United Arab Emirates

Three crypto regulators. VARA is the Dubai-onshore regulator established in 2022 specifically for virtual assets; the DFSA regulates the Dubai International Financial Centre (DIFC) free zone; the ADGM's FSRA regulates the Abu Dhabi Global Market free zone. Each issues its own licences, applies its own rulebook, and supervises its own licensees. The federal Securities and Commodities Authority (SCA) handles matters at the UAE-wide level for activities outside the financial free zones.

The free-zone structure. DIFC and ADGM operate as common-law financial free zones with their own courts and regulatory frameworks distinct from UAE federal law. A crypto business licensed in DIFC by the DFSA is not licensed to operate elsewhere in the UAE; cross-zone operations typically require multiple licences. The free-zone structure has historically attracted institutional and Western-domiciled crypto operators; VARA has expanded onshore-Dubai availability since 2022.

Post-FATF grey-list tightening. The UAE was placed on the FATF grey list in March 2022 for AML deficiencies and removed in February 2024 after substantial remediation. Crypto regulation was a focus of the remediation; standards were materially tightened in 2022-2023 across all three regulators. Practitioners report VARA and DFSA enforcement is materially stricter post-grey-list than the pre-2022 framework.

VARA licensing tiers. VARA operates a tiered licensing structure covering distinct activities: advisory services, broker-dealer services, custody services, exchange services, lending and borrowing services, payment services, and management and investment services. Each tier has distinct capital, governance, and operational requirements. The exchange services tier requires the highest paid-up capital and the most extensive compliance infrastructure.

DFSA / FSRA licensing. DFSA (DIFC) and FSRA (ADGM) crypto regimes are substantially aligned with traditional financial-services licensing extended to crypto. Capital requirements depend on the specific licence category (multilateral trading facility, custodian, fund manager, broker-dealer). Both regulators have been notably engaged with institutional crypto businesses and tokenised-asset issuances.

Multi-jurisdiction operations. A crypto business operating across mainland UAE + DIFC + ADGM typically requires three separate licences with distinct compliance teams. This complexity is part of the cost of the multi-regulator UAE structure but is generally regarded as manageable by major operators given the commercial environment.

VARA stablecoin framework. VARA's stablecoin rules require fiat-referenced stablecoin issuers operating in Dubai onshore to hold reserves 1:1, maintain segregation, publish attestations, and provide redemption at par. The framework is broadly aligned with international standards but applies specifically to VARA-supervised onshore issuers.

DIFC / ADGM stablecoin treatment. Stablecoin issuance in DIFC or ADGM falls under the respective securities-law / financial-services frameworks, with category-specific requirements depending on whether the stablecoin is treated as e-money, security token, or virtual asset.

Central Bank of UAE Dirham stablecoin. The Central Bank of the UAE has been notably active in CBDC research (the 'Aber' wholesale-CBDC pilot with Saudi Arabia + others) and has signalled potential issuance of an AED-denominated retail or wholesale digital currency. AED-denominated private stablecoins face additional Central Bank engagement.

No personal income tax or capital gains tax. UAE residents pay no federal personal income tax or capital gains tax. Individual crypto investors generally are not subject to UAE income or capital gains tax on disposals. This is one of the most favourable individual-investor tax frameworks globally.

Corporate tax from 2023. UAE introduced a federal corporate tax (9% on profits above AED 375,000) effective June 2023. Crypto businesses operating in the UAE outside free zones are subject to corporate tax. Free-zone businesses meeting qualifying-free-zone-person criteria may continue to benefit from 0% corporate tax on free-zone activities, though detailed conditions apply.

VAT (5%). UAE VAT applies to crypto-related services (exchange fees, custody fees, advisory fees) at the standard 5% rate. The crypto asset itself is generally treated outside VAT (analogous to other major jurisdictions), but the services around it are within scope.

This is general background, not tax advice. UAE tax treatment depends on residency status, business structure, and free-zone vs onshore positioning. Consult a UAE-qualified tax adviser for personal matters.

Federal AML framework + regulator-specific rules. UAE federal AML law (Federal Decree-Law No. 20 of 2018) applies across the country; the three crypto regulators each issue specific implementing rules. Customer due diligence, transaction monitoring, suspicious-transaction reporting to the UAE's Financial Intelligence Unit, and recordkeeping are mandatory.

Travel Rule. UAE implemented Travel Rule requirements in 2022-2023 across all three crypto regulators with thresholds broadly aligned with FATF Recommendation 16. Originator and beneficiary information accompanies crypto transfers between licensed VASPs; for transfers to self-hosted wallets, originator information collection is required.

Sanctions enforcement. UAE implements UN sanctions plus a substantial set of national-level designations. The Ministry of Economy and the Central Bank coordinate sanctions enforcement; licensed crypto VASPs must screen against the consolidated UAE sanctions list. Enforcement intensity has materially increased post-grey-list-removal.

VARA conduct rules. VARA's Conduct of Business module requires licensed VASPs to: assess customer suitability for the products offered; provide clear and balanced risk disclosure; maintain complaints-handling procedures; segregate customer assets; provide custody arrangements meeting VARA's standards.

DFSA / FSRA retail rules. DFSA and FSRA apply standard financial-services consumer-protection rules to crypto activities. Marketing communications must be balanced; suitability assessments are required for non-professional retail; cooling-off and disclosure rules apply.

Marketing restrictions. All three regulators apply restrictions on misleading promotional language. Promotion of returns, comparison to traditional investments without risk context, and 'guaranteed return' framing are enforced against.

Regulator-specific supervisory reporting. Each of VARA, DFSA, and FSRA collects supervisory data from its licensees covering transaction volumes, customer counts, customer-asset balances, AML statistics, and incident reports. Cross-regulator data exchange occurs but is less mature than within unitary jurisdictions.

OECD CARF. UAE has committed to OECD CARF implementation on the standard 2027-2028 timeline. Implementation across the federal + free-zone structure will require coordination across the three crypto regulators.

FIU centralisation. Suspicious-transaction reports across all three regulators flow to the central UAE Financial Intelligence Unit. This centralisation provides federal-level visibility into AML risk even where licensing is decentralised across regulators.