The United Arab Emirates (UAE) crypto regulatory framework is divided by the Emirates. Dubai crypto regulations were created to foster innovation and encourage a bustling crypto industry. This guide investigates Dubai cryptocurrency regulations and how crypto compliance, Anti-Money Laundering (AML) requirements, and local policy differ from the rest of the country.
The Crypto Regulatory Framework in the UAE
The United Arab Emirates has 7 regions, which were unified between 1971 and 1972 to bring about greater political and economic cooperation between the states. This allowed the Emirates to diversify its economies and specialize in each Emirate. Different regions now play independent but pivotal roles in strengthening the UAE’s economy.
Dubai’s innovation-focused regulatory policies regarding crypto assets are central to its rise as a financial and crypto hub. While all Emirates act under federal law, each state still has a great deal of autonomy. Dubai’s rise as a financial focal point is no coincidence. The region was given greater freedom to endorse regulations and policies attractive to global financial markets, notably the crypto industry.
The UAE’s leading federal financial industry regulatory authority is the Securities and Commodities Authority (SCA). The SCA enacted a policy prohibiting any person from engaging in Virtual Asset (VA) activities in Onshore Dubai without obtaining a license from the national regulator or a separate local authority.
In March 2022, however, Dubai’s Financial Free Zone took significant strides forward with its own set of regulations. Shortly after, the rest of Dubai (outside of the Free Zone) was subjected to the authority of the Virtual Assets Regulatory Authority (VARA), which enabled the significant growth and development of the Emirate’s crypto industry.
Dubai and Abu Dhabi Economic Strategies
All of the Emirates are fundamental to the country’s economy. However, Abu Dhabi and Dubai have the most significant international recognition. The former is generally recognized as a stable financial hub with rigorous regulatory policies to ensure a safe financial system and prevent money laundering. The Abu Dhabi financial sector is strengthened by oil industry revenues and sovereign wealth funds, including the Abu Dhabi Investment Authority (ADIA).
Conversely, Dubai is better characterized by a higher-risk and higher-reward economic strategy. Dubai crypto regulations, including legislation by the Virtual Assets Regulatory Authority, are designed to encourage the industry’s growth. Initiatives such as this have attracted multiple Financial Technologies (FinTechs) in a variety of forms, including crypto exchanges, VA services, and many others in non-crypto-related sectors.
Who Regulates Digital Assets in Dubai?
Article 121 of the UAE Constitution allows the creation of Free Zones throughout the country. Specifically, Federal Law No.8 of 2004 permits ‘Financial Free Zones,’ which are exempt from civic and commercial laws that the rest of the country is bound to. They are, however, required to adhere to the same federal criminal laws.
Dubai Crypto Regulations
The UAE has created two Financially Free Zones: the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC). The DIFC has its own regulator, the Dubai Financial Services Authority (DFSA). This regulatory body has established its own Virtual Asset (VA) framework, including the Investment and Crypto Tokens Regimes.
Outside the DIFC, known as onshore Dubai, a regulatory body called VARA oversees Virtual Asset Service Providers (VASPs). This council, established under Dubai Law No. 4 of 2022, provides comprehensive regulations and guidance for VASPs that are favorable for attracting crypto projects.
It is important to note that VARA has no legal jurisdiction in the DIFC, just as the DFSA has no authority outside of the International Financial Centre. Both regions of Dubai operate independently under different regulations. This does not denote that the regulatory landscape in both areas is vastly different; there are, naturally, areas of overlap.
The Dubai Financial Services Authority
The DFSA has two key regulatory policies, the Investment Token Regime (October 2021) and the Crypto Token Regime (November 2022). The former was ultimately a preliminary set of legislative measures that marked the birth of cryptocurrency regulation in the DFSI.
Investment Tokens Regime, 2021
The regulation of Investment Tokens was designed to outline the definitions, scopes of application, and current and future regulatory objectives. The proposal defined investment tokens as either security tokens or derivative tokens.
These tokens are defined as digital representations of rights and ownership stored cryptographically and transferred via a Distributed Ledger Technology (DLT) or a blockchain. Investment Tokens can either represent rights directly or display qualities that are ‘substantially similar in nature to those conferred by a security or derivative.‘
This framework applies to institutions involved in marketing, issuing, trading, or holding Investment Tokens within the DIFC. However, the regulations also extend to authorized firms that engage with Investment Tokens, such as facilitating transactions, using the tokens for payments, and advising.
