Last reviewed: 8 November 2026 · Regulatory Gate · General information, not legal advice

Short answer

Choose by activity and by location. VARA licenses virtual asset businesses and token issuers, including real-world asset tokens, across Dubai outside the DIFC. ADGM's FSRA suits firms that want stablecoin issuance, crypto activity and securities under one regulator.

The CMA is the federal securities regulator and now runs the onshore virtual asset framework outside Dubai and the financial free zones. The DFSA covers the DIFC. The CBUAE governs payments and payment tokens onshore, whichever regulator licenses the rest of your business.

At a glance

Regulator Where it applies Crypto role Best fit Our read
VARA All of Dubai, including its free zones, except the DIFC Licenses virtual asset activities such as exchange, broker-dealer and custody, plus token issuance Exchanges, brokers, custodians and real-world asset issuers in Dubai The most developed crypto-specific regime in the UAE
ADGM FSRA Abu Dhabi Global Market Virtual assets, fiat-referenced tokens, digital securities and related funds and derivatives Stablecoin issuers and firms combining crypto with securities One regulator for crypto and securities
DFSA Dubai International Financial Centre Treats crypto tokens as financial instruments; firms assess token suitability themselves Institutional firms already based in the DIFC Workable, but precedent is still forming
CMA Onshore UAE, excluding the DIFC and ADGM Federal securities regulator with a virtual asset framework of eight licensed activities Firms outside Dubai serving UAE clients, and securities businesses Growing in prominence for crypto outside Dubai
CBUAE Onshore UAE Payments and payment tokens (stablecoins used for payment) AED stablecoins, payment token custody, transfer and conversion Applies alongside your main licence when payments are involved

When VARA fits

VARA is the default choice for virtual asset service providers in Dubai. It was created by Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, and it regulates virtual assets across Dubai's mainland and free zones, except the DIFC (VARA).

  • Service providers. VARA licenses exchange, broker-dealer, custody, advisory, lending and borrowing, management and investment, and transfer and settlement services (VARA).
  • Tokenisation and real-world assets. Issuing fiat-referenced or asset-referenced virtual assets is a Category 1 issuance and needs a VARA licence (VARA Rulebook). VARA's asset-referenced issuance rules cover reference assets, reserve assets and redemptions (VARA Rulebook).
  • Federal link. Cabinet Decision No. 112 of 2022 delegates the federal regulator's virtual asset powers to VARA, exclusively within Dubai and its free zones. Dubai firms take their licence from VARA only, and VARA informs the federal regulator so there is one national register (VARA).
  • Choose VARA if you run an exchange, brokerage or custody business, or issue real-world asset tokens, and want to operate from Dubai outside the DIFC.

When ADGM FSRA fits

ADGM suits firms that want stablecoins, crypto and securities under one regulator. Its digital assets framework covers virtual assets, fiat-referenced tokens, digital securities, and related derivatives and funds. Any token with the characteristics of a security is regulated as a security by the FSRA (ADGM).

  • Stablecoin issuance. In December 2024, the FSRA made issuing fiat-referenced tokens a distinct regulated activity. The framework covers reserve assets, independent attestation, disclosure, capital and redemption at par (ADGM).
  • Wider stablecoin activity. Amendments in force from 1 January 2026 set how the FSRA accepts fiat-referenced tokens for use in ADGM, and widen the activities firms can carry on with them (ADGM).
  • Interaction with the CBUAE. Under the CBUAE's payment token rules, a firm incorporated in a financial free zone counts as incorporated outside the UAE. It can register with the CBUAE as a foreign payment token issuer (CBUAE Rulebook).
  • Choose ADGM if you plan to issue a non-AED stablecoin, or want crypto and securities permissions in one place.

When DFSA fits

The DFSA regime is workable but young, and precedent for crypto firms is still forming. The regime dates from 2022, and its latest rules took effect on 12 January 2026 (DFSA).

  • How it works. The DFSA treats crypto tokens as financial instruments, like securities or derivatives. New firms need DFSA authorisation, and existing firms must vary their permissions (DFSA).
  • Firms now judge suitability. Since January 2026, the DFSA no longer publishes a list of recognised tokens. Firms must assess, document and monitor each token's suitability themselves (DFSA).
  • Stablecoins. Fiat crypto tokens sit outside the firm-led suitability assessment (DFSA).
  • Choose the DIFC if you are already a DIFC institution adding crypto to an established financial services business.

Where the CMA comes in

The Capital Market Authority, formerly the Securities and Commodities Authority, is the federal securities regulator (CMA). It is becoming central to crypto outside Dubai. Federal Decree-Law No. 33 of 2025 on the Regulation of the Capital Market entered into force on 1 January 2026 (Article 85).

