UAE VIRTUAL ASSETS LAW AND PRACTICE 2026

• The CMA is the federal authority for virtual assets. It succeeded the SCA on 1 January 2026 under Federal Decree-Laws Nos 32 and 33 of 2025, assuming all rights, obligations and contracts of its predecessor.
• Not every activity crosses the perimeter. The trigger is conduct of a regulated activity in or from the jurisdiction, assessed on substance over form. Proprietary trading, software development and certain exempt token issuances sit outside it. The test is what is done for other persons, not whether virtual assets are involved.
• VARA licenses in Dubai under delegated federal authority, pursuant to Cabinet Decision No. 111 of 2022.
• CMA Decision No 4/R.M/2026, issued 13 February 2026, is a standalone VASP rulebook licensing eight activities across three modules. It supersedes Decision No 26/R.M/2023 in full.
• Penalties differ by regulator. Under the federal capital markets regime, unauthorised activity carries fines of up to AED 250 million and imprisonment of not less than one year. Exposure under the Central Bank regime reaches AED 1 billion. Owners, directors and managers face personal criminal liability in either case, and enforcement reaches any person targeting clients in the UAE from anywhere in the world, expressly including from a financial free zone.
• Federal Decree-Law No 6 of 2025 extended CBUAE oversight to virtual asset payment services and DeFi-related activity. In-scope operators must comply or cease by September 2026.
• Direct-ownership ARVAs do not require Reserve Assets. VARA’s Guidance of 9 April 2026 confines the reserve regime to stable-value ARVAs holding a peg.
• Mutual recognition operates between the CMA and VARA. Agreed August 2025, it provides for recognition of VASP licences issued by either authority, compliance monitoring and enforcement coordination.

The CMA is the legal successor to the SCA and assumed its rights, obligations and contracts entire. Federal Law No 4 of 2000 was repealed. For practitioners the substantive changes are four.

Market abuse is now codified. Article 37 of the Capital Markets Law prohibits trading with intent to deceive, market manipulation and insider dealing at federal statutory level for the first time, capturing indirect dealing by any person holding inside information, and reaching false statements and rumours capable of moving prices. Virtual assets sit inside the capital markets perimeter rather than beside it. The framework also codifies prospectus liability and establishes an Investor Protection Fund and a Settlement Guarantee Fund.

Penalties rose sharply and reach offshore. Under the federal capital markets regime, unauthorised activity carries fines of up to AED 250 million and imprisonment of not less than one year, under Article 71 of Federal Decree-Law No 33 of 2025. Exposure under the Central Bank regime is an order of magnitude higher, reaching AED 1 billion. Liability is not confined to the company in either case: owners, directors and managers face personal criminal liability. Administrative sanctions were expanded and criminal referral powers strengthened. The law applies to any person targeting clients within the UAE, expressly including persons operating from outside the country and persons operating from a financial free zone. That second limb matters more than it first appears: an ADGM or DIFC entity marketing onshore is within federal reach, not insulated by its free zone authorisation.

Five separate regimes, five rulebooks, five application processes, and the territorial reach of each is not the same.

The CMA’s two roles have different territorial reach, and conflating them is a common structuring error. VASP activity is federal minus Dubai, because Dubai is delegated to VARA. Tokenized securities and tokenized commodity contracts are federal across the whole UAE, Dubai included, because that scope attaches to what the instrument is rather than where it sits. A VARA-licensed platform listing a tokenized security is therefore in front of two regulators at once.

The trigger is conduct of a regulated activity in or from the jurisdiction, assessed on substance over form, not incorporation. A firm serving UAE or Dubai residents is expected to hold the relevant licence regardless of where it is incorporated or where its infrastructure sits.

Route detail sits on the VASP licence UAE hub, VARA licence Dubai , ADGM crypto licence and CMA federal crypto licence UAE . Current licensees across all five regimes are recorded in the UAE VASP Licence Tracker .

Both federal and Dubai regimes operate tiered classification, and the thresholds differ. Default is retail unless the client meets a higher category.

VARA operates the only developed token issuance regime in the UAE. Category 1, covering fiat-referenced and asset-referenced virtual assets, requires the issuer to hold a licence. Category 2, covering all other non-exempt virtual assets, does not require the issuer to be licensed but permits offering to persons in the UAE only through a VARA-licensed distributor. Exempt VAs may be issued without registration or approval.

Category 1 and Category 2 issuers must publish a White Paper before issuance. It must be machine-readable and kept current, records retained for eight years after the asset ceases to circulate, and a Risk Disclosure Statement must accompany the offering. No marketing material may be published before the White Paper is available.

What the 9 April 2026 Guidance Changed

The Guidance interprets rather than amends the Rulebook, but carries real weight in licensing review. Three points matter commercially.

