← Back to blog posts
In the industry
December 21, 2022

A Spotlight on Digital Asset Regulation in Dubai

Earlier this year, Dubai enacted its first virtual asset regulation. Discover how Dubai plans to regulate digital assets in its ambitions to become one of the largest crypto hubs in the world.

Here we jet-set to the Middle East, where Arab gulf states in particular have been plowing huge amounts of money and effort into reinventing themselves as hubs for digital assets. Their investment certainly hasn’t gone unrewarded, as the volume of crypto transactions is growing faster in the Middle East than in any other region in the world. 

The United Arab Emirates (UAE), one of the world’s top global financial centers, isn’t letting the digital economy steal its thunder. The country has repeatedly stated its plans to become among the world’s top hubs for crypto, and its capital Abu Dhabi flaunts itself as the world’s first jurisdiction to introduce a comprehensive legal crypto framework. 

As quoted by CNBC 30, the UAE’s share in the global crypto market has increased 500% between July 2020 and June 2021 and is now over US$25 billion in transaction value. This puts it regionally ranked third by transactions volume behind Turkey ($132 billion) and Lebanon (a close $26 billion). National news sources cite more than 400+ crypto businesses in the country, with some in the space predicting 1,000+ will be established there by the end of 2022.

In this blog post, we’ll zoom into the glittery metropolis of Dubai, which earlier this year enacted its first crypto law regarding virtual assets. We’ll also touch on the Dubai International Financial Centre, an economic freezone that’s also been trailblazing in its digital asset ambitions.

The Main players: VARA and the DFSA

The UAE is a legally complicated country made up of seven emirates governed by four judicial authorities: Dubai, Abu Dhabi, Ras Al Khaimah, and the federal agency that governs Sharjah, Fujairah, Umm al-Quwain, and Ajman. Each of the seven states institute their own regulations in areas where there is no federal law. The region also contains more than 40 multidisciplinary economic free zones, each with their own sets of rules. 

When it comes to financial and capital markets, there are four key regulators: the Central Bank of the UAE (CBUAE), the Securities and Commodities Authority (SCA), the Dubai Financial Services Authority (DFSA), and the Financial Services Regulatory Authority (FSRA). The DFSA and FSRA are responsible for regulating the two financial freezones, respectively the Dubai International Finance Centre (DIFC) and the Abu Dhabi Global Markets (ADGM). 

Exempt from many of the UAE’s laws around financial markets, the DIFC and ADGM have long been at the forefront of innovation in financial technology. However, federal criminal laws such as the federal anti-money laundering laws do apply; this extends to federal anti-money laundering related to digital assets. 

When it comes to digital assets in Dubai specifically, there are two jurisdictions to consider: Dubai and the DFIC.

Dubai benefits from a single dedicated regulator, the Virtual Assets Regulatory Authority (VARA), an autonomous public entity linked to the Dubai World Trade Centre Authority (DWTCA) that collaborates with the CBUAE and SCA. Meanwhile, the DIFC benefits from a single financial regulator, the DFSA. 

Both VARA and the DFSA have defined virtual assets broadly to include crypto tokens, security tokens, utility tokens, non-fungible tokens, and other token types. However, the exact regulatory perimeter differs for each jurisdiction. VARA’s jurisdiction is much more pervasive than the DFSA’s digital assets regime, which explicitly excludes certain token types unless they resemble financial instruments (e.g. securities).

Law No. 4 of 2022: The Virtual Assets Law

On February 28, 2022, Dubai issued Law No. 4 of 2022 “Regulating Virtual Assets in the Emirate of Dubai”, also known as the Virtual Assets Law. Enacted on March 11, 2022, the law sets the stage for how Dubai regulators will police the nascent virtual asset industry. 

The Virtual Assets Law will be impactful to Dubai’s crypto strategy in a few ways:

  • Proposing legal definitions for digital assets
  • Establishing a licensing regime
  • Stipulating penalties for firms found operating against its policies
  • Establishing Dubai’s Virtual Assets Regulatory Authority (VARA) 

The main objective is to position Dubai as a key global player in designing the future of virtual assets.

