Kadernani & CompanyA virtual-asset business can be incorporated in one country, hold technology in another, custody assets through a third-party provider elsewhere and reach UAE customers through a website within minutes.
That commercial flexibility is one of the attractions of the sector.
It is also why crypto regulation in the UAE cannot be understood simply by asking whether a company has a licence somewhere.
The important questions are more fundamental:
What asset is involved?
What service is actually being provided?
Who controls the customer relationship?
Who holds the private keys or customer assets?
Where are the relevant people and systems located?
Who is being marketed to?
And which UAE regulatory perimeter does that combination of facts engage?
For boards, founders, investors and international virtual-asset groups, the regulatory analysis should therefore begin with the business model rather than the company-formation application.
A licence should be the result of that analysis.
It should not be the starting assumption.
The UAE Does Not Have One Crypto Regulator
The first point to understand is structural.
There is no single regulator responsible for every virtual-asset, crypto-token, payment-token and digital-asset activity throughout the UAE.
Different regulatory frameworks operate depending on the nature of the asset, the service being performed and the jurisdiction from which the business operates.
The principal regulatory architecture now includes:
Dubai's Virtual Assets Regulatory Authority, or VARA;
the federal Capital Market Authority, or CMA;
the Central Bank of the UAE;
the Dubai Financial Services Authority in DIFC;
and
the Financial Services Regulatory Authority in ADGM.
These regimes interact, but they are not interchangeable.
A company authorised in one jurisdiction should not assume that its licence permits the same activity throughout the UAE.
Likewise, incorporation in a particular free zone does not itself constitute permission to provide a regulated virtual-asset service.
The regulatory perimeter must be mapped separately.
The Federal Framework Changed in 2026
The federal regulatory architecture changed materially on 1 January 2026.
Federal Decree-Law No. 32 of 2025 established the Capital Market Authority, replacing the former Securities and Commodities Authority structure at federal capital-market level.
Federal Decree-Law No. 33 of 2025 on the Regulation of Capital Markets gives the CMA express authority in relation to virtual assets, alongside its wider capital-market responsibilities.
The current law provides that, subject to the Central Bank's jurisdiction, the CMA regulates trading in Virtual Assets and the financial activities, services and functions associated with them.
It also gives the CMA supervisory and oversight responsibilities concerning Virtual Asset activities and trading within the UAE and its non-financial free zones.
This federal framework sits alongside Cabinet Resolution No. 111 of 2022, which established the earlier national framework for regulation of Virtual Assets and Virtual Asset Service Providers.
Businesses reviewing older UAE regulatory advice should therefore take care.
Documents referring exclusively to the SCA may still contain relevant legacy rules and guidance, but the current institutional framework should now be read through the CMA structure introduced in 2026.
For a new market-entry project, current regulatory responsibility should be confirmed rather than inferred from older memoranda.
Payment Tokens Remain a Separate Central Bank Question
The federal virtual-asset framework does not absorb every form of token.
One of the most important distinctions concerns assets used as a means of payment.
The Central Bank of the UAE maintains a separate regulatory perimeter for payment tokens and associated payment services.
Its Payment Token Services Regulation covers three principal categories:
Payment Token Issuance;
Payment Token Conversion; and
Payment Token Custody and Transfer.
This matters because a business can describe a product commercially as a:
stablecoin, digital dollar, settlement token, payment coin or crypto asset
while the legal analysis leads toward the Central Bank rather than the ordinary virtual-asset licensing route.
The label chosen by the marketing team is not determinative.
The regulatory analysis should examine what the token actually does.
If the token functions primarily as a payment mechanism, represents fiat-related value or forms part of a payment-service architecture, Central Bank regulation may become central.
That question should be answered before the product is launched.
Token Classification Comes Before Licence Selection
This is one of the most important principles in UAE digital-asset structuring.
A business should not begin by asking:
“Which crypto licence should we obtain?”
It should begin by asking:
“What exactly is this asset?”
A digital token can represent very different legal and economic rights.
It may function principally as:
a Virtual Asset;
a Crypto Token;
a security or investment;
a payment token;
a fiat-referenced token;
an interest in a fund;
a contractual entitlement;
or another form of digital right.
The analysis should consider the substance of the instrument.
Relevant features include its issuance structure, transferability, redemption rights, economic return, governance rights, underlying assets, payment functionality and intended investor base.
Technology does not determine legal classification.
Two tokens running on the same blockchain can fall into materially different regulatory categories because the rights attached to them are different.
The legal review should therefore occur before token design is commercially fixed.
It is considerably easier to adjust a product while the project remains on a whiteboard than after smart contracts, marketing material and customer terms have already been built around an incorrect regulatory assumption.
VARA Regulates Virtual Assets Across Dubai Except DIFC
For businesses operating in or from Dubai, VARA is central.
VARA was established under Dubai Law No. 4 of 2022 and regulates Virtual Assets and Virtual Asset Service Providers across Dubai, including the Emirate's ordinary free zones, except within the Dubai International Financial Centre.
That DIFC exclusion is fundamental.
A virtual-asset company incorporated in DMCC, for example, does not fall within the same regulatory framework as a financial-services company established in DIFC merely because both operate in Dubai.
