UAE digital asset licensing depends on the asset, the service and where the business operates. Before choosing between VARA, ADGM, DIFC or a federal route, establish what the business will do, whose assets it will handle and where it will serve clients.
A company providing software, a platform executing client orders and a business issuing a payment token can need different permissions. Describing all three as a crypto business does not identify the applicable rules.
This guide explains how to assess the route before incorporating, compare the relevant frameworks and plan the company, people and funding around the proposed activities.
Start with the business model
Write down how the product works before selecting a location. Five questions help establish the facts needed for a regulatory assessment.
What asset will the business use
Identify the rights the asset represents. It could be a virtual asset, a token representing shares or another investment, or a token intended for payments. A token’s marketing name does not determine its legal classification.
For a tokenised property project, for example, establish what the holder owns or can claim. A right to shares, income or redemption needs analysis before deciding which issuance or financial services rules apply.
What service will the company provide
Separate issuance, advice, arranging transactions, dealing, operating a trading venue, custody, management and payment services. One product can involve several functions, with different entities or permissions needed for each.
Whose assets will it handle
Distinguish the company’s own portfolio from assets held, controlled or managed for clients. Explain who controls wallets and keys, who can move assets and where client money enters the process.
Where will it operate and serve clients
Map the company’s location, staff, operations, marketing and intended clients. An incorporation address alone does not settle every licensing or distribution question. An overseas or financial free zone permission should not be assumed to authorise every activity elsewhere in the UAE.
Who are the clients
Define whether the service will be offered to retail clients, professional investors, institutions or a combination. Check each framework’s definitions and restrictions separately. Investor classifications and qualification tests are not interchangeable between regulators.
The five authorities at a glance
The authorities below are relevant to different aspects of digital asset activity. This is an initial map; the proposed service and asset determine the assessment.
ADGM and DIFC are financial free zones. ADGM is a defined jurisdiction within Abu Dhabi, rather than the regulator for the whole emirate. Commercial free zones such as DMCC and DWTC should not be treated as equivalent to financial free zones.
VARA for virtual asset activities in Dubai
The Virtual Assets Regulatory Authority regulates virtual asset activities across Dubai mainland and its free zones, excluding DIFC. A trade licence alone does not permit regulated virtual asset services.
Its framework covers advisory, broker-dealer, exchange, custody, lending and borrowing, management and investment, transfer and settlement, and Category 1 issuance. The business must assess each function it intends to provide.
VARA introduced staking-from-custody rules in August 2023, allowing licensed custodians to seek additional approval under the relevant conditions. A staking proposal needs to be assessed against the permitted model and the conditions attached to that approval.
For Dubai operations, assess the activity scope, any separation of entities, capital and liquidity, key people and the systems needed to operate. Proprietary trading and some technology models follow different routes from client services.
See VARA Licence in Dubai: Activities, Costs, and How to Apply for the detailed application and funding guide.
Official sources: VARA licensed activities and staking-from-custody announcement.
ADGM FSRA for activity in or from ADGM
The Financial Services Regulatory Authority regulates financial services in Abu Dhabi Global Market. Its virtual asset framework addresses activities such as operating trading facilities, dealing, custody, arranging, advising and managing, subject to the relevant permissions.
ADGM also has a framework for issuing Fiat-Referenced Tokens. Issuing a token and using it in another regulated service are separate questions, so assess the complete product and intended distribution.
The FSRA finalised its staking framework on 29 April 2026. The rules address which authorised firms may stake client assets and the conditions that apply, including disclosures and rewards. A staking proposal should be reviewed against those requirements alongside any other activities the firm will conduct.
An ADGM proposal should identify the intended regulated activities, clients, assets and counterparties. Existing institutional relationships can help determine the operating location, alongside the legal and regulatory requirements.
Official sources: FSRA virtual asset guidance, Fiat-Referenced Token issuance framework and April 2026 staking framework.
DIFC DFSA for financial services involving tokens
The Dubai Financial Services Authority regulates financial services in or from DIFC. Its Crypto Token framework works within the wider financial services regime.
Both new applicants and existing authorised firms can seek the relevant permissions. A firm already regulated by the DFSA may need a variation of permission. A new business must go through the applicable authorisation process. DIFC should not be ruled out simply because a firm is new or focuses on digital assets.
The rules effective from 12 January 2026 distinguish general Crypto Token suitability from the treatment of Fiat Crypto Tokens. For general Crypto Tokens, firms must make and document suitability assessments. The separate Fiat Crypto Token policy lists EURC, USDC and RLUSD as suitable, without removing firms’ wider obligations.
Assess whether the proposed services, token types and client base fit the framework. A token being suitable for use does not itself authorise a firm to provide services involving it or to issue it.
