Location decides which UAE regulator covers a virtual-asset business; onshore, payment use brings in the Central Bank

Five regulators, divided by place and by purpose

The UAE has no single virtual-asset regulator. In Dubai, outside the DIFC, VARA licenses virtual-asset activity. In the rest of the onshore UAE, including free zones outside Dubai, the federal Capital Market Authority (CMA) does. The DIFC and ADGM are financial free zones with their own regulators, the DFSA and the FSRA. Onshore, tokens used to pay for things fall to the Central Bank.

The federal starting point is Cabinet Resolution No. 111 of 2022. Article 4 prohibits virtual-asset activity in the UAE without approval and a licence from the federal authority or the local licensing authority, "as applicable", and prohibits dealing with an unlicensed provider. Article 3 excludes the financial free zones; digital securities and commodity contracts, which have their own rules; and virtual assets used for payment, which fall within the Central Bank's competence unless it approves them for investment trading on a platform. Security and commodity tokens issued in or from the State follow the CMA's rules for securities and commodity contracts (Article 3(1) of CMA Decision No. 15/Chairman of 2025).

The federal rules were rewritten in 2026

On 1 January 2026 the CMA became the legal successor of the Securities and Commodities Authority, taking its place wherever legislation names it (Article 2 of Federal Decree-Law No. 32 of 2025). Article 27(3) keeps Cabinet Resolutions No. 111 and 112 of 2022 in force where they do not conflict with the new laws.

The Capital Market Law, Federal Decree-Law No. 33 of 2025, took effect the same day. Article 3 lists "activities and services related to Virtual Assets" among the financial activities needing a CMA licence or approval in the State. The law reaches anyone targeting clients in the State, even from abroad, where the activity is one it governs (Article 2(1)(d)). It does not apply to the financial free zones or to activities the Central Bank licenses, and covers Central Bank licensees only for securities issues and Article 3 activities, virtual-asset services included (Article 2(4)). Without prejudice to the Central Bank law, Article 39 bars trading any virtual asset in the State unless it is on a CMA-licensed platform's official list and registered with the CMA. Carrying on a financial activity without a CMA licence, approval, registration or accreditation is punishable by at least one year's imprisonment and a fine of AED 50,000 to AED 250 million, or either (Article 71(1)).

The rulebook is CMA Decision No. 04/Chairman of 2026, in force since 28 February 2026. It repealed Decision No. 26/Chairman of 2023 and the virtual-asset provisions of the CMA's Financial Activities Rulebook, save their licensing conditions until status regularisation ends (Article 6 of the Decision). Its General Framework Module lists six activities that need a CMA licence, from operating a platform to services connected with offering virtual assets (Article 4). Licensees and their staff must comply from 28 February 2026, but have up to a year to meet the Business Regulation and Alternative Trading System Modules (Articles 2 and 3 of the Decision).

Dubai: VARA exercises the federal powers locally

Dubai Law No. 4 of 2022 applies to virtual-asset services in all zones of the emirate, including free zones but excluding the DIFC (Article 3). A regulated activity in Dubai needs a VARA permit, and the business must be set up in the emirate (Article 15). Cabinet Resolution No. 112 of 2022 delegates to VARA the federal authority's licensing, supervision and penalty powers under Resolution 111, exclusively within Dubai and its free zones (Articles 2 and 4).

Federal oversight continues alongside a VARA licence. The CMA may supervise and oversee locally licensed providers, whose licensing authorities must give it their data on request (Article 9(1) and (2) of Resolution 111), and the Capital Market Law gives it oversight of virtual-asset activity across the State and its non-financial free zones (Article 39(3)). Resolution 112 has VARA coordinate with it on a unified supervision mechanism (Article 3(1)). Cabinet Resolution No. 83 of 2025 prices a federal registration for locally licensed providers: AED 3,000 to register, AED 1,500 a year to renew and AED 1,000 to cancel (Article 1(1)). VARA's Regulations also require licensed firms to follow applicable Central Bank rules, naming payment token services (Regulation III.A.4).

When a token pays for something, the Central Bank steps in

Federal Decree-Law No. 6 of 2025, the Central Bank law in force since 16 September 2025, lists "providing payment services using Virtual Assets" and stored-value, retail-payment and digital-money services among the activities that need a Central Bank licence (Article 61(1)(f) and (g)). Article 62 extends that jurisdiction to licensed financial activity carried on "regardless of the medium, technology, or form", naming virtual-asset payment tokens and decentralised finance. Article 187 draws the line: where virtual assets are used as a means of payment, or exchanged for a currency, the Central Bank's rules apply; held for investment, swapped for other virtual assets or used in trading swaps, they fall outside the law. Unlicensed activity carries imprisonment and a fine of AED 50,000 to AED 500 million, or either (Article 170).

The Central Bank's Payment Token Services Regulation (Circular 2/2024, in force from 31 August 2024) prohibits payment token services in the UAE, or directed at persons in the UAE, without a Central Bank licence or registration (Article 2). A business in the UAE selling goods or services may accept a virtual asset only if it is a dirham payment token from a licensed issuer, or a foreign payment token from a registered issuer used to buy a virtual asset or a virtual-asset derivative. VARA likewise leaves the issuance of any token pegged to the dirham to the Central Bank (Rule I.B.4 of Annex 1 to its VA Issuance Rulebook). The Central Bank law and Article 2 of the regulation both exclude the financial free zones.

