UAE Crypto Regulation 2026: VARA, CBUAE, ADGM, DFSA and CMA Explained

An electronics wholesaler in Deira gets a message from a buyer in Lagos: can he settle a container of phones in USDT? Five years ago the honest answer in the UAE was "probably, nobody is checking." Today it is "not like that." Under the Central Bank's payment token rules, a dollar stablecoin issued abroad can be used onshore mainly to buy other virtual assets, not to pay for goods. A licensed dirham token is the route the Central Bank wants merchants to use. That single rule captures how far the UAE has moved from crypto-friendly slogan to a dense, layered rulebook.

The difficulty for anyone outside the country is that there is no single UAE crypto regulator. There are at least five, plus the financial intelligence unit, and which one applies depends on where a firm is incorporated, what it does and who its customers are. This guide maps who covers what as of mid-2026, what each licence lets a firm do, and where the federal Central Bank has recently pulled the threads tighter.

Five regulators, three geographies

Think of the UAE as three overlapping zones. Onshore UAE, including most ordinary free zones, falls under federal law. Dubai has its own emirate-level regulator for virtual assets. And two financial free zones, the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), run English common-law systems with their own financial regulators.

Over all of them sits anti-money-laundering law, reporting to the UAE Financial Intelligence Unit and the FATF standards, including the Travel Rule for transfers between providers. We cover that in our explainer on the FATF Travel Rule.

The Central Bank: payment tokens and the dirham-first rule

The CBUAE issued its Payment Token Services Regulation as Circular No. 2/2024 in June 2024, with a one-year transition. It defines a payment token as a virtual asset that aims to keep a stable value by referencing a fiat currency, which in practice means stablecoins. It covers three services: issuing tokens, converting them, and holding or transferring them for others.

The rules split tokens into two classes:

• Dirham payment tokens need a full CBUAE licence and can be issued only by UAE-incorporated companies (onshore or ordinary free zones, but not DIFC or ADGM). They may be used for payments generally.
• Foreign payment tokens such as USDT or USDC need the foreign issuer to be registered rather than licensed. Onshore, they can be transferred, and accepted by merchants, only when used to buy virtual assets or virtual asset derivatives.

Algorithmic stablecoins and privacy tokens are banned outright, along with services and promotion relating to them. Issuers must hold reserves; reports on the framework describe two options, either cash in a segregated dirham escrow account at a UAE bank, or at least 50% cash with the balance in UAE government bonds and CBUAE monetary bills of up to six months' average duration, according to Cointelegraph's report on the first approval.

That first approval went to AED Stablecoin LLC for AE Coin, which received in-principle approval in October 2024. Others have followed. RAKBANK received in-principle approval for its own dirham token, and Network International said it would integrate AE Coin into point-of-sale and e-commerce systems, Gulf News reported in January 2026.

The UAE welcomes dollar stablecoins as trading chips and wants dirham tokens as money.

The 2025 Central Bank law widened the net

The bigger shift came with Federal Decree-Law No. 6 of 2025, issued on 15 September 2025 and effective the next day. It repealed the 2018 Central Bank law and, in Article 62, extended the licensing perimeter to anyone who engages in, offers, issues or facilitates a licensed financial activity by any means, explicitly including virtual assets and decentralised finance. Technology providers and protocols that facilitate lending, payments or deposit-like products can fall inside it.

Three provisions matter for crypto firms:

• Promotion is itself licensed. Marketing a licensable activity to people in the UAE requires a licence, and the definition of communication is broad enough to reach online campaigns run from abroad.
• Free zone licences are not a shield for retail. Analysis by Gibson Dunn points out that federal law still applies in financial free zones, so a firm licensed only in DIFC or ADGM that targets UAE retail customers onshore faces federal exposure.
• Penalties are heavy. Carrying on licensed activity without a licence can bring imprisonment and a fine of AED 50,000 to AED 500 million.

Existing institutions were given one year from the effective date to regularise, a window that ran to mid-September 2026 unless the CBUAE extends it, which the law allows. Our view: the law turns the Central Bank into the backstop regulator for anything that looks like money, whoever else has licensed the firm. Expect it to be used sparingly but visibly.

VARA: Dubai's dedicated crypto regulator

The Virtual Assets Regulatory Authority was created by Dubai Law No. 4 of 2022 and runs on the Virtual Assets and Related Activities Regulations 2023 plus activity rulebooks. It licenses seven activities: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, and transfer and settlement. A firm needs authorisation for each one it carries on.

VARA's rulebooks have moved fast. Version 2.0, issued in May 2025, tightened margin trading and token distribution rules, according to a regulatory overview by ATB Legal. An updated Exchange Services Rulebook covering exchange-traded derivatives took effect on 31 March 2026. Enforcement has also become routine: in October 2025 VARA penalised 19 unlicensed firms, with reported fines of AED 100,000 to AED 600,000.

