Crypto-funded debit card in United Arab Emirates

Federal layer: The Securities and Commodities Authority was renamed the Capital Market Authority (CMA) when Federal Decree-Laws No. 32 and 33 of 2025 took effect on 1 January 2026. Under Cabinet Resolution 111/2022 it supervises investment-purpose virtual assets onshore, including non-financial free zones, but the resolution does not apply to the financial free zones (DIFC, ADGM) or to payment-purpose virtual assets (CBUAE), and in Dubai outside the DIFC VARA licenses VASPs.

Dubai layer: VARA is the sole virtual-asset regulator across Dubai's mainland and free zones except the DIFC; it licenses eight activities, including VA Issuance Category 1, and its public register listed 59 active VASPs on 14 October 2026.

ADGM layer: The Financial Services Regulatory Authority (FSRA) regulates financial services, including virtual-asset activity, in the Abu Dhabi Global Market financial free zone under FSMR 2015; it treats virtual assets as tradeable commodities and maintains a consolidated list of Accepted Fiat-Referenced Tokens, nine tokens as of 1 September 2026.

CBUAE layer: The Central Bank of the UAE licenses and supervises payment-token services (issuance, conversion, and custody and transfer) onshore under the Payment Token Services Regulation C 2/2024, in force 31 August 2024; its governing statute is Federal Decree-Law No. 6 of 2025 regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business.

Dubai layer (VARA): VARA licenses eight activities, and Company Rulebook Rule VI.B.1 sets minimum paid-up capital as the higher of a fixed amount or a share of fixed annual overheads: Exchange AED 1,500,000 or 25% (AED 800,000 or 15% if using VARA-licensed custody); Broker-Dealer AED 600,000 or 25% (AED 400,000 or 15%); Custody AED 600,000 or 25%; Lending and Borrowing, and Transfer and Settlement, AED 500,000 or 25%; Management and Investment AED 500,000 or 25% (AED 280,000 or 15%); Advisory AED 100,000.

Exchange licensing depends on the layer: in Dubai outside the DIFC, VARA licenses Exchange Services (Exchange Services Rulebook effective 31 March 2026); in the DIFC, the DFSA under GEN 3A; in ADGM, the FSRA; elsewhere onshore, the Capital Market Authority (ex-SCA), whose 13 April 2026 Virtual Assets Framework includes Operating a Multilateral Trading Facility. Token bans also differ by layer: VARA prohibits anonymity-enhanced tokens, DFSA GEN 3A.2 prohibits privacy and algorithmic tokens, and CBUAE PTSR Art. 2(3) bans algorithmic stablecoins and privacy tokens onshore, including for SCA- and locally-licensed VASPs.

Dubai layer (VARA): Custody Services is one of VARA's eight licensed activities, and a VA custodian must be a distinct legal entity with a standalone licence. VARA Company Rulebook Rule VI.B.1 sets custody paid-up capital at the higher of AED 600,000 or 25% of fixed annual overheads, and Rule VI.B.3 requires paid-up capital to be held in a UAE bank trust account or a surety bond naming VARA as beneficiary.

Dubai layer (VARA): Under Dubai Law No. 4 of 2022 and the Virtual Assets and Related Activities Regulations 2023, VARA licenses eight activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, and VA Issuance Category 1.

Federal layer (Capital Market Authority, the SCA renamed on 1 January 2026): On 13 April 2026 the CMA issued its Virtual Assets Framework, with five modules (General Requirements, Conduct of Business, Alternative Trading System, AML/CFT, Prudential Requirements), and expanded regulated VA activities from three to eight: dealing as principal, dealing as agent, providing custody, arranging custody, arranging investment deals, providing investment advice, portfolio management, and operating a multilateral trading facility.

Federal Decree-Law No. 26 of 2021 only amended Federal Decree-Law No. 20 of 2018; the current UAE AML/CFT/CPF law is Federal Decree-Law No. 10 of 2025, which repealed Federal Decree-Law No. 20 of 2018 (Article 41) and took effect on 14 October 2025.

Dubai (VARA) Rule III.G.1 of the Compliance and Risk Management Rulebook requires VASPs to comply with all Federal AML-CFT Laws including Travel Rule requirements and treats Rule III.G as a minimum standard; since VARA's circular of 24 February 2026 those federal requirements include the UAE Virtual Assets Travel Rule issued under Cabinet Resolution No. 134 of 2025.

