On-shore VASP in United Arab Emirates
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in United Arab Emirates with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- All licensed VASPs must comply with Federal Decree-Law No. 26 of 2021 (AML/CFT) and implementing regulations — VARA Rule III.G requires alignment with all federal AML-CFT laws (ae.aml.federal-decree-no-202018-amlcft)
- Travel Rule applies: AED 3,500 threshold (approx. $950 USD) for originator/beneficiary information collection and counterparty checks — federal/VARA benchmark; ADGM has effectively zero-threshold regime (ae.aml.federal-vara-benchmark-aed-3500)
- VASPs must collect and share originator and beneficiary information per FATF standards, implement policies per FATF Interpretive Note to Recommendation 15, and monitor for threshold circumvention (ae.aml.data-sharing-and-controls-vasps)
- Full responsibility on VASPs for FATF-aligned compliance, enforced across VARA, ADGM, and federal regimes (ae.aml.scope-full-responsibility-on-vasps)
- Regular supervision by CBUAE covering capital adequacy, risk management, and compliance; goAML reporting obligations (ae.enforcement.cbuae-conducts-regular-supervision-and)
- Sanctions compliance with OFAC SDN designations applicable in UAE (ae.aml.ofac-sdn-uae-applicable-httpsofactreasurygovfaqstopic1626)
Key Restrictions
- Three separate regulatory regimes apply depending on geographic presence: VARA (Dubai excl. DIFC), ADGM FSRA (Abu Dhabi), and federal SCA (rest of UAE including Free Zones) — a license from one regime does not automatically cover another (ae.licensing.regulator-sca, ae.licensing.regulator-vara, ae.licensing.regulator-adgm-fsra)
- Privacy tokens and algorithmic tokens are prohibited: federal law (SCA Decision No. 4/R.M/2026) bans algorithmic stablecoins with fines up to AED 50,000 and 3 months imprisonment; DFSA/DIFC bans privacy tokens effective Jan 2026 (ae.aml.regulatory-bans-not-enforcement-actions, ae.licensing.legislation-sca-decision-no-4-r-m-2026)
- Separate custody authorization required beyond basic VASP license — minimum capital AED 5M under VARA, $500K-$1M+ under ADGM (ae.licensing.custody)
- Client money/asset segregation and protection rules apply to all regulated firms handling crypto (ae.custody.client-asset-segregation-and-protection)
- Must operate through a locally-incorporated entity in the relevant jurisdiction (VARA Dubai, ADGM, or mainland UAE via SCA)
Key Risks
- Dual/multiple regulatory regimes create geographic scope risk — operating across Dubai, ADGM, and other Emirates may require separate licenses, increasing cost and complexity (ae.licensing.regulator-sca, ae.licensing.regulator-vara, ae.licensing.regulator-adgm-fsra)
- Post-FATF grey list exit (Feb 2024), CBUAE has escalated fines totaling hundreds of millions AED in 2024-2025, particularly targeting crypto-linked sectors — enforcement risk is high (ae.aml.post-fatf-grey-list-exit-feb)
- Engaging without appropriate license carries criminal penalties: up to 5 years imprisonment and AED 250,000–1 million fines; money laundering via crypto carries up to AED 50 million fines or 10 years imprisonment (ae.aml.general-penalties-for-unlicensed-crypto)
- Administrative fines can reach AED 1 billion under the New CBUAE Law (ae.enforcement.maximum-administrative-fines-increased-to)
- Regulatory ambiguity between federal and free-zone regimes — VARA, ADGM, and SCA frameworks are not fully harmonized, creating compliance gaps for multi-jurisdiction operators (ae.licensing.regulator-sca, ae.licensing.regulator-vara, ae.licensing.regulator-adgm-fsra)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SCA — Federal authority — virtual asset supervision across UAE including Free Zones (Cabinet Resolution 111/2022)
VARA — Dubai virtual asset regulation (excluding DIFC) — 7 activity categories. World's first standalone VA regulator.
