Remote VASP serving residents in United Arab Emirates
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in United Arab Emirates with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Federal AML/CFT obligations under Decree-Law No. 26 of 2021 — applies to all VASPs handling VA transfers, including exchanges and custodians
- Travel Rule compliance required — threshold of AED 3,500 (~$950 USD) under federal/VARA rules; ADGM has effectively no threshold (zero-threshold regime)
- Full responsibility on VASPs for FATF-aligned compliance, including originator/beneficiary data collection and sharing per FATF Interpretive Note to Recommendation 15
- Mandatory goAML reporting to CBUAE
- VARA Rule III.G requires compliance with all federal AML-CFT laws, including Travel Rule
- Transaction monitoring to detect threshold circumvention
- Sanctions compliance (OFAC SDN lists applicable in UAE)
Key Restrictions
- Must obtain a VASP license from the relevant regulator (VARA for Dubai, ADGM FSRA for Abu Dhabi, SCA for other Emirates) — no remote-only, no-license option exists
- Local entity incorporation is strictly required — licensing is only available to entities established in the relevant jurisdiction (Dubai, ADGM, or mainland UAE)
- Privacy tokens (e.g., Monero) are prohibited — DIFC/DFSA ban effective Jan 2026; federal ban on privacy/algorithmic tokens with fines up to AED 50,000 and 3 months imprisonment
- Algorithmic stablecoins prohibited at federal level under Decision No. 4/R.M/2026
- VARA licenses cover Dubai only (not DIFC/ADGM); ADGM license covers ADGM only; federal SCA license required for broader UAE operations
- Cross-border remote service without licensing is a criminal offence — unlicensed activity punishable by imprisonment and/or fines from AED 50,000 to AED 500 million
Key Risks
- High enforcement risk: CBUAE has escalated fines totaling hundreds of millions AED in 2024–2025 targeting crypto-linked sectors; unlicensed crypto activities carry up to 5 years imprisonment and AED 250,000–1 million fines
- Money laundering via crypto carries penalties up to AED 50 million fines or 10 years imprisonment
- Post-FATF grey list exit (Feb 2024), UAE has intensified AML enforcement — operating without license invites criminal prosecution
- Three separate regulatory frameworks (VARA, ADGM FSRA, SCA federal) create jurisdictional complexity and risk of operating in the wrong zone without proper coverage
- Administrative fines up to AED 1 billion under the New CBUAE Law for unauthorized activity
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SCA — Federal authority — virtual asset supervision across UAE including Free Zones (Cabinet Resolution 111/2022)
VARA — Dubai virtual asset regulation (excluding DIFC) — 7 activity categories. World's first standalone VA regulator.
ADGM FSRA — Abu Dhabi Global Market — institutional focus, common law jurisdiction, ex-FCA/MAS staff
DFSA — DIFC — investment/security tokens only, updated framework Jan 2026
CBUAE — Central bank — broader financial ecosystem, goAML reporting
VASP: VARA (Dubai): 7 categories. Exchange: AED 15M (~$4.1M). Broker-Dealer/Custody/Transfer: AED 5M each. Advisory: AED 1M. MVP phase before full license. 3-9 months. ADGM (Abu Dhabi): Exchange $2M+ base capital, Custody $500K-$1M+. Federal SCA: AED 500K-4M depending on activity.
General penalties for unlicensed crypto activities include up to 5 years imprisonment and AED 250,000–1 million fines; money laundering via crypto carries up to AED 50 million fines, license revocation, or 10 years imprisonment.
Post-FATF grey list exit (Feb 2024), CBUAE escalated fines totaling hundreds of millions AED in 2024–2025, targeting crypto-linked high-risk sectors like exchange houses.
Federal Decree-Law No. 26 of 2021 is the current and operative AML/CFT law in the UAE, superseding Federal Decree No. 20/2018.
Federal and free zone implementation: UAE is listed among jurisdictions that have implemented the Travel Rule, aligning with FATF Recommendation 15 and 16. VARA Rule III.G requires VASPs to comply with all federal AML-CFT laws, including Travel Rule, guided by FATF Interpretive Note to Recommendation 15, and to monitor for threshold circumvention.
Federal/ VARA benchmark: AED 3,500 (approximately $950 USD), mirroring federal AML rules; VARA aligns with this while monitoring for evasion.
ADGM variation: Effectively no threshold (zero-threshold regime).
Global FATF recommendation: $1,000/€1,000, but UAE sets jurisdiction-specific thresholds; no uniform zero-threshold like EU.
Travel Rule adopted — threshold: AED 3,500
Engaging in Licensed Financial Activities without a licence is a criminal offence, punishable by imprisonment and/or fines from AED 50,000 to AED 500 million under the UAE Central Bank's consolidated 2023/2025 regulatory framework.
Maximum administrative fines increased to AED 1 billion under the New CBUAE Law, with higher sanctions for unlicensed activity and authorised individuals.White & Case
CBUAE conducts regular supervision and examinations covering capital adequacy, risk management, and compliance.UAE Banks by License Type
OFAC SDN (UAE-applicable): https://ofac.treasury.gov/faqs/topic/1626
Federal and free zone implementation: UAE is listed among jurisdictions that have implemented the Travel Rule, aligning with FATF Recommendation 15 and 16. VARA Rule III.G requires VASPs to comply with all federal AML-CFT laws, including Travel Rule, guided by FATF Interpretive Note to Recommendation 15, and to monitor for threshold circumvention.
SCA Decision No. 4/R.M/2026 (2026) — Federal crypto law update — 8 licensed activities, prohibitions on privacy/algorithmic tokens
Regulatory bans (not enforcement actions): DFSA prohibited privacy tokens (e.g., Monero) in Jan 2026; federal law (Feb 2026) bans privacy/algorithmic tokens with fines up to AED 50,000 and 3 months imprisonment.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a foreign-incorporated remote VASP cannot serve UAE residents from abroad without a local entity and a VASP license from the relevant UAE regulator (VARA, ADGM FSRA, or SCA); unlicensed cross-border service is a criminal offence carrying imprisonment and fines up to AED 500 million.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?