VIRTUAL ASSET LICENCE · UAE (FEDERAL)

UAE Crypto Licensing:
Five Regulators, One Market

A UAE crypto licence is not a single product. A Dubai exchange, an Abu Dhabi custodian, a DIFC investment platform, an onshore broker, and a dirham stablecoin issuer may face different regulators, capital requirements, token rules, and operating restrictions.

That is what makes the UAE attractive—and difficult. The country combines Dubai’s virtual-asset market, Abu Dhabi’s institutional financial centre, two common-law financial free zones, federal capital-markets supervision, and a separate payments regime. Choosing the wrong jurisdiction can mean building the wrong governance model, applying to the wrong regulator, or discovering that your token or customer base creates an additional federal obligation.

Protegra maps your activity across VARA, CMA (formerly SCA), DFSA, FSRA, and CBUAE, selects the structure that fits your business, and takes you from entity formation and regulatory classification through licensing, banking readiness, and live operations.

Why teams choose Protegra

Built for Crypto — Not Adapted to It

A UAE licensing project is not won by selecting the free zone with the lowest headline capital requirement. It is won by proving that the regulator, entity, token, customer base, custody model, payment flows, and tax structure all fit together.

100% crypto-focused.

We turn UAE regulatory complexity into one operating plan.

Start your application

One regulatory map

not five disconnected licensing conversations. We work across Dubai VARA, federal CMA requirements, DFSA, ADGM FSRA, CBUAE payment-token rules, AML/CFT, custody, token admission, governance, tax structuring, and banking readiness.

We choose the jurisdiction before the entity

Your preferred location does not determine the regulator by itself. We assess where the entity will be incorporated; whether the business operates in Dubai mainland, a Dubai free zone, DIFC, ADGM, or onshore UAE; whether the business targets UAE clients from abroad; whether it provides exchange, custody, brokerage, advisory, management, lending, transfer, or payment services; and whether its token is a virtual asset, capital-markets product, or payment token.

We test the federal perimeter

A zone-specific licence does not automatically resolve every UAE obligation. We assess whether the CMA or CBUAE may apply because of the token, customer base, trading activity, payment function, or cross-border targeting.

We build the business behind the licence

The application must be supported by real governance, local substance, AML/CFT controls, technology risk management, custody arrangements, client disclosures, and banking procedures. We prepare the operating model before filing—not after approval.

Five regulators.
One market.

UAE AT A GLANCE

Five Regulatory Environments, One Market

100+
Licensed virtual-asset firms

The UAE has more than 100 licensed virtual-asset service providers across VARA, ADGM FSRA, DFSA, and federal regimes, with VARA and ADGM together accounting for the majority of licences.

AED 100,000
Entry-level VARA capital

VARA’s minimum capital for certain lower-risk virtual-asset activities starts around AED 100,000, with higher tiers for exchange, custody, and other higher-risk activities.

9%
Mainland corporate tax rate

Mainland UAE companies are generally subject to 9% corporate tax on taxable income above AED 375,000. Free-zone 0% treatment is conditional and depends on Qualifying Free Zone Person requirements and the nature of the income.

UAE licensing framework
The UAE does not use one unified crypto licence. The applicable route depends on the activity, entity location, financial-free-zone status, token type, and customer base.
Dubai outside DIFC
VARA regulates virtual-asset activity in Dubai mainland and Dubai free zones other than DIFC.
Federal onshore UAE
CMA regulates the federal virtual-asset and investment-services perimeter outside the financial free zones.
DIFC
DFSA regulates crypto-token activity inside the Dubai International Financial Centre.
ADGM
FSRA regulates virtual-asset activity inside Abu Dhabi Global Market.
Payments nationwide
CBUAE regulates payment services and payment tokens under the applicable federal framework.
WHY THE UAE

Beyond the Numbers

The UAE’s advantage is not simply low tax or a fast incorporation process. It is the combination of a large commercial market, specialist regulators, financial free zones, established banking infrastructure, and a growing institutional digital-asset ecosystem. The UAE also provides multiple routes rather than forcing every business into one licensing tier: an advisory business may not require the same capital as an exchange or institutional custodian, while a trading venue, stablecoin issuer, or payment-token business may face additional requirements. The opportunity is strongest for firms that classify the activity correctly before incorporation.

