← Back to United Arab Emirates Regulations

United Arab Emirates Compliance Report

Generated 2026-10-28

Comprehensive Framework

Regulatory Overview

Regulatory Status
Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s)
Capital Market Authority, Financial Services Regulatory Authority, Securities and Commodities Authority, Central Bank, Virtual Assets Regulatory Authority
Risk Level
low
Primary Legislation
Federal tax layer (applies in every regime): Federal Decree-Law No. 47 of 2022 o, CBUAE law, in force 16 September 2025, the new CBUAE law
Travel Rule
Adopted — Threshold: Implemented
Tax Reporting
UAE Corporate Tax under Federal Decree-Law No. 47 of 2022 applies 0% on taxable income up to AED 375,000 and 9% above it (Art. 3; Cabinet Decision No. 116 of 2022) for tax periods starting on or after 1 June 2023, and transfers and conversions of virtual assets are VAT-exempt under Art. 42(3)(e) of the VAT Executive Regulation.. Cabinet Decision No. 100 of 2024 (issued 6 September 2024, effective 15 November 2024) amended the VAT Executive Regulation so that the transfer of ownership and the conversion of virtual assets are exempt financial services, including services supplied on or after 1 January 2018 (Art. 42(3)(e)).. Federal Decree-Law No. 47 of 2022 levies Corporate Tax at 9% on taxable income above AED 375,000 and 0% up to that amount (Art. 3; Cabinet Decision No. 116 of 2022, Art. 2), applying to tax periods commencing on or after 1 June 2023 (Art. 69); Qualifying Free Zone Persons pay 0% on Qualifying Income.. VARA grants no VAT or Corporate Tax benefits: both taxes are federal (Federal Decree-Laws No. 8 of 2017 and No. 47 of 2022), and VARA's Compliance and Risk Management Rulebook Part II only obliges VASPs to meet all applicable tax reporting duties, including FATCA where applicable.. From 15 November 2024, under Cabinet Decision No. 100 of 2024, transfers and conversions of virtual assets are VAT-exempt (not zero-rated) under Art. 42(3)(e) of the VAT Executive Regulation, with the exemption reaching back to supplies made on or after 1 January 2018; custody of virtual assets is exempt only where no explicit fee is charged.

Key Facts

  • aml No CBUAE primary was located for fines "totaling hundreds of millions AED" in 2024–2025 against crypto-linked sectors, and the February 2024 FATF grey-list exit could not be confirmed at fatf-gafi.org. Under Federal Decree-Law No. 10 of 2025, money laundering is punishable by 1–10 years' imprisonment and a fine of AED 100,000–5,000,000 (Art. 26), legal persons face fines of AED 5,000,000–100,000,000 (Art. 27), supervisors may impose administrative fines of AED 10,000–5,000,000 per violation on VASPs (Art. 17), and Art. 20 prohibits VASP activity without a licence or registration. Privacy and algorithmic tokens were banned onshore from 31 August 2024 by Article 2(3) of the CBUAE Payment Token Services Regulation, including for VASPs licensed by the SCA or a local authority; the DIFC bans them separately under DFSA GEN 3A.2, and VARA's 24 February 2026 travel-rule circular bars VASPs from executing transfers involving Privacy Tokens. VARA publishes named enforcement against crypto firms, including the FTX Exchange FZE licence suspension (22 November 2022), a Notice of Fines on OPNX (2023), penalties on 19 unlicensed firms (7 October 2025) and Notices of Fines on CoinMENA, MEXC, KuCoin and Shelbit (June–July 2026). VARA names the entities it sanctions: its Regulatory Notices page lists 30 enforcement and warning notices, including Notices of Fines against CoinMENA FZE and MX Global (MEXC) on 22 June 2026, Peken Global (KuCoin) on 24 June 2026 and Shelbit General Trading on 24 July 2026. Federal Decree-Law No. 26 of 2021 only amended Federal Decree-Law No. 20 of 2018; the current UAE AML/CFT/CPF law is Federal Decree-Law No. 10 of 2025, which repealed Federal Decree-Law No. 20 of 2018 (Article 41) and took effect on 14 October 2025. Dubai (VARA): AML/CFT and sanctions duties for licensed VASPs sit in Part III of the Compliance and Risk Management Rulebook (effective 19 June 2025), covering the MLRO, CDD, STR reporting, the Travel Rule (III.G) and targeted financial sanctions (III.H), which requires screening against UNSC and federal lists and immediate freezing of designated persons' assets. The 2022 joint guidance banning banks from using WhatsApp for customer services has been superseded or replaced by the New CBUAE Law of 2023, and no evidence confirms the referenced guidance remains current under the new regulatory framework.
