Financial Services Permission with Crypto Token Activities Endorsement (Dubai International Financial Centre (DIFC))
The Financial Services Permission with Crypto Token Activities Endorsement from the Dubai Financial Services Authority (DFSA) authorizes crypto exchange, custody, and broker-dealer activities in the DIFC under English common law. Base capital ranges from USD 200,000 (agency/exchange) to USD 1,000,000 (crypto custody), alongside ongoing expenditure reserves (13/52 to 18/52). Initial licensing has no fixed statutory deadline ('without undue delay'), while change of control requires 90 days.
At a glance
| Official name | Financial Services Permission with Crypto Token Activities Endorsement1 |
|---|---|
| Also known as | DIFC crypto licence · DFSA crypto licence · DFSA crypto token licence · DIFC crypto token endorsement · DFSA · FSP |
| Issued by | Dubai Financial Services Authority |
| Jurisdiction | Dubai International Financial Centre (DIFC) |
| Licence family | Virtual asset service provider (non-MiCA) |
| Legal basis | DIFC Law No. 1 of 2004 (Regulatory Law 2004), Part 3 (Articles 42, 45, 48) and Article 642 DFSA Rulebook: Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (AML), Chapter 9.3A3 DFSA Rulebook: General Module (GEN), Chapter 3A (Crypto Token Requirements) and Chapter 7 (Authorised Individuals)4 DFSA Rulebook: Conduct of Business Module (COB), Chapter 14 and Chapter 15 (Crypto Tokens)5 DFSA Rulebook: Prudential Investment, Insurance Intermediation and Banking Module (PIB), Chapters 3.6 and 3.76 |
| Passporting | Domestic only: No passporting rights exist. A Financial Services Permission issued by the DFSA applies strictly within the Dubai International Financial Centre (DIFC) free zone. Providing services to clients in onshore UAE or internationally requires separate domestic authorisations or compliance with applicable cross-border exemptions.2 |
| Minimum capital | US $1,000,000 for Providing Custody of Crypto Assets (Category 3B); US $200,000 for Operating an MTF for Crypto Tokens or Dealing in Investments as Agent (Category 3A); US $500,000 for Managing Crypto Assets or Funds (Category 3C); US $2,000,000 for Dealing as Principal / Market Making (Category 2, reduced to US $500,000 if Matched Principal only); and US $30,000 for Advising or Arranging (Category 4)7 |
| Application fee | USD 15,000 to USD 150,000 depending on activity8 |
| Annual fee | USD 20,000 to USD 70,000+ depending on activity8 |
| Statutory decision time | No statutory decision period: the Regulatory Law (Art. 48) only requires the DFSA to notify the applicant of its decision without undue delay2 |
| Public register | official register9 |
What it lets you do
| Virtual asset exchange (FATF) | Exchanging virtual assets for fiat currency or for other virtual assets as a business, as defined in the FATF glossary. |
|---|---|
| Virtual asset transfer (FATF) | Conducting transactions that move virtual assets between addresses or accounts on behalf of another person. |
| Virtual asset safekeeping (FATF) | Safekeeping or administering virtual assets, or instruments enabling control over them, for another person. |
Where it is valid
Requirements
| Requirement | What is needed | Legal reference |
|---|---|---|
| Capital and people assessed | ||
| Minimum capital | US $1,000,000 for Providing Custody of Crypto Assets (Category 3B); US $200,000 for Operating an MTF for Crypto Tokens or Dealing in Investments as Agent (Category 3A); US $500,000 for Managing Crypto Assets or Funds (Category 3C); US $2,000,000 for Dealing as Principal / Market Making (Category 2, reduced to US $500,000 if Matched Principal only); and US $30,000 for Advising or Arranging (Category 4)7 | |
| Ongoing own funds | Authorised Firms must calculate an Expenditure Based Capital Minimum (EBCM) by multiplying Annual Audited Expenditure by 13/52 (25%, or 13 weeks of operational expenditure), increasing to 18/52 (approx. 34.6%, or 18 weeks of expenditure) if the firm holds Client Assets. The firm must maintain capital resources equal to or exceeding the higher of its Base Capital Requirement, its EBCM, and any applicable Risk Capital Requirement under PIB 3.8.10 | PIB Rule 3.7.1 and 3.7.2 PIB 3.8 |