Market

A regional centre with real counterparties
  • Dubai has a dedicated virtual-asset regulator covering Dubai mainland and most Dubai free zones.
  • Abu Dhabi’s ADGM provides a financial-services framework built around institutional governance and common-law courts.
  • The UAE has a significant regional base of funds, family offices, financial institutions, payment companies, and technology businesses.
  • A UAE licence can support a broader Middle East strategy—but only if the chosen regulatory route matches the clients and services.

Legal environment

Two financial free zones with common-law infrastructure
  • DIFC and ADGM operate distinct financial free-zone regimes with their own courts and English-based common-law frameworks.
  • This can be attractive to international investors and counterparties that want a familiar legal environment.
  • The benefit is not automatic: the business must fit the relevant financial-free-zone perimeter and token rules.
  • A free-zone licence does not automatically authorise activity throughout the wider UAE.

Currency and payments

A market built around the dirham
  • The UAE dirham has maintained a fixed exchange-rate relationship with the US dollar for decades.
  • This can simplify treasury planning for businesses operating between USD, AED, and digital assets.
  • Payment-token activity remains a separate regulatory question under the CBUAE framework.
  • A virtual-asset licence should not be treated as permission to issue or use payment tokens for general domestic payments.
Start your application

The UAE.
Pick correctly.

CHOOSE YOUR UAE REGULATORY ROUTE

Five Regulators, One Market — Where You Incorporate Decides Who You Answer To.

The UAE does not offer one universal virtual-asset licence. The correct route depends on your activity and where the business operates, and a company may need one primary licence plus additional federal registrations, approvals, or compliance obligations. More than one regulator may apply: a Dubai exchange may need to consider VARA, federal CMA requirements, token admission, and CBUAE issues if payment tokens are involved, while an ADGM custodian may need FSRA authorisation and an entity targeting UAE clients or operating a payment-token product may require a separate federal analysis. The correct question is not which UAE licence is cheapest. It is: which regulator has authority over each part of the business?

For virtual-asset businesses operating in or from DubaiDubai mainland and Dubai free zones, excluding DIFC

VARA Virtual Asset Licence

VARA is the dedicated virtual-asset regulator for Dubai outside the DIFC. It regulates activities including advisory, broker-dealer services, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and virtual-asset issuance.

A VARA licence does not automatically resolve every federal CMA or CBUAE issue. Token admission, payment-token activity, and UAE-targeted cross-border activity require separate analysis.

May suit

  • Dubai-based exchanges
  • Broker-dealers
  • Custodians
  • OTC businesses
  • Advisory firms
  • Virtual-asset managers
  • Lending and borrowing platforms
  • Transfer and settlement businesses
  • Virtual-asset issuers

Requires

  • Eligible Dubai entity structure
  • VARA approval for the relevant activities
  • Activity-specific capital and prudential safeguards
  • AML/CFT and market-conduct controls
  • Governance and local substance
  • Technology, custody, client-asset, and disclosure arrangements where applicable
For institutional businesses in ADGM or the DIFCAbu Dhabi Global Market and the Dubai International Financial Centre

FSRA and DFSA Financial Free Zone Regimes

The FSRA regulates virtual-asset activities inside ADGM under the Financial Services and Markets Regulations. Its framework covers activities including dealing, custody, operating a multilateral trading facility, advising, managing, and arranging. Capital depends on the activity: advisory-only models sit at a substantially lower level than Category 1 virtual-asset services, which carry a significantly higher capital requirement.

DIFC is a separate legal and regulatory environment. The DFSA’s crypto-token regime applies inside the DIFC and operates differently from VARA’s Dubai-wide virtual-asset framework, and the DFSA approach depends on whether the token is an accepted crypto token and whether the business is conducting a regulated financial service involving that token.

A VARA licence does not cover DIFC activity, and a DFSA authorisation does not cover Dubai mainland or other Dubai free zones.