The licensing authority and substantive rules are different.
VARA's framework is therefore relevant to businesses undertaking regulated Virtual Asset Activities in Dubai outside DIFC.
VARA Currently Recognises Eight Regulated Activities
VARA's current licensing framework identifies eight distinct categories of Virtual Asset Activity:
Advisory Services;
Broker-Dealer Services;
Custody Services;
Exchange Services;
Lending and Borrowing Services;
Management and Investment Services;
Transfer and Settlement Services; and
Category 1 Virtual Asset Issuance.
A VASP can in appropriate circumstances seek authorisation for more than one activity under an overarching licence, subject to the particular restrictions applicable to combinations of activities and, importantly, custody.
This is why a business model needs to be separated into individual functions.
A platform may describe itself commercially as an “exchange.”
Legally, the group may also:
provide custody;
arrange trades;
lend Virtual Assets;
manage portfolios;
provide recommendations;
transfer assets between wallets;
and issue its own token.
Each activity needs to be mapped.
The regulatory question is not the name on the website.
It is what happens when the customer presses each button.
A Technology Company Can Still Cross Into Regulated Activity
This issue arises frequently with blockchain and Web3 businesses.
A company may consider itself a software provider because it does not directly describe itself as a broker or exchange.
That conclusion can change when the actual customer journey is examined.
A technology business may move closer to regulated activity where it:
controls client assets or keys;
executes or arranges transactions;
determines how orders are routed;
receives transaction-based remuneration;
provides recommendations concerning Virtual Assets;
facilitates transfers;
or
stands between the client and the execution venue in a way that constitutes a regulated service.
Conversely, genuinely non-custodial technology infrastructure may present a different regulatory analysis.
The boundary depends on function.
The commercial contract and the actual system architecture should tell the same story.
If the agreement says the company merely provides software but the company can freeze client wallets, redirect trades and approve withdrawals, the operational reality will be difficult to ignore.
Proprietary Trading Requires Its Own Analysis
A business trading Virtual Assets solely for its own account is not necessarily in the same position as a VASP serving clients.
Under VARA's current framework, proprietary trading can require a No Objection Certificate rather than a full VASP licence in the circumstances prescribed by VARA.
This should not be confused with a general exemption from regulatory scrutiny.
The business should establish:
whose assets are being traded;
whether client money is involved;
whether services are offered to third parties;
whether market-making or another regulated function is performed;
and
whether the activity remains genuinely proprietary.
A group should not use a “proprietary trading” description where the economics show that it is effectively executing or managing transactions for customers.
Issuing a Token Can Be Regulated Even Without Operating an Exchange
Token issuers sometimes focus so heavily on exchange licensing that they overlook the issuance itself.
VARA maintains a separate Virtual Asset Issuance Rulebook.
The framework distinguishes among different categories of issuance, including Category 1 issuances requiring a VARA licence, other regulated issuance categories and exemptions subject to their applicable conditions.
The legal review should therefore examine the issuer separately from any exchange or platform on which the asset may later trade.
Relevant questions can include:
Who issues the token?
What rights does it provide?
What assets support it?
How are proceeds used?
Can it be redeemed?
How is supply controlled?
What disclosures are made to purchasers?
And who is responsible for ongoing obligations after issuance?
Listing a token later does not correct defects in its original issuance structure.
Marketing Can Create Regulatory Exposure Before the First Customer Is Onboarded
This is one of the most commercially important aspects of the VARA framework.
A company does not necessarily need to have completed a UAE transaction before its conduct becomes relevant.
VARA's current Marketing Regulations define marketing broadly.
The concept can include advertising, invitations, inducements, solicitation, offers and promotions delivered through channels such as social media, websites, videos, podcasts, events, sponsored content, influencers and other promotional communications.
Even certain educational content and token distributions can come within the analysis.
This means that a foreign platform saying:
“We do not have a UAE entity yet”
does not necessarily answer the marketing question.
If the campaign is being directed toward the UAE market, the regulatory analysis needs to occur before the marketing campaign launches.
A Disclaimer Cannot Cure an Unlicensed Business Model
Overseas platforms frequently attempt to manage jurisdictional exposure through website language.
The terms may say:
“Services are provided from another jurisdiction.”
Another section may say:
“Nothing on this website constitutes an offer in the UAE.”
Those statements can be relevant.
They are not magic words.
If the commercial conduct shows that the platform is actively targeting the UAE through:
local advertising;
UAE influencers;
Dubai events;
UAE-focused referral campaigns;
local sales teams;
AED-linked promotions;
or direct solicitation of UAE residents,
the actual conduct may carry more weight than a generic jurisdiction disclaimer.
The legal structure, website, sales process and marketing activity should therefore be aligned.
VARA Marketing Rules Apply Beyond Licensed VASPs
Another important point is that VARA's Marketing Regulations are not directed only at licensed firms.
The framework is deliberately broad and applies to entities conducting relevant marketing within its scope whether or not they themselves hold a VARA licence.
Marketing relating to a regulated VA Activity must generally be carried out by a VARA-licensed VASP or on behalf of, and approved by, the appropriately licensed VASP.
