Carrying on crypto asset activities in the UAE requires a special crypto licence. In practice, though, the term can cover several different authorisations issued by different regulators, depending on the company’s activities and the territory where it operates. A commercial licence is not the same as a crypto licence and does not replace it.
The sections below examine the allocation of powers among the UAE’s regulators, the scope of a free zone licence and the penalties for carrying on regulated activity without a licence.
- A free zone trade licence only confirms registration — it never authorises financial services, so a separate regulator's licence is always needed.
- Four regulators split the work: the CBUAE (payments), the CMA (investments outside the financial free zones), VARA (Dubai) and the DFSA or FSRA within DIFC and ADGM.
- The key test is a token's function: used for payment it falls to the central bank, held as an investment it does not.
- Unlicensed activity risks fines from AED 1,000,000 upwards, imprisonment, and personal liability for negligent managers.
- Voluntary self-reporting before detection can earn partial or full relief from penalties.
Financial Regulatory System in the UAE
Virtual asset activity in the UAE is regulated at three levels:
| Level of Regulation | Regulators |
|---|---|
|
Federal level |
|
|
Emirates |
Dubai Virtual Assets Regulatory Authority (VARA), with jurisdiction over the Emirate of Dubai, including Dubai’s free zones other than the DIFC free zone. |
|
Specialised free zones in the UAE |
The financial free zones, the DIFC and ADGM, each with its own regulator. |
Activities Licensed by the Central Bank of the UAE
The powers of the Central Bank of the UAE (CBUAE) are set out in Federal Decree-Law No. 6 of 2025. The financial activities that require a CBUAE licence are listed in Article 61 of the Decree-Law and include:
- taking deposits;
- providing credit and funding facilities;
- currency exchange and money transfers;
- payment services using virtual assets;
- stored value facilities, retail payment and digital money services;
- arranging, promoting and marketing for licensed activities;
- acting as a principal in certain financial products;
- insurance and reinsurance, and related services.
The list may be amended by decision of the CBUAE Board of Directors.
In addition to the traditional banking licence in the UAE, the CBUAE also issues specialised licences. All of them, however, cover the financial functions of a company, rather than virtual assets as such. Accordingly, if a company performs at least one of those functions, it will need a CBUAE licence, even if it already holds a licence from another regulator.
Article 62 of Decree-Law No. 6 of 2025 clarifies that CBUAE licensing and supervision extend to persons who, directly or indirectly, carry on, offer, issue or facilitate licensed activities, regardless of the technology used. The examples given include, among others, virtual asset payment tokens, other new technologies, as well as the offering or operation of applications, platforms or other technological infrastructure through which financial services are provided.
The CBUAE clarification (Question 6, paragraph 2) stresses that technology companies that merely supply software, infrastructure or technical solutions are not required to obtain a CBUAE licence. However, a licence will be needed where a technology company itself takes part in financial activity, whether by offering, issuing or facilitating a financial service or by presenting itself as doing so. This is the case, for example, where a software provider operates its own payment service or wallet. The CBUAE also noted separately that supplying software exclusively to licensed financial institutions does not constitute financial activity and falls outside the regulation.
Activities Licensed by the CMA
Since 1 January 2026, the CMA has been operating under Federal Decree-Law No. 32 of 2025 and Federal Decree-Law No. 33 of 2025. The CMA’s jurisdiction does not extend to banking operations or to payment systems regulated by the CBUAE. Nor does it extend to the financial free zones, the DIFC and ADGM, subject to certain exceptions (see below).
The full list of financial activities licensed by the CMA is set out in Article 3 of Decree-Law No. 33. These include, for example:
- operation of trading platforms,
- brokerage services,
- investment funds and portfolio management,
- financial advisory services,
- custody of assets, and
- activities and services relating to virtual assets (Article 3(1)(y)).
It is prohibited to carry on any of the activities listed above without a CMA licence or approval. As for virtual assets themselves, only those included in the official list published by a licensed virtual asset platform operator and registered with the CMA may be traded in the UAE.
In 2026, the CMA published a new Decision No. 4 on virtual asset service providers (Decision No. 4/R.M/2026). The Decision establishes eight regulated activities, each of which requires a separate licence:
- dealing in virtual assets as a principal;
- dealing as an agent;
- custody;
- arranging custody;
- arranging investment transactions;
- investment advice;
- portfolio management;
- operating a multilateral trading facility (MTF).
Since 25 June 2026, the CMA has allowed all CBUAE-licensed entities, other than insurance companies, to carry on the activities covered by Decision No. 4 (Decision No. 16 of 2026).
Activities Regulated by VARA
VARA (Virtual Assets Regulatory Authority) was established by Dubai Law No. 4 of 2022. The Law applies to the Emirate of Dubai, including all free zones other than the DIFC. VARA licenses virtual asset service providers (VASPs).
A VASP licence is required if a company carries on any of the following activities involving virtual assets:
- advisory services;
- broker-dealer services;
- issuance of Category 1 virtual assets (defined separately);
- custody;
- exchange services (virtual assets for fiat currency, or for other virtual assets);
- lending;
- virtual asset management and investment;
- transfers and settlement.
Holding a VASP licence does not exempt an entity from complying with the CBUAE’s requirements.
Regulators in the DIFC and ADGM
The DIFC free zone in Dubai and the ADGM free zone in Abu Dhabi are expressly designated as financial free zones of the UAE. These zones have a special status. In particular, the laws described above, which govern the powers of the CBUAE, the CMA and VARA, do not apply in them. However, the remaining federal laws, for example in the areas of criminal law and anti-money laundering, continue to apply.
Two licences are required to carry on financial activity:
- a commercial licence from the free zone registration authority; and
- an authorisation to carry on financial activity from the free zone regulator.
