal Decree-Law No. 47 of 2022, applies to tax periods commencing on or after 1 June 2023, at 0% on taxable income up to a Cabinet-set threshold and 9% above it.

UAE VAT exempts the transfer of ownership and the conversion of Virtual Assets under Articles 42(2)(k)-(l) and 42(3)(e) of the VAT Executive Regulation, as amended by Cabinet Decision No. 100 of 2024 (effective 15 November 2024), including supplies made on or after 1 January 2018; the VAT definition of Virtual Assets excludes digital representations of fiat currencies.

A stablecoin business active in several UAE zones needs separate authorisations: the FSRA in ADGM (FRT issuance is a Regulated Activity), the DFSA in the DIFC (GEN 3A), VARA elsewhere in Dubai (FRVA issuance is Category 1 VA Issuance), and a CBUAE licence or registration for payment-token services onshore (PTSR Art. 2(1)).

The FSRA Consolidated List of Accepted FRTs dated 1 September 2026 names nine tokens (EURC, PYUSD, RLUSD, USD1, USDC, USDG, USDP, USDT, USDU), each accepted only on specified networks; the FSRA states the list is subject to change and does not imply acceptance for serving clients outside ADGM.

The FSRA states that inclusion on the Accepted FRT list does not relieve potential FRT holders from conducting their own assessment of the FRT issuer, including its creditworthiness and the composition of its reserves.

Before applying to the FSRA, an applicant meets the FSRA Authorisation Team with a regulatory plan setting out planned regulated activities, internal controls and resources; the process then runs through application and fee, interviews, in-principle approval, satisfaction of conditions, and issue of the Financial Services Permission.

Crypto activity in the UAE is regulated in four layers: the federal Capital Market Authority (CMA, the renamed Securities and Commodities Authority since 1 January 2026) onshore outside the financial free zones; the CBUAE for payment tokens under the Payment Token Services Regulation (C 2/2024, in force 31 August 2024); Dubai's VARA across Dubai mainland and free zones except the DIFC; and, inside the financial free zones, the DFSA (DIFC, GEN 3A) and the FSRA (ADGM).

The Capital Market Authority, established by Federal Decree-Law No. 32 of 2025, replaced the Securities and Commodities Authority on 1 January 2026 as its legal successor and is the federal capital-markets regulator; Federal Decree-Law No. 33 of 2025 does not apply in the Financial Free Zones (Art. 2(4)(d)), where the DFSA regulates the DIFC.

Under Article 3(2) of Federal Decree-Law No. 33 of 2025, no person may carry out a listed Financial Activity in the UAE, including activities related to Virtual Assets (Art. 3(1)(y)), without a CMA licence or approval; Article 2(4)(d) excludes the Financial Free Zones, where the DFSA (DIFC) and the FSRA (ADGM) license firms under their own rulebooks.

The Capital Market Authority, which replaced the Securities and Commodities Authority on 1 January 2026, is a federal public authority with financial and administrative independence affiliated with the Cabinet, headquartered in the UAE capital (Federal Decree-Law No. 32 of 2025, Arts 2–3).

Under Article 4 of Federal Decree-Law No. 32 of 2025, the CMA's objectives include ensuring the safety and efficiency of the capital market, regulating and developing it, and promoting fair competition in it.

The Securities and Commodities Authority website is now the Capital Market Authority site at uaecma.gov.ae; sca.gov.ae addresses redirect there, and the CMA lists its regulations under the site's Regulations section, as Art. 81 of Federal Decree-Law No. 33 of 2025 requires it to publish its regulations and resolutions.

The Dubai Financial Services Authority (DFSA) is the independent regulator of financial services conducted in and from the Dubai International Financial Centre (DIFC), a financial free zone in Dubai, and is also responsible for administering AML/CFT legislation for regulated firms and DNFBPs in the DIFC.