This matters to:
influencers;
marketing agencies;
media platforms;
event organisers;
affiliates;
and
international crypto groups.
A commercial partner should therefore not assume that regulatory responsibility remains entirely with the licensed platform.
Marketing relationships need their own compliance process.
Promotional Statements Need to Be Capable of Being Defended
Crypto marketing creates particular risk because the product itself can be volatile and difficult for retail customers to evaluate.
Statements concerning:
expected returns;
liquidity;
asset backing;
token stability;
custody security;
regulatory approval;
or
availability of investor protection
should be reviewed carefully.
Regulatory approval should never be presented as investment endorsement.
A regulator permitting an activity does not mean the regulator believes that the token will appreciate or that customers cannot lose money.
Marketing should explain the product accurately.
The stronger the commercial claim, the stronger the evidence supporting it should be.
DIFC Is Regulated Separately by the DFSA
DIFC is outside VARA's geographic regulatory mandate.
Financial services conducted in or from DIFC are regulated by the Dubai Financial Services Authority under the DIFC framework.
The DFSA has maintained a Crypto Token regime since 2022 and materially updated that framework with rules effective from 12 January 2026.
Any business considering DIFC should therefore work from the current rules rather than early summaries of the DFSA regime.
The DIFC option can be particularly relevant to institutional financial-services businesses that want to operate within a recognised international financial centre and common-law legal environment.
It is not merely another Dubai company-formation route.
If the business carries on a regulated Financial Service involving Crypto Tokens, it requires the appropriate DFSA authorisation.
The DFSA No Longer Maintains a Recognised Crypto Token List
One of the significant 2026 changes is the DFSA's revised approach to token suitability.
Under the updated framework, authorised firms are responsible for determining, on a reasoned and documented basis, whether the Crypto Tokens with which they propose to engage satisfy the DFSA's applicable suitability criteria.
The DFSA no longer relies on its former prescribed Recognised Crypto Token list.
This shifts responsibility toward the regulated firm.
A platform cannot simply ask:
“Is this token on the regulator's list?”
It needs a documented internal process capable of explaining why the token is acceptable under the applicable criteria.
That has implications for:
token onboarding;
governance;
risk assessment;
documentation;
and
continuing monitoring.
A token that was acceptable when first onboarded may need to be reconsidered if its structure or risk profile changes.
ADGM Has Another Distinct Digital-Asset Framework
Abu Dhabi Global Market also maintains a separate regulatory environment.
The Financial Services Regulatory Authority regulates financial services in ADGM.
Its digital-asset framework addresses several categories, including:
Virtual Assets;
Fiat-Referenced Tokens;
Digital Securities;
and regulated financial products such as funds and derivatives involving digital assets.
A business conducting regulated financial activity in ADGM requires the appropriate Financial Services Permission.
As with DIFC, an ADGM commercial registration alone does not constitute financial-services authorisation.
The business should therefore distinguish:
incorporating the company
from
authorising the regulated activity.
Both are necessary where the proposed model falls within the FSRA perimeter.
ADGM's Accepted Virtual Asset Framework Was Updated in 2025
The FSRA updated its Virtual Asset framework in June 2025, including changes to the process through which Virtual Assets are assessed for use within ADGM.
The amendments also addressed capital requirements and regulatory fees applicable to Virtual Asset firms.
This reinforces a recurring theme across UAE digital-asset regulation:
authorisation is not static.
A licensed business needs a process for monitoring regulatory changes and assessing whether its token universe, capital position and activities remain compliant.
The launch memorandum should therefore not be placed on a shelf once the licence is issued.
It should become part of an ongoing regulatory governance system.
ADGM Introduced a Specific Staking Framework in 2026
Staking illustrates why regulatory perimeter analysis must keep pace with product development.
In April 2026, the FSRA finalised a regulatory framework governing staking of clients' Virtual Assets.
The framework identifies which categories of Authorised Persons may carry on the relevant staking activities and imposes requirements concerning matters such as customer terms, disclosures, rewards and reporting.
This is commercially important.
A regulated exchange or custodian may decide that customers want staking.
From a product team's perspective, that can look like a feature update.
From a regulatory perspective, it can change the obligations applicable to the firm.
New product functionality should therefore trigger regulatory review before development reaches the customer.
The same principle applies to:
lending;
borrowing;
yield products;
automated investment;
and
tokenised financial products.
Product development and legal perimeter review should happen together.
A Licence in DIFC or ADGM Is Not a UAE-Wide Passport
One of the most important mistakes to avoid is assuming that a financial-free-zone authorisation creates nationwide permission.
DIFC and ADGM are distinct financial free zones with their own regulators and legal systems.
The scope of an authorisation is governed by the applicable regulatory framework.
A group that intends to maintain a licensed entity in one financial centre while actively soliciting or servicing customers elsewhere in the UAE should determine what additional local or federal rules apply.
The same principle operates in the other direction.
A VARA licence does not constitute a DFSA Financial Services Permission.
A CMA or local authorisation does not automatically permit financial services from ADGM.
The legal entity map and the regulatory map should match.