  • cross border The United Arab Emirates (UAE) has emerged as a significant player in the global cryptocurrency landscape, offering a favorable regulatory environment that supports innovation while ensuring compliance with international standards. - Source: Migration diplomacy in the Gulf - non-state actors, cross-border mobility, and the United Arab Emirates UAE crypto regulation has four layers, chosen by where a firm operates: (1) federal onshore, the Capital Market Authority (CMA, renamed from the SCA by Federal Decree-Laws 32 and 33 of 2025 from 1 January 2026), which issued its Virtual Assets Framework on 13 April 2026; (2) the CBUAE for payment tokens under the Payment Token Services Regulation (C 2/2024, in force 31 August 2024); (3) VARA, the sole VA regulator across Dubai's mainland and free zones except the DIFC; (4) the financial free zones, where the DFSA (DIFC, GEN 3A) and the ADGM FSRA run their own regimes. The licence a crypto firm needs depends on where it operates: a VARA licence for Virtual Asset activities in or from Dubai (mainland and non-DIFC free zones), including when serving global customers; DFSA authorisation in the DIFC; FSRA authorisation in ADGM; and the Capital Market Authority (formerly the SCA) framework elsewhere onshore. Payment-token services onshore additionally need a CBUAE licence or registration under PTSR Art. 2(1). ADGM's Accepted FRT list states that inclusion does not imply acceptance for serving clients outside ADGM. Crypto businesses in the UAE are required to implement robust AML/KYC procedures, including customer identity verification, transaction monitoring, and reporting suspicious activities to regulatory authorities. These measures align with FATF recommendations to combat illicit financing risks. - Source: Cross-border enforcement and regulatory arbitrage in the crypto era: Evidence from the United States and the United Arab Emirates On 7 October 2025 Dubai's VARA announced financial penalties on 19 firms for unlicensed Virtual Asset activity and breaches of its Marketing Regulations, with cease-and-desist orders and fines from AED 100,000 to AED 600,000; VARA states only VARA-licensed entities may provide Virtual Asset services in or from Dubai. VARA publishes named enforcement notices, including Notices of Fines against CoinMENA FZE (22 Jun 2026) and Morpheus Software Technology FZE (18 Aug 2025). UAE federal tax applies in every emirate and free zone. Under the VAT Executive Regulation (FDL 8/2017), as amended by Cabinet Decision 100/2024 effective 15 Nov 2024, the transfer of ownership and the conversion of Virtual Assets are exempt financial services, including supplies on or after 1 January 2018 (Art. 42(2)(k)-(l), 42(3)(e)); keeping and managing Virtual Assets is taxable where an explicit fee is charged (Art. 42(4)). Businesses dealing in crypto are subject to Corporate Tax under Federal Decree-Law 47/2022 at 9% on taxable income above the Cabinet-set threshold, for tax periods starting on or after 1 June 2023 (Arts. 3, 69). Despite a comprehensive regulatory framework, the UAE faces challenges such as the need for clearer guidelines on stablecoins, evolving international standards in digital asset regulation, and potential cybersecurity risks associated with cross-border crypto operations. Addressing these gaps is crucial to sustaining the UAE's competitive position in the global fintech ecosystem. - Source: Global Networks, Linked Cities (The Hormuz Corridor: Building a Cross-Border Region between Iran and the United Arab Emirates) Migration diplomacy in the Gulf - non-state actors, cross-border mobility, and the United Arab Emirates
  • custody Enhanced custody requirements for regulated firms handling crypto tokens Client asset segregation and protection standards Strengthened governance and disclosure requirements for crypto-related activities within the DIFC
  • enforcement Under Article 170 of Federal Decree-Law No. 6 of 2025 (the CBUAE law, in force 16 September 2025), carrying on a Licensed Financial Activity listed in Article 61(1) without a Central Bank licence or authorisation is punishable by imprisonment and/or a fine of AED 50,000 to AED 500 million. This is the onshore CBUAE layer. Article 168 of Federal Decree-Law No. 6 of 2025 (the CBUAE law, in force 16 September 2025) lets the Central Bank fine a licensed financial institution up to AED 1 billion, fine an authorised individual AED 100,000 to AED 5 million, and fine any person carrying on or promoting financial activities without a licence at least AED 1 million, alongside powers up to licence revocation. CBUAE conducts regular supervision and examinations covering capital adequacy, risk management, and compliance.UAE Banks by License Type
