VARA, ADGM or DIFC: where to license a crypto business in the UAE

There is no single crypto licence in the UAE. Five regulators share the field, by place and by purpose. Where your company sits decides between VARA, the DFSA, the FSRA and the Capital Market Authority; what your tokens are used for can bring in the Central Bank of the UAE (CBUAE) as well.

This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply. UAE rules change often, so each rule below carries the version and date its regulator shows.

What the activity is in law

Cabinet Decision No. 111 of 2022, published on 12 December 2022, sets the federal baseline: operating a virtual asset platform, exchange, transfer, brokerage, custody and services around token issues all need a licence. It leaves out the financial free zones, and virtual assets used for payments, which belong to the CBUAE.

The CBUAE law, Federal Decree-Law No. (6) of 2025 (in force since 16 September 2025), draws the same line from the other side. Payment services using virtual assets are a CBUAE-licensed activity (Article 61(1)(f)), while virtual assets held for investment, crypto-to-crypto exchange and swaps for trading fall under other laws (Article 187). An exchange sits on the investment side; a crypto card that pays merchants touches both.

Who regulates what, and where

Dubai outside DIFC: VARA

Any firm carrying on virtual asset activities in or from Dubai, excluding DIFC, needs a VARA licence before operating. You apply through Dubai Economy and Tourism or a Dubai free zone, first for an approval to incorporate, then for the licence. For an exchange, the Company Rulebook (version of 19 May 2025) sets paid-up capital at the higher of AED 1,500,000 or 25% of fixed annual overheads, or, with a VARA-licensed custodian, the higher of AED 800,000 or 15%.

DIFC: the DFSA

The DFSA treats crypto tokens as financial instruments, so you need its licence for the financial service you provide, starting with an initial enquiry through DFSA Connect (DFSA crypto page). Since 12 January 2026 there is no DFSA list of recognised tokens: each firm assesses and documents a token's suitability under GEN Rule 3A.2.1, and fiat stablecoins follow a separate policy statement. A DIFC money services firm may use fiat stablecoins only to move money, and no other crypto services (GEN Rule 3A.2.5).

ADGM: the FSRA

Firms apply to the FSRA for a Financial Services Permission before registering in ADGM. Under its virtual asset guidance (VER07.100625):

• each firm checks a token against the FSRA's criteria and notifies the FSRA at least five business days before using it;

• a trading venue (MTF) holds capital in fiat of six months' operating expenses, plus a buffer of up to six more unless the FSRA directs otherwise;

• the "mind and management" must be in ADGM;

• applications run in five stages, ending in operational launch testing.

Fiat-referenced tokens must be on the FSRA's accepted list (ADGM).

The other emirates: the CMA

Federal Decree-Law No. (32) of 2025 replaced the Securities and Commodities Authority (SCA) with the Capital Market Authority (CMA) from 1 January 2026. Article 39 of the Capital Market Law, Federal Decree-Law No. (33) of 2025, in force from the same day, gives the CMA virtual asset trading: in the UAE, only tokens on the official list of a CMA-licensed platform and registered with the CMA may trade.

The SCA's 2024 agreement with VARA sets the split. Firms operating in or from Dubai, or serving Dubai, need a VARA licence and can be registered by default with the SCA to serve the rest of the UAE. Firms operating from any other emirate need an SCA licence, now the CMA's. Since 27 February 2026, Resolution No. (04/Chairman) of 2026 governs these firms, with up to a year for existing licensees to comply. The CMA's April 2026 framework has five modules, including prudential and AML, and eight activities, from dealing and custody to operating a trading facility.

Payments with tokens: the CBUAE

Onshore, the Payment Token Services Regulation (Circular No. 2/2024, in force since 31 August 2024) licenses dirham token issuers, token custody and transfer, and conversion. Only dirham tokens from licensed issuers may pay for goods and services; foreign stablecoins, from registered issuers, only buy virtual assets. Algorithmic stablecoins and privacy tokens are banned, for VARA- and SCA-licensed firms too. A VARA circular of July 2025 told licensees active in fiat-backed tokens to register with the CBUAE, whose grace period ended on 20 August 2025 (VARA news).

What every licence asks for

The rulebooks differ; the themes repeat. The DFSA focuses its supervision on governance and accountability, financial crime controls, custody and safeguarding of client tokens, technology resilience and market conduct. The CMA's framework has modules for conduct of business, AML and prudential requirements, and VARA's rulebooks cover the same ground in detail. Substance is local: VARA requires a physical presence in Dubai (FAQ), and the FSRA expects a firm's mind and management in ADGM. The UAE Virtual Assets Travel Rule, issued under Cabinet Resolution No. (134) of 2025, applies to virtual asset providers across the UAE, financial free zones included.