• Direct-ownership ARVAs need no Reserve Assets. Where ownership of the underlying asset transfers with the token, the reserve regime does not apply. It is confined to stable-value ARVAs maintaining a peg or fixed price against a reference asset. For tokenized real estate, commodities and art structured on direct ownership, this removes an entire compliance workstream.
• A mandatory five-part legal opinion framework applies to ARVA issuers, covering authorship and qualification, independence and objectivity, scope, assumptions and limitations, and ongoing validity. The opinion must be updated whenever the token structure or applicable law changes materially.
• Tokenized real-world assets qualifying as financial instruments may also fall inside the CMA perimeter. This is VARA’s first explicit acknowledgement of dual regulation for tokenized securities, sukuk and fund units, and it changes how those structures must be planned.

The Guidance also refines risk disclosure and white paper accessibility requirements, governance disclosure for Category 1 issuers, and confirms that broker-dealer licence holders may issue Category 2 tokens without a separate issuance licence.

The CMA addresses tokenization separately through Resolution No 15/Chairman of 2025, covering Security Tokens and Commodity Contract Tokens, defined as securities or commodity contracts whose rights are registered and transferable via distributed ledger. That framework excludes assets inside the VASP perimeter and does not extend to broader RWA tokenization unless the token represents a security or commodity contract. See UAE token launch and UAE RWA tokenization .

The UAE segments stablecoin regulation by reference currency and place of issuance. The reserve rules differ materially between the three, and the differences are commercially decisive.

The FSRA divergence on yield is the single most consequential difference between the three regimes for anyone modelling a stablecoin business. ADGM permits income from reserve assets to be distributed; the CBUAE and VARA prohibit it outright. The FSRA offsets this by prohibiting promotion of an FRT as an investment or savings product, which is intended to stop issuers competing on yield by taking reserve risk.

The DFSA operates no issuance regime but approves Fiat Crypto Tokens for use by DFSA-licensed firms, recognising EURC, USDC and RLUSD as at January 2026. VASPs already licensed by the CMA or VARA for stablecoin custody, transfer or conversion must apply for a Non-Objection Registration with the CBUAE to continue those services.

Algorithmic stablecoins are prohibited across every UAE framework, as are privacy tokens. The DFSA separately banned privacy tokens on DIFC exchanges from January 2026.

VARA’s Marketing Regulations 2024 have applied across the onshore UAE since 1 October 2024 and reach any marketing or promotional activity relating to virtual assets, by UAE or foreign entities, regardless of licensing status. Only licensed VASPs or their authorised representatives may promote regulated activities.

The perimeter is drawn by targeting rather than establishment. AED pricing, UAE-based influencers and localised content are the facts that establish promotion to UAE residents. Marketing is defined broadly across social media, digital advertising, public events, influencer promotion and traditional media. Content must carry clear and prominent risk disclaimers and avoid language such as guaranteed returns or limited-time urgency. Influencers must disclose paid partnerships, and performance claims must be balanced and factual. Records of marketing content and audience data must be kept for at least eight years. Promotion of privacy tokens is prohibited outright.

Firms licensed in ADGM or the DIFC are subject to their own financial promotion and conduct rules, and remain subject to VARA’s Marketing Regulations where their marketing is directed at onshore residents. Additional restrictions apply under the CBUAE’s PTSR to promotion of payment token services and of foreign payment tokens to UAE persons. See UAE crypto marketing compliance .

VARA has been the most active enforcement body. In one of its largest single actions it penalised nineteen entities simultaneously, imposing fines alongside cease-and-desist orders. In March 2026 it issued a public market alert directing several entities operating under a major international exchange brand to cease all virtual asset activity in Dubai; none held a licence from VARA, the FSRA or the DFSA.

The reach extends expressly to overseas firms targeting Dubai audiences. VARA has sanctioned foreign firms for unlicensed marketing directed at Dubai users, including a Singapore-based payment technology provider and an offshore exchange operator.

The federal Penal Code, Federal Decree-Law No 31 of 2021, and the AML and CFT legislation provide a further baseline of fraud and breach of trust offences applying to virtual asset activity by extension.

Part VII of VARA’s Company Rulebook imposes specific obligations that most licensees underestimate at application stage. Every VASP must maintain a Wind Down Plan covering risk identification and mitigation, safekeeping and return of client virtual assets, personnel arrangements, communications, knowledge transfer and record retention.

A VASP electing to discontinue must notify VARA within one business day of the decision, implement the plan subject to VARA’s directions, and report weekly throughout. Client money and client virtual assets are expressly excluded from the wind-down asset pool and cannot be applied to the VASP’s liabilities.

At federal level the CMA framework contains no virtual-asset-specific insolvency provisions; the general recovery and resolution regime applies to all Licensed Persons, including recovery plans for systemically important entities, an early intervention framework, and resolution powers covering appointment of a resolution administrator, transfer of assets and liabilities, write-off of debt obligations and orderly wind-down under a statutory hierarchy of claims.