The DFSA's legal foundation is the DIFC Regulatory Law (DIFC Law No. 1 of 2004, in force 16 September 2004), alongside the Markets Law, Collective Investment Law, Investment Trust Law and Law Regulating Islamic Financial Business, with detailed obligations in DFSA Rulebook modules such as GEN, COB, PIB and AML.

The DIFC Regulatory Law is made by the Ruler of Dubai (Article 2), and Article 23 empowers the DFSA Board of Directors to make Rules on licensing, financial resources, conduct of business and other matters related to the DFSA's objectives, powers and functions.

The CMA issues its rules as resolutions of the Chairman of its Board; in 2026 Chairman's Decisions No. 11 and No. 13 amended the Regulations Manual of the Financial Activities adopted by Decision No. 13 of 2021.

The Capital Market Authority (formerly SCA) states its vision as "a reliable, competitive, and sustainable investment environment in a world-leading capital market".

Cabinet Resolution No. 93 of 2021 names the Ministry of Finance as the UAE CRS Competent Authority and appoints the CBUAE, the Securities and Commodities Authority (now the CMA), each Financial Free Zone's appointed authority and, residually, the Ministry of Finance as Regulatory Authorities for the institutions they supervise (Art. 3).

The CMA licenses and supervises the operation of the Market, trading platforms, central clearing counterparties and central depositories, as well as brokerage and other Financial Activities (FDL 33/2025 Art. 3(1)), with oversight, inspection and investigation powers in Articles 46–48.

Under Article 39 of Federal Decree-Law No. 33 of 2025, the CMA regulates trading of Virtual Assets and related Financial Activities, and no Virtual Asset may be traded in the UAE unless it is registered with the CMA and admitted to the official list of a CMA-licensed virtual asset platform.

The DFSA regulates Crypto Tokens in the DIFC under GEN chapter 3A (in force 1 November 2022, amended 3 June 2024 and 12 January 2026); since 12 January 2026 a firm must itself assess each non-fiat Crypto Token as suitable before using it, a Fiat Crypto Token requires the DFSA to be satisfied of its suitability, Privacy and Algorithmic Tokens are prohibited, and the DFSA no longer publishes a Recognised Crypto Token list.

CMA Chairman's Resolution No. 16 of 2026 (issued 25 June 2026) allows entities licensed by the Central Bank of the UAE, except insurance companies, to carry out any activity under CMA Resolution No. 04 of 2026 on Virtual Assets Service Providers and Alternative Trading System Operators; FDL 33/2025 Art. 59 empowers the CMA to cooperate and exchange information with other UAE regulators.

Article 80 of Federal Decree-Law No. 33 of 2025 lets the CMA circulate draft regulations, with a summary and statement of purpose, for comment before issuance, and Article 81 requires the CMA to publish the regulations and resolutions it issues.

Article 41(1) of the DIFC Regulatory Law prohibits carrying on a Financial Service in or from the DIFC without DFSA authorisation (GEN Rule 7.2.1 requires a Licence); for Crypto Tokens the GEN 3A Guidance lists dealing, arranging, managing assets, advising, custody, clearing and operating an MTF, and GEN Rule 3A.2.1 additionally requires a suitability assessment of each token.

DFSA licensing rests on Part 3 of the DIFC Regulatory Law 2004, whose Article 41 Financial Services Prohibition bars unlicensed Financial Services in or from the DIFC, and on chapter 7 of the DFSA General Module (GEN), under which a person intending to carry on a Financial Service must apply to the DFSA for a Licence (GEN Rule 7.2.1).

DFSA GEN Rule 2.2.2 lists 29 Financial Services that need a DFSA Licence, including Accepting Deposits, Providing Credit, Providing Money Services, Dealing in Investments as Principal or Agent, Arranging Deals, Managing Assets, Advising, Providing and Arranging Custody and Operating an Alternative Trading System; per the GEN 3A Guidance, nine of them apply directly to Crypto Tokens.

DFSA capital rules are in the Prudential – Investment, Insurance Intermediation and Banking module (PIB): PIB Rule 3.6.2 (version from 1 July 2025) sets a Base Capital Requirement by firm Category, e.g. US$10 million for Categories 1 and 5, US$2 million for Category 2, US$1 million for a Category 3B firm whose only such service is Providing Custody of Crypto Assets, and US$30,000 for most Category 4 firms.

