UAE

1. Legal Status

Virtual assets and crypto custody services are legal and regulated across multiple jurisdictions within the UAE. The UAE operates a multi-regulator model, with distinct regulatory frameworks governing crypto custody depending on the geographic zone:

• VARA (Virtual Assets Regulatory Authority): Regulates virtual asset activities in mainland Dubai (excluding the DIFC). Established under Dubai Law No. 4 of 2022.
• ADGM FSRA (Abu Dhabi Global Market - Financial Services Regulatory Authority): Regulates virtual asset activities within the Abu Dhabi Global Market free zone. ADGM was one of the first jurisdictions globally to issue comprehensive regulations for digital asset activities.
• DFSA (Dubai Financial Services Authority): Regulates crypto token activities within the Dubai International Financial Centre (DIFC).
• CBUAE (Central Bank of the UAE): Oversees payment token services (stablecoins) and, under Federal Decree-Law No. 6 of 2025, has expanded authority over virtual asset payment activities nationwide.
• CMA (Capital Market Authority): The federal capital-markets regulator. Effective 1 January 2026, the former Securities and Commodities Authority (SCA) was replaced in full by the independent CMA under Federal Decree-Laws No. 32 and No. 33 of 2025. Virtual assets are now a "Financial Product" within the federal capital-markets perimeter, and CMA Decision No. 4/R.M/2026 (effective 13 February 2026) introduced a new activity-based federal VASP framework — including a dedicated Custody Services license — that supersedes the prior SCA virtual-asset regime.

The UAE's approach is classified as permissive, with purpose-built regulatory frameworks designed to attract institutional participants while maintaining robust oversight. This contrasts with more restrictive approaches in some jurisdictions and positions the UAE alongside Singapore and Hong Kong as a leading crypto hub.

Sources: DLA Piper - UAE Regulatory Landscape; Sumsub - Crypto in the UAE

2. Regulatory Framework

2.1 Multi-Regulator Architecture

The UAE's regulatory landscape is defined by its free zone structure, which creates distinct regulatory perimeters:

2.2 Free Zone vs. Onshore Differences

A critical distinction in UAE crypto regulation is the separation between free zone and onshore frameworks:

• Free zones (ADGM, DIFC) operate under their own independent legal systems, often based on English common law, with their own courts and regulatory authorities.
• Mainland Dubai falls under VARA's jurisdiction, which operates under Dubai's civil law framework.
• Federal-level regulation by the CBUAE applies across all of the UAE for payment tokens and stablecoins, including within free zones for activities falling under its purview.

Federal Decree-Law No. 6 of 2025, which came into effect on 16 September 2025, expanded the CBUAE's regulatory perimeter to expressly cover payment services using virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, and supporting blockchain infrastructure. Existing operators have until September 2026 to comply.

Sources: Ashurst - UAE Central Bank Law; CMS - New UAE Central Bank Law; Databirdjournal - Federal Decree-Law No. 6

3. Custody Licensing & Registration

3.1 VARA Custody Services License

VARA's Custody Services Rulebook (Version 2.0, effective 19 June 2025) establishes a dedicated licensing regime for crypto custody:

• Dedicated entity requirement: Custody must be operated through a separately licensed entity. Custody services cannot be combined with other virtual asset activities under a single license.
• Application fee: AED 100,000 (non-refundable) for the first activity category; AED 50,000 for each additional category.
• Annual supervision fee: AED 200,000+ for custody services, varying by risk classification.
• Timeline: Minimum 9 months from initial application to operational license.
• Process: Two-phase: (1) Pre-approval including Initial Disclosure Questionnaire and business plan submission; (2) Post-incorporation including entity establishment, appointment of Responsible Individuals, and systems readiness demonstration.
• Responsible Individuals: Minimum two "Fit and Proper" individuals required, full-time and UAE-based.

3.2 ADGM FSRA Custody Authorization

Under the ADGM framework, custody of virtual assets is a regulated financial service requiring FSRA authorization:

• Accepted Virtual Assets only: Only virtual assets meeting FSRA criteria may be custodied. The FSRA shifted from an approval-based process to a notification process based on self-assessment (as of June 2025).
• Prohibited assets: Privacy tokens, algorithmic stablecoins, and similar technology are expressly banned from regulated activities within ADGM.
• Timeline: Approximately 6-12 months depending on complexity.
• FSRA intervention powers: Under Financial Services and Markets Regulations sections 5A and 5B, the FSRA can require compliance actions or mandate cessation of activities for specified periods.

