- Which regulator applies depends on where a firm is based: VARA in Dubai, the FSRA in the ADGM free zone, the DFSA in the DIFC, and the federal Capital Market Authority (CMA) elsewhere.
- The CMA replaced the Securities and Commodities Authority on 1 January 2026 and issued a new Virtual Assets Framework on 13 April 2026.
- Providers must collect sender and recipient details for transfers above AED 3,500 (VARA travel rule).
- Businesses may only accept dirham payment tokens from a Central Bank-licensed issuer as crypto payment. Algorithmic stablecoins and privacy tokens are prohibited as means of payment.
- Your own wallet needs no license or registration.
This page explains who regulates crypto in the UAE and what that means for you. Which exchanges hold a license is on exchanges. It is general information, not legal advice.
Legal status
Holding and trading crypto as a private person is legal; we found no restriction on it on the official pages we checked. Providing virtual asset services to others needs a license, and the regulator depends on where the firm operates.
| Where | Regulator |
|---|---|
| Dubai, mainland and free zones (not the DIFC) | Virtual Assets Regulatory Authority (VARA) |
| Abu Dhabi Global Market (ADGM) | Financial Services Regulatory Authority (FSRA) |
| Dubai International Financial Centre (DIFC) | Dubai Financial Services Authority (DFSA) |
| Elsewhere in the country, outside the financial free zones | Capital Market Authority (CMA) |
| Payment tokens (stablecoins used for payments), outside the financial free zones | Central Bank of the UAE (CBUAE) |
Federal Decree-Law No. 32 of 2025 set up the Capital Market Authority as the legal successor of the Securities and Commodities Authority (SCA), and Federal Decree-Law No. 33 of 2025 regulates the capital market; both took effect on 1 January 2026. Cabinet Resolution No. 111 of 2022 regulates virtual assets and their service providers at federal level. In Dubai, Law No. 4 of 2022 regulates virtual assets, and VARA’s register also shows each Dubai firm’s CMA registration number.
The CMA framework of April 2026
On 13 April 2026 the CMA announced its Virtual Assets Framework. It has five modules (General Requirements, Conduct of Business, Alternative Trading System, Anti-Money Laundering and Counter-Terrorist Financing, and Prudential Requirements) and widens the regulated activities from three to eight: dealing in virtual assets as principal, dealing as agent, providing custody, arranging custody, arranging investment deals, providing investment advice, portfolio management and operating a multilateral trading facility. The CMA says it follows IOSCO and FATF standards and the principle “same activity, same risk, same regulatory outcome”.
The CMA’s announcement does not give the number of the decision, an effective date or a transition period for firms licensed under the old SCA rules, and we could not open the decision text on the CMA site (October 2026). The framework applies to firms under the CMA; Dubai firms stay with VARA, and the ADGM and DIFC keep their own rules.
Dubai (VARA)
VARA licenses advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement services, and virtual asset issuance. Four rulebooks apply to every licensed firm: company, compliance and risk management, technology and information, and market conduct. VARA also issues an In-Principle Approval (IPA) as a step before a full license; it says IPA holders “are strictly prohibited from initiating operations” or serving clients until they have the full license. VARA prohibits anonymity-enhanced cryptocurrencies “and all VA Activity(ies) related to them”.
Abu Dhabi (ADGM)
The FSRA regulates virtual asset activities in the ADGM, including trading facilities, brokers, custodians and asset managers, and says more than 20 licensed firms carry out activities with virtual assets or fiat-referenced tokens. Its amended rules on fiat-referenced tokens, which widen what regulated firms may do with them, took effect on 1 January 2026.
Exchanges and KYC
Use only a provider licensed by the regulator for its location, and check the register yourself; how to do that is on exchanges. Licensed providers must identify their customers and follow the anti-money-laundering rules of Federal Decree-Law No. 10 of 2025.
VARA’s travel rule says that before a transfer of virtual assets “with an equivalent value exceeding AED 3,500”, the provider must obtain and hold the sender’s name, account number or wallet address and residential or business address, and the recipient’s name and account number or wallet address. Providers must also manage the risks of transfers with “non-obliged entities (i.e. unhosted VA Wallets)”.