Article 3 of Federal Decree-Law No. 33 of 2025 lists the Financial Activities requiring a CMA licence or approval, including brokerage, general clearing, dealing in Financial Products, financial advisory, custody, portfolio management, virtual-asset activities and investment-based crowdfunding.

No natural person may perform a CMA accredited function without prior CMA approval or accreditation (FDL 33/2025 Art. 4), and licensed persons must stay within the limits of their CMA licence and meet its conditions on an ongoing basis (Art. 12).

A DFSA Licence applicant must apply under GEN Rule 7.2.1 and be a body corporate or partnership (GEN Rule 7.2.2); since 12 January 2026 a Crypto Token applicant must be a DIFC Companies Law company unless it is a supervised foreign branch outside ATS, clearing, custody and market-making; under Regulatory Law Article 49 the DFSA may impose or vary licence conditions at any time.

Applications for a CMA licence, approval, registration or accreditation are filed with the CMA in the prescribed form (FDL 33/2025 Art. 6); the CMA may grant or refuse with written reasons and may attach conditions (Art. 8).

Under DFSA GEN Rule 7.5.1 (version from 1 July 2026) an Authorised Firm must at all times have a Senior Executive Officer, Finance Officer, Compliance Officer and Money Laundering Reporting Officer, each an Authorised Individual approved by the DFSA, and under GEN Rule 7.2.2(7) a Crypto Token applicant must generally be incorporated under the DIFC Companies Law.

Federal Decree-Law No. 33 of 2025 applies to Financial Activities practised in the UAE and to any person in a (non-financial) Free Zone, whether conducted inside or outside that zone (Art. 2(1)(b)); it does not apply to the Financial Free Zones (Art. 2(4)(d)), and Art. 3(2) requires a CMA licence or approval for every listed Financial Activity.

The CMA sets fit-and-proper conditions for board members and executive management of licensed persons and must approve their appointment (FDL 33/2025 Art. 10, except CBUAE-supervised firms); licensed persons must manage and disclose conflicts of interest and maintain compliance controls (Art. 12).

The CMA Virtual Assets Framework issued on 13 April 2026 has five modules (General Requirements, Conduct of Business, Alternative Trading System, AML/CFT, Prudential Requirements) and expands regulated virtual-asset activities from three to eight, including dealing as principal or agent, custody, investment advice, portfolio management and operating a multilateral trading facility.

DFSA AML Rule 5.2.1 (version from 2 March 2026) requires DIFC firms to establish and maintain effective AML policies, procedures, systems and controls approved by senior management, tailored to the nature, scale and complexity of the business, able to identify PEPs and comply with Federal AML legislation, with regular management information and periodic risk assessments of their adequacy.

In the DIFC, DFSA AML Rule 7.1.1 requires every Relevant Person to undertake Customer Due Diligence for each customer, and AML Rule 7.2.1 requires it when establishing a business relationship; under AML Rule 7.3.1 the firm must identify and verify the customer and take reasonable measures to verify any Beneficial Owners, using reliable and independent source documents, data or information.

In the DIFC, DFSA AML Rule 7.1.1(1)(b) requires Enhanced Customer Due Diligence for any customer the firm has rated high risk under its AML Rule 6.1.1 customer risk assessment; AML Rule 7.4.1 (version from 1 May 2024) then requires additional identification and purpose information, more frequent CDD updates, reasonable measures to establish source of funds and source of wealth, enhanced monitoring and senior-management approval.

The DFSA's AML obligations sit in the Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (AML) of its rulebook: firms must appoint an MLRO (AML Rule 11.2.1) and a Compliance Officer (GEN Rule 7.5.1), have their audit function regularly review AML controls (AML Rule 9.4.1), and file an annual AML Return by the end of September covering 1 August to 31 July (AML Rule 14.5.1).

