The DFSA's Supervisory Guidelines on Assessing the Suitability of Crypto Tokens, issued on 15 December 2025, set out how a DIFC firm is expected to discharge the suitability assessment required by GEN Rule 3A.2.1(2)(a). The assessment is firm-specific and activity-specific rather than a property of the token: the same token can be suitable for one firm's closed-ended professional-client fund and unsuitable for another firm dealing as agent for retail clients. Where a negative indicator in the Annex is present, the onus shifts to the firm to document why the token is nonetheless suitable.
Who should read this
A token approval file that records a conclusion without recording the reasoning and the objective evidence behind it does not meet GEN Rule 3A.2.1A(c), and that is exactly the deficiency a thematic review is designed to surface.
Directly affected
Key facts
- The guidance addresses GEN Rule 3A.2.1 and was issued by the DFSA on 15 December 2025.
- Five criteria drive the assessment under GEN Rule 3A.2.1(3): (a) the token's characteristics, including purpose, governance arrangements and founders; (b) its regulatory status in other jurisdictions; (c) the size, liquidity and trading history of its global market; (d) the technology used; and (e) whether its use could prevent the firm complying with DFSA-administered law.
- Relative weight is not fixed: the guidance expects the criteria to be weighed against the firm's proposed activity, its customer base, and the nature, scale and complexity of its DIFC operations.
- Where a negative indicator in the Annex applies, GEN Rule 3A.2.1A(c) requires the firm to satisfy itself that the token is suitable anyway, with reasoning documented and supported by objective evidence.
- A suitability conclusion is not portable across activities: a token assessed as suitable by a firm for one activity is not thereby suitable for that same firm's other activities.
- Suitability does not reach a Privacy Token at all: GEN Rule 3A.2.2 prohibits financial services, financial promotions, public offers and the listed fund and derivative activities in relation to one outright, and GEN Rule 3A.1.1(c) catches any token whose own features, or those of its underlying ledger, are used or intended to be used to obscure a transaction, the parties, the value or the beneficial owner — optional features included, on the guidance's reading.
- Limited reliance is permitted — a firm dealing in a financial product relating to a token already assessed by another person may take that assessment into account, as a distributor of fund units may rely on the fund manager's assessment.
What this means for you
The Annex is the operative part, because it converts five abstract criteria into indicators a supervisor can test a file against. On the positive side sit tokens with a demonstrable use case and measurable third-party adoption, full transaction visibility on a public permissionless chain, comprehensive protocol and governance documentation, a chain with established incident response and a history of prompt patching, approval for retail offering under a full licensing regime elsewhere such as MiCA, and a market capitalisation and trading history that indicate genuine liquidity rather than a thin book. The negative indicators are more useful to advisers, because they identify what a firm will have to argue around. Meme coins whose value rests on community sentiment rather than application are called out, as is founder and affiliate concentration — the guidance uses 15 per cent or more of total supply as its illustration, on the basis that disposal by that group could move the price severely and immediately. Privacy designs need separating from that list, because treating them as one more indicator understates the position badly. A token whose chain uses ring signatures and stealth addresses to obscure sender, receiver and amount is not an unfavourable factor to be argued around: GEN Rule 3A.1.1(c) defines a Privacy Token as a crypto token where the token, or the distributed ledger technology used for it, has any feature used or intended to be used to hide, anonymise, obscure or prevent the tracing of a transaction, a holder's identity, the parties to a transaction, its value or the beneficial owner. GEN Rule 3A.2.2 then prohibits a person, in or from the DIFC, from carrying on a financial service relating to such a token, from making or approving a financial promotion for it, from offering it to the public, and from the fund and derivative activities the rule lists. That prohibition carries no suitability condition. GEN Rule 3A.2.1 opens with a prohibition that applies unless a prior assessment has been made and the token concluded suitable; GEN Rule 3A.2.2 states no such condition and does not cross-refer to it, so documented reasoning is not a route through it. The guidance under 3A.2.2 reads the definition as reaching a token whose privacy features are merely optional, on the footing that a feature capable of being turned on at the user's option is still intended to be used — so a token that is traceable by default is caught if the capability is there. The remaining negative indicators work the way the rest of the framework does: each is a point at which the firm must produce documented, evidence-based reasoning, and the practical consequence is that token onboarding becomes a file-building exercise that has to stand up months later to a supervisor who already knows which indicators were present.
Directly affected: DIFC authorised firms dealing or arranging in crypto tokens, fund managers and fund distributors, crypto token custodians, and compliance and risk functions responsible for token onboarding files
Effective date: Issued 15 December 2025
Action items
- Rebuild the token onboarding template around the five GEN Rule 3A.2.1(3) criteria so each is addressed on its own terms rather than in a single overall conclusion
- Record the weighting applied to each criterion and why, by reference to the firm's own activity, client base and the scale of its DIFC operations
- Screen candidate tokens against the GEN Rule 3A.1.1(c) Privacy Token definition before anything else, because GEN Rule 3A.2.2 bars the activity outright and no assessment file cures it
- Then screen for the Annex negative indicators — supply concentration and absent use case — before committing to a listing
- Where a negative indicator is present, document the countervailing reasoning and the objective evidence supporting it, as GEN Rule 3A.2.1A(c) requires
- Re-assess a token for each distinct activity rather than carrying one conclusion across the business
- Where reliance is placed on a fund manager's or another person's assessment, keep a copy of it and a record of the enquiry made into it
Litigation impact
Suitability assessments are documentary by nature, so a DFSA enforcement or thematic review turns on the contemporaneous file rather than on the firm's present explanation of its thinking. Where a token later fails — a depeg, an exploit, a founder disposal — the assessment written before the event is the firm's defence, and a file that records only the outcome leaves nothing to defend with.
Source
DFSA, Supervisory Guidelines on Assessing the Suitability of Crypto Tokens
https://www.dfsa.ae/rulebook
Original-source date: 15 December 2025 · Captured: 2026-10-31T12:54:34+04:00
This update is generated from a public regulator publication and reviewed under the firm's automated editorial quality gate. General information only — it does not constitute legal advice. For advice on a specific matter, please contact us. Last updated: 31 October 2026.