Official sources: DFSA Crypto Token framework and authorisation guidance and Policy Statement on Fiat Crypto Tokens.
CMA and the federal virtual asset framework
The Capital Market Authority is relevant to the federal licensing assessment. Its 2026 Virtual Assets Framework covers activities including dealing as principal or agent, providing or arranging custody, arranging investments, advice, portfolio management and operating a multilateral trading facility. These categories should not be treated as identical to VARA’s.
For a proposed business outside DIFC and ADGM, establish how the federal framework applies and whether supervision by a local authority affects the licensing or registration route. For tokenised instruments, classify the rights represented before choosing a virtual asset or capital market route.
Wider UAE distribution does not, on its own, establish that a VARA licensee needs a second full licence. The September 2024 SCA–VARA cooperation announcement described default federal registration for VARA licensees serving the wider UAE. Confirm how the current CMA framework and coordination mechanism apply to the proposed activities and operating locations.
Official sources: CMA Resolution 04 of 2026 and SCA–VARA coordination announcement.
CBUAE for payment tokens and financial functions
Payment tokens need a separate assessment. The CBUAE Payment Token Services Regulation addresses issuance, conversion, custody and transfer, with licensing or registration requirements depending on the service and token.
The Central Bank’s guidance on Federal Decree-Law No. 6 of 2025 explains that its licensing assessment follows the underlying financial activity. Using decentralised technology does not remove a regulated financial function from supervision. Equally, purely technical providers are not automatically brought within licensing merely because they supply software or infrastructure.
Financial free zones have a distinct treatment under the law. Assess where the service is provided and how it reaches customers outside the financial free zone when reviewing the applicable requirements.
For a payment product, explain who issues the token, converts funds, operates wallets, transfers value and provides services to customers. Assess those functions and distribution before deciding which permissions are needed alongside any other licence.
Official sources: CBUAE Payment Token Services Regulation and Central Bank guidance on the 2025 law.
Compare the cost of the same business model
A useful cost comparison starts with a defined activity and operating plan. An advisory firm, a trading venue and a custodian should not be compared using one headline licence price.
For each relevant route, separate:
- Application, authorisation and recurring supervision fees.
- Capital that must be maintained and ongoing liquidity requirements.
- Company establishment, premises and employment costs.
- Governance, compliance, technology, insurance and audit.
- Professional support and funding during preparation and review.
A capital requirement is not an application fee or an operating expense. Assess how the required funds must be held and how much remains available to run the business.
Compare the same services, client types, staffing assumptions and launch scope across routes. Record which figures come from published rules, which are supplier quotes and which remain planning assumptions. Compare preparation and review milestones on the same assumptions, allowing for changes requested by the regulator.
How different business models change the assessment
The examples below are illustrative. They show what needs to be assessed rather than prescribe a final licensing outcome.
A brokerage planning to operate from Dubai
The initial VARA assessment should identify how the brokerage arranges or executes transactions and whether it holds or controls client assets. Wider UAE marketing and distribution require their own review. Holding client assets can change the permissions, company structure and funding needed.
A manager considering DIFC or ADGM
Compare the relevant management permissions, fund structure, proposed assets, client classifications and custody model in each jurisdiction. The decision should reflect the intended business and counterparties. An existing regulated entity may need permission changes; a new entity needs the relevant authorisation.
A stablecoin or payment platform
Separate token issuance from conversion, wallet custody, transfers and customer payments. Identify which entity performs each function and where. A suitable or accepted token does not automatically authorise the platform’s services. The complete flow of money and tokens should be assessed before incorporation.
A blockchain software provider
Describe what the provider supplies and whether it controls assets, executes transactions or performs a financial service. Pure software provision and operation of a customer payment service are different models, even when they use similar technology.
Put the company and application in the right sequence
Begin with a written description of the asset, services, clients and money flows. Assess the regulatory route against those facts, then design the entity, ownership and governance to support the application.
Before filing, establish the key people, funding and systems required. Keep the business plan, financial forecast, company records and banking file consistent. Where a group divides functions between entities, document which company contracts with clients, holds assets and carries each responsibility.
This sequence also helps define what specialist input is needed and which decisions the founders must make. Changes to custody, client types or payment functions should trigger a review of the proposed scope before launch.
How GCG supports the decision
GCG works with digital asset businesses to assess the regulatory route and the company structure needed to support it. We begin with the proposed activities, clients, assets and operating locations, then define the work and responsibilities within the agreed scope.
For a Dubai VARA project, GCG handles company establishment and application support as one engagement. The scope identifies the materials GCG prepares, the information the business must provide and any specialist input required. GCG’s professional fees are separate from regulator and third-party charges.
GCG does not manage client money. Tell us what you are building, whether a company already exists and which decision you need to make next.
