UAE crypto licensing in 2026: Which regulator applies to your business
Sponsored content. This article was supplied by a third party and Business Money has been paid to publish it.
Ask a founder where they are setting up a digital asset business in the UAE and you will usually get a place name back. Dubai. Abu Dhabi. Sometimes just “the free zone.” None of those answers tells you who regulates the business, and in the UAE that is a separate question with five possible answers.
For UK firms and the advisers helping them into the market, this is where UAE entry tends to go wrong early. The country runs several regulatory perimeters alongside each other, each with its own authority, its own activity definitions and its own application process. Choosing the wrong one is rarely a filing error that gets corrected at the counter. More often it means rebuilding the structure.
Working out which perimeter applies is the first piece of work on any UAE digital asset project, and it is where specialist counsel starts. Ape Law, a UAE-based crypto-native legal practice, treats that classification question as the opening step of a licensing engagement rather than a detail to settle once the platform is built.
Five perimeters, not one
| Authority | Where it applies | What it covers |
| VARA | Dubai, excluding the DIFC | Virtual asset activities carried on from Dubai, including exchange, broker-dealer, custody, transfer and settlement, advisory and management |
| FSRA | Abu Dhabi Global Market | Regulated activities involving virtual assets under ADGM’s financial services regime |
| DFSA | Dubai International Financial Centre | Crypto token activity conducted from within the DIFC |
| CMA | Onshore UAE, outside the financial free zones | Virtual asset activities under the federal framework issued in 2026 |
| CBUAE | Federal, financial institutions and payments | Licensed financial institutions and payment activity under Federal Decree-Law No. 6 of 2025 |
These rows are not interchangeable. A model that sits neatly inside one authority’s activity definitions can land somewhere quite different under another’s, and the same commercial product can attract different permissions depending on where it is operated from and who it is offered to. Anyone weighing Abu Dhabi specifically will find the route turns on how the FSRA classifies the activity rather than on how the business describes itself, which is why practical ADGM crypto licensing guidance starts with an activity map rather than an application form.
The federal picture moved in 2026
Until recently, a business could reason about the UAE in fairly settled terms: the two financial free zones ran their own regimes, and onshore activity sat with the Securities and Commodities Authority under a narrow set of virtual asset permissions.
That has changed. On 1 January 2026, Federal Decree-Law No. 32 of 2025 and Federal Decree-Law No. 33 of 2025 came into force, reconstituting the SCA as the Capital Market Authority and replacing the framework that had governed onshore markets since 2000. The CMA then issued Decision No. 4/R.M/2026 and announced its Virtual Assets Framework on 13 April 2026.
The framework is built on five core modules: General Requirements, Conduct of Business, Alternative Trading System, Anti-Money Laundering and Counter-Terrorist Financing, and Prudential Requirements. The headline change for anyone modelling a UAE entry is the scope. Regulated activities expanded from three to eight, covering dealing, custody, investment advice, portfolio management, arranging transactions and operating trading platforms.
For a UK business that assessed the onshore option a year ago and set it aside as too narrow, the assessment is worth redoing.
Why “we are in a free zone” is not the end of the analysis
The general position is that activity conducted solely within ADGM or the DIFC sits with the FSRA and the DFSA respectively. That much is unchanged, and it is the reason the financial free zones remain attractive.
The qualification is the part worth reading twice. Federal Decree-Law No. 33 of 2025 expressly reaches a person targeting clients in the UAE even where the activity is conducted from a financial free zone. Free zone establishment on its own does not automatically place a business beyond the federal perimeter if it is marketing into the wider UAE market.
This is not confined to the capital markets legislation. The new Central Bank law, Federal Decree-Law No. 6 of 2025, follows a similar pattern: a general carve-out for the financial free zones, qualified where a firm is reaching UAE customers.
A good deal of published commentary still describes the free zones as simply carved out. That description was never quite complete and it is a poor guide for any business with UAE-facing customers. Separately, Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, is the current UAE anti-money laundering, counter-terrorist financing and proliferation financing law, and it brings virtual asset service providers expressly within scope, so those obligations follow the activity regardless of which perimeter the license sits in.
Abu Dhabi’s own framework has moved too
ADGM’s digital asset amendments took effect on 10 June 2025 and changed several things that older guidance still describes in superseded terms. Accepted virtual asset recognition moved from an FSRA approval process to a notification based on the firm’s own assessment. Privacy tokens and algorithmic stablecoins were expressly prohibited in regulated activities. Capital requirements and fees were revised, and the FSRA gained a product intervention power specific to virtual assets.
Nor did the FSRA stop there. Rules for regulated activities involving fiat-referenced tokens were finalised in October 2025 and took effect on 1 January 2026, and further proposals covering areas such as staking have followed. Guidance written even a year ago can describe a structure that no longer applies. The FSRA publishes its current position in its guidance and policy statements, and for fee or rule questions it is worth confirming which version of a document is in force before relying on it.
What to establish before committing
Before selecting a jurisdiction, a business should be able to answer four questions with some precision. What is the regulated activity, described in the authority’s own terms rather than in marketing language? Does the business hold, control or transfer client assets or fiat? Where are the customers, and is the business marketing into the UAE? And which entity in the group is actually conducting the activity?
Those four answers determine the perimeter. Almost everything else, including cost, timeline and capital, follows from them.
Frequently asked questions
Which regulator licenses a crypto business in the UAE?
It depends on where the activity is conducted from. VARA covers Dubai outside the DIFC, the FSRA covers the Abu Dhabi Global Market, the DFSA covers the DIFC, the CMA covers onshore UAE outside the financial free zones, and the Central Bank has responsibility for payment tokens and payment services. The relevant authority follows the activity and its location rather than the company’s registered address alone.
Does operating from ADGM or the DIFC put a business outside federal regulation?
Not automatically. Activity conducted solely within ADGM or the DIFC sits with the FSRA and the DFSA. However, Federal Decree-Law No. 33 of 2025 expressly reaches a person targeting clients in the UAE even where the activity is carried on from a financial free zone, so a free zone entity marketing into the wider UAE market should take advice on its federal position.
What changed under the UAE’s 2026 virtual assets framework?
The Capital Market Authority issued Decision No. 4/R.M/2026 and announced the Virtual Assets Framework on 13 April 2026. It is structured around five core modules covering general requirements, conduct of business, alternative trading systems, anti-money laundering and counter-terrorist financing, and prudential requirements. It expands the list of regulated virtual asset activities from three to eight, including operating a trading platform.
Do UAE anti-money laundering rules apply to virtual asset businesses?
Yes. Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, is the UAE’s anti-money laundering, counter-terrorist financing and proliferation financing law. It replaced the 2018 legislation and brings virtual asset service providers expressly within scope. AML and counter-terrorist financing obligations also appear inside the individual regulatory frameworks, so a business will typically be answering to both.
Can one business need more than one UAE authorisation?
It can. Groups often place different functions in different entities, and where those entities conduct regulated activity in different perimeters or market to different client bases, more than one authority can be engaged. This is one reason the entity chart and the activity map need to be built together rather than in sequence.
This article is general information about UAE regulatory frameworks and does not constitute legal advice. Requirements depend on the specific activity, structure and client base involved. The position described reflects published rules as at August 2026.