ADGM FSRA — Abu Dhabi Global Market — institutional focus, common law jurisdiction, ex-FCA/MAS staff
DFSA — DIFC — investment/security tokens only, updated framework Jan 2026
CBUAE — Central bank — broader financial ecosystem, goAML reporting
VARA Regulations (Dubai Law No. 4 of 2022) (2023) — 7-category VASP licensing: advisory, broker-dealer, custody, exchange, lending, transfer, VA management
ADGM FSMR / Virtual Asset Framework (2018) — Financial services permission for crypto asset business — amended 2023
SCA Decision No. 4/R.M/2026 (2026) — Federal crypto law update — 8 licensed activities, prohibitions on privacy/algorithmic tokens
VASP: VARA (Dubai): 7 categories. Exchange: AED 15M (~$4.1M). Broker-Dealer/Custody/Transfer: AED 5M each. Advisory: AED 1M. MVP phase before full license. 3-9 months. ADGM (Abu Dhabi): Exchange $2M+ base capital, Custody $500K-$1M+. Federal SCA: AED 500K-4M depending on activity.
CUSTODY: Separate custody authorization required. VARA: AED 5M. ADGM: $500K-$1M+ (FSRA case-by-case). Client money rules apply.
EXCHANGE: Exchange license from VARA or FSRA. VARA license covers Dubai only (not DIFC/ADGM). ADGM covers ADGM only. Federal SCA license for broader UAE. Privacy tokens and algorithmic tokens explicitly prohibited.
Post-FATF grey list exit (Feb 2024), CBUAE escalated fines totaling hundreds of millions AED in 2024–2025, targeting crypto-linked high-risk sectors like exchange houses.
General penalties for unlicensed crypto activities include up to 5 years imprisonment and AED 250,000–1 million fines; money laundering via crypto carries up to AED 50 million fines, license revocation, or 10 years imprisonment.
Regulatory bans (not enforcement actions): DFSA prohibited privacy tokens (e.g., Monero) in Jan 2026; federal law (Feb 2026) bans privacy/algorithmic tokens with fines up to AED 50,000 and 3 months imprisonment.
Federal Decree-Law No. 26 of 2021 is the current and operative AML/CFT law in the UAE, superseding Federal Decree No. 20/2018.
Federal and free zone implementation: UAE is listed among jurisdictions that have implemented the Travel Rule, aligning with FATF Recommendation 15 and 16. VARA Rule III.G requires VASPs to comply with all federal AML-CFT laws, including Travel Rule, guided by FATF Interpretive Note to Recommendation 15, and to monitor for threshold circumvention.
Federal/ VARA benchmark: AED 3,500 (approximately $950 USD), mirroring federal AML rules; VARA aligns with this while monitoring for evasion.
ADGM variation: Effectively no threshold (zero-threshold regime).
Data sharing and controls: VASPs must collect/share originator and beneficiary info (per FATF standards), implement policies guided by FATF Interpretive Note to Recommendation 15, and detect threshold circumvention via transaction monitoring.
Scope: Full responsibility on VASPs for FATF-aligned compliance, beyond standard AML; enforced in licensing regimes like VARA and ADGM.
OFAC SDN (UAE-applicable): https://ofac.treasury.gov/faqs/topic/1626
Client asset segregation and protection standards
Enhanced custody requirements for regulated firms handling crypto tokens
Evidence fact ae.tax not found (may have been renamed).
Corporate Tax Law (Federal, effective 2023): 9% on business profits > AED 375,000; FTA registration required. Details at FTA site (not specified in results).
Federal Tax Authority (FTA) VAT revisions (October 2, 2024): Published exemptions for virtual asset transfers/exchanges retroactive to 2018. No direct FTA URL in results; see PwC analysis via .
November 15, 2024 VAT Public Clarification: Zero-rate for qualifying digital assets retroactive to 2018.
Engaging in Licensed Financial Activities without a licence is a criminal offence, punishable by imprisonment and/or fines from AED 50,000 to AED 500 million under the UAE Central Bank's consolidated 2023/2025 regulatory framework.
Maximum administrative fines increased to AED 1 billion under the New CBUAE Law, with higher sanctions for unlicensed activity and authorised individuals.White & Case
CBUAE conducts regular supervision and examinations covering capital adequacy, risk management, and compliance.UAE Banks by License Type
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — On-shore VASPs are permitted in the UAE but must secure licensing from one of three regimes (VARA for Dubai, ADGM FSRA for Abu Dhabi, or federal SCA for the broader UAE), satisfy activity-specific minimum capital (AED 1M–15M depending on license category and regulator), comply with FATF-aligned AML/CFT/Travel Rule obligations, and operate through a locally-incorporated entity; privacy and algorithmic tokens are prohibited.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?