AED 3,500 is the UAE travel-rule threshold: VARA Rule III.G.2–3 applies originator and beneficiary information duties to VA transfers exceeding AED 3,500, and under the federal UAE Virtual Assets Travel Rule (VARA circular, 24 February 2026) beneficiary identity verification is required at daily aggregated transfers of AED 3,500 or more, while information must accompany transfers below that amount.

ADGM (FSRA) travel rule: AML Rule 10.3.3 (AML Rulebook VER11.210526, added 21 May 2026) requires relevant transfer information to accompany every Virtual Asset or Fiat-Referenced Token transfer with no minimum, but AML 10.3.4(2) waives verification of that information where the originator's daily aggregated transfers are below USD 1,000 and none is suspicious.

Dubai (VARA): Compliance and Risk Management Rulebook Rule III.G.4–5 requires the originator's name, account number or VA wallet address and residential or business address, and the beneficiary's name and account number or wallet address; Rule III.G.9 requires VASPs to follow the FATF Interpretive Note to Recommendation 15 and to monitor for transactions structured to circumvent Travel Rule thresholds.

Scope: Full responsibility on VASPs for FATF-aligned compliance, beyond standard AML; enforced in licensing regimes like VARA and ADGM.

No CBUAE primary was located for fines "totaling hundreds of millions AED" in 2024–2025 against crypto-linked sectors, and the February 2024 FATF grey-list exit could not be confirmed at fatf-gafi.org.

Under Federal Decree-Law No. 10 of 2025, money laundering is punishable by 1–10 years' imprisonment and a fine of AED 100,000–5,000,000 (Art. 26), legal persons face fines of AED 5,000,000–100,000,000 (Art. 27), supervisors may impose administrative fines of AED 10,000–5,000,000 per violation on VASPs (Art. 17), and Art. 20 prohibits VASP activity without a licence or registration.

Privacy and algorithmic tokens were banned onshore from 31 August 2024 by Article 2(3) of the CBUAE Payment Token Services Regulation, including for VASPs licensed by the SCA or a local authority; the DIFC bans them separately under DFSA GEN 3A.2, and VARA's 24 February 2026 travel-rule circular bars VASPs from executing transfers involving Privacy Tokens.

Under Article 170 of Federal Decree-Law No. 6 of 2025 (the CBUAE law, in force 16 September 2025), carrying on a Licensed Financial Activity listed in Article 61(1) without a Central Bank licence or authorisation is punishable by imprisonment and/or a fine of AED 50,000 to AED 500 million. This is the onshore CBUAE layer.

Article 168 of Federal Decree-Law No. 6 of 2025 (the CBUAE law, in force 16 September 2025) lets the Central Bank fine a licensed financial institution up to AED 1 billion, fine an authorised individual AED 100,000 to AED 5 million, and fine any person carrying on or promoting financial activities without a licence at least AED 1 million, alongside powers up to licence revocation.

Federal Decree-Law No. 47 of 2022 levies Corporate Tax at 9% on taxable income above AED 375,000 and 0% up to that amount (Art. 3; Cabinet Decision No. 116 of 2022, Art. 2), applying to tax periods commencing on or after 1 June 2023 (Art. 69); Qualifying Free Zone Persons pay 0% on Qualifying Income.

From 15 November 2024, under Cabinet Decision No. 100 of 2024, transfers and conversions of virtual assets are VAT-exempt (not zero-rated) under Art. 42(3)(e) of the VAT Executive Regulation, with the exemption reaching back to supplies made on or after 1 January 2018; custody of virtual assets is exempt only where no explicit fee is charged.

Privacy and algorithmic token bans exist in more than one layer: onshore, CBUAE PTSR Art. 2(3) (in force 31 August 2024) bars issuing or servicing algorithmic stablecoins and privacy tokens, including for SCA- and locally-licensed VASPs; in the DIFC, DFSA GEN 3A.2.2 has prohibited privacy tokens and devices since 1 November 2022 and GEN 3A.2.3 prohibits algorithmic tokens; in Dubai, VARA prohibits anonymity-enhanced tokens.

The CBUAE licenses Dirham Payment Token issuers under the Payment Token Services Regulation (Circular No. 2/2024, in force 31 August 2024), and VARA's FRVA Rules state that tokens referencing the AED remain under the sole and exclusive regulatory purview of the CBUAE.