The law will apply to services related to virtual assets in Dubai, including all special development and free zones, except in the DIFC, which has its own set of digital asset regulations policed by the DFSA. 

The Virtual Assets Law makes Dubai one of the few jurisdictions to have adopted a legal framework specifically for investors and businesses involved with virtual assets. The law is an exciting development towards the UAE achieving its vision of becoming a global hub for digital assets and likely to attract businesses to the region’s booming emerging digital technology market. 

It’s not fully clear yet how the Virtual Assets Law and VARA will interact with existing federal laws and authorities in Dubai, such as the CBUAE and SCA, which have their own digital assets regulation. Further guidance is expected in supplementary legislation.

Defining digital assets

Dubai’s Virtual Assets Law defines virtual assets as “digital representations of value that may be digitally traded, transferred, or used as an exchange or payment tool, or for investment purposes, including virtual tokens”. 

The definition is left purposely broad to give VARA a degree of discretion in determining the applicability of the law. Currently, it encompass a wide range of asset types including security tokens, non-fungible tokens, and cryptocurrency. However, digital representations of fiat currency (e.g. CBDCs) are excluded.

Virtual Assets Regulatory Authority (VARA)

Significantly, Dubai’s Virtual Asset Law sees the birth of the Virtual Assets Regulatory Authority (VARA) as the primary watchdog for virtual assets in Dubai. 

The single regulator dedicated to virtual assets is a major advantage as it means regulators will be trained and knowledgeable specifically on the unique asset class, and more able to understand how to modify existing laws to mitigate against the risks inherent in crypto.

An independent public entity affiliated with the Dubai World Trade Centre Authority (DWTCA), VARA will be responsible for providing a full range of regulatory services in relation to cryptocurrencies, NFTs, and any other virtual asset. Additionally, VARA will coordinate with the CBUAE and SCA to ensure the protection and stability of the financial system in Dubai.

Some of VARA’s key responsibilities will include: 

  • Licensing and regulating entities engaging in activities with virtual assets 
  • Developing strategic plans and policies around virtual assets activities
  • Supervising the issuance and offering of virtual assets and tokens
  • Prescribing regulations in relation to personal data protection and KYC/AML
  • Combatting money laundering and terrorism financing

VARA will coordinate with the DWTCA, intended to become the new dedicated zone for regulated virtual asset businesses, on launching the application process for Regulated Virtual Asset Business Licenses. It’s currently drafting further regulations that will enable the DWTCA to issue its own crypto licenses for a range of virtual assets and virtual asset service providers.

VARA’s mandate to organize and govern rules around virtual assets will help to promote Dubai as a regional and international destination for virtual assets. This will be further aided by facilitating collaborative engagement between global virtual asset service providers, industry thought leaders, and international regulatory authorities.

In May 2022, VARA became the world’s first regulator to make its metaverse debut when it announced its MetavHQ hub in ‘The Sandbox’ (SAND), a diverse metaverse built on the Ethereum blockchain. The move is part of Dubai’s strategy to expand to a borderless audience to create a prototype of a decentralized regulator model.

Overall, Dubai’s interaction with blockchain through the implementation of its Virtual Assets Law, the installation of VARA, and its experimentation with transposing its regulatory system to the metaverse is a clear indication of a forward-looking city pioneering the way to a web3 future. 

What virtual asset activities are regulated by VARA? 

Under the new Virtual Assets Law, the following activities will be regulated and require a permit from VARA to operate in Dubai: 

  • Operating and managing virtual asset platform services 
  • Exchange services between virtual assets and currencies (both domestic and foreign) and between one or more forms of virtual assets 
  • Virtual asset transfer services
  • Virtual asset custody, settlement, management, or control services 
  • Services related to virtual asset wallets or portfolios
  • Services related to offering and trading of virtual tokens

Entities operating in Dubai and engaging in one or more of the above activities will be prohibited to do so unless authorized by VARA and within the limits of the authorisation granted. Prerequisites for authorisation include setting up business headquarters in Dubai and obtaining the appropriate license from the relevant commercial authority. 

