Self-custodial wallet / non-custodial software in United Arab Emirates
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in United Arab Emirates without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No AML/CFT obligations attach to the software publisher itself when it never holds, controls, or has access to user funds or private keys — the non-custodial nature means the publisher is not a VASP under any UAE regulatory framework.
- If the publisher also provides any VA transfer facilitation, exchange, or custody-adjacent services (e.g., swap features embedded in the wallet), it may become a VASP and must comply with federal AML-CFT laws (Federal Decree-Law No. 26 of 2021), including Travel Rule requirements (FATF Recommendation 15/16) with a UAE threshold of AED 3,500 (~$950).
- ADGM/FSRA-applicable activities have effectively no threshold (zero-threshold regime) for Travel Rule.
Key Restrictions
- The software publisher must not hold, control, or have access to user private keys or funds — pure non-custodial software is not a regulated VASP activity under VARA's 7 categories (advisory, broker-dealer, custody, exchange, lending, transfer, VA management) or ADGM/FSRA's framework.
- If any integrated feature crosses into broker-dealer, transfer, or exchange activity (e.g., in-wallet swaps, fiat on/off ramps where the publisher facilitates), a VASP license would be required from VARA (Dubai, excluding DIFC), ADGM/FSRA (Abu Dhabi), or the federal SCA.
- Privacy tokens and algorithmic tokens are prohibited under UAE federal law (Decision No. 4/R.M/2026) — wallet software must not support or facilitate transactions in such tokens when offered to UAE residents.
- DIFC/DFSA framework applies only to security/investment tokens (updated Jan 2026) — non-custodial wallet software for utility tokens or payment tokens is outside DFSA scope.
Key Risks
- Regulatory ambiguity: UAE has a layered federal + free-zone system (SCA, VARA, ADGM, DFSA). A non-custodial wallet publisher could face differing interpretations of whether integrated features (swaps, dApp browser, staking) trigger VASP classification across these regimes.
- Enforcement exposure: Engaging in unlicensed financial activities carries criminal penalties of up to 5 years imprisonment and fines from AED 50,000 to AED 500 million (CBUAE framework); post-FATF grey-list exit, enforcement against crypto-adjacent entities has intensified.
- Scope creep risk: Any minor service enhancement (e.g., fee-based transaction relay, fiat gateway referral fees) could be reclassified as a regulated activity, requiring expensive retroactive licensing.
- Consumer protection expectations: UAE regulators increasingly expect consumer-facing crypto products to have disclosure, governance, and security standards — pure software publishers may face pressure even if not formally regulated.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SCA — Federal authority — virtual asset supervision across UAE including Free Zones (Cabinet Resolution 111/2022)
VARA — Dubai virtual asset regulation (excluding DIFC) — 7 activity categories. World's first standalone VA regulator.
ADGM FSRA — Abu Dhabi Global Market — institutional focus, common law jurisdiction, ex-FCA/MAS staff
DFSA — DIFC — investment/security tokens only, updated framework Jan 2026
CBUAE — Central bank — broader financial ecosystem, goAML reporting
VARA Regulations (Dubai Law No. 4 of 2022) (2023) — 7-category VASP licensing: advisory, broker-dealer, custody, exchange, lending, transfer, VA management
ADGM FSMR / Virtual Asset Framework (2018) — Financial services permission for crypto asset business — amended 2023
SCA Decision No. 4/R.M/2026 (2026) — Federal crypto law update — 8 licensed activities, prohibitions on privacy/algorithmic tokens
VASP: VARA (Dubai): 7 categories. Exchange: AED 15M (~$4.1M). Broker-Dealer/Custody/Transfer: AED 5M each. Advisory: AED 1M. MVP phase before full license. 3-9 months. ADGM (Abu Dhabi): Exchange $2M+ base capital, Custody $500K-$1M+. Federal SCA: AED 500K-4M depending on activity.
CUSTODY: Separate custody authorization required. VARA: AED 5M. ADGM: $500K-$1M+ (FSRA case-by-case). Client money rules apply.
Market Integrity and AML: Dubai's VARA framework is designed to enhance market integrity and ensure alignment with global Anti-Money Laundering (AML) standards (coinpedia.org, 2025).
Federal UAE regulations (Decision No. 4/R.M/2026) prohibit algorithmic stablecoins at the federal level. Privacy token prohibitions originate from DIFC/DFSA rules (effective January 2026), not federal regulations. The two restrictions operate under different jurisdictional frameworks.
Federal Decree-Law No. 26 of 2021 is the current and operative AML/CFT law in the UAE, superseding Federal Decree No. 20/2018.
Federal and free zone implementation: UAE is listed among jurisdictions that have implemented the Travel Rule, aligning with FATF Recommendation 15 and 16. VARA Rule III.G requires VASPs to comply with all federal AML-CFT laws, including Travel Rule, guided by FATF Interpretive Note to Recommendation 15, and to monitor for threshold circumvention.
Federal/ VARA benchmark: AED 3,500 (approximately $950 USD), mirroring federal AML rules; VARA aligns with this while monitoring for evasion.
ADGM variation: Effectively no threshold (zero-threshold regime).
All licensed VASPs: Applies to Virtual Asset Service Providers handling VA transfers, including exchanges and custodians, requiring sender/recipient identification and counterparty checks under federal AML-CFT laws.
Engaging in Licensed Financial Activities without a licence is a criminal offence, punishable by imprisonment and/or fines from AED 50,000 to AED 500 million under the UAE Central Bank's consolidated 2023/2025 regulatory framework.
Maximum administrative fines increased to AED 1 billion under the New CBUAE Law, with higher sanctions for unlicensed activity and authorised individuals.White & Case
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a publisher of pure non-custodial wallet software (no control over keys or funds) is not a VASP under UAE federal or free-zone frameworks and does not require licensing, but any integrated financial service features (swaps, staking, fiat on/off ramps) would trigger VASP licensing obligations under VARA, ADGM/FSRA, or SCA.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?