Digital Asset Regulation in the UAE: CBUAE, VARA and Financial Licensing Requirements
Part 1
The United Arab Emirates has become one of the leading international hubs for financial technology and digital asset businesses. However, its regulatory framework has a distinctive feature: fintech activities are supervised by multiple authorities, each with its own jurisdiction, licensing requirements and regulatory responsibilities.
Companies planning to provide digital asset exchange services, facilitate international payments, issue stablecoins or offer custodial solutions must carefully determine which regulatory framework applies to their business model.
Registering a company in a UAE free zone does not automatically authorise it to conduct regulated financial activities.
1. CBUAE — Regulation of Payment Tokens and Financial Infrastructure
The Central Bank of the UAE (CBUAE) is the federal authority responsible for supervising banking activities, payment systems and certain financial services.
One of the most important regulatory developments for digital asset businesses is the Payment Token Services Regulation (PTSR), which came into effect on 31 August 2024.
The regulation establishes three principal categories of regulated activities:
- Payment Token Issuance — issuing payment tokens.
- Payment Token Conversion — converting payment tokens.
- Payment Token Custody and Transfer — safeguarding and transferring payment tokens.
A key feature of this framework is that regulatory treatment depends not only on the technology underlying a token but also on its intended payment functionality.
For example, a company planning to issue an AED-backed stablecoin must consider CBUAE requirements relating to reserve assets, liquidity, token redemption, corporate governance and customer protection.
Certain requirements may also apply to foreign payment token issuers whose activities fall within the UAE regulatory perimeter.
An important legal consideration: holding a virtual asset service provider licence does not automatically authorise a company to perform all payment token activities. Depending on the business model, additional CBUAE authorisation or registration may be required.
2. VARA — Specialised Virtual Asset Licensing in Dubai
The Virtual Assets Regulatory Authority (VARA) was established under Dubai Law No. 4 of 2022. VARA regulates virtual asset activities throughout Dubai, including most free zones, with the exception of the Dubai International Financial Centre (DIFC).
Its framework establishes separate categories of regulated activities, including:
- Exchange Services;
- Broker-Dealer Services;
- Custody Services;
- Transfer and Settlement Services;
- VA Management and Investment Services;
- VA Lending and Borrowing Services;
- VA Advisory Services.
VARA follows an activity-based licensing approach. This means companies must obtain authorisation corresponding to the services they actually provide.
For example, a platform that facilitates digital asset exchanges while also controlling the private keys of customer wallets may need to assess the requirements for both Exchange Services and Custody Services.
VARA also imposes specific requirements on custodial service providers, including structural separation requirements for regulated custody activities.
Is an IFZA or DMCC Commercial Licence Sufficient?
This is one of the most common questions among companies considering entering the UAE market.
A commercial licence issued by a free zone may permit software development, blockchain technology services or certain consulting activities.
However, such a licence does not replace VARA authorisation when a company conducts regulated virtual asset activities.
For example, developing software for digital wallets and directly safeguarding customers' digital assets are legally different activities.
In the second scenario, the company may fall within the scope of financial services regulation and require additional authorisation.
3. Why Is It Important to Distinguish Between CBUAE and VARA?
Although both authorities have responsibilities relating to certain digital asset activities, their regulatory functions are not identical.
CBUAE primarily focuses on payment functions, payment tokens, financial stability and the regulation of relevant payment infrastructure.
VARA specialises in supervising virtual asset service providers operating within its territorial jurisdiction.
Consider a practical example.
A Dubai-based company plans to offer custodial wallets, facilitate digital asset exchanges and use stablecoins for international settlements.
In this situation, the company must assess which activities fall under VARA supervision and whether any payment token operations require additional CBUAE authorisation or registration.
The appropriate licensing structure therefore depends on the actual movement of funds, control over customer assets, token characteristics and contractual relationships between the parties.
In Part 2 of our legal review, we examine the ADGM and DIFC regulatory frameworks, their differences from VARA and the practical considerations involved in selecting the most appropriate jurisdiction for a fintech business.
This article reflects information available at publication. Requirements may change; confirm current rules with the relevant regulator before acting.