May suit

  • Institutional exchanges
  • Custodians
  • Brokers and dealers
  • Asset managers and fund managers
  • Multilateral trading facilities
  • Advisory and arranging businesses
  • DIFC-based investment firms and institutional crypto-token businesses
  • Businesses dealing in accepted crypto tokens
  • Firms that need ADGM’s or DIFC’s common-law financial-services environment

Requires

  • An ADGM entity structure, or DIFC incorporation or an eligible DIFC structure
  • FSRA or DFSA authorisation for the regulated activity
  • Activity-specific capital and prudential safeguards
  • Accepted-virtual-asset and accepted-token analysis
  • AML/CFT, governance, conduct, custody, and technology controls
  • Appropriate local substance and senior management
  • Separate analysis where the business also operates outside the free zone
For onshore activity, payment tokens, and stablecoinsOnshore UAE and the nationwide payments perimeter

CMA and CBUAE Federal Frameworks

The UAE’s federal CMA framework covers virtual-asset activities outside the financial free zones and operates alongside emirate-level regimes. CMA Decision No. 4/R.M/2026 introduced an activity-based framework covering eight categories, including dealing as principal or agent, custody, arranging custody, operating a multilateral trading facility, investment advice, portfolio management, and arranging investment deals.

The CBUAE regulates payment services and payment tokens under the federal payments framework. That part of the route is relevant where the business issues, converts, transfers, custodies, or uses payment tokens, or provides payment services involving virtual assets.

CMA is not a replacement for VARA, DFSA, or FSRA, and a virtual-asset licence from VARA, CMA, DFSA, or FSRA should not automatically be treated as permission to conduct regulated payment-token activity. Stablecoin issuance and general payment use must be analysed separately from exchange, custody, or brokerage licensing.

May suit

  • Onshore UAE virtual-asset platforms
  • Federal virtual-asset brokers
  • Investment and portfolio managers
  • Custody businesses
  • Multilateral trading facilities
  • Businesses targeting UAE clients from outside the country where the federal perimeter applies
  • Dirham-backed stablecoin issuers and other payment-token issuers
  • Payment platforms using regulated virtual assets
  • Businesses converting or transferring payment tokens
  • DeFi or digital-asset platforms targeting UAE payment users

Requires

  • CMA authorisation for each relevant activity
  • Federal governance, prudential, AML/CFT, and conduct controls
  • Compliance with the applicable capital and operational requirements
  • Token-admission analysis where virtual assets are traded
  • CBUAE analysis and, where applicable, licensing or registration
  • Reserve, redemption, safeguarding, and governance arrangements
  • Payment-risk, technology, and operational-resilience arrangements
  • Coordination with VARA or any other primary virtual-asset regulator
COST CALCULATOR

Know the Commitment Before You Make It

The licence fee is only one part of a UAE virtual-asset project. A realistic Year 1 estimate must account for the selected zone, regulator, entity setup, capital, local substance, board and key personnel, AML/CFT, technology, custody, audit, banking, tax structuring, and any additional federal registrations.

Three levels of support

How much of the work do you want us to do?

01 · TEMPLATES

You get the documents. You file them yourself.

On request
  • The full policy, procedure and governance pack for this regulator
  • Application forms filled in as far as your own data allows
  • One handover session so you know what goes where
  • You deal with the regulator yourself
02 · TAILORED

We write the file around your business.

On request
  • Everything above, rewritten around your actual model
  • Business plan, governance and AML/CFT built from your data
  • We assemble and check the whole file before it goes in
  • You submit and answer; we stay on call throughout
Every figure on this page assumes this level
03 · TO DECISION

We carry the file to the regulator’s answer.

On request
  • Everything above, and we file it
  • Every regulator question and clarification round comes to us
  • Meetings and pre-application engagement handled for you
  • We stay on the file until the decision is issued

One licence, three levels — the regulator asks for exactly the same file in all three, and what changes is how much of it sits with you. Our fee for each level is quoted on scope after the first call; the estimate below holds at every level. Moving up or down changes our fee and nothing else — not the capital, not the state fees, not the statutory clock. Carrying a file to the decision is not a promise of approval: no adviser can give one, and an adviser who does is selling you something other than advice.