| Who is assessed | The DFSA assesses all Authorised Individuals holding Licensed Functions (Senior Executive Officer, Licensed Directors/Partners, Compliance Officer, Money Laundering Reporting Officer, and Finance Officer) under GEN Section 7.6 and GEN App7 against fitness and propriety criteria covering integrity, competence and capability, and financial soundness. In addition, all natural and legal persons becoming or acting as Controllers (holding 10% or more of shares or voting rights, or exercising significant influence over management) must pass DFSA fit-and-proper scrutiny and obtain prior regulatory approval under Regulatory Law 2004 Article 64 and GEN Section 11.8.11 | Section 7.6 Law 2004 Article 64 Section 11.8 |
| Substance and people | ||
| Local presence | The Authorised Firm must establish a physical presence in the DIFC, either incorporated as a DIFC legal entity (such as a company limited by shares) or registered as a branch of a foreign company, with an operational place of business in the Centre.2 | |
| AML/CFT | Finance Officer, Compliance Officer and Money Laundering Reporting Officer) with Authorised Individuals, and the SEO, Compliance Officer and MLRO must be resident in the UAE. GEN Rule 7.5.1A lets one person hold both the Compliance Officer and MLRO functions.12 | GEN Rules 7.5.1 and 7.5.2 GEN Rule 7.5.1A |
| Client assets | Firms operating an MTF, holding client crypto tokens, or carrying on crypto financial services must appoint an independent third party to carry out an annual technology audit of Chapter 15 compliance and submit the report to the DFSA within 4 months of financial year-end.13 | COB Rule 15.8.1 |
| Client assets | Digital wallet service providers must ensure clear identification and segregation of client crypto tokens, maintain resilient and secure DLT applications, safeguard cryptographic keys via password protection and encryption, and conduct regular reconciliations.14 | COB 15.4.2 COB 14.3.3 |
| Requirement | Any DLT application used to provide crypto token services must operate based on permissioned access, ensuring the firm maintains adequate control over persons permitted to access and update ledger records.15 | COB Rule 15.7.2 |
| Travel rule | Firms transmitting or receiving crypto tokens must implement systems complying with the FATF Travel Rule, including verifying originator and beneficiary identities, screening transactions, and managing missing transfer details.16 | AML Rule 9.3A.1 and 9.3A.2 |
| Conditions to keep the licence | ||
| Withdrawal | The DFSA may withdraw an authorisation or Licence Endorsement on its own initiative if the Authorised Person fails for a period of at least 12 consecutive months to carry on the relevant financial service or crypto activity.17 | Law 2004 Article 50(3)(d) |
| Requirement | Authorised Persons are strictly prohibited from providing financial services, promotions, or public offerings relating to Privacy Tokens, Privacy Devices, or Algorithmic Tokens in or from the DIFC.18 | GEN 3A.2.2 GEN 3A.2.3 |
| ICT and DORA | Firms must conduct and document a comprehensive suitability assessment before offering services in respect of any crypto token, evaluating regulatory status, blockchain technology, market liquidity, and cybersecurity resilience.19 | GEN 3A.2.1 |
| Audit | Authorised Firms must continuously maintain Common Equity Tier 1 capital above their Base Capital Requirement (PIB 3.6.3) and Expenditure Based Capital Minimum (PIB 3.7.2), submitting regular prudential returns and annual audited financial statements to the DFSA under GEN 8.3 and PIB 2.3.20 | PIB 3.6.3) PIB 3.7.2) GEN 8.3 |
Cost
Buying a company that already holds it
A Financial Services Permission is personal to the Authorised Firm and cannot be assigned, transferred, or pledged to another entity (Regulatory Law 2004, Art. 48). Acquiring an existing regulated crypto business in the DIFC must be executed via an acquisition of shares or corporate control in the licensed legal entity, which triggers the mandatory prior approval requirement for a change of controller under Regulatory Law 2004 Article 64 and GEN Section 11.8.2
Prior approval required. Under Regulatory Law 2004 Article 64 and DFSA Rulebook General Module (GEN) Section 11.8, prior written approval from the DFSA is required before any person becomes a Controller, or increases their holding across 30% or 50% thresholds. A Controller is defined as someone holding 10% or more of shares or voting rights, or exercising significant influence over management. Under GEN 11.8.6, the DFSA must determine an application for approval of a change of control within 90 days of receipt of a duly completed application.4
Ready-made companies holding this licence: see verified positions.