3.3 DFSA Crypto Token Framework

The DFSA updated its crypto token regulatory framework effective 12 January 2026:

• Firm-led suitability: The DFSA no longer prescribes a list of Recognised Crypto Tokens. Instead, authorised firms are responsible for determining whether tokens meet the DFSA's suitability criteria.
• Custody activities: Include "arranging custody of a crypto token" and "providing custody of a crypto token" as regulated activities.
• Third-party custodian assessment: Firms using third-party custodians must evaluate whether the custodian is authorised and supervised, and assess its policies for secure storage, key safety, and protection from hacking, theft, or fraud.

3.4 CMA Federal Custody Services License (Decision No. 4/R.M/2026)

Effective 13 February 2026, CMA Decision No. 4/R.M/2026 replaced the former SCA federal VASP regime (it supersedes SCA Decision No. 26/R.M/2023 and repeals the virtual-asset provisions of the prior Financial Activities Rulebook). It establishes a modular, activity-based licensing model with eight regulated virtual-asset activities, one of which is Custody Services:

• Authority: Capital Market Authority (federal; ex-SCA, renamed/replaced effective 1 January 2026 under Federal Decree-Laws No. 32 and No. 33 of 2025).
• Definition of custody: An activity that "safeguards and administers virtual assets belonging to clients, either by holding the legal right to the asset through control of cryptographic keys or through registration on a distributed ledger."
• Minimum paid-up capital (custody): Conflicting across practitioner sources; primary CMA text not located. NeosLegal reads the Decision as setting AED 3,000,000 for "Providing Custody" (distinct from AED 1,000,000 for "Arranging Custody"), with AED 4,000,000 attaching to "Dealing as Principal." Cryptoverse Lawyers' prudential analysis instead maps Custody → AED 4,000,000. The discrepancy appears to turn on whether the AED 4M figure is the custody floor or is being conflated with the "Dealing as Principal" floor; it cannot be resolved without the primary CMA Decision text (which remains unfetchable as of this pass — see Verification Notes).
• Liquid resources: At least 6 months of operating expenses must be maintained as a buffer in addition to paid-up capital.
• Anti-commingling: A platform offering both exchange and custody must separately meet the capital adequacy and risk-management standards for both licenses, structurally separating the activities to prevent co-mingling of client funds.
• Governance/substance: Firms must appoint defined senior roles spanning executive management, compliance, AML/CFT, finance and internal audit, with certain key positions required to be held by UAE-resident individuals.
• Prohibited assets: Total ban on privacy tokens; algorithmic stablecoins excluded from the Official Virtual Asset List (fiat-backed tokens must prove 1:1 backing by high-quality liquid reserves, subject to monthly CMA audits).
• Transition/grandfathering: Existing licensees have a one-year window to 13 February 2027 to comply with the new Business Regulation Module / Alternative Trading System Module (existing licensing conditions remain enforceable during the period); entities holding preliminary approval face a tighter ~6-month deadline (one CMA-discretionary extension available).
• Relationship to free zones: CMA operates at the federal/onshore level alongside VARA (Dubai), ADGM/FSRA and DIFC/DFSA, which continue under their own rulebooks. The CMA regime is the federal successor to the SCA framework that underpinned the SCA-VARA mutual-recognition arrangement (see §12.5).
• Segregation specifics / annual cost / approval data: NOT VERIFIED from primary CMA text at time of writing.

Sources: NeosLegal - UAE Federal Crypto Regulations Explained; Clyde & Co - CMA Replaces Federal VASP Framework; Mielo Group - CMA Decision No. 4/R.M/2026 Guide; Cryptoverse Lawyers - CMA Prudential Rules (capital by activity); CMS - From the SCA to the CMA

3.5 Notable Licensed Entities

• Komainu: Among the first to receive a full VASP license from VARA, offering institutional custody, staking, and collateral management via its Komainu Connect platform.
• Laser Digital (Nomura): Received VARA license for institutional digital asset services.
• BitOasis: Previously held a conditional VARA license (suspended in August 2023 for not meeting mandated conditions; status should be verified on VARA's Public Register).

Sources: Neo Legal - VARA License; King & Spalding - ADGM FSRA Amendments; DFSA - Crypto Token Regulation; Blockworks - Komainu VASP License; Cointelegraph - Laser Digital VARA License

4. Asset Segregation

4.1 VARA Segregation Requirements

VARA's Custody Services Rulebook mandates strict asset segregation:

• Client-level segregation: Custodians must "segregate the Virtual Assets of each client in separate VA Wallets containing the Virtual Assets of that client only."
• Proprietary vs. client separation: Licensed custodians must segregate client assets from proprietary holdings at all times.
• Operational segregation: "Operational and physical segregation between individuals handling operations for Custody Services" and other business lines is required.
• Proof-of-reserves: Custodians must pass proof-of-reserves checks under the Rulebook 2.0 framework.
• Regular reconciliation: Custodians must maintain regular reconciliation of client assets.

4.2 ADGM Segregation Requirements

ADGM's regulatory framework requires that client virtual assets be held separately from the firm's own assets, consistent with established financial services segregation principles under ADGM's broader conduct of business rules.