The New CMA Framework Must Be Included in Federal Market-Entry Planning
Outside the financial free zones, the federal CMA now has a central role in virtual-asset regulation alongside the established local licensing architecture.
Federal Decree-Law No. 33 of 2025 expressly gives the CMA responsibility for regulating trading in Virtual Assets and related financial activities, services and functions, subject to matters falling within Central Bank jurisdiction.
The legislation also contemplates registration of Virtual Assets and oversight of Virtual Asset activity within the UAE and its ordinary free zones.
This means that international businesses should no longer use a simplified jurisdiction map that says only:
“Dubai equals VARA, Abu Dhabi equals ADGM.”
That is incomplete.
ADGM applies within the Abu Dhabi Global Market financial free zone.
Outside the financial free zones, federal rules and any applicable local licensing framework need to be considered.
The legal analysis should identify the precise location and regulatory route rather than infer it from the Emirate name alone.
Legacy Virtual Asset Rules Still Matter During the Federal Transition
The creation of the CMA did not mean that the earlier regulatory framework disappeared overnight.
Cabinet Resolution No. 111 of 2022 remains part of the statutory architecture, together with the virtual-asset rules and guidance developed under the former SCA regime and subsequent federal legislation.
Current CMA materials continue to reflect that regulatory history.
A business therefore needs to understand both:
the new institutional framework; and
the continuing substantive rules that have carried into it.
The answer should come from the current consolidated regulatory position rather than the name appearing on an older PDF.
Virtual Assets Used for Payment Need to Be Separated From Investment Virtual Assets
The boundary with Central Bank regulation deserves particular attention.
The federal virtual-asset framework historically distinguished investment-oriented Virtual Assets from payment-related arrangements falling within Central Bank competence.
The current capital-market legislation continues to preserve the Central Bank's jurisdiction.
A token can therefore sit close to two regulatory worlds.
A platform may view it as a Virtual Asset because customers trade it.
A merchant may view it as a payment mechanism.
A regulator may focus on redemption, fiat reference, settlement function or the underlying customer use.
The classification should therefore occur before the group decides which regulator to approach.
Where there is genuine overlap, regulatory engagement may be necessary rather than forcing the product into one preferred category.
Stablecoin Is a Commercial Description, Not a Complete Legal Classification
The word “stablecoin” can be particularly misleading from a regulatory perspective.
A token may purport to maintain value against:
AED;
USD;
another currency;
gold;
a basket of assets;
or another reference.
Those structures do not necessarily receive identical treatment.
A fiat-related token can engage Central Bank payment-token requirements.
ADGM has a specific Fiat-Referenced Token framework.
DIFC's updated Crypto Token regime contains its own rules affecting fiat-related tokens.
VARA also regulates relevant token issuance and specific asset-referenced structures within its framework.
The business should therefore avoid beginning with:
“We want a stablecoin licence.”
The correct question is:
“What claims does the token make, what is it backed by, what redemption obligation exists, and how will customers use it?”
The legal category follows those answers.
Custody Is a High-Risk Regulatory Boundary
Custody deserves particular treatment because the technical structure can determine the regulatory position.
A business should establish who can control the assets.
If the company or its provider controls private keys, signing arrangements or withdrawal processes, custody regulation may be engaged.
The legal review should understand:
who holds keys;
whether keys are shared;
how withdrawals are authorised;
what happens if a key is compromised;
how client assets are segregated;
what records prove beneficial ownership;
and
what happens to customer assets if the custodian becomes insolvent.
A marketing statement saying:
“we never touch customer funds”
should be verified against the actual wallet architecture.
Technical custody and legal custody cannot be analysed separately.
Wallet Architecture Should Be Designed With the Legal Model
The difference between:
hot wallets;
cold storage;
omnibus wallets;
segregated wallets;
multi-signature arrangements;
and
third-party custody
can affect the control environment significantly.
The firm's legal terms should accurately explain the arrangement.
If client assets are pooled operationally, records should be capable of identifying each customer's entitlement.
If an external custodian is used, the contract should address responsibility, service levels, asset segregation, incident response and regulatory cooperation.
Outsourcing custody does not automatically outsource responsibility.
The licensed firm remains responsible for complying with the obligations that continue to apply to it.
Technology Governance Is a Regulatory Issue
A Virtual Asset business is unusually dependent on technology.
That makes cybersecurity and systems governance more than an IT concern.
Regulators expect firms to maintain controls proportionate to risks involving:
wallets;
private keys;
cybersecurity;
system development;
access controls;
transaction monitoring;
business continuity;
and
incident response.
Boards should therefore receive meaningful technology-risk information.
The question should not be merely whether there has been a hack.
The board should understand whether:
critical systems are tested;
key-management responsibilities are segregated;
privileged access is monitored;
outsourced systems are supervised;
and
incident escalation actually works.
A compliance manual cannot compensate for a system that operates differently from the documented control environment.
AML Is Central to the Operating Model
Virtual-asset businesses are exposed to particular financial-crime risks because assets can move across borders rapidly and through multiple wallet addresses.
The UAE's current AML framework is based on Federal Decree-Law No. 10 of 2025 regarding Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation Financing, together with Cabinet Resolution No. 134 of 2025, effective from 14 December 2025.