VARA will establish rules and conditions around these services, with specific licensing processes and ongoing requirements for anti-money laundering, disclosure, transparency, and KYC procedures expected to be clarified in supplementary legislation. The list of activities may also be expanded at any time.VARA will also have the power to suspend the issuance of authorizations or cease the dealing in a virtual asset in Dubai. Further guidance is expected on what acts constitute a violation of the provisions and corresponding penalties.

DIFC: Dubai International Financial Centre

The main regulator for the DIFC, the DFSA, has also been called a progressive regulator for recognizing interest in new financial products related to virtual assets and initiating consultations indicating future regulation. 

In 2021, the DFSA announced its “Digital Assets Regime”, a two phase initiative that extends the scope of many financial services activities to allow for firms in the DIFC to provide products and services around virtual assets. 

The DFSA’s aim is to foster digital asset innovation in a measured, responsible, and transparent way with a regulatory focus on the risks relating to anti-money laundering, consumer protection, market integrity, and custody. Its proposed regulation will apply to companies interested in marketing, issuing, trading, or creating tokens in or from the DIFC. 

Many blockchain projects have already established presence in the DIFC, no doubt trying to take advantage of one of the most exciting financial zones’ openness to emerging technology. 

Investment tokens (security tokens and derivative tokens) 

Phase One of the DFSA’s “Digital Assets Regime” began in early 2021 when the DFSA unveiled a regulatory framework for public consultation covering what it refers to as investment tokens

Investment tokens are essentially tokens with the same, or substantially similar, purpose or effect as pre-existing categories of regulated investments. The framework encompasses two types of tokens: security tokens or derivative tokens. 

Formally, investment tokens are defined as digital representations of rights and obligations either equivalent or substantially similar to a security or derivative that has been issued, transferred, and stored using distributed ledger technology such as blockchain.

Under the framework, any person in or from the DIFC requires DFSA authorization to engage in certain activities related to investment tokens. These activities include the promotion or public offering of the token as well as applying for a security token to be admitted to the official list of securities. 

Security tokens will be regulated according to existing securities regulation with additional requirements to mitigate risks specific to blockchain.

Crypto tokens

This November 2022, the DFSA implemented the Crypto Tokens Regime, the second phase of its Digital Assets Regime covering those tokens not covered by the Investment Tokens framework. 

The DFSA defines crypto tokens as “a token that is used, or is intended to be used, as a medium of exchange or for payment or investment purposes but excludes an Investment token, or any other type of Investment, or an Excluded Token”. Thus the framework creates two categories of tokens: crypto tokens and excluded tokens. 

Crypto tokens include payment tokens such as Bitcoin and Ethereum, stablecoins with value backed by fiat currency, and hybrid utility tokens. 

Non-investment “excluded tokens” include non-fungible tokens and pure utility tokens, although those tokens still fall within the remit of the DFSA’s AML regime. Also excluded are central bank digital currencies (CBDCs). 

Importantly, the DFSA emphasizes that asset referenced tokens that take on characteristics of regulated investments (e.g. commodity derivatives; units of a fund) will be treated as such and fall within the scope of the Investment Tokens regime. 

Required authorization to engage in crypto asset financial services 

The new regulatory regime prohibits non-authorized firms from providing financial services in relation to crypto tokens in or from the DIFC. For firms engaging in crypto token activities amounting to financial services, there is a six month grace period to obtain appropriate licensing. Further, only activities with recognized tokens will be permitted. 

Permitted activities include dealing in investments as principal or agent, arranging deals, managing assets, advising on financial products, providing or arranging custody, operating a clearing house, and operating an alternative trading system. These activities will be subject to the existing regulations applicable to those financial services, adapted to reflect the specific risks and features of blockchain technology. 

With the exception of custody, no authorized individual may be permitted to provide services in relation to both a crypto token and excluded token. This line is drawn to maintain a clear distinction between regulated and unregulated crypto asset activities. 

Regarding who can carry on regulated activities around crypto tokens, the DFSA currently only permits entities incorporated in the DIFC or branches of entities established in other jurisdictions who meet certain strict conditions.

Utility tokens 

Notably, utility tokens will be included in the definition of crypto token should they have relevant hybrid features beyond a use case of pure utility. 