4.3 Insolvency Protections

Under VARA's framework, only licensed "qualified custodians" may hold client funds, which requires multi-signature wallets or insured vault services, rigorous audit trails, and periodic proof-of-reserves. These measures are designed to ensure client asset protection in insolvency scenarios.

Sources: VARA Custody Services Rulebook; Solidus Labs - VARA 2025 Update; Legasset - VARA Rulebook 2.0

5. Key Management

5.1 VARA Key Management Requirements

VARA's Custody Services Rulebook (Part III) sets detailed key management standards:

• Secure generation (Part III.C.2a): Custodians must "implement robust and secure private key generation processes" using "industry best standards" for seed, asymmetric private/public key combinations, or similar mechanisms.
• Industry-standard cryptography (Part III.C.2b): Custodians must "use cryptography that complies with industry best practices."
• Geographic distribution (Part III.C.2c): Custodians must "create and store multiple copies of private keys in geographically dispersed locations" with "encryption and secure storage mechanisms to protect backup copies from unauthorised access."
• Multi-signature (Part III.C.2d): Custodians must "implement multi-signature schemes, where appropriate, to minimise the risk of unauthorised access." VARA also "reserves the right to require VASPs to use multi-signature approaches."
• Access control (Part III.C.2e): Custodians must "limit and monitor access to private keys."
• Segregation of duties (Part III.B.5-6): "Clear segregation of duties between the custodian and the operational company."
• Regular testing (Part III.C.3a): Custodians must "regularly test the effectiveness of backup and recovery procedures."
• Ongoing review (Part II.A.2): Regular review of the "effectiveness of policies and procedures, including those relating to key management."

5.2 Hot, Cold, and Warm Wallet Requirements

VARA does not mandate a specific cold storage percentage (the often-cited "95% cold storage" requirement does not originate from VARA). Instead, VARA requires:

• Risk-based analysis: VASPs must use a risk-based analysis to determine storage methods between hot, cold, and warm wallets.
• Documentation: Detailed documentation of "the methodologies and behavior determining the transfer of virtual assets between different types of virtual assets wallets."
• Internal controls and audit: Mechanisms for transfer between wallet types must be "well documented and subject to internal controls and audits performed by an independent third-party auditor."

Sources: CoinCover - VARA Key Management; VARA Rulebook - VA Wallet Management; Dataflowx - Crypto Asset Storage Laws

6. Capital Requirements

6.1 VARA Capital Requirements

Capital requirements under VARA are activity-specific:

In addition to paid-up capital, VARA imposes ongoing Net Liquid Asset and Reserve Asset requirements that must be maintained at all times.

6.2 ADGM FSRA Capital Requirements

ADGM capital requirements depend on the nature of activities:

Capital must be held in fiat currency. The BCR reduction for non-public fund custody was implemented to align capital requirements more closely with actual risk profiles.

Sources: Ape.law - VARA Real Cost; GRC Partners - VARA Licensing Guide 2025; ACA Group - ADGM Prudential Changes; King & Spalding - ADGM FSRA Amendments

7. Insurance & Liability

7.1 VARA Insurance Framework

VARA's Rulebook 2.0 framework requires custodians to use "qualified custodians" with "insured vault services." While VARA does not prescribe a specific insurance amount, the framework mandates:

• Proof-of-reserves checks
• Rigorous audit trails
• Adequate risk management frameworks covering cybersecurity, fraud, and operational risks
• Capital commensurate with liabilities

7.2 ADGM Requirements

ADGM requires authorized persons to maintain appropriate professional indemnity insurance or equivalent arrangements as part of its broader conduct of business framework.

7.3 Liability

Custodians under both VARA and ADGM frameworks bear fiduciary-like responsibility for client assets. Failure to maintain adequate controls, segregation, or capital can result in enforcement action, license suspension, or revocation.

Sources: Solidus Labs - VARA 2025 Update; ADGM FSRA Guidance

8. AML/KYC

8.1 Federal AML Framework

The UAE's AML/CFT framework applies across all jurisdictions and regulators:

• Compliance with FATF recommendations, including the Travel Rule.
• The CBUAE published specific Virtual Assets Travel Rule guidance requiring VASPs to collect and transmit originator and beneficiary information for virtual asset transfers.

8.2 VARA AML Requirements

VARA requires all licensed VASPs to:

• Implement comprehensive AML/KYC procedures aligned with national standards.
• Maintain customer due diligence programs.
• Submit suspicious transaction reports.
• Comply with VARA's marketing regulations (effective October 2024), with penalties up to AED 10 million for non-compliance.

8.3 ADGM AML Requirements

ADGM-regulated firms must comply with the ADGM's Anti-Money Laundering and Sanctions Rules and Guidance, which align with FATF standards and UAE federal AML legislation.