In the DIFC, the Digital Assets Law No 2 of 2024 amended the DIFC Insolvency Law to address digital assets directly, including debts denominated in digital assets, asset control where control is impaired, and the exercise of rights on death, incapacity or insolvency. ADGM applies its general insolvency framework with no digital-asset-specific provisions.

Three points, each of which turns on jurisdiction rather than on the asset.

Property. Onshore there is no federal definition of digital asset ownership and no settled case law; VARA has clarified that virtual assets may be objects or rights under the Civil Transactions Law, Federal Law No 5 of 1985, assessed case by case. The DIFC is the outlier: under Digital Assets Law No 2 of 2024, effective 8 March 2024, title passes on control coupled with intention to exercise it, and the same law supports digital assets as collateral in secured transactions. ADGM does not specifically address ownership, so collateral arrangements there are assessed case by case.

DAOs. Two regimes confer legal personality: the DAO Associations Regime introduced by Innovation City, formerly RAK DAO, in 2024, and ADGM’s DLT Foundations Regulations 2023, under which a foundation is governed by a council of two to sixteen councillors with a minimum initial asset value of USD 50,000 payable in fiat only. Neither confers regulatory authorisation; licensing requirements apply independently. See offshore Web3 DeFi structuring .

DeFi. No general prohibition, and CeFi firms may use DeFi protocols while meeting their AML, conduct and client asset obligations. The exception is payments: Federal Decree-Law No 6 of 2025 extended the CBUAE’s remit to payment activity conducted through decentralised mechanisms, and in-scope operators must comply or cease by September 2026. Liability in a DeFi context remains untested, with no UAE judicial decision or regulatory action on the point.

The headline position is straightforward and widely known. What follows is not.

• The VAT exemption is split by date. Cabinet Decision No 100 of 2024 exempts transfer, conversion, and custody and management of virtual assets. Transfer and conversion apply retroactively from 1 January 2018. Custody and management apply from 15 November 2024 only. Treating the whole exemption as retroactive is a common and material error.
• Mining is not exempt. FTA guidance VATP039 of January 2025 confirms cryptocurrency mining falls outside the exemption and remains subject to VAT.
• CARF obligations are coming. The UAE signed the Multilateral Competent Authority Agreement on the OECD Crypto-Asset Reporting Framework on 21 July 2025, committing to automatic exchange by 2028 in respect of the 2027 reporting year. Domestic implementation went to public consultation in September 2025 and the precise scope of obligations on crypto-asset service providers remains open.
• Small Business Relief runs to 2029. A resident business with revenue of AED 3,000,000 or less in the current and every previous tax period may elect to be treated as having no taxable income. The relief was due to end in 2026 and has been extended to 2029. The election must be made, and free zone entities claiming qualifying income cannot use it.
• Corporate tax treatment of digital assets is still developing. The FTA has issued a series of clarifications addressing asset managers and investment funds, and uncertainty persists for specific business models.

See crypto tax UAE .

The UAE chapter appears in two parts. Law and Practice sets out the framework in the structure Chambers applies to every jurisdiction in the guide, which is what makes it usable for cross-border comparison. Trends and Developments covers what moved in the year and where the framework is going, and it is the half that dates fastest.

The 2026 Trends and Developments section covers:

• The federal reset in practice. What the CMA succeeding the SCA has meant operationally, the twelve-month migration under way, and the areas where the CMA, VARA and CBUAE perimeters still need watching.
• VARA at scale. 71 authorisations granted as at 1 May 2026, and a licensee base that has shifted from exchanges toward RWA tokenization platforms and institutional custodians.
• Dubai Land Department tokenization, from pilot to market. The title deed now records ownership as Tokenholder against a TokenID linked to a digital wallet, the first government-recognised on-chain title structure of its kind. Phase 2 activated a regulated 24/7 secondary market on 20 February 2026, with the DLD projecting tokenized assets at up to 7 percent of Dubai real estate by 2033.
• The stablecoin build-out. AE Coin, Zand AED, RAKBANK and the IHC-led DDSC on the AED side, USDU registered as the first foreign payment token in January 2026, Paxos Issuance MENA and Universal Digital licensed under the ADGM FRT framework, and the Digital Dirham granted equal legal status to physical cash by federal law in November 2025.
• Sovereign Bitcoin. Industrial-scale mining in Abu Dhabi alongside disclosed sovereign allocation into spot Bitcoin ETFs, a combination of energy infrastructure and balance sheet exposure that few states have assembled.
• ADGM DLT Foundations in the wild. IOTA, Stacks Asia, TON and Avalanche have all registered, making the regime the most used DAO framework in the region rather than a theoretical one.
• Dispute resolution. ADGM as an opt-in jurisdiction requiring no physical presence, applying English common law directly, with judgments recorded and executed on-chain.