Protegra regulatory mapping and licence supportRegulatory route selection across VARA, CMA, FSRA, DFSA, CBUAE, or a combination. This page routes between five regimes. The figure follows the route selected above; a multi-regulator structure costs more than a single licence. Priced on scope after the first call, so it is not part of the estimate below — everything above and beneath this line is money that goes to third parties.On request
UAE entity formation and registered officeDubai mainland, Dubai free zone, DIFC, ADGM, or another eligible UAE structure.AED 45,000
VARA activity-specific capitalActivity-specific capital, security, reserves, safeguarding, and fixed-overhead requirements.Confirm by activity
CMA activity-specific capitalExchange, custody, broker-dealer, advisory, portfolio management, transfer, lending, issuance, trading venue, payment token, or stablecoin activity.Confirm by activity
ADGM FSRA capitalCapital depends on the activity: advisory-only models sit substantially below Category 1 virtual-asset services. For qualifying advisory activity; substantially higher for certain institutional activities.From US$10,000
DFSA capitalPrudential requirements under the DIFC crypto-token regime and the accepted-token framework.By DFSA category
CBUAE capital or reserve requirementsReserve, redemption, safeguarding, and governance arrangements for payment-token and payment-service activity. Assessed against the licence and the payment-token model.By licence model
Board, MLRO, compliance, and risk supportOffice, directors, senior management, MLRO, compliance, risk, technology, and locally accountable functions. AED 360,000 annualised.AED 30,000 / mo
Technology-risk and penetration testingCybersecurity, key management, wallet architecture, access controls, incident response, business continuity, outsourcing, and asset segregation.AED 120,000
AML, blockchain analytics, and Travel Rule toolingRisk assessment, KYC, sanctions screening, transaction monitoring, wallet analytics, Travel Rule controls, reporting, and independent review.AED 85,000 / yr
Tax structuring and annual auditCorporate tax, free-zone eligibility, QFZP analysis, audited financial statements, accounting, and tax filings.AED 75,000 / yr
Fixed regulatory charges — paid to the regulator of the chosen route.
Entry-level VARA capitalAED 100,000
Mainland corporate tax9% above AED 375,000
ROADMAP WITH PROTEGRA

From Regulatory Mapping to Live UAE Operations

A UAE virtual-asset project must begin with regulatory mapping. Incorporating first and choosing a regulator later is one of the most expensive mistakes a crypto business can make. On timing: the route you choose sets the clock. From first conversation to licence the market median is about eight months with the federal CMA (formerly SCA), nine with the DFSA and ten with VARA, while ADGM firms took a median of twelve months from in-principle approval to permission alone. Sources: regulator process guidance and public approval announcements, checked 23 September 2026. The timings below are indicative, not a promise.

We assess:

  • The entity’s proposed location
  • The target customers
  • UAE and cross-border marketing
  • Exchange and brokerage activity
  • Custody and wallet control
  • Transfers and settlement
  • Lending and borrowing
  • Advisory and portfolio management
  • Trading-venue operation
  • Token issuance
  • Payment-token and stablecoin activity
  • Whether the token may be a capital-markets product

We determine which regulator or combination of regulators may apply.

We compare the available operating environments:

  • Dubai mainland and non-DIFC free zones
  • DIFC
  • ADGM
  • Onshore UAE
  • Other structures where relevant

The decision is based on regulatory scope, client profile, capital, governance, local substance, banking, tax, investor expectations, and expansion strategy.

We establish the governance model around the chosen regulator:

  • Board and senior-management roles
  • Resident director or manager arrangements
  • MLRO and compliance ownership
  • Risk and internal-control functions
  • Technology and cybersecurity accountability
  • Beneficial ownership documentation
  • Outsourcing oversight
  • Local decision-making and reporting lines

We prepare the control framework around the actual product:

  • Enterprise-wide financial-crime risk assessment
  • KYC and source-of-funds procedures
  • Sanctions and PEP screening
  • Blockchain analytics and transaction monitoring
  • Travel Rule controls
  • Wallet and key-management procedures
  • Asset segregation and reconciliation
  • Cybersecurity and access controls
  • Incident response
  • Business continuity
  • Vendor and outsourcing oversight
  • Customer disclosures and complaints handling

The application is prepared for the selected authority: VARA, CMA, FSRA, DFSA, or CBUAE.

Where multiple regulators apply, we coordinate the submissions so the same business model, ownership, governance, token scope, and financial projections are presented consistently.