  • general Supervised Learning: Training models with labeled data (e.g., "This image is a cat," "This text is spam"). Unsupervised Learning: Finding hidden patterns or structures in unlabeled data (e.g., clustering customer segments). Reinforcement Learning (RL): Training agents to make decisions through trial and error within an environment to maximize a reward (e.g., training a bot to play Chess or Go). Convolutional Neural Networks (CNNs): The standard for image processing and computer vision. Recurrent Neural Networks (RNNs) / Transformers: Critical for sequence data, especially language and time series. (Transformers are the architecture behind modern Large Language Models like ChatGPT). Key Focus: Sentiment analysis, machine translation, text summarization, and dialogue generation. Dominant Tool: Large Language Models (LLMs). Key Focus: Image recognition, object detection (identifying cars, people, etc., in a frame), image segmentation (pixel-by-pixel labeling), and facial recognition.
  • licensing Federal layer: The Securities and Commodities Authority was renamed the Capital Market Authority (CMA) when Federal Decree-Laws No. 32 and 33 of 2025 took effect on 1 January 2026. Under Cabinet Resolution 111/2022 it supervises investment-purpose virtual assets onshore, including non-financial free zones, but the resolution does not apply to the financial free zones (DIFC, ADGM) or to payment-purpose virtual assets (CBUAE), and in Dubai outside the DIFC VARA licenses VASPs. Dubai layer: VARA is the sole virtual-asset regulator across Dubai's mainland and free zones except the DIFC; it licenses eight activities, including VA Issuance Category 1, and its public register listed 59 active VASPs on 14 October 2026. ADGM layer: The Financial Services Regulatory Authority (FSRA) regulates financial services, including virtual-asset activity, in the Abu Dhabi Global Market financial free zone under FSMR 2015; it treats virtual assets as tradeable commodities and maintains a consolidated list of Accepted Fiat-Referenced Tokens, nine tokens as of 1 September 2026. DIFC layer: The DFSA regulates Crypto Tokens generally in the DIFC under GEN 3A, not only investment or security tokens; since 12 January 2026 firms self-assess non-fiat Crypto Tokens for suitability, while a Fiat Crypto Token may be used only if the DFSA is satisfied it is suitable for use in the DIFC. CBUAE layer: The Central Bank of the UAE licenses and supervises payment-token services (issuance, conversion, and custody and transfer) onshore under the Payment Token Services Regulation C 2/2024, in force 31 August 2024; its governing statute is Federal Decree-Law No. 6 of 2025 regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. Dubai layer (VARA): Under Dubai Law No. 4 of 2022 and the Virtual Assets and Related Activities Regulations 2023, VARA licenses eight activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, and VA Issuance Category 1. ADGM layer (FSRA): ADGM regulates virtual-asset activity under the Financial Services and Markets Regulations 2015 (FSMR), treating virtual assets as tradeable commodities rather than securities, under a crypto-asset framework introduced in 2018. FSRA Consultation Paper No. 7 of 20 August 2024 proposed a new Regulated Activity of Issuing a Fiat-Referenced Token and stated that algorithmic stablecoins will not be permitted in ADGM; the FSRA consolidated list of Accepted Fiat-Referenced Tokens dated 1 September 2026, issued under COBS 17.2A.1, names nine tokens. Federal layer (Capital Market Authority, the SCA renamed on 1 January 2026): On 13 April 2026 the CMA issued its Virtual Assets Framework, with five modules (General Requirements, Conduct of Business, Alternative Trading System, AML/CFT, Prudential Requirements), and expanded regulated VA activities from three to eight: dealing as principal, dealing as agent, providing custody, arranging custody, arranging investment deals, providing investment advice, portfolio management, and operating a multilateral trading facility.