Under DFSA AML Rule 13.3.1 (version from 2 March 2026), when a DIFC firm's MLRO receives an internal suspicion notification it must without delay inquire into it, determine under Federal AML legislation (Federal Decree-Law No. 10 of 2025) whether a Suspicious Activity Report must be made to the UAE FIU, file it if required, and notify the DFSA immediately after filing.

DFSA AML Rule 14.4.1 requires DIFC firms to keep CDD documents, transaction records sufficient to reconstruct individual transactions, internal findings, Suspicious Activity Reports and FIU communications for at least six years from the date the report was made, the business relationship ended or the transaction completed, whichever is last.

For a corporate customer in the DIFC, DFSA AML Rule 7.3.3 requires the firm to identify the natural persons who ultimately have a controlling ownership interest, direct or indirect, or otherwise exercise control; if none can be identified after exhausting all means and there is no suspicion, senior management is treated as the Beneficial Owner and the steps taken must be recorded.

DFSA AML Rule 7.3.8 requires DIFC firms to take reasonable measures to determine whether a customer or Beneficial Owner is a Politically Exposed Person and, for every PEP, to obtain senior-management approval, establish source of wealth and source of funds, and increase monitoring; full Enhanced Customer Due Diligence under AML Rule 7.4.1 applies only where the PEP is rated high risk.

The DFSA AML module Guidance (version from 2 March 2026) states that federal AML law applies in the DIFC: Federal Decree-Law No. 10 of 2025 on AML, CFT and proliferation financing, Federal Law No. 7 of 2014 on terrorism offences and their implementing regulations, including Cabinet Resolution No. 134 of 2025; the DFSA supervises DIFC firms for compliance and Regulatory Law Article 71(1) requires compliance with the federal regime.

The DFSA AML module Guidance states that the DFSA had regard to the FATF Recommendations in making its AML Rules, but where a FATF Recommendation or interpretive note conflicts with a DFSA AML Rule, the Rule takes precedence for DIFC firms.

CMA-licensed firms are subject to the federal AML/CFT regime: Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation, which supersedes Federal Decree-Law No. 20 of 2018, and its implementing Cabinet Resolution No. 134 of 2025, which supersedes Cabinet Decision No. 10 of 2019.

UAE FATCA reporting rests on the 17 June 2015 US–UAE intergovernmental agreement and Cabinet Resolution No. 63 of 2022; UAE Reporting Financial Institutions, including those supervised by the CMA (formerly SCA), report specified account information annually to the UAE Ministry of Finance, which exchanges it with the US IRS.

Under Cabinet Resolution No. 93 of 2021, each Reporting Financial Institution must apply the Common Reporting Standard due-diligence procedures and file a Report on Reportable Account Information with its Regulatory Authority (the CMA, formerly SCA, for firms it supervises) or directly with the Ministry of Finance as Competent Authority (Art. 4); the CMA states that RFIs report annually to the UAE Ministry of Finance, which exchanges the data with peer jurisdictions.

Under DFSA AML Rule 11.2.1 a DIFC firm must appoint a Money Laundering Reporting Officer with sufficient seniority and independence who is resident in the UAE, and under GEN Rule 7.5.1 the MLRO, together with the Senior Executive Officer, Finance Officer and Compliance Officer, must be held at all times by an Authorised Individual approved by the DFSA.

DFSA AML Rule 12.1.1 requires DIFC firms to give AML training to all relevant employees at appropriate and regular intervals, tailored to their products, customers and channels, covering Federal AML legislation, internal controls, recognising suspicious activity, MLRO reporting and the sanctions matters in AML chapter 10.

DFSA AML Rule 10.2.1 (version from 1 January 2024) requires DIFC firms to maintain effective systems and controls to stay informed of, and take reasonable measures to comply with, United Nations Security Council resolutions and sanctions, and to enable compliance with Article 21 of UAE Cabinet Decision No. 74 of 2020 on terrorism lists.

