Regulatory Intelligence Centre
A machine-readable, executive-readable reference to the principal UAE and Bahrain virtual asset frameworks relevant to licensing, AML/CFT and supervisory readiness.
Authority-by-authority reference.
Law No. (4) of 2022; Virtual Assets and Related Activities Regulations 2023; Company, Compliance & Risk Management, Technology & Information, Market Conduct and VA activity-specific rulebooks.
VARA's published federal AML/CFT laws reference Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025.
Status: In-Force. Applies to VASPs within the stated territorial scope and establishes data and risk-based controls for specified Virtual Asset Transfers.
Regulated Activities involving Virtual Assets use the FSRA financial-services-permission framework, with COBS and virtual-asset guidance. The AML Rulebook was updated in May 2026.
The Crypto Token framework applies to financial services activities involving Crypto Tokens. Updated rules became effective on 12 January 2026, including firm-led suitability assessment.
Volume 6, Capital Markets, Module CRA (Crypto-asset) is the published CBB reference for Crypto-Asset Service licensing, licensing conditions, minimum capital and ongoing business standards; verify the latest CBB Rulebook version for subsequent amendments.
Use the right term for the right framework.
A defined term used in Dubai / UAE and ADGM regulatory contexts. It should not be used as a universal synonym for every digitally represented instrument.
The DFSA uses “Crypto Token” within its DIFC regime; it is not interchangeable with the DFSA's broader descriptions of digital assets.
Virtual Asset Service Provider — used by VARA and across the UAE AML / Travel Rule context.
ADGM's permissioning concept for regulated financial services activities, including applicable activities in relation to Virtual Assets.
The terminology used by the CBB in Module CRA for regulated crypto-asset services in Bahrain.
VARA's framework is activity-specific. The applicable licence and rulebooks depend on the VA Activities carried on by the VASP.
Questions boards and control functions ask first.
Does a Dubai business simply need a “crypto licence”?
No. VARA's framework is based on specified VA Activities. The business should identify the precise activities and the applicable compulsory and activity-specific rulebooks. Depending on the structure, establishment with DET or a relevant free-zone licensor also forms part of the application pathway.
Is an IPA the same as a full VARA licence?
No. VARA describes an In-Principle Approval as a conditional step in the licensing process. An IPA holder cannot commence virtual asset activities or service clients until the full VASP licence has been obtained.
Does the DIFC use VARA?
No. VARA's perimeter expressly excludes the DIFC. The DFSA regulates financial services activities involving Crypto Tokens in the DIFC.
What is the UAE Virtual Assets Travel Rule?
It is an in-force CBUAE rule addressing specified Virtual Asset Transfers involving VASPs, including required originator/beneficiary information and additional risk-based controls for transfers to or from unhosted wallets.
Has the UAE AML/CFT legal framework changed?
Yes. VARA's published federal AML/CFT laws reference Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025 as the current listed federal laws / implementation regulation, superseding the prior 2018/2019 framework referenced there.
What changed in the DFSA Crypto Token regime in 2026?
The updated regime took effect on 12 January 2026. Firms are directly responsible for reasoned, documented Crypto Token suitability assessments and ongoing monitoring rather than relying on a DFSA-maintained recognised-token list.