VASPs need to assess the AML requirements applicable through their regulator and the federal framework.
The operating model should address matters such as:
customer identification;
beneficial ownership;
risk classification;
source of funds and source of wealth where appropriate;
sanctions and targeted financial sanctions;
transaction monitoring;
suspicious transaction escalation;
and
record retention.
For virtual-asset businesses, blockchain analytics can form part of the control environment where appropriate.
Technology can improve monitoring.
It does not remove the obligation to exercise judgment.
Automated Onboarding Should Not Bypass the Compliance Function
A platform can process onboarding in seconds.
That does not mean every customer should be activated in seconds.
If the firm's risk framework states that particular customers require enhanced due diligence or compliance approval, the technical system should enforce that requirement.
A common governance failure occurs where written policy and platform functionality diverge.
The policy says:
“High-risk customers require manual approval.”
The software says:
“Account activated.”
From a regulatory perspective, the relevant question is what actually happened.
Compliance requirements should therefore be built into the product architecture rather than added through paperwork after launch.
Sanctions Controls Need to Extend Beyond Customer Names
Virtual-asset sanctions risk can be more complex than screening an individual's passport.
Depending on the firm's business and legal obligations, risk analysis may also need to consider:
wallet addresses;
transaction counterparties;
ownership and control;
high-risk services;
and
the destination or source of funds.
A customer may have passed ordinary onboarding while later transactional activity creates a different risk profile.
Monitoring should therefore continue after account opening.
The strongest financial-crime framework is dynamic.
It reacts when the customer's activity stops matching the business profile originally presented.
Customer Asset Protection Should Be Treated as a Legal Architecture
Where a platform holds customer assets, the board should understand exactly what would happen if the company failed tomorrow.
Are assets legally and operationally segregated?
Which entity holds them?
Do the customer terms describe that structure accurately?
Can company creditors reach them?
Which third-party custodians are involved?
Who reconciles balances?
How quickly can a customer withdraw?
What happens during a cybersecurity incident?
These questions should not first be asked during insolvency.
The asset-protection model should be designed alongside licensing and custody arrangements.
The balance sheet, wallet architecture and customer terms should all reflect the same structure.
Complaints Handling Matters Even in a Technology-Led Business
A crypto platform may be highly automated.
Customer disputes are not.
Clients can complain about:
execution;
fees;
frozen accounts;
withdrawals;
token delistings;
liquidations;
custody;
account compromise;
or
incorrect transfers.
The firm should have a clear process for identifying, investigating and resolving complaints.
A support ticket should not disappear between technical support and compliance.
Patterns in complaints can also indicate a broader control failure.
Board reporting should therefore distinguish an isolated customer disagreement from recurring operational issues.
Token Listing Governance Needs Independence
An exchange or platform deciding which assets to make available can face commercial pressure.
Listing a popular token may attract customers and trading volume.
The regulatory risk can move in the opposite direction.
The listing process should therefore use documented criteria appropriate to the jurisdiction.
Relevant factors may include:
legal classification;
technology;
market integrity;
liquidity;
issuer information;
custody compatibility;
financial-crime risk;
and
ongoing monitoring.
Commercial staff can participate.
They should not be the sole decision-makers where the regulatory framework requires an independent or controlled assessment.
The DFSA's 2026 move toward firm-led documented token suitability assessments makes this particularly important in DIFC.
Delisting Needs as Much Planning as Listing
Assets change.
A token may become subject to enforcement action.
Liquidity may disappear.
Technology may fail.
The issuer may stop providing information.
A token can cease to meet the firm's internal or regulatory criteria.
The platform should therefore have a documented delisting process before that situation occurs.
Customer terms should explain what can happen if support for an asset is discontinued.
The process should consider:
customer notice;
withdrawal periods;
open orders;
custody;
and
regulatory reporting.
An emergency delisting handled without a plan can create both regulatory and customer claims.
Outsourcing Does Not Eliminate Regulatory Responsibility
Virtual-asset businesses rely heavily on third parties.
A licensed UAE entity may use an overseas group company for technology.
Another provider may supply blockchain analytics.
A global cloud provider may host infrastructure.
A specialist company may provide custody.
Customer support may be centralised abroad.
These arrangements can be efficient.
They also require governance.
The firm should understand:
what has been outsourced;
which data is transferred;
what regulatory approvals or notifications apply;
what audit rights exist;
how the service can be terminated;
and
what happens if the provider fails.
The contract should also support regulatory access where required.
A regulator should not be unable to inspect an important business function simply because the firm outsourced it to its parent company overseas.
Cross-Border Group Structures Need a Clear Allocation of Functions
Many digital-asset groups operate through several companies.
One may own the technology.
One may employ developers.
One may hold intellectual property.
One may hold the licence.
One may provide custody.
One may operate the exchange.
Another may conduct marketing.
That structure can be legitimate.
It becomes risky when the real activity does not correspond with the legal documents.
The group should be able to explain:
which entity contracts with customers;
which entity receives fees;
which entity controls onboarding;
which entity executes transactions;
which entity holds assets;
which entity handles complaints;
and
which entity bears the relevant regulatory responsibility.