How to choose

• Retail customers in Dubai: VARA, with registration at the CMA, formerly the SCA, to serve the rest of the UAE.

• Headquarters in another emirate: the CMA.

• An international or institutional business in a financial free zone: the DFSA or the FSRA, each for its own zone.

• A card or wallet that spends stablecoins onshore: the CBUAE as well, whichever regulator licenses your crypto services.

Before your own licence

Few shortcuts exist. VARA's sponsored regime works only within a group, and soliciting orders is itself a licensed broker-dealer service. Under the Payment Token Services Regulation, only licensees, or firms they appoint, may promote payment token services in the UAE (Article 2). Building on a licensed partner's licence means working out with both regulators who provides the service.

Common mistakes

• A free zone trade licence without a VARA licence. In Dubai, a commercial licence alone does not permit virtual asset activities.

• Treating DIFC as part of VARA's Dubai. It has its own regulator.

• Ignoring the payment side. A stablecoin card brings in the CBUAE's rules.

• Building to the SCA's 2023 rules. Resolution No. (04/Chairman) of 2026 repealed them, with a transition period.

• Waiting for a regulator's token list. In DIFC and ADGM, the firm assesses each token.

What this means for your platform

Whichever regulator you choose, the licence is tested against your systems: onboarding, custody, reconciliation, transfers and records. Our white-label crypto exchange platform ships with those modules, including custody wallets with withdrawal approvals, a ledger reconciled daily and Travel Rule messaging. Our crypto card app combines custody wallets with cards from a licensed issuer, and KYC/AML, transaction monitoring and Travel Rule data built in. We configure either for the regulator you choose; the EU route is in our MiCA checklist.

Sources

Checked on 6 October 2026.

• Cabinet Decision No. 111 of 2022, on VARA's rulebook: https://rulebooks.vara.ae/rulebook/cabinet-decision-no-1112022-regulation-virtual-assets-and-their-service-providers

• CBUAE Rulebook, Federal Decree-Law No. (6) of 2025: https://rulebook.centralbank.ae/en/rulebook/federal-decree-law-no-6-2025-regarding-central-bank-regulation-financial-institutions-and

• VARA, Licence Applications: https://www.vara.ae/en/licenses-and-register/licence-applications/

• VARA, Company Rulebook, version of 19 May 2025: https://rulebooks.vara.ae/rulebook/company-rulebook

• VARA, Frequently Asked Questions: https://www.vara.ae/en/faq/

• VARA, News and circulars: https://www.vara.ae/en/news/

• DFSA, Crypto Token Regulation: https://www.dfsa.ae/crypto

• DFSA Rulebook, GEN 3A Crypto Token Requirements, VER72/07-26: https://dfsaen.thomsonreuters.com/rulebook/gen-3a-crypto-token-requirements

• FSRA, Guidance on Regulation of Virtual Asset Activities in ADGM, VER07.100625: https://en.adgm.thomsonreuters.com/rulebook/guidance-regulation-virtual-asset-activities-adgm-10-june-2025

• ADGM, Digital assets: https://www.adgm.com/setting-up/digital-assets/overview

• CMA, regulations listing, including Federal Decree-Laws No. (32) and (33) of 2025: https://www.uaecma.gov.ae/en/regulations/regulations-listing

• CMA, SCA and VARA agreement, 5 September 2024: https://www.uaecma.gov.ae/en/media-center/news/9/9/2024/sca-and-vara-set-regulatory-framework-for-the-uaes-virtual-assets-sector-in-boost-to-the-countrys-

• CMA, Resolution No. (04/Chairman) of 2026: https://www.sca.gov.ae/assets/849bd7e0/the-chairman-of-the-authoritys-board-of-directors-resolution-no4of-2026-concerning-the.aspx

• CMA, Virtual Assets Framework, 13 April 2026: https://www.uaecma.gov.ae/en/media-center/news/13/4/2026/

• CBUAE Rulebook, Payment Token Services Regulation, Circular No. 2/2024: https://rulebook.centralbank.ae/en/rulebook/payment-token-services-regulation

• CBUAE Rulebook, the UAE Virtual Assets Travel Rule: https://rulebook.centralbank.ae/en/rulebook/united-arab-emirates%E2%80%99-virtual-assets-travel-rule