Sources: CBUAE Rulebook - Travel Rule; Sumsub - Crypto in the UAE

9. Audit & Reporting

9.1 VARA Audit Requirements

Under VARA's Custody Services Rulebook:

• Independent third-party audits: Wallet management mechanisms and transfer procedures must be subject to audits by an independent third-party auditor.
• Proof-of-reserves: Periodic proof-of-reserves checks are mandatory.
• Regular policy review: Part II.A.2 requires regular review of the effectiveness of all policies and procedures.
• Full risk management framework: Each custodian must implement a comprehensive risk-management framework covering cybersecurity, fraud, and related risks.

9.2 ADGM Reporting

ADGM-regulated firms are subject to:

• Annual audited financial statements.
• Regulatory returns and prudential reporting.
• Technology-related operational expense reporting.

Sources: VARA Rulebook - Custody Services; CoinCover - VARA Compliance

10. Enforcement

10.1 VARA Enforcement Actions

VARA has demonstrated active enforcement:

• October 2024: VARA fined seven unlicensed crypto entities between USD 13,600 and USD 27,200 and issued cease-and-desist orders.
• October 2025: VARA sanctioned 19 companies operating outside its regulatory perimeter, with penalties ranging from USD 27,000 to USD 163,000 per entity.
• 2025 total: As of late 2025, VARA's website listed 38 entities with 31 sanctions issued in 2025 alone.
• March 2026 (KuCoin): On 5 March 2026, VARA ordered four entities operating under the KuCoin brand — Phoenixfin Pte Ltd, MEK Global Limited, Peken Global Limited, and KuCoin Exchange EU GmbH — to immediately cease all virtual asset activity in/from Dubai for operating without a license, citing Dubai Law No. 4 of 2022 and Cabinet Resolution No. 111/2022.
• Marketing violations: Following new marketing regulations effective October 2024, violations may result in fines up to AED 10 million (~USD 2.7 million).

10.2 ADGM FSRA Enforcement

The FSRA possesses broad supervisory authority under Financial Services and Markets Regulations sections 5A and 5B, including the power to require compliance actions or mandate cessation of virtual asset activities for specified periods.

10.3 CBUAE Federal Enforcement

Under Federal Decree-Law No. 6 of 2025, any person carrying on, offering, issuing, or facilitating a licensed financial activity involving virtual assets without CBUAE authorization is subject to enforcement action.

Sources: Cointelegraph - VARA Fines 19 Firms; CoinDesk - VARA Enforcement 2024; CoinMarketCap - Dubai Licensing Crackdown; Crypto Times - VARA Orders KuCoin to Halt Operations

11. Recent Developments

11.1 VARA Rulebook 2.0 (May 2025)

On 19 May 2025, VARA published Version 2.0 of its activity-based Rulebooks, representing a structural shift with:

• Tighter controls around margin trading and token distribution services.
• Clearer definitions for collateral wallet arrangements.
• Harmonised compliance requirements across all licensed activities.
• Strengthened custodian requirements including proof-of-reserves and qualified custodian mandates.
• Full compliance required by 19 June 2025 (30-day transition period).

11.2 ADGM Digital Asset Framework Amendments (June 2025)

The FSRA's June 2025 amendments introduced:

• Shift from approval-based to notification-based process for Accepted Virtual Assets.
• Express prohibition of privacy tokens and algorithmic stablecoins.
• Expanded investment permissions for Venture Capital Funds to include virtual assets.
• Streamlined fee structure treating VA activity charges as add-on fees.

11.3 Federal Decree-Law No. 6 of 2025 (September 2025)

The new CBUAE law brought virtual assets, DeFi protocols, stablecoins, tokenized real-world assets, decentralized exchanges, wallets, bridges, and all supporting blockchain infrastructure under central bank authority. Compliance deadline: September 2026.

11.4 DFSA Crypto Token Framework Update (January 2026)

The DFSA shifted responsibility for crypto token suitability assessments from the regulator to DFSA-authorised firms, enabling a broader range of tokens to be used in DIFC-based financial services.

11.5 CMA Federal VASP Framework — Decision No. 4/R.M/2026 (February 2026)

Effective 13 February 2026, the Capital Market Authority (CMA — the federal successor to the SCA, which was replaced on 1 January 2026 under Federal Decree-Laws No. 32 and No. 33 of 2025) issued Decision No. 4/R.M/2026, a comprehensive federal virtual-asset framework that replaces the prior SCA regime in full (superseding SCA Decision No. 26/R.M/2023). The Decision is dated/effective 13 February 2026, but the CMA's public issuance of the framework was announced on 13 April 2026 (The National, 13 Apr 2026) — which explains why some summaries describe the framework as "issued April 2026" while the operative effective date remains 13 February 2026. Key custody-relevant features: an activity-based model with eight licensed activities including a dedicated Custody Services license; higher minimum capital (figures conflict across practitioner sources — AED 3,000,000 for "Providing Custody" per NeosLegal vs AED 4,000,000 for Custody per Cryptoverse Lawyers' prudential analysis; primary CMA text not located) plus a 6-month operating-expense buffer; mandatory structural separation between exchange and custody activities to prevent commingling; a total privacy-token ban; exclusion of algorithmic stablecoins (fiat-backed must prove 1:1 reserve backing under monthly CMA audit); and a one-year transition window to 13 February 2027. See §3.4 for detail.