VASP in other countries
| Country | Licence | Regulator | Min. capital | Application fee | Statutory time |
|---|---|---|---|---|---|
| Abu Dhabi Global Market (ADGM) | VASP licenceFinancial Services Permission with Virtual Asset Activities Endorsement | FSRA | USD 250,000 | USD 20,000 | n/a |
| Australia | VASP licenceRegistration as a virtual asset service provider (VASP) on the AUSTRAC Virtual Asset Service Provider Register (formerly the Digital Currency Exchange Register) | AUSTRAC | n/a | n/a | n/a |
| Bermuda | Digital Asset Business Class F (Full) Licence | BMA | n/a | n/a | n/a |
| Bermuda | Digital Asset Business Class M (Modified) Licence | BMA | n/a | n/a | n/a |
| Bermuda | Digital Asset Business Class T (Test) Licence | BMA | n/a | n/a | n/a |
| British Virgin Islands | Virtual Assets Service Provider Registration | BVI FSC | n/a | n/a | n/a |
| Cayman Islands | Virtual Asset Service Provider Licence | CIMA | n/a | KYD 5,000 | n/a |
| Cayman Islands | Virtual Asset Service Provider Registration | CIMA | n/a | KYD 1,000 | n/a |
| Dubai (VARA) | Virtual Asset Advisory Services Licence | VARA | AED 100,000 | AED 40,000 | n/a |
| Dubai (VARA) | Virtual Asset Broker-Dealer Services Licence | VARA | AED 600,000 | AED 100,000 | n/a |
| Dubai (VARA) | Virtual Asset Custody Services Licence | VARA | AED 600,000 | AED 100,000 | n/a |
| Dubai (VARA) | Virtual Asset Exchange Services Licence | VARA | AED 1,500,000 | AED 100,000 | n/a |
| Dubai (VARA) | Virtual Asset Lending and Borrowing Services Licence | VARA | AED 500,000 | AED 100,000 | n/a |
| Dubai (VARA) | Virtual Asset Management and Investment Services Licence | VARA | AED 500,000 | AED 100,000 | n/a |
| Dubai (VARA) | Virtual Asset Transfer and Settlement Services Licence | VARA | AED 500,000 | AED 40,000 | n/a |
| Dubai International Financial Centre (DIFC) | Financial Services Permission with Crypto Token Activities Endorsement | DFSA | USD 1,000,000 | USD 15,000 | n/a |
| El Salvador | Proveedor de Servicios de Activos Digitales (PSAD) registration | CNAD | USD 2,000 | USD 5,475 | ~0.9 mo |
| Germany | Qualified crypto custody licence | BaFin | n/a | n/a | n/a |
| Ireland | Virtual Asset Service Provider AML/CFT Registration | CBI | n/a | n/a | n/a |
| Mauritius | Virtual Asset Advisory Services (Class I) | FSC | n/a | n/a | n/a |
| Mauritius | Virtual Asset Broker-Dealer (Class M) | FSC | n/a | MUR 2,000,000 | n/a |
| Mauritius | Virtual Asset Wallet Services (Class O) | FSC | n/a | n/a | n/a |
| Mauritius | Virtual Asset Custodian (Class R) | FSC | n/a | MUR 5,000,000 | n/a |
| Mauritius | Virtual Asset Market Place (Class S) | FSC | n/a | MUR 6,500,000 | n/a |
| Seychelles | Virtual Asset Service Provider Licence / RegistrationVirtual Asset Service Provider Licence / Registration (Wallet Provider, Exchange, Broking, Investment Provider) under the Virtual Asset Service Providers Act 2024 | FSA | n/a | SCR 75,000 | n/a |
| South Africa | Crypto Asset Service Provider licenceCrypto Asset Service Provider licence (an FSP authorisation category under FAIS, not a MiCA-equivalent regime) | FSCA | n/a | n/a | n/a |
| Switzerland | Financial intermediary / VASP SRO affiliation | FINMA | CHF 10,000,000 | CHF 1,600 | n/a |
| United Kingdom | Cryptoasset Business Registration (MLRs 2017) | FCA | n/a | GBP 11,260 | ~3 mo |
Values come from each licence's page, where every figure has its source.