Stablecoins
The Central Bank’s Payment Token Services Regulation (in force since 31 August 2024) covers stablecoins used as a means of payment:
- Dirham payment tokens, denominated in AED and issued by a Central Bank-licensed issuer, may be used for any lawful purpose. A licensed issuer may issue them only to UAE residents.
- Foreign payment tokens, such as dollar stablecoins from a registered foreign issuer, may be used only to buy virtual assets or virtual asset derivatives.
- No merchant or other person selling goods or services in the course of business may accept a virtual asset as payment unless it is one of these two, used as described.
- Issuing, promoting and providing certain services for algorithmic stablecoins and privacy tokens is prohibited.
In the ADGM, the FSRA has its own rules for fiat-referenced tokens (see above). We found no public Central Bank list of licensed payment token issuers on the pages we checked (October 2026).
Crypto ATMs
We found no specific rule on crypto ATMs from VARA, the CMA, the FSRA or the Central Bank. VARA says that only entities it has licensed may provide virtual asset services in or from Dubai, so a machine that exchanges cash or dirhams for crypto would need a licensed operator. Check the operator in the register before you use one.
Scams and where to report them
VARA publishes investor and marketplace alerts about unlicensed platforms and tokens, and notices of fines. Recent examples: on 7 October 2025 it fined 19 unlicensed firms between AED 100,000 and AED 600,000; on 5 March 2026 it warned about MEXC and KuCoin entities; and in June 2026 it fined MX Global Ltd (MEXC) and Peken Global Limited (KuCoin) for serving Dubai customers without a license. VARA calls engaging with unlicensed operators a “significant financial, legal, and reputational risk”.
Warning signs: a platform that is not in the regulator’s register, promises of fixed or very high returns, pressure to act fast, contact through social media or messaging apps, and requests to send crypto to a personal wallet or to share your recovery phrase. VARA also warned about firms falsely claiming to be part of the Dubai Land Department’s real estate tokenization project.
According to the UAE government portal you can report cybercrime online through the Ministry of Interior’s eCrimes platform (MOI UAE app), the eCrime website of Dubai Police, the Aman service of Abu Dhabi Police, or the federal Public Prosecution’s My Safe Society app; you can also go to the nearest police station or call 999. Report an unlicensed provider to the regulator too. The regulators’ notices say they are for market awareness; they do not promise to recover money, and crypto sent to a scammer is usually very hard to get back.
Self-custody
We found no federal or VARA rule that restricts private wallets. Custody for others is a licensed activity under the VARA, CMA and ADGM rules. The Central Bank’s payment token rules exclude technology that lets people safeguard their own tokens or keys, so non-custodial wallet software is not a licensed custody service under that regulation. When you move coins between an exchange and your own wallet, the travel rule above applies to the exchange, not to you. If you hold a larger amount in your own wallet, this comparison of a single hardware wallet and a multisig setup explains the options.
Lost access
No UAE authority publishes guidance on lost keys or recovery phrases. Nobody can restore access to a self-custody wallet for you, so keep a secure backup of your recovery phrase.
Sources
- Capital Market Authority: Federal Decree-Laws on the Capital Market Authority and the regulation of capital markets (last checked October 2026)
- Capital Market Authority: The CMA issues the Virtual Assets Framework (13 April 2026) (last checked October 2026)
- VARA: SCA and VARA to ensure a unified register of regulated virtual asset firms (last checked October 2026)
- VARA: Public register (last checked October 2026)
- VARA: Rulebooks (last checked October 2026)
- VARA: Cabinet resolutions (last checked October 2026)
- VARA: Virtual Asset Issuance Rulebook, prohibited virtual assets (last checked October 2026)
- VARA: Travel Rule (last checked October 2026)
- VARA: Regulatory notices (last checked October 2026)
- VARA: 19 unlicensed firms penalised and public warning issued (7 October 2025) (last checked October 2026)
- VARA: Notice of fines, MX Global Ltd (MEXC) (last checked October 2026)
- VARA: Notice of fines, Peken Global Limited (KuCoin) (last checked October 2026)
- ADGM: Digital assets (last checked October 2026)
- ADGM: FSRA digital assets framework enhancements (10 December 2025) (last checked October 2026)
- Central Bank of the UAE: Payment Token Services Regulation (last checked October 2026)
- UAE government portal: Cyber safety and digital security (report cybercrimes online) (last checked October 2026)
This page is general information, not legal advice. Rules change, so check the official sources above before you act.