11.6 VARA Exchange Services Rulebook update (effective 31 March 2026)

On 31 March 2026, VARA brought into effect an updated Exchange Services Rulebook formalising rules for crypto exchange-traded derivatives (ETDs) in Dubai. The 31 March 2026 effective date is confirmed on the official VARA rulebook page (rulebooks.vara.ae/rulebook/exchange-services-rulebook), which lists the prior versions "V.1.(7Feb2023)" and "V.2.(19May2025)" and shows the current edition (document VARA_EN_258_VER20260331.pdf) as the active version effective 31 March 2026. The official page does not display the version label "2.1" that some trade press (BanklessTimes, PnyxHill) attached to this edition — VARA's own version history labels only V.1 and V.2; the "2.1" designation is therefore NOT confirmed on the primary source and should not be relied on (see Verification Notes). While derivatives-focused, the update carries custody-relevant provisions: mandatory separation of client assets from company capital, tightened margin/liquidation procedures, a ~5x retail leverage cap, client suitability/classification tiers, and strengthened VARA intervention powers (including the ability to suspend trading or demand immediate action without prior notice during market stress).

11.7 VARA Virtual Asset Issuance Guidance & Rulebook (9 April 2026)

On 9 April 2026, VARA published a dedicated Virtual Asset Issuance Guidance expanding its Virtual Assets Issuance Rulebook, covering Fiat-Referenced Virtual Assets (FRVAs), Asset-Referenced Virtual Assets (ARVAs/tokenised assets) and exempt tokens. Custody/segregation-relevant requirements: issuers must legally segregate Reserve Assets so they remain separate from the issuer's own assets and do not form part of its estate (insolvency-remoteness for redemptions); maintain 100% 1:1 reserve backing with segregated eligible assets; undergo monthly independent audits for ARVAs; and meet a capital requirement of the higher of AED 1,500,000 or 2% of the trailing-24-month average reserve value. FRVAs are restricted to use within the virtual-asset ecosystem (not general payment for goods/services in the UAE); anonymity-enhanced cryptocurrencies are prohibited.

Sources: Solidus Labs - VARA 2025; ADGM - FSRA Amendments; Ashurst - UAE Central Bank Law; DFSA - Crypto Token Updates; NeosLegal - UAE Federal Crypto Regulations Explained; Clyde & Co - CMA Replaces Federal VASP Framework; VARA Exchange Services Rulebook (official — effective 31 Mar 2026); BanklessTimes - VARA Stricter Governance for Derivatives; The National - CMA Issues Virtual Assets Framework (13 Apr 2026); Cryptonomist - Dubai Virtual Asset Rulebook & Issuance Guidance; CoinEdition - Dubai RWA & Stablecoin Issuance Guidelines

12. Practical Intelligence [NEW]

12.1 Application Timeline (Actual)

Published timelines and actual licensing experience diverge significantly across UAE regulators:

Sources: NeosLegal - UAE Crypto Licensing 2026; Cryptoverse Lawyers - UAE Licensing Tips 2026; Prifinance - ADGM License

12.2 Application Cost (Total Cost of Licensing)

The published government fees represent only a fraction of total licensing cost. Below is a realistic Year 1 budget for a custody-focused VASP:

VARA Custody License — Estimated Year 1 Total: AED 6,500,000-8,000,000 (~USD 1.77M-2.18M)

ADGM FSRA Custody License — Estimated Year 1 Total: USD 800,000-5,500,000

DFSA (DIFC) Custody License — Estimated Year 1 Total: USD 500,000-2,000,000+

Sources: Ape.law - VARA Real Cost; Cryptoverse Lawyers - DFSA Fees & Capital; King & Spalding - ADGM FSRA Amendments; ADGM Schedule of Fees 2025

12.3 Annual Ongoing Cost

Beyond Year 1, licensed custodians face recurring annual costs:

Note: VARA capital must be held as locked capital (trust account with VARA as beneficiary, bank guarantee, or surety bond), creating an ongoing cost of 2-3% in bank charges plus the full opportunity cost of the locked amount.