The Dubai Financial Services Authority (DFSA), the regulator of the DIFC, introduced its Crypto Token regime on 1 November 2022. Since that date, financial services involving Crypto Tokens in the DIFC may be provided only with the DFSA’s approval or prior authorisation.
From 12 January 2026, a firm that intends to deal in Crypto Tokens must itself assess each token against the prescribed criteria (except for fiat Crypto Tokens) and decide whether the token is suitable for its business.
A Crypto Token is a token that is intended to be used as:
- a medium of exchange,
- a means of payment, or
- an investment.
The following fall outside the Crypto Token regime:
- NFTs,
- utility tokens, and
- central bank digital currencies.
Investment tokens and derivatives are regulated as securities and are likewise outside the Crypto Token regime.
The ADGM financial sector is regulated by the Financial Services and Markets Regulations 2015 (FSMR), which, among other things, establish the structure and powers of the regulator, the FSRA.
The equivalent of a crypto licence in ADGM is a financial services permission issued by the FSRA in respect of virtual assets. Virtual assets are treated as part of the ordinary regulated activities alongside financial instruments, for example dealing in virtual assets as a principal, custody, management and others.
After obtaining a crypto licence in ADGM, a company may deal only in Accepted Virtual Assets. The company must itself monitor whether an asset meets the prescribed criteria. These include, for example:
- traceability of the origin and destination of funds,
- practical application,
- security,
- market profile, and other factors.
What a Free Zone Licence Covers
Companies registered in the UAE must obtain a commercial licence, regardless of place of incorporation. Such a licence, including a free zone licence, entitles the company to carry on the activity specified in it.
A free zone licence is issued by the relevant free zone authority, not by the financial regulator. It therefore only confirms that the company is registered and entitled to operate in that zone. It does not authorise the provision of financial services. For example, a company that trades cryptocurrency must apply to the relevant regulator for a separate licence to do so in the UAE.
The same requirement to hold two licences applies to companies registered in the financial free zones, the DIFC and ADGM:
| Free Zone and Licence | Issuing Authority |
|---|---|
|
DIFC, commercial licence |
DIFC Registrar of Companies |
|
DIFC, financial services licence |
DFSA |
|
ADGM, commercial licence |
ADGM Registration Authority |
|
ADGM, financial services licence |
FSRA |
The DFSA expressly warns that companies that are registered or licensed in the DIFC but not authorised by the DFSA may not provide financial services in or from the DIFC (Article 41 of the DIFC Regulatory Law 2004).
In the ADGM, obtaining an ordinary commercial licence is one of the prerequisites for applying to the FSRA for permission. A company that holds only a commercial licence is subject solely to the ADGM’s commercial regulation and may not present itself as an “ADGM regulated company”.
Penalties for Operating Without a Financial Licence
Federal Decree-Law No. 6 of 2025 entered into force on 16 September 2025. Article 184 provided for a transitional period to allow persons subject to the law to bring their activities in line with its provisions. The transitional period expired in September 2026. No extension has been announced, so from September 2026 the law applies in full, including its provisions on liability.
The Central Bank may, at its discretion, impose one or more of the sanctions listed in Article 168. In particular, the following may be imposed for carrying on activity without the relevant licence:
- a warning;
- an order to refund clients any funds obtained as a result of violations of the Decree-Law;
- a fine not exceeding ten times the amount of funds involved in the violation or unjust enrichment;
- a fine of not less than AED 1,000,000 for conducting financial activities without a licence or promoting financial services without the required licence.
In addition, Article 170 of the Decree-Law establishes criminal liability for conducting financial activities without a licence, punishable by imprisonment and/or a fine ranging from AED 50,000 to AED 500,000,000.
Separate liability is provided for the manager of a company that has committed a violation (Article 181). The same sanctions apply to that person if it is established that they knew of the violation, or that it resulted from their negligence or failure to perform their duties.
Sanctions are also provided for in Article 71 of Decree-Law No. 33. For example, carrying on financial activity without a CMA licence is punishable by:
- imprisonment for a term of not less than one year, and/or
- a fine of between AED 50,000 and AED 250,000,000.
Companies may bring their activities into line with Decree-Law No. 33 by 1 January 2027. This period may be extended.
Whether a Licence Is Required, and Where to Obtain It
To determine whether a company’s activities are subject to regulatory requirements, it is useful to consider the following questions:
| Question | Explanation |
|---|---|
|
Is the activity a financial service? |
A technology company may also need a CBUAE licence, depending on the activities it is involved in (see above). |
|
What is the role of a virtual asset? |
To identify the relevant regulator, it is necessary to understand the function of a virtual asset:
|
|
Where does the company carry on its activity, and where are its clients located? |
If a company carries on activity from abroad, from the DIFC or from the ADGM and targets clients in the UAE, it is subject to Decree-Law No. 33 on the regulation of capital markets. |
Operating Without a Licence: How to Remedy the Situation
If you have discovered that your activity requires a licence that you do not hold, you should:
- stop all further activity, client acquisition and advertising in the UAE;
- identify the relevant regulator;
- approach the regulator on your own initiative;
- satisfy the prerequisites and apply for the necessary licence.
Approaching the regulator does not release a company from sanctions for breaches that have already occurred. The legislation does, however, allow for some leniency. For example, the CBUAE may enter into a settlement with the offender in respect of fines (Article 168(6) of Federal Decree-Law No. 6 of 2025). The CMA may likewise release the offender from sanctions in whole or in part if the offender reported the breach itself before it came to the attention of the CMA or a court, and is prepared to remedy the breach (Article 70 of Federal Decree-Law No. 33 of 2025).
Activity may be resumed only after a licence has been obtained from the relevant regulator.
Tags: UAE