The DFSA released this initial Regime with the intention of providing more comprehensive regulation for other kinds of cryptocurrencies, including asset-baked tokens (stablecoins), utility tokens, and more. The Investment Tokens consultation was designed to help authorities comprehend how best to regulate the broader industry in a way that would benefit the firms operating in the Dubai International Financial Centre.
Crypto Tokens Regime, 2022
The following year, on November 1st, 2022, the DFSA released its comprehensive legislation for regulating the cryptocurrency industry and markets generally. This second initiative was built to foster innovation responsibly, ensure businesses adhere to best Anti-Money Laundering practices, and provide infrastructure for consumer protection.
The framework is designed to balance technologies, allowing firms to offer a broad range of financial products, including VAs. Covering areas of financial crime, technology, fraud, governance, and risk, the Regime ensures that Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) issues are covered.
Under this policy, firms operating in the Dubai International Financial Center can apply for licenses to provide financial services using Crypto Tokens. Furthermore, this opened the opportunity for crypto services, meaning the industry could branch into custodial services, crypto asset management, and token markets/exchanges.
The response to this development was very positive, with over 100 firms inquiring about Crypto Token initiatives in the DIFC. In 2022, the DFSA recognized 3 tokens, including Bitcoin, Ethereum, and Litecoin. At the turn of the year in 2023, it added 2 tokens: Toncoin and Ripple’s XRP token.
While these appear to be very few cryptocurrencies, they are some of the most prominent in the industry regarding market capitalization and trading volumes. Their longstanding credibility makes them a more suitable choice – at least in the short term – for institutional adoption and use.
Gaining a license with the DFSA
The regulator has created a list of modules for businesses looking for a license to adhere to; firms must also meet the specifications established in their comprehensive GEN modules (their regulatory rule book.) The list includes:
-
Business model and strategy
-
Corporate governance and management
-
Senior management
-
Ownership and corporate structure
-
Financial and relevant operational resources
-
Business conduct and approach to AML
As the Regime relates to multiple financial sectors, the fees for gaining a license can vary significantly, between $2,000 and $70,000, notably paid in USD. These regulations exemplify Dubai’s progressive stance on the future of finance and fintech, positioning itself as a leader by example for other financial hubs.
The Dubai International Financial Centre has become a cornerstone of the Emirate’s economy. 2023 alone witnessed the development of over 500 global AI and Web3 start-ups. Of course, the Dubai VA sector extends far beyond the jurisdiction of only the DFSA.
The Virtual Assets Regulatory Authority
VARA has significant autonomy from all other UAE federal regulators. This is one of the core components behind the region’s success. There are some parallels between VARA and DFSA; however, there is no jurisdictional overlap.
The Virtual Assets Regulatory Authority is the leading regulatory voice of Onshore Dubai and was established in 2022 under Law No. 4 of 2022. This law was passed to give VARA total authority over the crypto industry’s legislation in the region.
To promote the Emirate as a regional and international hub for Virtual Assets.
VARA was the world’s first independent crypto regulator, intending to provide legal clarity for crypto in Dubai. Every Virtual Asset Service Provider (VASP) in Onshore Dubai must be licensed with VARA. The following requirements must be met to obtain a license:
-
The firm must have sufficient financial resources to operate its business securely.
-
Risk assessments must be done, and remedial processes must be staged for associated VA risk.
-
Robust AML and KYC systems must be in place.
-
The VASP must demonstrate rigorous Customer Due Diligence (CDD) measures.
-
Management and governance controls are required.
-
Sufficiency training for managers to ensure individuals are fit to carry out their roles.
-
VASPs must comply with the regulations and obtain a license from any external jurisdiction.
There are some professional exemptions, such as lawyers and accountants, where firms come into contact with VAs under a professional practice. Furthermore, VARA may decide if certain institutions are exempt due to particular circumstances. This is entirely up to VARA’s discretion.
Scope of VARA’s Authority
As the only cryptocurrency-focused regulator, VARA has full responsibility for providing detailed digital asset regulation to support an active and regulated crypto industry. This gives the institution the power to:
-
Create and dismantle rules pertaining to the operation of the crypto industry.
-
Direct particular (or groups of) VASPs to take or refrain from taking a particular action or policy.
-
Issue guidance that is non-binding and portrays the feelings of the regulator on particular topics.
-
Modify specific policies or regulations at any point.
-
Apply regulations with a case-by-case approach with general supplementary powers.
The Virtual Asset Framework
The VA Framework consists of two elements: the 4 Compulsory Rulebooks and the Virtual Assets and Related Activities Regulations (2023). The 4 Rulebooks are:
The Company Rulebook dictates the structuring and management of a VASP, including its board, senior management, and staff. It demands the perpetual maintenance of internal management structures, including staff training, processes, and best practices regarding environmental and social responsibilities.