Intercompany contracts should reflect those answers.
A licence should not sit in one company while all meaningful regulated functions are quietly performed by another.
The Customer Journey Is One of the Best Regulatory Mapping Tools
A practical way to analyse a digital-asset business is to follow one hypothetical customer from beginning to end.
Where does the customer see the advertisement?
Which entity's name appears on the website?
Who performs KYC?
Who approves the customer?
Which entity signs the terms?
Where is fiat money sent?
Who controls the wallet?
Who accepts the order?
Where does execution occur?
Who receives the fee?
Who handles the complaint?
Who returns assets when the customer exits?
By answering those questions, a board can often see where the real regulated activity occurs more clearly than by studying the organisation chart.
The regulatory structure should follow that customer journey.
Customer Terms Need to Describe the Real Service
Virtual-asset client agreements should not be generic website terms copied from an overseas group company.
They should accurately explain the UAE service.
Depending on the product, matters requiring careful drafting can include:
service scope;
fees;
execution;
custody;
token eligibility;
wallet arrangements;
suspension and freezing rights;
risk disclosures;
forks and airdrops;
staking;
complaints;
account termination;
governing law;
and
dispute resolution.
The terms should also identify the correct legal entity.
A customer should know which company owes the contractual obligation.
Branding should not obscure that answer.
Risk Disclosures Need to Be Product-Specific
A general statement that:
“Cryptocurrency is risky”
provides limited protection.
The relevant risks depend on the service.
An exchange customer faces execution and market risks.
A custody client faces key-management and insolvency risks.
A staking customer may face lock-up, slashing or reward-related risks depending on the model.
A lending product presents counterparty and credit risk.
A token investor may face issuer, liquidity and technological risks.
Disclosure should therefore explain the material risks of the actual service.
The objective is not to bury the client in warnings.
It is to ensure that a reasonable customer understands the principal features of what is being offered.
Consumer-Facing Businesses Need Greater Discipline
A product offered only to sophisticated institutional counterparties presents a different risk profile from one offered to retail customers.
This distinction affects:
marketing;
appropriateness;
disclosures;
customer support;
complaints;
and
product governance.
A business entering the UAE should therefore decide its intended customer segment early.
Changing later from institutional clients to mass-market retail is not simply a sales strategy.
It can alter the regulatory requirements and operating controls required of the business.
Expansion into retail should therefore be treated as a regulatory project.
Banking Should Be Part of Regulatory Planning
A virtual-asset licence does not guarantee access to banking.
Banks conduct their own risk analysis and may require extensive information concerning:
regulatory status;
ownership;
source of capital;
AML systems;
customer profile;
countries served;
expected transaction flows;
payment processors;
and
the treatment of client money.
A firm can therefore obtain a licence and still struggle to operate if banking has not been planned.
Regulatory, banking and treasury workstreams should proceed together.
A payment flow that cannot be supported by a banking partner is not yet a viable operating model.
Regulatory Status Should Be Described Accurately
Digital-asset firms understandably want to publicise regulatory milestones.
Those statements should be precise.
There is a meaningful difference between:
an application submitted;
initial approval;
an in-principle approval;
a no-objection confirmation;
authorisation subject to conditions;
and
a fully operational licence.
Marketing should not collapse those stages into:
“regulated in the UAE.”
Likewise, a licence for one activity should not be presented as authorisation for every service offered by the global group.
Regulatory credibility is strengthened by precision.
Overstatement produces the opposite result.
Regulatory Change Should Be a Standing Board Item
The UAE digital-asset framework is developing rapidly.
The federal regulator changed in 2026.
The DFSA materially amended its Crypto Token framework in January 2026.
ADGM introduced new staking rules in April 2026.
VARA's rulebooks and regulatory guidance continue to develop.
The appropriate governance response is not to wait for external counsel to send occasional regulatory updates.
The board should maintain a process for identifying changes capable of affecting:
products;
customers;
capital;
technology;
marketing;
outsourcing;
or
licence scope.
The compliance officer should be able to explain not only what changed, but what the business has done about it.
Regulatory Perimeter Reviews Should Continue After Launch
The licence obtained at launch reflects the business described at that time.
Technology companies evolve quickly.
A simple exchange may add custody.
A custody platform may add staking.
A broker may introduce lending.
A proprietary trading company may begin accepting third-party capital.
A token issuer may introduce redemption.
A technology provider may move into managed services.
Each of those changes can affect the regulatory perimeter.
Product approval should therefore include a legal question:
Does this feature change what regulated activity the company performs?
If the answer may be yes, the regulator should be considered before launch rather than after customers begin using the product.
M&A Due Diligence on a Crypto Business Requires More Than Checking the Licence
A buyer acquiring a virtual-asset business should not stop after verifying that the target appears on the regulator's public register.
The buyer should examine whether the company has actually operated within the scope of that licence.
Due diligence should consider:
licensed activities;
licence conditions;
regulatory correspondence;
AML controls;
token listings;
custody arrangements;
customer complaints;
technology incidents;
outsourcing;
marketing;
capital requirements;
and
pending product launches.