VARA covers mainland Dubai and its free zones except DIFC. A mutual recognition arrangement with the federal securities regulator, in place since September 2024, lets a VARA licence be recognised for serving the wider UAE outside the financial free zones. Its terms are being reset now that the federal regulator itself has changed.

The CMA replaces the SCA

On 1 January 2026 the Securities and Commodities Authority was replaced by the Capital Market Authority under Federal Law No. 32 of 2025, with a companion law on financial products. The CMA then issued Decision No. 4/R.M/2026 on virtual assets, which licenses eight activities: dealing as principal, dealing as agent, providing custody, arranging custody, operating a multilateral trading facility, investment advice, portfolio management and arranging deals. It works alongside VARA rather than replacing it, and does not apply in ADGM or DIFC.

The CMA decision is unusually precise on capital, which makes it useful for budgeting. Dealing as principal or agent requires the greater of AED 4 million or 25% of annual expenses. Custody requires AED 3 million or 35% of expenses. Advisory, arranging and portfolio management start at AED 1 million, and a trading facility at AED 500,000, each subject to the expenses test or risk-based capital if higher.

ADGM and DIFC: approved-token lists

The two financial free zones regulate crypto under their own common-law frameworks and take a list-based approach to stablecoins. Firms authorised by the DFSA in DIFC may only use crypto tokens the regulator has recognised. In February 2025 Circle's USDC and EURC became the first stablecoins recognised in DIFC. In ADGM, the FSRA recognised Ripple's RLUSD as an Accepted Fiat-Referenced Token in November 2025, meaning FSRA-authorised firms can use it for regulated activities.

For institutional business this is the cleaner route: common law, English-language courts, and a regulator that publishes which tokens are acceptable. The catch, as above, is that it does not by itself license a firm to serve retail customers onshore.

A worked example: licensing a Dubai-based crypto broker

Take a hypothetical broker that wants to let UAE residents buy and sell crypto, hold it for them, and pay out to bank accounts. It expects annual operating expenses of AED 20 million.

1. Location choice. Incorporated in a Dubai free zone other than DIFC, it falls under VARA and needs broker-dealer and custody authorisations, plus transfer and settlement if it moves tokens for customers.
2. Serving Abu Dhabi and Sharjah clients. It relies on recognition of its VARA licence for the wider onshore UAE, whose terms are being updated under the CMA.
3. Capital benchmark. If it instead sought a federal CMA licence to deal as principal, it would need the greater of AED 4 million or 25% of AED 20 million, so AED 5 million. Adding custody under CMA rules sets a separate floor of AED 3 million or 35% of expenses, which is AED 7 million at this cost base.
4. Stablecoins. It can let customers use USDT or USDC to buy other virtual assets, provided the issuer is registered with the CBUAE. If it wanted to let customers pay merchants, it would need to use a licensed dirham token.
5. Marketing. Any campaign aimed at UAE residents needs to fit both VARA's marketing rules and the CBUAE law's treatment of promotion as licensed activity.

The capital figures here are regulatory floors, not total cost. Real set-up budgets also include compliance staff, audits, technology and licence fees, so anyone planning an application should get advice from a UAE-qualified regulatory lawyer.

What this means for remittances, and what to watch

The UAE is one of the world's largest sources of remittances, and the dirham-first rule has a direct effect on that business. A money transfer firm that wants to use stablecoins as a settlement leg onshore must either use a licensed dirham token or keep dollar stablecoins strictly within the virtual-asset exception. For a corridor overview see our UAE to India transfer guide and our Gulf to South Asia corridor analysis. For how the UAE fits against Singapore and Hong Kong, see our Asia and Gulf stablecoin rules comparison, and for the licence categories in plain terms, our guide to CASP, VASP and MTL licences.

Three items to watch through 2026 and into 2027:

• Transition under the CBUAE law. The one-year regularisation period from 16 September 2025 has passed its first anniversary. Watch for extensions, the first enforcement under Article 62, and any guidance on DeFi front-ends.
• Full licences for dirham tokens. AE Coin and RAKBANK hold in-principle approvals. Final licences, and whether any large bank-issued dirham coin reaches real merchant volume, will show whether the dirham-first policy can work.
• VARA-CMA recognition terms. A new recognition arrangement between Dubai and the federal regulator will decide how easily a Dubai licence travels to the rest of the country.

This article summarises UAE rules as reported by regulators and law firms as of July 2026, with later updates noted. It is not legal advice; rules and rulebooks change often.

About this researchMuffinPay InsightsIndependent analysis of stablecoins, CBDCs, cross-border payments and digital public infrastructure. Every figure is linked to its source. Read our editorial standards →