Laws behind it
- Regulatory Law 2004: DIFC Law No. 1 of 2004
Getting this licence
Protegra handles this licence end to end: crypto licensing in DIFC: process, timeline and our fee.
Frequently asked questions
What is the regulatory framework for crypto tokens in DIFC?
The DFSA regulates crypto tokens under the Regulatory Law 2004, the Conduct of Business (COB) Module Chapter 15, and the General Module (GEN) Chapter 3A. In January 2026, the DFSA overhauled the framework by removing the token whitelist and introducing a firm-led token suitability assessment model alongside strict investor protection and disclosure rules.
What are the minimum capital requirements for a DFSA crypto licence?
Capital requirements depend on the underlying prudential category under PIB Module Rule 3.6.2. Operating a crypto custody service (Category 3B) requires US $1,000,000 in base capital. Crypto brokerage or MTF trading (Category 3A) requires US $200,000, asset management (Category 3C) requires US $500,000, and market making (Category 2) requires US $2,000,000.
Does a DFSA crypto licence allow passporting across the UAE?
No. DFSA licences and endorsements do not offer passporting rights. The permission is legally restricted to operations conducted in or from the DIFC financial free zone. Providing crypto services to onshore UAE clients requires a separate license from the federal SCA or Dubai's VARA, unless operating under reverse solicitation exemptions.
What key personnel and substance are required in Dubai?
Firms must incorporate a legal entity or register a branch in the DIFC with physical premises. Under GEN Rule 7.5, the firm must appoint Authorised Individuals including a Senior Executive Officer, Compliance Officer, and Money Laundering Reporting Officer who must reside in the UAE, alongside an annual independent third-party technology audit.
Are privacy coins and algorithmic stablecoins permitted in DIFC?
No. Under DFSA General Module Rules 3A.2.2 and 3A.2.3, regulated entities are strictly prohibited from providing financial services, promotions, or public offerings relating to Privacy Tokens, Privacy Devices (mixers/tumblers), or Algorithmic Tokens in or from the DIFC due to heightened illicit finance and stability risks.
Sources
- DFSA Rulebook: 12 january 2026 dfsa implements major updates crypto token r · retrieved 2026-09-24
- DFSA Rulebook: regulatory law 1 · retrieved 2026-09-24
- DFSA Rulebook: anti money laundering counter terrorist financing and sancti · retrieved 2026-09-24
- DFSA Rulebook: general module gen ver7207 26 · retrieved 2026-09-24
- DFSA Rulebook: conduct business module cob ver5107 26 · retrieved 2026-09-24
- DFSA Rulebook: prudential investment insurance intermediation and banking m · retrieved 2026-09-24
- DFSA Rulebook: pib 362 · retrieved 2026-09-24
- DFSA Rulebook: DFSA1547 10726 VER350426 (PDF) · secondary · retrieved 2026-09-29
- dfsa.ae: firms · retrieved 2026-09-24
- DFSA Rulebook: pib 372 · retrieved 2026-09-24
- DFSA Rulebook: gen a711 · retrieved 2026-09-24
- DFSA Rulebook: DFSA1547 1843 VER720726 (PDF) · retrieved 2026-09-29
- DFSA Rulebook: cob 1581 · retrieved 2026-09-24
- DFSA Rulebook: cob 1433 · retrieved 2026-09-24
- DFSA Rulebook: cob 1572 · retrieved 2026-09-24
- DFSA Rulebook: aml 93a2 · retrieved 2026-09-24
- DFSA Rulebook: 50 withdrawing authorisation under or endorsement licence · retrieved 2026-09-24
- DFSA Rulebook: gen 3a22 · retrieved 2026-09-24
- DFSA Rulebook: gen 3a21 · retrieved 2026-09-24
- DFSA Rulebook: pib 363 · retrieved 2026-09-24
Want the VASP licence in Dubai International Financial Centre (DIFC)?
Tell us your business model and target markets. We check the fit before you spend on an application, then handle the licence end to end.
A free preliminary assessment: we check your business model against the licence before you spend on an application. We handle this licence and any other fintech licence, including jurisdictions the Atlas does not cover yet.