Sources: Ape.law - VARA Real Cost; SecureVisaNow - VARA Supervision

12.4 Staffing & Substance Requirements

All three UAE crypto regulators require meaningful local substance:

VARA Requirements:

• Responsible Individuals: Minimum 2, must be full-time employees, UAE residents or UAE passport holders, approved by VARA as "Fit and Proper"
• Four accredited roles (require VARA regulatory approval): Head of Category/Manager, Head of Compliance, Head of Risk Management, Operations Manager
• Non-accredited roles (no formal VARA approval): IT Officer, Information Security Officer, Financial Manager
• Dedicated entity: Custody must operate through a separately licensed entity; cannot be combined with other VA activities
• Physical office: Required in Dubai mainland

ADGM Requirements:

• Minimum 2-3 directors, preferably with financial services experience
• Senior Executive Officer (SEO): Must be UAE resident; typically requires ~10 years relevant experience
• Compliance Officer (CO): Must be UAE resident; can double as MLRO
• Risk Officer (RO) and Finance Officer (FO): Required, though may be outsourced
• Physical presence: Office in ADGM required

DFSA Requirements:

• Senior Executive Officer (SEO): Must be ordinarily UAE-resident
• Finance Officer (FO): Cannot combine with SEO, CO, or MLRO
• Compliance Officer (CO): Must be ordinarily UAE-resident; can combine with MLRO under conditions
• Money Laundering Reporting Officer (MLRO): Must be ordinarily UAE-resident
• Internal Audit function: Recommended but not always mandatory for smaller firms

UAE Emiratization / National Requirements: There is no specific UAE national (Emirati) hiring quota for ADGM or DIFC free zone entities. VARA (mainland Dubai) entities may be subject to broader Emiratization policies, but crypto-specific mandates have NOT VERIFIED as being imposed to date.

Sources: NeosLegal - UAE Crypto Licensing 2026; Cryptoverse Lawyers - DFSA Fees & Capital; Prifinance - ADGM License; LegalBison - VARA License

12.5 Passporting & Cross-Border Operations

Intra-UAE Passporting (SCA-VARA Agreement)

In August 2025, the SCA and VARA formalized a strategic partnership (operationalizing a 2024 MOU) that provides:

• Mutual license recognition: A VASP licensed by VARA is automatically registered with the SCA, enabling operation throughout the UAE
• Not automatic passporting: VARA clarified that mutual recognition does not equal automatic passporting — VASPs remain subject to coordination protocols, AML/CFT assessments, operational readiness checks, and supervisory alignment
• ADGM/DIFC not covered: The SCA-VARA agreement does not extend to ADGM or DIFC, which operate under their own independent regulatory frameworks. ADGM has confirmed "ongoing dialogue" but no formal mutual recognition arrangement exists
• SCA superseded by CMA (1 Jan 2026): The SCA was replaced in full by the Capital Market Authority (CMA) effective 1 January 2026 under Federal Decree-Laws No. 32 and No. 33 of 2025; the CMA assumed all rights, obligations and contracts of the SCA as legal successor. The mutual-recognition arrangement therefore now sits with the CMA. Under the new CMA federal VASP framework (Decision No. 4/R.M/2026, eff. 13 Feb 2026) the federal layer is materially heavier (dedicated activity-based licenses, higher capital), and how VARA-CMA mutual recognition operates in practice under the new regime is NOT VERIFIED.

GCC Cross-Border Operations

• No formal GCC-wide crypto passporting regime exists. Each GCC state (Saudi Arabia, Bahrain, Kuwait, Oman, Qatar) maintains its own regulatory approach
• UAE-licensed custodians cannot automatically serve clients in other GCC markets based solely on a UAE license
• Bahrain (CBB): Has its own crypto-asset licensing framework; no mutual recognition with UAE regulators
• Saudi Arabia (SAMA/CMA): Crypto services remain largely restricted; no mutual recognition
• Practical reality: UAE-licensed firms may serve GCC clients on a reverse-solicitation basis or by establishing licensed operations in each jurisdiction, but this requires case-by-case legal analysis
• Future direction: VARA and other regulators have indicated cross-border cooperation is a "strategic priority," but formal frameworks remain aspirational

Sources: Cointelegraph - SCA VARA Partnership; MoneyCheck - UAE VARA SCA Deal

12.6 Restrictions & Exclusions by License Type

12.7 Transition & Grandfathering Provisions

Note: VARA's 30-day transition for Rulebook 2.0 was notably aggressive. Unlike MiCA's 18-month grandfathering in the EU, VARA offered minimal transition time, reflecting the regulator's expectation that licensed entities maintain continuous compliance readiness.

