Centralized exchange in United Arab Emirates

SCA — Federal authority — virtual asset supervision across UAE including Free Zones (Cabinet Resolution 111/2022)

VARA — Dubai virtual asset regulation (excluding DIFC) — 7 activity categories. World's first standalone VA regulator.

ADGM FSRA — Abu Dhabi Global Market — institutional focus, common law jurisdiction, ex-FCA/MAS staff

DFSA — DIFC — investment/security tokens only, updated framework Jan 2026

CBUAE — Central bank — broader financial ecosystem, goAML reporting

VASP: VARA (Dubai): 7 categories. Exchange: AED 15M (~$4.1M). Broker-Dealer/Custody/Transfer: AED 5M each. Advisory: AED 1M. MVP phase before full license. 3-9 months. ADGM (Abu Dhabi): Exchange $2M+ base capital, Custody $500K-$1M+. Federal SCA: AED 500K-4M depending on activity.

CUSTODY: Separate custody authorization required. VARA: AED 5M. ADGM: $500K-$1M+ (FSRA case-by-case). Client money rules apply.

EXCHANGE: Exchange license from VARA or FSRA. VARA license covers Dubai only (not DIFC/ADGM). ADGM covers ADGM only. Federal SCA license for broader UAE. Privacy tokens and algorithmic tokens explicitly prohibited.

VARA Regulations (Dubai Law No. 4 of 2022) (2023) — 7-category VASP licensing: advisory, broker-dealer, custody, exchange, lending, transfer, VA management

ADGM FSMR / Virtual Asset Framework (2018) — Financial services permission for crypto asset business — amended 2023

SCA Decision No. 4/R.M/2026 (2026) — Federal crypto law update — 8 licensed activities, prohibitions on privacy/algorithmic tokens

Securities and Commodities Authority (SCA): This is the primary federal authority responsible for supervising and regulating virtual asset activities across the entire UAE, including in Free Zones. This mandate stems from Cabinet Resolution No. 111 of 2022. The federal framework has been updated by SCA Board of Directors Decision No. 4/R.M/2026.

Virtual Asset Regulatory Authority (VARA): Specific to Dubai (excluding the Dubai International Financial Centre, DIFC). VARA is central to Dubai's strategy to become a crypto hub, providing a clear and secure framework. Its rulebooks have been finalized since 2023, with active supervision and VASP licensing ongoing since at least 2026, attracting major platforms.

Licensing and Capital Requirements: The federal framework (SCA) is expected to establish eight licensed financial activities for virtual assets, with minimum capital requirements ranging from AED 500,000 to AED 4 million (neoslegal.co, 2026). VARA in Dubai also outlines key licensing requirements and compliance standards for crypto businesses (coinbro.pro, 2025).

Federal UAE regulations (Decision No. 4/R.M/2026) prohibit algorithmic stablecoins at the federal level. Privacy token prohibitions originate from DIFC/DFSA rules (effective January 2026), not federal regulations. The two restrictions operate under different jurisdictional frameworks.

Enhanced custody requirements for regulated firms handling crypto tokens

Client asset segregation and protection standards

Strengthened governance and disclosure requirements for crypto-related activities within the DIFC

Post-FATF grey list exit (Feb 2024), CBUAE escalated fines totaling hundreds of millions AED in 2024–2025, targeting crypto-linked high-risk sectors like exchange houses.

General penalties for unlicensed crypto activities include up to 5 years imprisonment and AED 250,000–1 million fines; money laundering via crypto carries up to AED 50 million fines, license revocation, or 10 years imprisonment.

Regulatory bans (not enforcement actions): DFSA prohibited privacy tokens (e.g., Monero) in Jan 2026; federal law (Feb 2026) bans privacy/algorithmic tokens with fines up to AED 50,000 and 3 months imprisonment.

No sources detail VARA/ADGM/FSRA fines against specific crypto firms; general unlicensed trading risks criminal prosecution.

Federal Decree-Law No. 26 of 2021 is the current and operative AML/CFT law in the UAE, superseding Federal Decree No. 20/2018.

Federal and free zone implementation: UAE is listed among jurisdictions that have implemented the Travel Rule, aligning with FATF Recommendation 15 and 16. VARA Rule III.G requires VASPs to comply with all federal AML-CFT laws, including Travel Rule, guided by FATF Interpretive Note to Recommendation 15, and to monitor for threshold circumvention.

Federal/ VARA benchmark: AED 3,500 (approximately $950 USD), mirroring federal AML rules; VARA aligns with this while monitoring for evasion.

ADGM variation: Effectively no threshold (zero-threshold regime).

Scope: Full responsibility on VASPs for FATF-aligned compliance, beyond standard AML; enforced in licensing regimes like VARA and ADGM.

Data sharing and controls: VASPs must collect/share originator and beneficiary info (per FATF standards), implement policies guided by FATF Interpretive Note to Recommendation 15, and detect threshold circumvention via transaction monitoring.

Challenges noted: Interoperability issues with global systems, no mandated specific tech solution; UAE focuses on federal alignment with free zone supplements.

Travel Rule adopted — threshold: AED 3,500

Engaging in Licensed Financial Activities without a licence is a criminal offence, punishable by imprisonment and/or fines from AED 50,000 to AED 500 million under the UAE Central Bank's consolidated 2023/2025 regulatory framework.

Maximum administrative fines increased to AED 1 billion under the New CBUAE Law, with higher sanctions for unlicensed activity and authorised individuals.White & Case

CBUAE conducts regular supervision and examinations covering capital adequacy, risk management, and compliance.UAE Banks by License Type