A target can hold a valid licence while carrying material regulatory exposure because its business gradually moved beyond the activities originally authorised.
The purchase agreement should allocate that risk appropriately.
A Token Acquisition or Investment Also Requires Regulatory Due Diligence
Investors purchasing equity in a token issuer or acquiring a substantial allocation of tokens should also consider the regulatory architecture.
The diligence should ask:
who issued the token;
where it was issued;
which approvals were obtained;
where it may lawfully be marketed;
who holds reserves or backing assets;
what contractual rights token holders possess;
and
whether a regulatory change could restrict trading or distribution.
Token economics and legal architecture should be reviewed together.
A technically successful network can still become commercially impaired if its distribution model cannot operate lawfully in the intended market.
Tax Should Be Considered Alongside Regulation
A regulatory licence does not determine the Corporate Tax position.
A UAE VASP may operate from a mainland or free-zone entity.
Revenue can arise from:
trading fees;
custody;
brokerage;
staking;
token issuance;
technology services;
or
intercompany arrangements.
Those revenue streams can have different tax consequences.
Cross-border group structures also raise transfer-pricing questions.
An entity holding the UAE licence should not be left with minimal profit merely because the global group assigns most economics to an overseas intellectual-property company without analysing functions, assets and risks.
Tax and regulatory substance should be considered together.
Data Protection and Cybersecurity Need Cross-Border Planning
Crypto businesses routinely move personal and transactional data across jurisdictions.
Customer onboarding may be processed through a global compliance platform.
Support staff may be overseas.
Cloud infrastructure may be located outside the UAE.
Blockchain analytics providers may receive customer-related information.
These arrangements should be reviewed against the applicable data-protection regime.
The relevant law can differ between:
mainland UAE;
DIFC;
and
ADGM.
The company should know what data is collected, why it is processed, who receives it and where it is stored.
A privacy notice should reflect the real data architecture rather than a generic template borrowed from another jurisdiction.
Corporate Governance Should Match the Risk of the Business
A regulated virtual-asset company should have governance proportionate to what it does.
A custody provider safeguarding significant client assets requires a different control environment from a software company providing analytics.
A retail exchange has different risks from an institutional advisory business.
The board should understand the risks specific to the licensed model.
This may include:
financial crime;
custody;
market conduct;
technology;
liquidity;
counterparty exposure;
outsourcing;
and
consumer protection.
Reports to the board should be useful enough to support actual decisions.
Governance becomes ineffective when directors receive hundreds of pages of compliance reporting but cannot identify the company's most significant current risk.
The Compliance Function Must Have Real Authority
A compliance officer who can identify a problem but cannot stop a launch is not functioning effectively.
The governance structure should establish when compliance approval is required.
Material issues should have an escalation route to senior management or the board.
Commercial urgency should not routinely override compliance controls.
This is particularly important in fast-moving markets where teams may argue that a delay of several weeks will cause the company to miss an opportunity.
Regulatory problems created by launching too early can be substantially more expensive than the missed revenue.
A Practical UAE Crypto Regulatory Review
Before launching or materially expanding a virtual-asset business in the UAE, management should be able to answer:
What assets are involved?
How are those assets legally classified?
Which services will the company provide?
Which entity provides each service?
Where is that entity incorporated?
Which regulator has jurisdiction?
Does VARA, the CMA, the Central Bank, the DFSA or the FSRA regulate the activity?
Is more than one regulatory perimeter relevant?
Does the company control customer assets or keys?
Will it trade only for itself or for clients?
Will it issue a token?
Will the token be used for investment, payment or both?
Who is the target customer—retail or institutional?
Where and how will the service be marketed?
What licence, authorisation or No Objection Certificate is required?
What AML controls apply?
How will customer assets be protected?
What functions are outsourced?
Where is customer data stored?
Which entity receives the revenue?
Can the banking model support the transaction flows?
Do customer terms describe the service accurately?
And what internal process ensures that future product changes do not move the business beyond its licence?
If the board cannot answer those questions, incorporation is probably premature.
The Jurisdiction Should Follow the Business Model
Dubai, DIFC and ADGM are all credible environments for digital-asset businesses.
They do not serve every business model in the same way.
A company seeking an institutional financial-services model may place different weight on the DIFC or ADGM regulatory environments.
A consumer-facing Virtual Asset platform operating in Dubai may focus on VARA.
A payment-token project may need to begin with the Central Bank perimeter.
A business outside the financial free zones may need to address the federal CMA framework and any applicable local licensing arrangements.
The correct decision therefore does not begin with:
“Which jurisdiction is cheapest?”
or
“Which licence can we obtain fastest?”
It begins with:
“Which regulatory environment fits the business we actually intend to operate?”
The licensing timetable follows that answer.
Do Not Build the Product Around a Preferred Licence
Founders understandably want certainty.
A project may have already selected Dubai as its preferred headquarters.
Investors may expect a particular free zone.
A banking partner may prefer another jurisdiction.
The legal analysis should still remain independent.
If the product does not fit the preferred regulatory perimeter, the business has three choices:
change the product;
change the jurisdiction;
or
accept the regulatory requirements of the activity as designed.