We test the business against additional obligations:

  • CMA token-admission and federal activity requirements
  • CBUAE payment-token requirements
  • UAE-targeted cross-border activity
  • Marketing and solicitation restrictions
  • Client-asset and custody rules
  • Tax and free-zone conditions
  • Any transition or regularisation deadlines

After approval, the business completes the remaining pre-commencement actions:

  • Capital and security confirmation
  • Office and substance activation
  • Banking and payment-provider onboarding
  • Technology and custody testing
  • Staff training
  • AML monitoring activation
  • Regulatory reporting setup
  • Client disclosures
  • Marketing and communications review
08

Post-Licensing Support

INCLUDED, NOT OPTIONAL

A UAE licence is the beginning of a multi-regulator compliance relationship.

Ongoing AML and sanctions monitoring

Customer-risk review, transaction monitoring, sanctions controls, suspicious-activity escalation, and policy updates.

Regulatory coordination and reporting

Support across VARA, CMA, DFSA, FSRA, and CBUAE where more than one regime applies, together with supervisory communications, material-change notifications, new activities, token listings, and market expansion.

Technology and custody governance

Cybersecurity, wallet and key controls, incident response, vendor oversight, resilience testing, and evidence maintenance.

Tax and corporate maintenance

Support for QFZP conditions, audited financial statements, tax-period testing, and corporate changes.

WHY PROTEGRA

The Moments Where UAE Applications Go Wrong

The UAE offers several viable regulatory environments. That flexibility is valuable, but it creates several points where an application can become misaligned before it is submitted.

See how we work

“Which regulator actually applies to us?”

A Dubai entity, DIFC entity, ADGM entity, and onshore entity do not face the same regulator. Your customers, token, services, marketing, and payment flows may also create obligations beyond the primary zone licence.

⟶ We map the complete perimeter before incorporation.

“Can we use a VARA licence across the UAE?”

A VARA licence covers the Dubai perimeter outside DIFC. It does not automatically cover DIFC, ADGM, federal payment-token activity, or every federal CMA obligation.

⟶ We test whether your intended customers, services, and token listings require additional approval or coordination.

“Which token can we list?”

A token accepted in one regulatory environment may not automatically be accepted in another.

⟶ We assess token classification, admission, disclosures, market conduct, and any federal or zone-specific restrictions before the platform goes live.

“Is our free-zone income really taxed at 0%?”

A free-zone company does not automatically receive 0% corporate tax. The company may need to satisfy Qualifying Free Zone Person conditions, maintain substance, pass the relevant income tests, meet the de minimis rule, and prepare audited financial statements.

⟶ We coordinate regulatory and tax structuring rather than treating them as separate decisions.

“Do we need the CBUAE as well?”

If the business issues or uses payment tokens, operates a stablecoin, or provides regulated payment services, a virtual-asset licence may not be enough.

⟶ We separate investment-token, virtual-asset, and payment-token activity before the business commits to a licence route.

“Are we building for the regulator or for the bank?”

A technically correct licence does not guarantee banking access. Banks and payment providers will independently assess ownership, transaction flows, source of funds, customer risk, custody, technology, and governance.

⟶ We build banking readiness into the application from the start.
CLIENT EXPERIENCE

How These Problems Get Resolved

Select a challenge to see how a UAE virtual-asset project moves from multiple possible routes to one coherent operating structure.

Before Protegra
“We chose a UAE free zone based on the headline capital requirement. Later, our customers, custody model, and marketing plans pointed to a different regulatory perimeter.”
With Protegra
“We compared the jurisdictions before incorporation. The entity, regulator, business model, and investor story were designed together.”
FFounder, virtual-asset platform, UAE
FAQ