Sources: Solidus Labs - VARA 2025; Ashurst - UAE Central Bank Law

12.8 Banking Access

Banking access remains one of the most significant practical challenges for crypto custodians in the UAE:

Crypto-Friendly Banks (as of early 2026):

Account Opening Realities:

• Licensing (VARA, ADGM, DFSA, or SCA) is typically a prerequisite before banks will engage
• Banks require blockchain analytics integration (Chainalysis or Elliptic) for transaction monitoring
• Enhanced Due Diligence (EDD) applies: verified UBO information, clear transaction flow documentation
• Onboarding involves high minimum balances, extensive documentation, and direct interviews with senior compliance officers
• Timeline: Banking onboarding can take 2-4 months after licensing is secured — this is often an underestimated bottleneck

Sources: KWSME - UAE Banks for Crypto Companies; Zodia Custody - Emirates NBD Investment; Aston VIP - Crypto Exchange Banking UAE

12.9 Approval & Rejection Data

Formal approval/rejection rate statistics are not published by VARA, ADGM, or DFSA. Available data points:

• VARA: As of February 2026, approximately 507 VASPs licensed (across all activity categories, not custody-specific), managing combined assets exceeding USD 25 billion. The public register is maintained at vara.ae.
• ADGM: More than 40 companies have obtained ADGM virtual asset licenses, including Binance (which secured a "global license" under the ADGM framework, announced as a first-of-its-kind).
• DFSA: Number of licensed crypto token firms NOT VERIFIED from public sources.
• Rejection rates: No regulator publishes rejection statistics. Practitioner reports indicate that non-compliance with AML/CTF infrastructure requirements causes "immediate application rejection or lengthy delays."
• BitOasis case: Received an MVP license in May 2023 but was suspended in August 2023 for not meeting mandated conditions — illustrating that VARA will revoke conditional approvals.

Sources: DigitalDubai.ai - VARA 500+ Companies; ADGM - Binance Global License; VARA Public Register

12.10 Regulatory Direction & Strategic Positioning

The UAE is pursuing an explicit strategy to become the world's preeminent crypto and Web3 hub:

Strategic Framework:

• Dubai Economic Agenda D33: Aims to make Dubai a top-3 global financial hub; crypto/digital assets are a key pillar
• UAE Digital Economy Strategy (April 2022): Target to double digital economy GDP contribution from 9.7% (2022) to 19.4% by 2031
• Real-world asset tokenization: Major focus area, with BlackRock, Citi, and BCG projecting USD 10-16 trillion in tokenized assets by 2030; UAE positioning for Islamic DeFi and tokenized Sukuk

Regulatory Evolution Trajectory:

• 2022: VARA established; ADGM early-mover framework operational
• 2023-2024: MVP/conditional licensing phase; enforcement begins
• 2025: Major maturation — VARA Rulebook 2.0, ADGM framework amendments, CBUAE Federal Decree-Law No. 6 brings all VA activity under central bank authority
• 2026: DFSA framework update (Jan 2026); CBUAE compliance deadline (Sep 2026); SCA-VARA mutual recognition operational
• 2026-2030 outlook: Convergence toward unified national framework; potential GCC-level coordination; institutional-grade infrastructure (custody, staking, tokenization) as competitive differentiator

Market Indicators:

• USD 30+ billion in crypto inflows (July 2023 - June 2024), ~10% of MENA total
• Institutional transfers (USD 1M-10M) up ~55% year-on-year
• ~30% of UAE population owns cryptocurrency
• Fines for unlicensed operations up to AED 1 billion (~USD 272M) under new CBUAE law — signaling zero tolerance for non-compliance

Licensing Path Case Studies:

Sources: FiscalNote - UAE Virtual Asset Leadership; CoinDesk - UAE Central Bank Law; Chambers - Blockchain 2025 UAE; Blockworks - Komainu; Cointelegraph - Hex Trust VASP

13. Assessment

Strengths

• Comprehensive multi-regulator framework: The UAE offers multiple pathways for institutional crypto custody through VARA, ADGM, DIFC, and federal-level regulation, providing flexibility for different business models.
• Institutional-grade standards: Capital requirements (AED 4M for VARA custody; up to USD 4M for ADGM public fund custody) signal a serious commitment to institutional-grade custody operations.
• Active enforcement: VARA's escalating enforcement actions (38 sanctioned entities by late 2025) demonstrate regulatory credibility.
• Global alignment: Frameworks are aligned with FATF standards and draw on international best practices, comparable to European Union MiCA standards.
• Risk-based approach: VARA's wallet management requirements use a risk-based framework rather than prescriptive mandates, allowing firms to optimize security architecture.

Challenges

• Regulatory complexity: Navigating four overlapping regulatory regimes creates compliance burden and potential jurisdictional confusion.
• Timeline: Minimum 9-month licensing process (VARA) can be challenging for firms seeking rapid market entry.
• Evolving landscape: Rapid regulatory changes (VARA v2.0, ADGM amendments, new CBUAE law all in 2025) require continuous compliance monitoring.
• Cost: Combined application fees, capital requirements, and annual supervision fees make the UAE one of the more expensive jurisdictions for crypto custody licensing.