  • securities Crypto activity in the UAE is regulated in four layers: the federal Capital Market Authority (CMA, the renamed Securities and Commodities Authority since 1 January 2026) onshore outside the financial free zones; the CBUAE for payment tokens under the Payment Token Services Regulation (C 2/2024, in force 31 August 2024); Dubai's VARA across Dubai mainland and free zones except the DIFC; and, inside the financial free zones, the DFSA (DIFC, GEN 3A) and the FSRA (ADGM). The Capital Market Authority, established by Federal Decree-Law No. 32 of 2025, replaced the Securities and Commodities Authority on 1 January 2026 as its legal successor and is the federal capital-markets regulator; Federal Decree-Law No. 33 of 2025 does not apply in the Financial Free Zones (Art. 2(4)(d)), where the DFSA regulates the DIFC. Under Article 3(2) of Federal Decree-Law No. 33 of 2025, no person may carry out a listed Financial Activity in the UAE, including activities related to Virtual Assets (Art. 3(1)(y)), without a CMA licence or approval; Article 2(4)(d) excludes the Financial Free Zones, where the DFSA (DIFC) and the FSRA (ADGM) license firms under their own rulebooks. The UAE has been actively developing its virtual asset regulatory framework, and both the SCA and DFSA have issued licenses to financial institutions and service providers, though the practical reality is that dual regulation (federal and free-zone) requires careful navigation depending on where a business is domiciled. Vision, Mission and Regulatory Philosophy | About Us | Securities and Commodities Authority Compliance with AML/CTF and sanctions obligations is mandatory for all regulated entities, with both the SCA and DFSA enforcing comprehensive AML frameworks aligned with FATF standards. Overview of DFSA AML/CTF & Sanctions Obligations | DFSA The Capital Market Authority, which replaced the Securities and Commodities Authority on 1 January 2026, is a federal public authority with financial and administrative independence affiliated with the Cabinet, headquartered in the UAE capital (Federal Decree-Law No. 32 of 2025, Arts 2–3). Under Article 4 of Federal Decree-Law No. 32 of 2025, the CMA's objectives include ensuring the safety and efficiency of the capital market, regulating and developing it, and promoting fair competition in it. The Securities and Commodities Authority website is now the Capital Market Authority site at uaecma.gov.ae; sca.gov.ae addresses redirect there, and the CMA lists its regulations under the site's Regulations section, as Art. 81 of Federal Decree-Law No. 33 of 2025 requires it to publish its regulations and resolutions.
