UAE virtual-asset businesses carry the full federal AML regime, and VARA and the CMA go further

The 2025 federal law treats virtual-asset firms like financial institutions

Every virtual-asset service provider operating from within the UAE must assess its money-laundering risks, identify customers and beneficial owners, report suspicion to the Financial Intelligence Unit (FIU), apply targeted financial sanctions immediately and keep records (Articles 18 and 19 of Federal Decree-Law No. 10 of 2025). The Decree-Law, issued on 30 September 2025, repealed the 2018 AML law (Article 41); its executive regulations, Cabinet Resolution No. 134 of 2025, replaced the 2019 regulations (Article 70) and took effect on 14 December 2025, according to the UAE Legislation portal.

A virtual asset service provider is anyone who, as a commercial activity, carries out virtual-asset activities for or on behalf of another person (Article 1). Article 4 of the regulations lists them: exchange between virtual assets and fiat currency or between virtual assets, transfer, safekeeping or administration, and services connected with an issuer's offer or sale. Article 20 of the Decree-Law bars the activity without a licence, registration or enrolment.

Who supervises: VARA in Dubai, the CMA at federal level

In Dubai outside the DIFC, VARA is a designated Supervisory Authority for all virtual-asset providers under the federal AML laws (Regulation VI.A.3 of the VARA Regulations) and exercises the federal regulator's licensing and supervisory powers there, including action on suspicious transactions, under the delegation in Cabinet Resolution No. 112 of 2022 (Articles 2 and 4). Its licensees follow the federal laws and VARA's rules (Regulation VI.B.1), chiefly Part III of the Compliance and Risk Management Rulebook.

At federal level, the Capital Market Authority (CMA) supervises virtual-asset activity across the State and its non-financial free zones under Federal Decree-Law No. 33 of 2025, in force since 1 January 2026 (Article 39(3)). Cabinet Resolutions No. 111 and 112 of 2022 remain in force where consistent with the 2025 laws (Article 27(3) of Federal Decree-Law No. 32 of 2025); Resolution 111 binds every provider to AML legislation (Article 8) and lets the federal regulator oversee locally licensed providers (Article 9(2)). The CMA's Decision No. 04/Chairman of 2026, in force since 28 February 2026, applies the CMA rulebook's AML section to its licensees (Business Regulation Module, Article 4).

Neither the CMA's supervision nor Resolution 111 (Article 3(2)(a)) reaches the financial free zones, and VARA's remit stops at the DIFC; our companion article maps the regulators there.

Due diligence: every relationship, and occasional transactions from AED 3,500

Due diligence is required when a relationship starts, when there is suspicion and when earlier identification data is in doubt (Article 7(1) of the regulations). For occasional transactions, a virtual-asset firm applies it at AED 3,500 or more, counting linked transactions together (Article 7(3)); VARA uses the same figure and adds any transaction for a high-risk client (Rule III.E.4).

For a corporate customer, the firm identifies each natural person owning 25 per cent or more, then whoever controls it by other means, and failing both, its senior managers (Article 10). For high-risk clients and politically exposed beneficial owners, a VARA licensee verifies source of funds and source of wealth, obtains senior management approval and requires the first transaction to come from an account in the client's name at a regulated institution (Rule III.E.10).

If due diligence cannot be completed, neither the relationship nor the transaction can proceed (Article 14; Rule III.E.8). Reliance on a regulated third party is allowed, but responsibility stays with the firm (Article 20; Rule III.E.9).

Transfers, screening and sanctions run in real time

Under Article 36(2), the originating firm obtains the originator's name, account number or wallet address and residential or business address, and the beneficiary's name and account or wallet, and sends them immediately and securely to the beneficiary's provider, which holds them too. VARA applies the same minimum to transfers worth more than AED 3,500 and requires due diligence on counterparty providers and a decision on unhosted wallets (Rules III.G.2 to III.G.7).

Article 36(2) also applies Articles 26 to 33, the wire-transfer rules among them, to virtual-asset firms, proportionately and as the supervisor directs, and Article 1 counts a transfer by a virtual-asset provider to another provider or to a wallet as a wire transfer. So the data travels with every international transfer and the originator's details are verified from AED 3,500 (Article 28(1) and (3)). The CMA's AML section likewise requires basic data on every transfer and fuller originator details from AED 3,500 (Chapter Five, Articles 1 and 4(1)). VARA's rule, written before the 2025 regulations, starts above AED 3,500 but is a minimum that federal law may supplement (Rule III.G.1), and Article 35(1) lets the supervisor set the scope and limits of transfers.

Article 36(3) gives virtual-asset firms every sanctions duty of financial institutions, including registering with the Executive Office and screening customers, owners and transactions against UN and local lists (Article 21 of Cabinet Decision No. 74 of 2020). Article 15 of that Decision requires a freeze within 24 hours of listing and notice to the Executive Office within five business days. VARA adds automated, real-time sanctions screening of transactions and risk rules that screen clients, owners and wallet addresses (Rules III.B.3 and III.H.1 to III.H.5).