The framework defines “pure utility tokens” as utility tokens that operate in a closed ecosystem and give access to products, services, or discounts provided by their issuer/the issuer’s group. 

“Hybrid features” occur when the token is used beyond pure utility, for example as a medium of exchange or developing a secondary market. Hybrid utility tokens are typically first offered through initial public offerings with the intention of funding the blockchain’s further development. 

Examples of hybrid utility tokens cited by the DFSA in its consultation include the Basic Attention Token (BAT) used by digital marketers to pay for ads on the Brave browser as well as Filecoin (FIL), used to pay for services on the decentralized data storage network. Another well-known example is Huobi Token (HT), used to support Huobi’s business and products. 

Prohibited tokens 

The framework also introduces the category of “prohibited tokens”. Prohibited tokens will include:

  • Algorithmic tokens, which achieve price stability by using algorithmic mechanisms to adjust the supply or demand of the token. These tokens use a method which can issue more coins when the price increases and buy off the market when the price falls, however the method is not immediately transparent to users, markets, or regulators. As such, algorithmic tokens may not enable effective oversight and supervision.

  • Privacy tokens or devices, which hide, anonymise, obscure, or prevent tracing of the holder of a token. Privacy tokens pose a risk to regulatory compliance as they make it virtually impossible to accurately identify the holder or beneficial owner of a token, or to trace a chain of transactions. 

Under the current provisions, providers of privacy tokens and devices as well as algorithmic tokens, will be prohibited from operating, offering, or promoting these tokens in or from the DIFC. 

Accepted crypto tokens 

Under the Crypto Token Regime, any person wanting to provide financial services in or from the DIFC in relation to a crypto token or its derivative will require the DFSA to explicitly recognize the token. This “accepted crypto token” strategy is echoed elsewhere in the Middle East (e.g. ADGM, Bahrain). 

On November 1, 2022, the DFSA published an initial list of recognized tokens that will be immediately available for use by firms with appropriate permissions to conduct financial services from or within the DIFC. Tokens on the initial list included Bitcoin (BTC), Ethereum (ETH), and Litecoin (LTC).

For crypto tokens not on the official list of accepted tokens, an application must be granted by the DFSA that recognizes the token before it can be available for use by a DFSA authorized firm. 

Once a token is recognized, it will be added to the DFSA’s centralized register and anyone with required permissions may provide services in respect to the token. 

Of note, the DFSA currently doesn’t allow for the issuance of new crypto tokens in or from the DIFC. However, it has stated that it will keep this policy under review as it gains more regulatory experience. 

DIFC Courts 

The DFSA isn’t the only regulatory body in the DIFC experimenting with the blockchain: it’s also made its way into the strategy of the DIFC Courts, an independent English language common law judiciary. 

Established in 2004, the DIFC Courts have jurisdiction over civil and commercial matters or disputes that directly connect to the DIFC, including the laws and regulations created by the DFSA. Interestingly, jurisdictional connection is not a prerequisite to use the DIFC Courts; companies may use the DIFC Courts for dispute resolution even if they are not within the DIFC or the transaction in question was concluded elsewhere.

In 2017, the DIFC Courts partnered with the Dubai Future Foundation (DFF) to launch the Court of the Future, a legal think tank focused on the intersections between law, technology, IT, and business. Then in 2021, the DIFC Courts announced the launch of a Specialized Court for the Digital Economy to deal with disputes related to big data, blockchain, artificial intelligence, and other emerging technologies. 

Currently, the DIFC Court is looking to develop blockchain to enable instant settlements once a judge has issued a final decision in a case. The idea is that by using blockchain, the winning claimant can receive a money transfer instantly, wherever they are in the world, once a final judgment has been issued. This view adheres to the Court’s philosophy that judgements should be converted to money and not rely on paper processes; an unsurprising view from the region’s first paperless court. 

As of 2022, the DIFC Courts plan to enter the metaverse. Importantly, the DIFC isn’t looking to enter the metaverse by creating a digital twin of the DIFC but as a strategic offering for online dispute resolution that uses smart contracts.

The DIFC Courts’ metaverse initiative aligns with Dubai’s Metaverse Strategy that aims to turn Dubai into one of the world’s top 10 metaverse economies with over 40,000 virtual jobs and a contribution of $4 billion to the emirate’s GDP by 2030.

