How to read this
Five regulators, and the boundaries between them are territorial and functional. The question is never which one you would prefer; it is which one the activity has already walked into. Law stated as at 30 October 2026.
VARA — Dubai, excluding the DIFC
Territory. The Emirate of Dubai including its commercial free zones, but not the DIFC. The boundary follows the address on the trade licence, which is why two businesses doing identical things a few kilometres apart answer to different authorities.
Trigger. Carrying on any of the eight licensed virtual asset activities in or from Dubai.
What it does not cover. Activity directed at the rest of the onshore UAE, which is federal. Payment tokens pegged to the dirham, which are the Central Bank's. Proprietary trading, which is outside the licensed activities entirely and requires a separate company and a No Objection Certificate.
Substance. A real presence in Dubai and approval of key personnel. Custody, if it is part of the plan, must sit in its own legal entity with its own licence — a structural decision that has to be taken before incorporation rather than after.
The Capital Market Authority — the federal perimeter
Territory. Onshore UAE outside Dubai's virtual asset regime, and the commercial free zones that are not financial free zones.
The change most material has not caught up with. Federal Decree-Law No. 32 of 2025 established the CMA with effect from 1 January 2026, and Federal Decree-Law No. 33 of 2025 regulates capital markets alongside it. The CMA is the legal successor to the Securities and Commodities Authority, and references to the SCA in existing legislation are read as references to the CMA. Compliance manuals, prospectuses and risk disclosures still naming the SCA are describing a body that no longer holds that name.
Trigger. Securities activity, and — since the Virtual Assets Framework issued in April 2026 — a materially wider set of virtual asset activities, expanded from three categories to eight, across modules covering general requirements, conduct of business, alternative trading systems, AML and CFT, and prudential standards.
The boundary case that matters. Tokenised real-world assets. A token representing property, debt or fund units invites a securities analysis regardless of the technology, and that analysis is federal.
The DFSA — the DIFC
Territory. The Dubai International Financial Centre only, which is why a Dubai address tells you almost nothing until you know which district it is in.
Trigger. Financial services involving crypto tokens in or from the DIFC.
The shape of the regime. The DFSA moved away from a prescribed list of recognised tokens toward an approach in which authorised firms assess for themselves whether a token is suitable, and reassess that judgment at regular intervals. The gate is lighter and the ongoing obligation is heavier. Firms that read the change as a relaxation, rather than as a transfer of the assessment burden onto their own governance, are the ones that come out badly from a thematic review.
The ADGM FSRA — Abu Dhabi Global Market
Territory. ADGM.
Trigger. Regulated financial services involving virtual assets, under the FSRA's own framework.
The distinction worth knowing. The ADGM perimeter is drawn differently in places. Crypto mining is treated as a licensable commercial activity through the Registration Authority rather than as a regulated financial service requiring FSRA authorisation — a materially different process, cost and timeline from an FSRA permission, and one that businesses comparing jurisdictions frequently price wrongly.
The Central Bank — payment tokens
Trigger. Issuance, conversion, custody or transfer of payment tokens under the Payment Token Services Regulation. Issuing a Dirham Payment Token requires a CBUAE licence.
Who may apply. Entities incorporated in the UAE, including in free zones. A bank may not act as a payment token issuer itself, though it may establish a subsidiary or affiliate to perform the activity.
Why it catches people. Because a stablecoin feels like a virtual asset and is treated as money. A platform that lists a dirham-pegged token has not simply added a trading pair; it has touched a different regulator's perimeter.
Where two perimeters apply at once
These are not mutually exclusive. The common overlaps:
- Exchange in Dubai listing a dirham-pegged token — VARA for the activity, CBUAE for the token.
- Tokenised real estate offered from a Dubai platform — VARA for the platform, the CMA for the instrument, and a property-law analysis underneath both.
- A DIFC firm marketing to onshore investors — DFSA for the firm, federal rules for the approach.
- A group with entities in ADGM and Dubai — two regulators, two rulebooks, and intra-group flows that have to be documented as if they were third-party.
Primary sources
The law and rules this page relies on. Links go to the regulator rather than to a summary, because the rulebooks move faster than commentary on them. Law stated as at 30 October 2026.
- Federal Decree-Law No. 32 of 2025 concerning the Capital Market Authority — in force 1 January 2026; the CMA is the legal successor to the Securities and Commodities Authority, and references to the SCA in legislation are read as references to the CMA. CMA
- Federal Decree-Law No. 33 of 2025 on the Regulation of Capital Markets — in force 1 January 2026. UAE Legislation
- VARA Rulebooks and Licensed Activities — the eight licensed virtual asset activities, the custody segregation rule and the proprietary-trading carve-out. VARA
- VARA Exchange Services Rulebook v2.1 — effective 31 March 2026, introducing a regime for exchange-traded derivatives. VARA rulebooks
- CBUAE Payment Token Services Regulation (Circular No. 2/2024) — issuance, conversion, custody and transfer of payment tokens; Dirham Payment Token issuance is licensable. CBUAE
- DFSA Crypto Token regime — DIFC. DFSA
- ADGM FSRA virtual asset framework — Abu Dhabi. ADGM
Frequently asked questions
Can I passport a VARA licence to Abu Dhabi?
No. There is no passporting between the UAE's virtual asset regimes. ADGM sits under the FSRA with its own authorisation process, and a VARA licence does not carry across. Groups operating in both ordinarily establish separate entities and run two compliance programmes.
Is ADGM or VARA faster?
The honest answer is that the comparison depends almost entirely on the activity, and the published timelines are the least reliable part of it. What is reliably different is scope: some activities that need full FSRA authorisation in ADGM sit elsewhere in Dubai, and crypto mining in ADGM runs through the Registration Authority as a commercial licence rather than through the FSRA at all.
What happens to references to the SCA in my existing documents?
Legally they are read as references to the Capital Market Authority, so an old contract does not become void. Commercially it is a different matter: a prospectus or compliance manual that still presents the SCA as the live regulator signals that the document has not been reviewed since 2025, and regulators and counterparties both notice.