The Compliance & Risk Management Rulebook outlines the core principles for regulatory compliance coupled with the implementation of a compliance management system, including the appointment of Compliance Officers. VASPs must comply with all Federal Tax Authority reporting responsibilities (such as the Internal Revenue Service in America), regulations, rules, and international best practices, such as the United States Foreign Account Tax Compliance Act (FATCA).
The Technology & Information Rulebook provides VASPs with a framework for technology governance, controls, security, and cybersecurity. Personal data protection and general compliance programs, such as AML solutions, must be installed.
The Market Conduct Rulebook informs VASPs how they are permitted to market and advertise their services to clients in and outside of the jurisdiction. Market conduct is a growing regulatory trend in multiple hot spots around the globe.
The VA-specific Rulebooks pertain to:
-
Advisory services
-
Broker-dealer services
-
Custody services
-
Exchange services
-
Lending and borrowing services
-
VA management and crypto investment firms
-
VA transfer and settlement services
-
VA issuance
The Virtual Asset Regulatory Authority is permitted to inspect and audit the implementation of its regulations as it deems necessary, and this extends to the adoption of its four Rulebooks.
VARA’s AML/CFT Policies
The Virtual Asset Regulatory Authority is the Supervisory Authority for Dubai Emirate in all VA respects and is fundamental in preventing money laundering via digital currencies. Therefore, it is entirely responsible for creating and enforcing AML policies for all VASPs in its jurisdiction.
All VASPs, such as crypto trading platforms, must adhere to the national federal AML/CFT regulations mandated by the Securities and Commodities Authority, which includes conducting business according to a Risk-Based Approach (RBA). The SCA implemented this in 2018 with Federal Law No. 20 and Cabinet Resolution No. 10.
[Crypto companies must] identify crime risks within (their) scope of work.
UAE Financial Institutions (FIs) must enact a compliance program appropriate to the associated risks their sector presents. Crypto assets are well known for their anonymity and, thus, connections with illicit finance. VARA also significantly endorses the crypto travel rule, both inside its own jurisdiction and internationally. For more information on what the rule involves, read The Crypto Travel Rule.
The enhanced enforcement of these policies further strengthens the holism of international regulatory legislation, as recommended by the Financial Action Task Force (FATF). Ahead of the 2025 Mutual Evaluations, it is expected that global regulations will become increasingly holistic to achieve compliance with FATF AML Recommendations.
To mitigate these risks, VARA enforces substantial AML practices upon licensed crypto exchanges and other VASPs. Learn more about KYC and AML compliance solutions by reading How KYC Crypto Regulations Safeguard the Industry.
Central Bank Digital Currency (CBDC) Policies
In January 2024, the UAE made the first-ever cross-border transaction with a digital currency using the mBridge infrastructure. 4 leading central banks developed this innovative technology: the Hong Kong Monetary Authority, the Central Bank of the UAE, the Digital Currency Institution of the People’s Bank of China, and the Bank of Thailand.
The value of the payment was AED 50 million (around $13.6 million) and was sent by the chairman of the board of the UAE’s central bank to China. mBridge aims to revolutionize wholesale international payments using a cooperative and shared CBDC platform. For more information on CBDCs in Hong Kong, read Hong Kong Crypto Regulation in 2024.
The UAE’s developments with this technology further evidence the country’s commitment—on a national scale—to digitally transform itself. Dubai has undoubtedly been built to foster and attract fintech and blockchain innovations; however, there is a concerted national effort to institutionalize crypto and blockchain payments.
The UAE has a more forward-thinking approach to crypto regulation, including stablecoin and CBDC adoption, than other parts of the world. This typifies many Asian crypto hubs, including Hong Kong and Singapore.
Western regulators, including the Financial Conduct Authority (FCA) in the United Kingdom and the Securities and Exchange Commission (SEC) in America, are notably behind Asian jurisdictions in stablecoin and CBDC legislation.
About ComplyCube
ComplyCube provides an award-winning SaaS compliance solution to firms globally. The RegTech 100 Ai platform offers solutions that are tailored towards flexibility without compromising comprehensive coverage. Due to this, its crypto KYC and AML solutions can be leveraged to comply with international regulations for a plethora of cryptocurrency utilities.
If your firm is facing regulatory challenges from international expansion plans or any other business activities, we can help. Start a conversation with our team of compliance experts here, or follow us on LinkedIn or X (formerly Twitter) for more information.