Suspicion reports, officers and records

Suspicious transactions are reported to the FIU without delay, whatever their value (Article 18 of the Decree-Law); VARA names goAML (Rule III.F.4) and gives the MLRO 48 hours to answer FIU or VARA requests (Rule III.F.3). Tipping off is prohibited (Article 19 of the regulations). Under the Decree-Law it is punishable by imprisonment and a fine of at least AED 50,000, or either (Article 29(1)), and failing to report, deliberately or through gross negligence, by imprisonment and a fine of AED 100,000 to AED 1 million, or either (Article 28).

The regulations require an independent compliance officer at management level (Article 22), whose appointment the supervisor approves in advance (Article 49(18)). VARA requires a compliance officer with five years' compliance experience, UAE residence or a UAE passport, full-time employment and a direct line to the board (Rule I.C.1), and an MLRO with two years' AML experience reporting to the board quarterly (Rules III.A.1 and III.A.2); the MLRO role may be outsourced (Company Rulebook, Rule IV.A.3). The CMA requires both officers to reside in the State (General Framework Module, Article 54(2)) and a semi-annual report on internal controls (AML section, Chapter Seven).

Records must be kept for at least five years federally, running from the end of the transaction or relationship and, for due-diligence files, from any later inspection, investigation or final judgment (Article 25 of the regulations); eight years under VARA, and indefinitely where they may relate to national security (Rules I.F.2 and III.I.2); and ten years under the CMA's AML section (Chapter Twelve, Article 1). VARA also requires business and client risk assessments at least every three months (Rules III.D.3 and III.D.8) and AML policies attested by a competent third party, refiled within 21 calendar days of a change (Rule III.B.4).

Penalties reach the company and the people running it

A supervisor may warn, fine AED 10,000 to AED 5 million per violation, suspend directors or the activity, revoke the licence and publish the outcome (Article 17 of the Decree-Law). A company whose representatives or directors commit offences such as failing to report, breaching sanctions or operating unlicensed on its behalf faces a fine of AED 200,000 to AED 10 million (Article 27(2)). Dealing in virtual assets built for total anonymity is an offence (Article 30(2)); VARA prohibits anonymity-enhanced cryptocurrencies and related activity in Dubai (Regulation II.C.1).

VARA's fine schedule leaves AML and know-your-customer fines to be set under local and federal law (Regulations, Schedule 3, No. 1). Other Compliance and Risk Management breaches carry indicative company fines of up to AED 50 million, 15 per cent of annual revenue or 300 per cent of the profit gained or loss avoided, whichever is higher (No. 2), and VARA may act directly against directors, Responsible Individuals and the MLRO (Rule III.J.2; Regulation IX.C.3).

Cabinet Resolution No. 71 of 2024 does not reach virtual-asset firms: its fines of AED 50,000 to AED 1 million per violation, which the Ministry may double for a repeat, apply to designated businesses supervised by the Ministries of Justice and Economy (Articles 2 and 5), which can include a firm's corporate service provider.

Where the texts overlap or have not caught up

VARA's texts still cite the repealed 2018 law and 2019 regulations (Regulation VI.A.1; Schedule 4), and its Company Rulebook takes its definition of a politically exposed person from the 2019 regulations, repealed by Article 70 of Cabinet Resolution No. 134 of 2025. Because Schedule 4 also covers federal AML legislation in force from time to time, we read VARA's references as pointing to the 2025 texts, including the definition of a politically exposed person in Article 1 of the regulations.

The CMA's AML section applies to virtual-asset firms licensed 'by the Authority or local entities' (Chapter One, Article 3), and its April 2026 letter lists VARA's rulebook among the texts firms must follow. Cabinet Resolution No. 112 of 2022 requires VARA to work with the federal regulator towards a unified mechanism for supervising its licensees (Article 3(1)), but we have found no published text setting it out or saying how the CMA's AML section applies to them. The CMA section also still refers to penalties under the repealed 2018 law (Chapter Twelve, Article 4).

On officers, VARA lets one person be compliance officer and MLRO (Rule III.A.4), while the CMA's AML section keeps the compliance officer out of other operational functions (Chapter Seven, Article 1(2)) even though its 2026 regulation allows positions to be combined (Article 54(4)).

What a virtual-asset business and its service providers check

The CMA's April 2026 letter to securities firms and VASPs points to concrete checks: a documented gap analysis against the 2025 texts; a designated deputy MLRO or other authorised alternative to cover absences, with any deputy full-time, independent and UAE-resident; sanctions screening that covers wallet addresses where feasible; and blockchain analytics that are calibrated and validated rather than taken on trust from a third-party provider. The rules above add goAML access and a retention schedule set to the longest applicable period.

On the corporate side, the company keeps its shareholder register, updates its basic and beneficial-owner information within 15 working days of a change, and nominees disclose their nominator (Articles 38 and 39 of the regulations). A VARA licensee needs VARA's written approval before any material change to its owners or beneficial owners (Company Rulebook, Rule I.A.5). A corporate service provider that forms the company, provides its office or acts as secretary or nominee is itself a designated business (Article 3(5) of the regulations) and runs its own due diligence on the firm.

For a new venture, the AML framework belongs in the licence file: VARA expects attested policies and a travel-rule plan during licensing (Rules III.B.4 and III.G.8).

This article describes UAE laws and regulators’ rules as of 2 November 2026. It is general information, not legal or investment advice. Polaris is not a law firm and is not licensed by VARA, the CMA, the Central Bank, the DFSA or the FSRA.