Trying to describe the product differently without changing what it actually does is not a sustainable fourth option.
Regulators examine substance.
The legal structure should do the same.
UAE Crypto Regulation Is Now a Board-Level Function
The virtual-asset sector has moved beyond the stage where compliance could be left to a licensing consultant after the commercial model had already been designed.
Regulatory classification affects:
product development;
marketing;
custody architecture;
banking;
customer contracts;
capital;
technology;
outsourcing;
tax;
and
corporate governance.
These are board-level decisions.
Management should therefore understand the principal regulatory assumptions on which the business depends.
The board does not need to perform the regulator's work itself.
It does need to know whether the business model being approved is the same business model that was presented to the regulator.
If those two versions of the company begin to diverge, the regulatory problem has already started.
How Kadernani & Company Legal Consultants Can Assist
Kadernani & Company Legal Consultants advises founders, investors, technology businesses, financial-services groups and international virtual-asset businesses on the legal and regulatory structuring of UAE digital-asset operations.
For professional advice regarding crypto regulation in the UAE, VARA licensing, CMA virtual-asset regulation, DFSA Crypto Token rules, ADGM virtual assets, Central Bank payment tokens, Virtual Asset issuance, crypto marketing, VASP structuring, AML compliance or digital-asset transactions, contact Kadernani & Company Legal Consultants to discuss the regulatory architecture appropriate to the proposed business.
Our approach begins with the product rather than the licence.
The first stage is to map each asset, customer-facing activity, transaction flow, entity, jurisdiction, revenue stream and control point.
That analysis allows the business to identify whether the proposed model falls principally within VARA, the federal CMA framework, the Central Bank, the DFSA, the ADGM FSRA or a combination of regulatory considerations.
For Dubai businesses outside DIFC, we consider the current VARA framework, including the specific Virtual Asset Activities the business proposes to undertake.
The analysis should distinguish among advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and issuance activities, rather than assuming that one broad “crypto licence” covers the entire platform.
Where the business intends to trade only for its own account, the proprietary-trading position and applicable VARA No Objection Certificate requirements should be reviewed separately.
For token projects, classification should occur before issuance.
A token designed for investment use can raise different issues from a payment token, fiat-referenced token, digital security or contractual digital right.
The token documentation, economic model, reserve structure, redemption terms and intended customer use should therefore be reviewed before the regulatory route is selected.
Payment-token structures require particular attention to the Central Bank Payment Token Services Regulation, including the regulated categories of issuance, conversion and custody and transfer.
For businesses considering DIFC, the legal review should use the current DFSA Crypto Token regime as revised from 12 January 2026.
The firm's responsibility for conducting and documenting its own suitability assessment of Crypto Tokens should be built into product-governance and token-onboarding procedures.
For ADGM businesses, we consider the FSRA's current digital-asset framework covering Virtual Assets, Fiat-Referenced Tokens and related regulated financial services, including the updated Accepted Virtual Asset framework and the 2026 staking regime where relevant.
The federal position should also reflect the establishment of the Capital Market Authority from 1 January 2026 and the new federal Capital Markets legislation, rather than relying solely on pre-2026 references to the SCA.
Market entry does not end when authorisation is obtained.
The licensed operating model must be translated into customer agreements, intercompany contracts, custody arrangements, outsourcing documents, compliance processes, technology controls, board reporting and marketing procedures.
Where overseas group companies perform significant functions, those arrangements should demonstrate clearly which entity performs each role and where regulatory responsibility remains.
Marketing should be reviewed before launch.
VARA's Marketing Regulations are deliberately broad and can capture websites, social media, influencers, events, promotions and other customer-acquisition channels.
A foreign platform should therefore not assume that the absence of a UAE entity prevents UAE regulatory exposure where its campaign is intentionally directed toward the market.
The current Federal AML/CFT and Proliferation Financing framework introduced in 2025 should also be integrated into the operating structure.
For VASPs, customer due diligence, beneficial ownership, source-of-funds analysis, sanctions controls, transaction monitoring and escalation should operate in practice rather than appear only in a written compliance manual.
For investment or acquisition transactions, regulatory due diligence should go beyond verifying that the target holds a licence.
The review should examine whether the company's actual products, token listings, custody model, marketing, outsourcing, financial-crime controls and historical customer activities stayed within the permitted regulatory perimeter.
Where regulatory questions overlap with specialist technical, cybersecurity, accounting, tax or blockchain-forensics issues, the legal work should be coordinated with appropriately qualified specialists.
The objective is not simply to obtain a licence.
It is to build a business in which the product, legal entity, technology, customer contract, marketing strategy and regulatory authorisation all describe the same commercial reality.
For boards and investors, the practical test is straightforward:
before launching a UAE virtual-asset business or introducing a new crypto product, management should be able to explain exactly what regulated activity is being performed, which authority regulates it, which entity bears that responsibility and whether the customer journey remains within the permissions actually granted.
Where those answers are unclear, a senior-led regulatory perimeter review before launch is usually considerably less expensive than restructuring the business after customers have been acquired, banking relationships have been established or a regulator has begun asking questions.