  • Virtual assets inside the perimeter. The decree-law treats virtual asset activities as financial activities. Article 39 bars trading any virtual asset in the UAE unless it is admitted to the official list (Decree-Law No. 33).
  • Eight licensed activities. The CMA's April 2026 virtual asset framework has five modules and eight regulated activities (CMA): dealing as principal, dealing as agent, providing custody, arranging custody, operating a multilateral trading facility, investment advice, portfolio management and arranging deals (CMA General Module).
  • Capital. Dealing as principal needs minimum capital of AED 4 million, or a figure based on annual expenses if higher (CMA General Module).
  • Where it applies. The decree-law does not apply to the financial free zones, so the DIFC and ADGM keep their own regulators. In Dubai, VARA exercises the delegated federal powers described above.
  • One-year window. Entities in scope must adjust their status within one year of entry into force, so by 1 January 2027, unless the CMA Board extends the period (Article 83).
  • Choose the CMA if you operate onshore outside Dubai, or combine securities and virtual asset activity across the UAE mainland.

Where the CBUAE comes in

The Central Bank governs payments and payment tokens, and its rules apply alongside your main licence. Its Payment Token Services Regulation (C 2/2024) has applied since 31 August 2024.

  • Licences. Payment token services need one or more licences: Dirham Payment Token Issuer, Payment Token Custodian and Transferor, or Payment Token Conversion (CBUAE Rulebook).
  • Foreign tokens. Firms incorporated outside the UAE, including in a financial free zone, register as foreign payment token issuers instead (CBUAE Rulebook). Onshore, a foreign payment token may be used only as a means of payment to buy virtual assets (CBUAE Rulebook).
  • Banned tokens. No one may issue algorithmic stablecoins or privacy tokens in the UAE or to persons in the UAE (CBUAE Rulebook).
  • Licensed VASPs. A VASP licensed for custody by the SCA, now the CMA, or by a local authority such as VARA can apply for a non-objection registration to hold and transfer foreign payment tokens (CBUAE Rulebook).
  • New Central Bank law. Under Federal Decree-Law No. 6 of 2025, anyone carrying on a licensed financial activity falls under the Central Bank whatever the technology used, including virtual assets, payment tokens and DeFi (Article 62) (CBUAE Rulebook). Its transition period has ended, so firms in scope must now be licensed.
  • Check the CBUAE rules if you issue, hold, transfer or convert stablecoins, accept them as payment, or offer payment-like services through any technology.

Five questions to decide

  1. What exactly will you do? List each activity: exchange, brokerage, custody, token issuance, payments or advice. Each one may need its own permission.
  2. Where will you be established? Dubai outside the DIFC points to VARA. The DIFC points to the DFSA, ADGM to the FSRA, and the rest of the onshore UAE to the CMA.
  3. Who are your clients? Retail or institutional, and in the UAE or abroad. This shapes capital, conduct rules and which regulator will expect to supervise you.
  4. Do you touch stablecoins or payments? If so, check the CBUAE rules alongside your main licence.
  5. Do you also need securities permissions? If you will tokenise or trade securities too, ADGM or the CMA can cover both.

FAQ

Can one licence cover the whole UAE? Not usually. VARA covers Dubai outside the DIFC, the CMA covers the rest of the onshore UAE, and ADGM and the DIFC each have their own regulator. Payment activity adds CBUAE rules on top.

Do I need a CBUAE licence to use stablecoins? It depends on what you do with them. Issuing dirham tokens needs a CBUAE licence. Onshore, foreign stablecoins may be used only as a means of payment to buy virtual assets. An issuer based in ADGM or the DIFC can register with the CBUAE as a foreign payment token issuer.

Is the DIFC a good choice for a new crypto business? It can be, especially for institutions already in the DIFC. Since January 2026, firms carry the token suitability assessment themselves, so expect more internal work and less precedent to follow.

What changed for crypto firms when the CMA replaced the SCA? Federal Decree-Law No. 33 of 2025 entered into force on 1 January 2026, and the CMA issued its virtual asset framework in April 2026. Firms in scope have until 1 January 2027 to adjust their status, unless the CMA Board extends the period. Firms licensed under the old regime should run a gap analysis now.

Can I tokenise real-world assets in Dubai? Yes, under VARA. Issuing asset-referenced virtual assets is a Category 1 issuance and needs a VARA licence. VARA's issuance rules cover reference assets, reserve assets and redemptions.

Need a view on your business model? Book a call with Regulatory Gate. For the technology, cyber and AI governance side of a licence application, see Governance Genius.

Sources