The three guides, and what each one answers
This page is the entry point to the reference layer under our virtual assets practice. The practice page explains what we do and how to instruct us. These three guides are the working material underneath it, and each answers a different question at a different point in the life of a crypto business.
Regulator Selection Matrix answers whose rulebook applies to me. VARA, the CMA, the DFSA, the FSRA and the CBUAE set side by side on the factors that actually decide the question — territory, trigger, what the licence does not cover, and what substance each expects on the ground.
Activity Classification Guide answers which licence do I actually need. VARA's eight licensed activities taken one at a time, with the custody segregation rule, the proprietary-trading carve-out, and the activities that look regulated and are not.
Enforcement & Recovery Atlas answers what happens when it goes wrong — both directions. Tracing, freezing and recovering misappropriated assets through the UAE courts, and defending a VARA enforcement action when the authority is on the other side.
What the regulator decides
The regulator is the perimeter the business lives inside. It fixes the rulebook, the capital, the people who must be approved, the reporting, and the authority that can suspend the licence. There are five, and the boundaries between them are territorial and functional rather than negotiable.
VARA regulates virtual asset activity in the Emirate of Dubai, including its commercial free zones, but excluding the DIFC. It is the busiest of the five and the one most businesses mean when they say “a Dubai crypto licence”.
The Capital Market Authority holds the federal perimeter. This is the change most compliance material has not caught up with: Federal Decree-Law No. 32 of 2025 established the CMA with effect from 1 January 2026, and it is the legal successor to the Securities and Commodities Authority, with references to the SCA in existing legislation now read as references to the CMA. In April 2026 the CMA issued a Virtual Assets Framework that expanded its regulated virtual asset activities from three categories to eight, across modules covering general requirements, conduct of business, alternative trading systems, AML and CFT, and prudential standards.
The DFSA regulates inside the DIFC under its own crypto token regime, which moved from a prescribed list of recognised tokens to an approach in which firms determine for themselves whether a token is suitable and reassess that judgment at regular intervals. That is a lighter gate and a heavier ongoing obligation, and firms that treat it as the former are the ones that fail a thematic review.
The ADGM FSRA regulates in Abu Dhabi Global Market. Its perimeter is drawn differently in places that matter: crypto mining, for instance, is treated as a licensable commercial activity through the Registration Authority rather than as a regulated financial service requiring FSRA authorisation.
The Central Bank regulates payment tokens. Its Payment Token Services Regulation covers the issuance, conversion, custody and transfer of payment tokens, and issuing a Dirham Payment Token requires a CBUAE licence. Only entities incorporated in the UAE, including in free zones, may apply, and a bank may not act as a payment token issuer itself though it may establish a subsidiary that does.
What the activity decides
Within a perimeter, the activity decides the licence. VARA identifies eight licensed virtual asset activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, and Issuance Category 1. A VASP may apply for several of them under one overarching licence, and must then satisfy the requirements of each in full.
Two rules cut across that and are missed often enough to be worth stating plainly. Custody must be separated. A VA Custodian must be set up as a distinct legal entity holding its own standalone licence, and where custody sits alongside other activities the business must segregate them or demonstrate independent governance. Proprietary trading is not a licensed activity at all. It cannot be carried on under a regulated activity licence, it has to run through a separate company, and it needs a No Objection Certificate from VARA.
The Activity Classification Guide takes each of the eight in turn.
What the token decides
The third question is what the thing itself is, and it is the one that moves a business between perimeters without it moving office. A token pegged to the dirham is a Central Bank question before it is a virtual asset question. A token that carries rights to profits, or that represents a tokenised real-world asset, invites the securities analysis and the federal regulator with it. A pure utility token used inside a closed product may sit outside all of this — but that conclusion is a legal opinion, not a design choice, and it is worth obtaining in writing before launch rather than after a regulator asks.
Classification is also not permanent. A token's treatment can change with how it is marketed, who is allowed to buy it, and what the issuer promises about redemption. The same asset can be outside the perimeter on day one and inside it after a funding round.
The order to take the decisions in
Most of the remediation work we are asked to do exists because these were taken in the wrong order. The sequence that avoids it is short.
- Classify the token first. Payment token, security, tokenised asset or utility — because this decides which of the five regulators is even in the conversation.
- Define the activity precisely. Not “we run a crypto platform”, but which of the eight, and whether custody is involved. Custody changes the corporate structure, so it has to be known before incorporation.