Dubai’s lure: clear interest and proof of business 

As one of the top 10 richest countries in the world and boasting almost 100,000 USD millionaires, the UAE is a massive lure for crypto firms hoping to attract businesses and wealthy investors. 

Many crypto firms have recently established offices in Dubai, hoping to ride the wave of the city’s digital asset ambitions and tap into the UAE’s lucrative market. The entry of leading international crypto exchanges Binance, Crypto.com, Kraken, and Bybit are a few examples. 

What makes Dubai so attractive? Clear state interest, proof of business, and a willing customer base with both the funds and interest to engage in crypto, as well as loose city policies that exempt investors from paying taxes on crypto profits. 

For companies, the benefits of a clear regulatory framework outweigh the even looser tax policies found in other crypto friendly jurisdictions. Establishing presence in Dubai gives companies the chance to maintain working relationships with regulators reputed to be amicable and progressive. 

Part of the draw to Dubai is the perceived ease of getting licensed or approved to establish a crypto business compared to say, Singapore, which has a more arduous reputation thanks to more mature regulations. With the warmer climate and a positive economy, it’s not a bad place to wait for licensing, either. 

That said, friendly jurisdictions aren’t always a dream-come-true (the UK is one example). The UAE isn’t immune to a bit of regulatory headache, especially for banks, regulated by the four different financial authorities. The system can be difficult to navigate, and the process isn’t always easy. For example, VARA’s due diligence process reportedly requires applicants to submit over 100 data items or documents. 

As much as the UAE has been acclaimed for its crypto friendly approach, it’s also come under heavy international scrutiny for insufficiently addressing the risks of money-laundering and terrorism financing. In March 2022, it was placed on the FATF Grey List, with attention to risks of certain industries including real estate and precious metals. 

What are the common use cases for crypto in Dubai? 

The UAE is considered to be progressively using crypto with mass adoption primarily by airlines and real estate firms, some of which now accept payments in crypto. 

Emirates Airlines, the national flagship carrier, announced in May 2022 that it intends to ‘embrace advanced digital solutions such as Blockchain, metaverse and cryptocurrency’ to enhance its customer connections. Etihad Airways, the other national airline of the UAE, announced in July 2022 that it was launching a non-fungible token (NFT) collection ‘EY-ZERO1’ that gives NFT owners Etihad Guest Silver tier membership for one year plus a chance to win free tickets. Future metaverse products are planned as part of its Web3 strategy. 

Real estate firms have begun embracing the technology, too. Several international real estate developers based in Dubai, including DAMAC Properties and Ellington Properties, have announced they will accept payments in cryptocurrency such as Bitcoin and Ethereum. Similarly, Knox Group and Dubai-based Aston Property Ventures launched a website with a range of apartments in a £250 million development in Dubai available for purchase in Bitcoin via the U.S. company BitPay. 

The strategy is being replicated by other local businesses, such as grocery delivery company Yalla Market, which have made similar announcements to accept cryptocurrency as a form of payment.

Interestingly, the UAE actually prohibits the use of cryptocurrencies as a payment method. As such, these announcements to accept cryptocurrency can be seen as attempts to attract the crypto community more than adopt the technology, since interested buyers must work with third-party brokers to convert their crypto to fiat currency to send to the seller.


While the finer details remain to be clarified in upcoming guidance, it’s clear the UAE is working hard to cultivate huge growth in the crypto industry from within its shores by establishing clear regulation. Both Dubai’s enactment of the Virtual Assets Law and VARA and the DFSA’s Digital Assets Regime will undoubtedly play a key role in fostering the UAE’s crypto friendly reputation. 

However, as with other jurisdictions, only time will tell if the UAE is able to successfully find the balance between reducing financial crime risks in the nascent industry while inviting innovation. 

For now, though, it’s not so difficult to expect the number of transactions involving virtual assets in Dubai to keep wildly increasing, especially as blockchain-related businesses look increasingly keen to begin carving a foothold in both of its jurisdictions. 

Join DiscordDownload the report

Ready to use Polymesh?