Common Questions

About the calculator
01How close is the calculator to what I’ll actually spend in Year 1?
The calculator provides an indicative planning estimate based on your UAE jurisdiction, selected activities, primary regulator, capital requirements, local substance, and supporting workstreams. The final cost depends on the entity location, regulator, activity scope, token, customer base, capital, governance, banking, technology, tax structure, and any additional federal obligations.
02Why are capital and reserves shown separately from the other costs?
Capital, reserves, and security are financial resources required by the relevant regulatory framework. They are different from legal fees, regulator charges, office costs, compliance, technology, audit, accounting, and operating expenses.
03Can I get a documented breakdown to take to my board or investors?
Yes. We can provide a detailed Year 1 estimate separating regulator-specific capital, legal work, entity setup, board and key personnel, AML/CFT, technology, custody, tax, audit, banking, and recurring operating costs.
About UAE virtual-asset licensing
04Is there one UAE crypto licence?
No. The applicable route depends on the entity’s location, the activity, the token, the client base, and whether the business involves payments. The main environments are VARA in Dubai outside DIFC, CMA for the federal onshore perimeter, DFSA in DIFC, FSRA in ADGM, and CBUAE for payment-token and payment-service activity.
05Does a VARA licence cover the whole UAE?
No—not automatically. VARA regulates virtual-asset activity in Dubai mainland and Dubai free zones other than DIFC. DIFC, ADGM, federal onshore activity, and payment-token activity require separate analysis.
06Which UAE regulator is right for an exchange?
It depends on where the exchange is established and which customers it serves. A Dubai exchange outside DIFC will generally begin with VARA. An ADGM exchange may require FSRA authorisation. A DIFC platform falls within the DFSA regime. An onshore or federal activity may involve CMA requirements, and payment-token activity may involve CBUAE.
07Which UAE route is best for a custodian?
Dubai custody is generally analysed under VARA. ADGM custody is regulated by FSRA. DIFC custody falls within the DFSA regime, while onshore federal custody may require CMA analysis. The correct route depends on the entity, client assets, wallet control, accepted tokens, governance, and customer base.
08Can a UAE company serve clients across all emirates?
Not automatically. The business must assess the applicable emirate, free-zone, federal, solicitation, marketing, token, and payment rules. A licence in one zone should not be marketed as nationwide permission without confirming the relevant framework.
Tokens, tax, and payment activity
09Does a UAE licence provide EU passporting?
No. A UAE licence does not provide MiCA authorisation or passporting rights in the EU or EEA. A business serving EU clients may require a separate MiCA analysis and, where applicable, an EU CASP authorisation.
10Is UAE free-zone crypto income taxed at 0%?
Not automatically. A free-zone entity may qualify for 0% corporate tax on qualifying income only if it satisfies the requirements for a Qualifying Free Zone Person and the specific income qualifies under the applicable rules. The business should not assume that all crypto trading, exchange, advisory, custody, or platform revenue qualifies for 0%.
11Do we need a CBUAE licence for a stablecoin?
Potentially, yes. A business issuing, converting, transferring, or using payment tokens may fall within the CBUAE framework. A VARA, CMA, DFSA, or FSRA licence should not automatically be treated as sufficient for payment-token activity.
12Can we list any token once we are licensed?
No. Token admission and permitted assets depend on the relevant regulator, activity, customer base, and token characteristics. A token listed in one UAE regulatory environment may require separate analysis elsewhere.
Banking, timelines, and life after authorisation
13Will a UAE bank open an account for us?
A licence does not guarantee banking access. Banks assess the ownership structure, customer profile, source-of-funds controls, transaction flows, custody model, AML programme, technology risk, governance, and commercial rationale independently.
14How long does UAE licensing take?
There is no single UAE timeline. The project may include entity formation, regulator pre-application engagement, governance appointments, capital preparation, AML and technology implementation, application review, clarification rounds, and pre-commencement conditions. The timeline depends on the selected regulator, activity, entity, and whether multiple regimes apply.
15What happens after authorisation?
The business must maintain its approved governance, AML/CFT, technology, custody, reporting, disclosures, outsourcing, tax, and customer-protection framework. Material changes to ownership, services, tokens, key people, technology, or target markets may require notification or further approval.
16Can Protegra support us after authorisation?
Yes. Ongoing support can include AML/CFT monitoring, sanctions controls, Travel Rule implementation, technology-risk governance, cybersecurity, custody, tax-period readiness, regulator communication, reporting, token listings, and expansion into additional UAE markets.

Reference: Virtual asset service provider (non-MiCA) licences compared in the Licensing Atlas.

Start now

Apply for Your UAE Crypto Licence

Leave your details and we will map your business across the UAE’s regulatory environments and identify the licensing route that fits your activity.

Blog

Latest news from Protegra