The DIFC and ADGM run their own regimes

The DIFC is a financial free zone (Article 3 of Dubai Law No. 5 of 2021), as is ADGM (Federal Decree No. 15 of 2013). In the DIFC, no one may carry on a financial service in or from the centre except as the Regulatory Law permits, with DFSA Rules prescribing which activities count (Article 41). The DFSA's latest crypto token amendments took effect on 12 January 2026; since then the DFSA no longer keeps a list of recognised crypto tokens and firms assess suitability themselves, fiat crypto tokens apart.

In ADGM, the general prohibition bars regulated activity by way of business without FSRA authorisation or exemption (section 16 of the FSMR). The FSMR treats virtual assets and fiat-referenced tokens, which are redeemable against a single fiat currency, as separate categories and makes issuing the latter a regulated activity (section 258; Schedule 1, paragraph 53B). Regulated activity involving algorithmic stablecoins or privacy tokens is barred (section 5A(4)).

Onshore clients complicate the picture. The Capital Market Law reaches a firm targeting clients in the State from a financial free zone where the activity is one it governs (Article 2(1)(d)), yet it does not otherwise apply in those zones (Article 2(4)(d)); neither the law nor Decision No. 04/Chairman of 2026 says how the two fit for a DFSA- or FSRA-authorised firm. A CMA licensee needs the CMA's approval for a branch in a financial free zone (Article 65 of the General Framework Module).

Where the texts overlap or leave the line unclear

Dubai platforms and the federal trading rule. Article 39(2) ties lawful trading in the State to a CMA-licensed platform's list and CMA registration, and Decision No. 04/Chairman of 2026 does not mention local licensing authorities. Resolutions 111 and 112, kept in force, still let VARA license Dubai platforms. None of these texts says how Article 39(2) applies to tokens traded on a VARA-licensed exchange, or what the federal registration priced by Resolution 83 allows a VARA licensee to do outside Dubai. We raise both with the authorities, alongside the client's counsel, rather than assume.

Central Bank licensees. Decision No. 16/Chairman of 2026, in force since 25 June 2026, lets Central Bank licensees other than insurance companies practise any activity in Decision No. 04/Chairman of 2026. The Capital Market Law covers them for Article 3 activities (Article 2(4)(c)), and Article 3(2) requires a CMA licence or approval for those; Decision No. 16 does not say whether it is itself that approval or whether a separate CMA licence or registration is still needed. Article 61(3) of the Central Bank law separately requires Central Bank approval before a licensee takes another regulator's licence for activities outside the Central Bank's list.

Fiat legs. Exchange Services under VARA's Regulations include converting virtual assets into fiat currency (Schedule 1), and the Dubai law lists exchange between virtual assets and currencies as a VARA activity (Article 16). Article 187(2) of the Central Bank law applies Central Bank rules where a virtual asset is exchanged for a currency. No text we read says whether that leg needs a Central Bank licence of its own.

Definitions and bans. Dubai's law counts value usable "as an exchange or payment tool" as a virtual asset (Article 2); the federal texts define virtual assets by investment use and exclude digital fiat and securities (Article 1 of Resolution 111 and of the Capital Market Law). VARA bans anonymity-enhanced cryptocurrencies (Regulation II.C.1); the CMA bans privacy and algorithmic tokens (Articles 5 and 6 of its General Framework Module).

How a group maps its entities

Working with the client's regulatory counsel, we build the map entity by entity, recording where each company is incorporated and licensed, where its management sits, where its clients are, and each virtual-asset service it provides or plans. Each activity is then matched to the relevant regulator's list: Schedule 1 of the VARA Regulations, Article 4 of the CMA's General Framework Module, Article 61 of the Central Bank law, or the DFSA and FSRA rules.

Three checks follow. Any token used for payment, any dirham-pegged token and any fiat on-ramp is flagged for Central Bank analysis. Counterparties are checked, because Resolution 111 prohibits dealing with an unlicensed provider (Article 4(4)) and Cabinet Resolution No. 99 of 2024 fines that from AED 100,000 for a first breach. And the licence sits in the entity that serves the clients: VARA's delegated powers stop at Dubai's boundary (Article 4 of Resolution 112), and a VARA licensee acting outside Dubai must meet VARA's standard or the local one, whichever is higher (Regulation IV.A.4).

The corporate file follows the map: board resolutions for each application, registers showing controllers, and the status wording a licensee must use, such as "Licensed by CMA" on its documents and website (Article 64 of the General Framework Module).

Keeping the map current

The map moves. The Capital Market Law gives one year from 1 January 2026 to adjust status, extendable by the CMA's board (Article 83); the Central Bank law's year from 16 September 2025 ran to 16 September 2026 unless the Central Bank's board extended it (Article 184). We diarise the live deadlines for each entity, including the CMA's window for the two modules, and re-run the map when a group adds an activity, a market or a token.

This article describes UAE laws and regulators’ rules as of 2 November 2026. It is general information, not legal or investment advice. Polaris is not a law firm and is not licensed by VARA, the CMA, the Central Bank, the DFSA or the FSRA.