The perimeter: classification follows the activity, not the asset
The first question in any ADGM digital asset matter is which regulated activity, if any, the business is carrying on. That turns on conduct — holding client assets, operating a multilateral facility, dealing as principal or agent, advising, managing — rather than on what the instrument is called.
Two businesses handling identical tokens can therefore sit on opposite sides of the perimeter. A pure software provider that never touches client assets or funds is in a different position from one that takes custody, even where the user interface looks the same. And a token that is not itself a specified investment can still be handled in a way that constitutes a regulated activity.
The practical discipline is to map the money and asset flows before the legal analysis, because the analysis follows them. Where a business has already launched, the same map is the starting point for working out what has to be remediated and in what order.
Authorisation, and what the application actually tests
An application to the FSRA is not a form-filling exercise. It tests governance, capital, systems and controls, the fitness of controllers and senior managers, custody arrangements, and the credibility of the business plan against the permissions sought.
Applications fail or stall for recurring reasons: permissions sought that do not match the business described; a compliance function that is nominal rather than resourced; custody arrangements that have not been thought through to the level of what happens on insolvency of a third-party provider; and financial projections that do not reconcile with the capital requirement for the activity.
ADGM also operates a regulatory laboratory pathway for firms testing a proposition under restricted conditions. It is useful where the model is genuinely novel and the firm accepts the limits; it is not a shortcut for a business that simply wants to launch faster.
Custody and client assets
Custody is where digital asset regulation bites hardest, because it is where customer loss actually happens. The questions are concrete: are client assets segregated, how is that segregation evidenced, who holds the keys, what is the ceremony for access, and what happens if the custodian fails.
Client-money and client-asset obligations are not satisfied by a statement of intention. They require records capable of demonstrating, at any moment, what is held for whom. Where a firm cannot produce that reconstruction on demand, it has a problem regardless of whether any asset is missing.
Insolvency is the stress test. A custody arrangement that does not clearly separate client assets from the firm's own estate will be argued over by an officeholder, and the customers will be the ones funding the argument.
Market conduct, AML and the reporting obligations
Beyond authorisation, an ADGM digital asset business carries continuing conduct obligations: market abuse provisions, disclosure requirements, and a full anti-money-laundering regime including customer due diligence, transaction monitoring calibrated to the risks of the asset class, and suspicious activity reporting.
The AML expectations are not generic. Chain analytics, source-of-funds enquiry where provenance is opaque, and escalation procedures that actually operate are what supervision looks for. A policy document that describes controls the firm does not run is worse than no policy, because it evidences that the firm knew what was required.
Disputes, tracing and asset recovery
Private claims are heard by the ADGM Courts applying English common law and equity directly. For digital asset disputes that matters enormously: proprietary claims, constructive trust, and tracing into mixed funds are available on established principles, as are freezing injunctions and disclosure orders against third parties.
Speed is the whole game in recovery. Assets move quickly, and the value of an order falls sharply with delay. The work that makes an urgent application succeed — evidence of the transfers, identification of the counterparty, a clear proprietary case — is work best done before the application, not during it.
ADGM compared with DIFC and VARA
The UAE has three relevant regimes and they are not interchangeable. ADGM regulates through the FSRA under a common-law framework with the ADGM Courts as the forum. DIFC regulates through the DFSA with its own courts. Dubai's VARA regulates virtual asset activity in the emirate outside the DIFC.
Choice of regime determines the perimeter analysis, the capital and custody requirements, the supervisory relationship, and the court that will hear a dispute. A business serving customers across the UAE may touch more than one, and the question of which licence covers which activity should be settled at structuring rather than discovered under supervision.
| Question | ADGM | DIFC | Dubai (VARA) |
|---|---|---|---|
| Regulator | FSRA | DFSA | VARA |
| Legal framework | English common law applied directly | DIFC law, common-law based | Dubai law |
| Forum for private claims | ADGM Courts | DIFC Courts | Onshore Dubai Courts |
| Equitable tracing | Available | Available | Not in the common-law sense |
Frequently asked questions
Does ADGM regulate cryptocurrency?
ADGM regulates activities, not asset categories. The question is never whether a token is 'legal' but whether what you do with it — holding client assets, operating a facility, dealing, advising, managing — is a regulated activity. Two businesses handling the same token can sit on opposite sides of the perimeter depending on their model.
Do I need an FSRA licence for a digital asset business in ADGM?
If you carry on a regulated activity in or from ADGM, yes. The analysis follows the money and asset flows rather than the description in the whitepaper. A software provider that never takes custody of client assets or funds is in a materially different position from one that does, even where the product looks identical to a user.
What makes an FSRA application fail?
Recurring causes: permissions sought that do not match the business described; a compliance function that is nominal rather than resourced; custody arrangements not thought through to what happens on a third-party provider's insolvency; and financial projections that do not reconcile with the capital requirement for the activity sought.
What is the RegLab and should we use it?
It is a pathway for testing a genuinely novel proposition under restricted conditions. It suits firms whose model does not fit the existing framework and who accept the operating limits. It is not a faster route to an ordinary licence, and treating it as one tends to produce a poor application.
A customer says we lost their assets. What are we facing?
Potentially two things at once. A private claim before the ADGM Courts, where English equity applies and proprietary and tracing claims are available; and separately a supervisory interest from the FSRA. Settling the customer claim does not close the supervisory file, and disclosure made in one is visible to the other. They need to be run together.
Can stolen digital assets be traced and frozen through ADGM?
Yes in principle. Because ADGM applies English common law and equity directly, proprietary claims, constructive trust and tracing into mixed funds are available, alongside freezing injunctions and third-party disclosure orders. Recovery is time-critical — the evidential work that makes an urgent application succeed should be done before it is issued.
How does ADGM differ from DIFC and VARA for digital assets?
Three separate regimes: FSRA in ADGM, DFSA in DIFC, VARA for Dubai outside the DIFC. They differ on perimeter analysis, capital and custody requirements, supervisory relationship, and which court hears a dispute. A business serving customers across the UAE may touch more than one, and that should be settled at structuring.
What do custody rules actually require in practice?
Records capable of demonstrating, at any moment, what is held for whom — segregation that is evidenced rather than intended, a defined key-management and access ceremony, and an arrangement that separates client assets from the firm's own estate so an insolvency officeholder cannot argue otherwise. A firm that cannot produce that reconstruction on demand has a problem whether or not anything is missing.