Crypto ATM / kiosk operator in United Arab Emirates
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in United Arab Emirates with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Travel Rule compliance: all VA transfers require originator/beneficiary info collection and sharing per FATF Rec 15-16, enforced by VARA (Rule III.G) and FSRA
- Cash transaction threshold: AED 3,500 (~$950 USD) triggers federal/VARA AML reporting obligations
- ADGM zero-threshold regime: no minimum threshold — all cash transactions require AML screening
- Enhanced KYC for cash transactions: VARA aligns with federal AED 3,500 benchmark and monitors for evasion patterns
- Suspicious Transaction Reports (STRs) to CBUAE goAML system
- Federal AML/CFT obligations under Decree-Law No. 26 of 2021 — enforced by CBUAE, VARA, FSRA, and ADGM
- OFAC SDN screening obligations apply to UAE-licensed VASPs
- Physical cash-in/cash-out at kiosks triggers heightened due diligence and transaction monitoring for structuring evasion
Key Restrictions
- Dubai (VARA): requires a specific Exchange license (7th category) — capital AED 15M (~$4.1M) plus separate custody license if holding keys (AED 5M additional capital)
- Abu Dhabi (ADGM): Exchange license required — $2M+ base capital; kiosk cash-handling likely triggers institutional-fit assessment by FSRA
- Federal SCA license required for any operation outside Dubai or ADGM — capital AED 500K–4M
- Privacy tokens (e.g. Monero) and algorithmic stablecoins prohibited at federal level and by DIFC/DFSA
- MVP (Minimum Viable Product) phase required before full VARA license — 3-9 months
- Kiosks must comply with VARA market integrity rules and federal AML travel-rule obligations
- Must incorporate a local entity (on-shore or in a free zone) — no remote operation without local incorporation
Key Risks
- Unlicensed kiosk operation is a criminal offence — penalties up to 5 years imprisonment and AED 250K–1M fines; money laundering via crypto carries up to AED 50M fines or 10 years
- High AML scrutiny post-FATF grey list exit — CBUAE fines in 2024-2025 reached hundreds of millions AED targeting cash-heavy sectors like exchange houses
- Cash-intensive model attracts particularly aggressive enforcement attention from CBUAE and VARA
- Federal vs free zone jurisdictional overlap creates ambiguity on which regulator has primacy for kiosks with multi-emirate footprint
- No published enforcement actions specific to crypto ATM operators means uncertain regulatory practice / precedent for this model
- Kiosk cash-handling may trigger additional CBUAE money-transmitter type oversight layered on top of VARA/ADGM VASP licensing
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SCA — Federal authority — virtual asset supervision across UAE including Free Zones (Cabinet Resolution 111/2022)
VARA — Dubai virtual asset regulation (excluding DIFC) — 7 activity categories. World's first standalone VA regulator.
ADGM FSRA — Abu Dhabi Global Market — institutional focus, common law jurisdiction, ex-FCA/MAS staff
CBUAE — Central bank — broader financial ecosystem, goAML reporting
VARA Regulations (Dubai Law No. 4 of 2022) (2023) — 7-category VASP licensing: advisory, broker-dealer, custody, exchange, lending, transfer, VA management
ADGM FSMR / Virtual Asset Framework (2018) — Financial services permission for crypto asset business — amended 2023
SCA Decision No. 4/R.M/2026 (2026) — Federal crypto law update — 8 licensed activities, prohibitions on privacy/algorithmic tokens
VASP: VARA (Dubai): 7 categories. Exchange: AED 15M (~$4.1M). Broker-Dealer/Custody/Transfer: AED 5M each. Advisory: AED 1M. MVP phase before full license. 3-9 months. ADGM (Abu Dhabi): Exchange $2M+ base capital, Custody $500K-$1M+. Federal SCA: AED 500K-4M depending on activity.
CUSTODY: Separate custody authorization required. VARA: AED 5M. ADGM: $500K-$1M+ (FSRA case-by-case). Client money rules apply.
EXCHANGE: Exchange license from VARA or FSRA. VARA license covers Dubai only (not DIFC/ADGM). ADGM covers ADGM only. Federal SCA license for broader UAE. Privacy tokens and algorithmic tokens explicitly prohibited.
Federal UAE regulations (Decision No. 4/R.M/2026) prohibit algorithmic stablecoins at the federal level. Privacy token prohibitions originate from DIFC/DFSA rules (effective January 2026), not federal regulations. The two restrictions operate under different jurisdictional frameworks.
Post-FATF grey list exit (Feb 2024), CBUAE escalated fines totaling hundreds of millions AED in 2024–2025, targeting crypto-linked high-risk sectors like exchange houses.
General penalties for unlicensed crypto activities include up to 5 years imprisonment and AED 250,000–1 million fines; money laundering via crypto carries up to AED 50 million fines, license revocation, or 10 years imprisonment.
Regulatory bans (not enforcement actions): DFSA prohibited privacy tokens (e.g., Monero) in Jan 2026; federal law (Feb 2026) bans privacy/algorithmic tokens with fines up to AED 50,000 and 3 months imprisonment.
Federal Decree-Law No. 26 of 2021 is the current and operative AML/CFT law in the UAE, superseding Federal Decree No. 20/2018.
Federal/ VARA benchmark: AED 3,500 (approximately $950 USD), mirroring federal AML rules; VARA aligns with this while monitoring for evasion.
ADGM variation: Effectively no threshold (zero-threshold regime).
Global FATF recommendation: $1,000/€1,000, but UAE sets jurisdiction-specific thresholds; no uniform zero-threshold like EU.
All licensed VASPs: Applies to Virtual Asset Service Providers handling VA transfers, including exchanges and custodians, requiring sender/recipient identification and counterparty checks under federal AML-CFT laws.
Scope: Full responsibility on VASPs for FATF-aligned compliance, beyond standard AML; enforced in licensing regimes like VARA and ADGM.
Data sharing and controls: VASPs must collect/share originator and beneficiary info (per FATF standards), implement policies guided by FATF Interpretive Note to Recommendation 15, and detect threshold circumvention via transaction monitoring.
Federal and free zone implementation: UAE is listed among jurisdictions that have implemented the Travel Rule, aligning with FATF Recommendation 15 and 16. VARA Rule III.G requires VASPs to comply with all federal AML-CFT laws, including Travel Rule, guided by FATF Interpretive Note to Recommendation 15, and to monitor for threshold circumvention.
Key regulatory updates: FSRA revised its AML and Sanctions Rules and Guidance to clarify Travel Rule application to VAs in wire transfer provisions; VARA enforces it as a minimum standard potentially supplemented by federal rules.
Engaging in Licensed Financial Activities without a licence is a criminal offence, punishable by imprisonment and/or fines from AED 50,000 to AED 500 million under the UAE Central Bank's consolidated 2023/2025 regulatory framework.
Maximum administrative fines increased to AED 1 billion under the New CBUAE Law, with higher sanctions for unlicensed activity and authorised individuals.White & Case
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operation is permitted in the UAE but requires a local entity, a VARA Exchange license (AED 15M capital) for Dubai or ADGM Exchange license ($2M+) for Abu Dhabi, a federal SCA license for broader UAE operations, separate custody authorization if holding keys, and cash-transaction AML obligations trigger at AED 3,500 (federal/VARA) or zero-threshold (ADGM), with high enforcement risk for non-compliance.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?