  • stablecoin The CBUAE licenses Dirham Payment Token issuers under the Payment Token Services Regulation (Circular No. 2/2024, in force 31 August 2024), and VARA's FRVA Rules state that tokens referencing the AED remain under the sole and exclusive regulatory purview of the CBUAE. Under VARA's FRVA Rules (Annex 1 to the VA Issuance Rulebook, version effective 19 June 2025), issuing a fiat-referenced virtual asset is Category 1 VA Issuance needing a VARA licence and approval of each FRVA; issuers keep Paid-Up Capital of AED 1,500,000 plus 2% of available supply and at least 100% Reserve Assets. The FSRA Accepted FRT list dated 1 September 2026 includes three Paxos-issued tokens: PYUSD (Paxos Trust Company, N.A.), USDP (Paxos Trust Company) and USDG (Paxos Digital Singapore). Acceptance permits use by ADGM Authorised Persons and is distinct from an FSRA permission to issue FRTs in ADGM. DFSA (DIFC): Firms self-assess tokens; fiat crypto tokens must meet strict standards. UAE virtual-asset and stablecoin activity is not unified under VARA: VARA regulates Dubai's mainland and free zones except the DIFC, the DFSA regulates the DIFC (GEN 3A), the FSRA regulates ADGM, and the CBUAE Payment Token Services Regulation governs payment-token services onshore, including for VARA- and SCA/CMA-licensed firms. Within Dubai, VARA is the sole virtual-asset regulator for the mainland and free zones except the DIFC, where the DFSA regulates Crypto Tokens under GEN 3A; this is not a UAE-wide framework, as the FSRA regulates ADGM and federal CMA and CBUAE rules apply onshore. The Financial Services Regulatory Authority (FSRA) is the financial services regulator of Abu Dhabi Global Market (ADGM), the international financial centre of Abu Dhabi, and grants the Financial Services Permissions that ADGM digital asset businesses require. The Dubai Financial Services Authority (DFSA) is a body established under Dubai law as the independent regulator of financial services and related activities for the Dubai International Financial Centre (DIFC), a financial free zone.
  • status The UAE has no single crypto licence: four layers apply by location — the federal Capital Market Authority (renamed from the SCA on 1 January 2026) onshore, the CBUAE Payment Token Services Regulation (in force 31 August 2024) for payment tokens onshore, VARA in Dubai outside the DIFC, and the free zones' own regulators (FSRA in ADGM, DFSA in the DIFC). No federal or free-zone primary was fetched for general one-year mainland licence validity or multi-year free-zone licences; the cited source is an accounting firm. No fetched primary sets a 16 September 2026 licensing deadline for entities newly in scope under Federal Decree-Law No. 6 of 2025 (the new CBUAE law); the only support is a White & Case summary, and the law's transitional article was not read.
  • tax UAE Corporate Tax under Federal Decree-Law No. 47 of 2022 applies 0% on taxable income up to AED 375,000 and 9% above it (Art. 3; Cabinet Decision No. 116 of 2022) for tax periods starting on or after 1 June 2023, and transfers and conversions of virtual assets are VAT-exempt under Art. 42(3)(e) of the VAT Executive Regulation. Cabinet Decision No. 100 of 2024 (issued 6 September 2024, effective 15 November 2024) amended the VAT Executive Regulation so that the transfer of ownership and the conversion of virtual assets are exempt financial services, including services supplied on or after 1 January 2018 (Art. 42(3)(e)). Federal Decree-Law No. 47 of 2022 levies Corporate Tax at 9% on taxable income above AED 375,000 and 0% up to that amount (Art. 3; Cabinet Decision No. 116 of 2022, Art. 2), applying to tax periods commencing on or after 1 June 2023 (Art. 69); Qualifying Free Zone Persons pay 0% on Qualifying Income. VARA grants no VAT or Corporate Tax benefits: both taxes are federal (Federal Decree-Laws No. 8 of 2017 and No. 47 of 2022), and VARA's Compliance and Risk Management Rulebook Part II only obliges VASPs to meet all applicable tax reporting duties, including FATCA where applicable. From 15 November 2024, under Cabinet Decision No. 100 of 2024, transfers and conversions of virtual assets are VAT-exempt (not zero-rated) under Art. 42(3)(e) of the VAT Executive Regulation, with the exemption reaching back to supplies made on or after 1 January 2018; custody of virtual assets is exempt only where no explicit fee is charged.
  • travel rule The UAE Virtual Assets Travel Rule, issued under Cabinet Resolution No. 134 of 2025, applies to VASPs across the UAE including all free zones; originator and beneficiary information must accompany VA transfers, beneficiary verification is required at daily aggregated transfers of AED 3,500 or more, and VARA Rule III.G uses the same AED 3,500 threshold.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-10-14. View full profile