- Pick the perimeter, then incorporate into it. Territory is the last decision, not the first, and it is the one almost everyone takes first.
- Map the marketing before launch. Who you are permitted to approach is a function of the licence, and a compliant platform can become an unlicensed one through a campaign.
Where this goes wrong
The failures that reach us are not exotic.
The licence that does not cover the activity. A business licensed for broker-dealer services starts holding client assets, and has become an unlicensed custodian without a single decision being minuted.
The perimeter crossed by marketing. A correctly licensed Dubai platform runs a campaign aimed at the wider onshore market and acquires a federal problem it has no licence to answer.
Compliance written against a regulator that no longer exists. Manuals, prospectuses and risk disclosures still naming the SCA as the live federal authority have been out of date since 1 January 2026.
Tracing started too late. In recovery matters the determining factor is almost never the strength of the claim; it is whether the on-chain work and the exchange correspondence were done while the assets were still identifiable.
Primary sources
The law and rules this page relies on. Links go to the regulator rather than to a summary, because the rulebooks move faster than commentary on them. Law stated as at 30 October 2026.
- Federal Decree-Law No. 32 of 2025 concerning the Capital Market Authority — in force 1 January 2026; the CMA is the legal successor to the Securities and Commodities Authority, and references to the SCA in legislation are read as references to the CMA. CMA
- Federal Decree-Law No. 33 of 2025 on the Regulation of Capital Markets — in force 1 January 2026. UAE Legislation
- VARA Rulebooks and Licensed Activities — the eight licensed virtual asset activities, the custody segregation rule and the proprietary-trading carve-out. VARA
- VARA Exchange Services Rulebook v2.1 — effective 31 March 2026, introducing a regime for exchange-traded derivatives. VARA rulebooks
- CBUAE Payment Token Services Regulation (Circular No. 2/2024) — issuance, conversion, custody and transfer of payment tokens; Dirham Payment Token issuance is licensable. CBUAE
- DFSA Crypto Token regime — DIFC. DFSA
- ADGM FSRA virtual asset framework — Abu Dhabi. ADGM
Frequently asked questions
Which regulator covers crypto in Dubai?
It depends which part of Dubai. VARA covers the Emirate of Dubai including its commercial free zones but excluding the DIFC. Inside the DIFC the regulator is the DFSA, under its own crypto token regime. The two are not alternatives you can choose between: the boundary is territorial, and it follows the address on the licence. A business operating from Business Bay answers to VARA; the same business operating from the Gate District answers to the DFSA.
Is the SCA still the federal regulator?
No. Federal Decree-Law No. 32 of 2025 established the Capital Market Authority, which took effect on 1 January 2026, and the CMA is the legal successor to the Securities and Commodities Authority. References to the SCA in existing legislation are read as references to the CMA. Any advice, contract or compliance manual still naming the SCA as the live federal regulator is describing a body that no longer exists under that name.
Does a VARA licence cover the whole UAE?
No. A VARA licence is territorial to Dubai excluding the DIFC. Activity directed at the rest of the onshore UAE falls under the federal perimeter now held by the CMA, which issued a Virtual Assets Framework in April 2026 expanding its regulated virtual asset activities from three categories to eight. Abu Dhabi's ADGM and the DIFC each sit under their own regulator again. Businesses that assume one licence travels across the federation discover otherwise at the point of marketing.
Do I need a separate licence for each activity?
Generally no — a VASP can apply for several of VARA's licensed activities under one overarching licence, and must then meet the requirements for each in full. Custody is the exception: a VA Custodian must be established as a distinct legal entity holding its own standalone licence. Proprietary trading is not one of the licensed activities at all; it has to be run through a separate company and needs a No Objection Certificate from VARA.
Where do stablecoins sit?
With the Central Bank, not with VARA. The CBUAE Payment Token Services Regulation covers the issuance, conversion, custody and transfer of payment tokens, and issuing a Dirham Payment Token requires a CBUAE licence. Only entities incorporated in the UAE, including in free zones, may apply. A bank cannot act as a payment token issuer itself, though it may establish a subsidiary to do so. A token that is pegged to the dirham is a Central Bank question before it is a virtual asset question.
Can crypto be recovered through the UAE courts?
Yes, and we do it. The obstacle is almost never whether the courts will grant relief — it is whether the tracing was done early enough and documented well enough to identify a defendant and an attachable asset before the coins move again. Recovery work is won in the first fortnight, in exchange records and on-chain analysis, not in the hearing.