Under Article 90 of the DIFC Regulatory Law the DFSA may fine, censure, order restitution or disgorgement, issue cease-and-desist directions and prohibit individuals for any contravention of DFSA-administered legislation; recent fines include Ark Capital Management (Dubai) Limited, USD 504,000 (6 February 2026), and Vault Wealth Limited, USD 109,200 (1 October 2026).

DFSA sanctions under Regulatory Law Article 90 follow the Schedule 3 decision-making procedures (an opportunity to make representations, then a Decision Notice), and the person may refer the decision to the Financial Markets Tribunal; on 3 February 2026 the FMT dismissed Al Ramz Capital LLC's reference and upheld a USD 25,000 DFSA fine.

Article 65 of Federal Decree-Law No. 33 of 2025 lets the CMA impose warnings, reprimands, fines up to AED 200 million or ten times the profit gained or loss avoided, trading suspensions of up to three years, and licence revocation for breaches of the Capital Market Law.

The DFSA enforces the DIFC Financial Services Prohibition against unauthorised firms: on 1 October 2026 it fined Vault Wealth Limited USD 109,200 (reduced 30% for settlement) because its staff advised clients and arranged deals from a DIFC office between February and May 2024 without DFSA authorisation.

The Capital Market Authority (formerly SCA) publishes news releases in the Media Centre of uaecma.gov.ae, including its 13 April 2026 announcement of the Virtual Assets Framework.

The UAE VAT Executive Regulation, as amended by Cabinet Decision No. 100 of 2024 (issued 6 September 2024, effective 15 November 2024), defines Virtual Assets as a digital representation of value that can be digitally traded or converted, excluding digital representations of fiat currencies.

UAE Corporate Tax under Federal Decree-Law No. 47 of 2022 applies to tax periods starting on or after 1 June 2023 at 0% on taxable income up to a Cabinet-set threshold and 9% above it (Arts 3, 69), with no carve-out for income from virtual assets.

Since 15 November 2024 (Cabinet Decision No. 100 of 2024), the UAE VAT Executive Regulation treats the transfer of ownership and the conversion of Virtual Assets as exempt financial services, applied to supplies made on or after 1 January 2018 (Art. 42(2)(k)–(l), 42(3)(e)).

The CMA (formerly SCA) is a Regulatory Authority under the UAE CRS and FATCA regimes for the financial institutions it supervises and publishes CRS guidance notes and circulars for them, though it does not set tax rates.

UAE crypto regulation has four layers: the federal Capital Market Authority (renamed from the SCA on 1 January 2026) onshore, VARA across Dubai mainland and free zones except the DIFC, the FSRA in ADGM, and the DFSA in the DIFC under GEN chapter 3A; a firm must hold the licence of the layer where it operates.

Federal Decree-Law No. 33 of 2025 (in force 1 January 2026) is a single federal capital-markets law that covers Virtual Assets (Art. 39) and virtual-asset activities (Art. 3(1)(y)) alongside securities; it does not apply in the Financial Free Zones, where the DFSA regulates crypto tokens under GEN 3A.

A licence from another UAE regulator does not cover DIFC activity: on 1 October 2026 the DFSA fined ADGM/FSRA-licensed Vault Wealth Limited USD 109,200 for advising and arranging in the DIFC without DFSA authorisation, stating that authorisation by another regulator does not permit financial services in or from the DIFC; CMA (ex-SCA), VARA, FSRA and DFSA licences are separate.

The CMA (formerly SCA) has a codified virtual-asset regime: Federal Decree-Law No. 33 of 2025 Art. 39 and the Virtual Assets Framework of 13 April 2026, implemented by CMA Chairman's Resolution No. 04 of 2026 on Virtual Assets Service Providers and Alternative Trading System Operators.

Under the UAE VAT Executive Regulation as amended by Cabinet Decision No. 100 of 2024, keeping and managing Virtual Assets is a financial service that is exempt only when no explicit fee, commission or similar consideration is charged; fee-based VA services are taxable (Art. 42(2)(m), 42(3)(a), 42(4)).