Comparative Position

The UAE's framework is more developed than many jurisdictions in the region, including Bahrain, and comparable in sophistication to Singapore and Hong Kong. The multi-regulator model offers flexibility but adds complexity compared to single-regulator approaches seen in the Switzerland FINMA model. For detailed guidance on navigating Licensing Frameworks across jurisdictions, see the comparative analysis.

---

<!-- related-coverage:BEGIN — auto-generated by related_coverage.py; edit via --apply re-run, not by hand -->

Related coverage

UAE in other research domains:

• Crypto Mining Regulations
• DeFi Regulation & Liability Frameworks
• Digital Asset Insurance & Risk Transfer
• Digital Asset License Map
• Digital Asset Taxation
• NFT & Digital Collectibles Regulations
• Payment Services & Crypto Payment Regulation
• Stablecoin Regulations & License Regimes
• Tokenized Real-World Assets (RWA) Regulation

<!-- related-coverage:END -->

Verification Notes

Corrections Made (2026-06-04 refresh)

1. SCA → CMA institutional change (stale entity name): The prior version described the federal-level mutual-recognition arrangement only in terms of the "SCA" (§12.5) and did not reflect that the SCA was replaced in full by the Capital Market Authority (CMA) effective 1 January 2026 (Federal Decree-Laws No. 32 and No. 33 of 2025). Corrected in §1, §2.1 table, §3.4 (new), §11.5 (new) and §12.5, with the SCA-VARA passporting paragraph annotated to note the CMA succession.
2. Missing federal custody license: The prior version omitted CMA Decision No. 4/R.M/2026 (eff. 13 Feb 2026), which introduces a dedicated federal Custody Services license. Added new §3.4 and §11.5. No factual claim in the prior version was wrong on this point — it was a coverage gap, now filled.

Targeted gap-closure pass (2026-06-06)

Worked the four crypto-custody gaps flagged for this file. Fetches this pass: official VARA Exchange Services Rulebook page (primary), Cryptoverse Lawyers prudential page, NeosLegal, Clyde & Co, Lexis.ae, The National, plus the sca.gov.ae CMA regulations portal landing page.

1. VARA Exchange Services Rulebook version label "2.1" — CORRECTED / partially CLOSED. Fetched the official rulebook page (https://rulebooks.vara.ae/rulebook/exchange-services-rulebook). It confirms the 31 March 2026 effective date (primary) and document VARA_EN_258_VER20260331.pdf, but its version history lists only "V.1.(7Feb2023)" and "V.2.(19May2025)" — it does not display a "2.1" label. The "2.1" designation originated with trade press (BanklessTimes/PnyxHill) and is NOT confirmed on the primary page. Was: "§11.6 VARA Exchange Services Rulebook v2.1" / "reported as Version 2.1". Now: §11.6 retitled "VARA Exchange Services Rulebook update (effective 31 March 2026)"; body and Verification Notes row state the effective date is primary-confirmed while the "2.1" label is not. Source: https://rulebooks.vara.ae/rulebook/exchange-services-rulebook.

2. CMA effective-date framing (13 Feb 2026 vs "April 2026") — REFINED (primary still unfetchable). The Decision is dated/effective 13 February 2026 (consistent across NeosLegal, Clyde & Co, CMS). The CMA's public issuance/announcement of the framework was 13 April 2026 (The National, 13 Apr 2026), which is why some summaries say "issued April 2026." Added this distinction to §11.5. The primary CMA Decision text was not located/fetched, so this is corroborated by secondary/event reporting only — gap not closed against primary, but the apparent date contradiction is resolved.

3. CMA custody minimum paid-up capital (AED 3M vs AED 4M) — STILL OPEN (primary not located). NeosLegal reads "Providing Custody" = AED 3,000,000 (distinct from "Arranging Custody" AED 1M and "Dealing as Principal" AED 4M); Cryptoverse Lawyers' prudential analysis maps Custody = AED 4,000,000. The conflict is now better characterised (likely a Providing-Custody vs Dealing-as-Principal conflation) but cannot be resolved without the primary CMA Decision text. The sca.gov.ae CMA regulations portal landing page was fetched but did not expose the VA-decision PDF; the decision text remains unfetchable.

4. CMA custody segregation specifics / annual ongoing cost / approval-rejection data — STILL OPEN (primary not located). No primary CMA text reproducing custody-specific asset-segregation provisions, ongoing-cost schedules, or approval/rejection statistics was located this pass. §3.4 retains the explicit "NOT VERIFIED from primary CMA text" wording.

Standard

Verified under verification-standards.md Standard version: 2026-06-04 (gap-closure pass 2026-06-06 operated under the same standard version).