Over the past 12 months, the United Arab Emirates (UAE) has solidified its position as a leading global hub for blockchain and virtual asset services companies. The jurisdiction has seen a surge in both regulated Virtual Asset Service Providers (VASPs) and unregulated Web3-native businesses, creating a vibrant and fast-evolving ecosystem. From the leading exchanges, such as Binance, Crypto.com and Bybit, and custodians like BitGo and Laser Digital, to DeFi protocols and tokenisation platforms, the UAE continues to attract top-tier players from around the world. Real-world asset (RWA) tokenisation has also emerged as a particularly hot topic, with the regulatory framework steadily evolving to support institutional-grade initiatives in this space.

A unique hallmark of the UAE’s regulatory environment is its multi-layered regulatory structure: five different regulators oversee VASP activities across distinct jurisdictions.

Onshore UAE

At the federal level, covering what is commonly referred to as “onshore” or “mainland” UAE, the Central Bank of the UAE (CBUAE) and the Securities and Commodities Authority (SCA) regulate payment tokens and investment-related virtual assets, respectively.

In the Emirate of Dubai (excluding DIFC), the Virtual Assets Regulatory Authority (VARA), established in 2022, operates a bespoke licensing regime specifically tailored to the virtual asset industry.

Financial Free Zones

In parallel, the UAE has two Financial Free Zones, Abu Dhabi Global Market (ADGM) and Dubai International Financial Centre (DIFC). ADGM is regulated by the Financial Services Regulatory Authority (FSRA), while DIFC is regulated by the Dubai Financial Services Authority (DFSA).

Each Financial Free Zone operates under its own legal system based on common law and has independent regulatory frameworks and courts that govern financial activities conducted within its jurisdiction.

Rather than being a regulatory hurdle, this layered structure offers flexibility and choice for founders and businesses. It enables companies to choose the regime that best aligns with their business model. However, navigating this framework requires careful planning and specialist local legal and regulatory expertise.

UAE’s Appeal

The UAE’s appeal extends far beyond its regulatory clarity. It offers one of the most business-friendly environments globally, with 0% personal income and capital gains tax, and a low corporate tax rate of just 9%. Its geopolitical neutrality, stable banking system, and world-class infrastructure have made it a magnet for capital, talent and innovation.

Moreover, being a licensed VASP in the UAE provides access not only to the local and regional market but also to over three billion consumers in Africa, Asia and South Asia – jurisdictions where foreign VASPs are not expressly prohibited from marketing. This global access makes the UAE a strategic launchpad for blockchain and Web3 companies seeking international reach.

In addition, the UAE offers a streamlined business setup process, investor-friendly visa pathways, and ease of relocation for global teams and venture capitalists. Combined with a rapidly growing talent pool and an active investor ecosystem, these features make the UAE a premier destination for blockchain and digital asset businesses.

In the UAE, blockchain business models fall into two distinct categories:

• regulated VASPs; and
• unregulated blockchain and Web3 businesses.

Regulated VASPs, such as exchanges, custodians and broker-dealers, must obtain regulatory licences from one of the UAE’s five regulatory authorities prior to operations or face multi-million dirham penalties.

Unregulated Web3-native projects include software houses or so-called “labs” for L1 and L2 protocols, DeFi applications and decentralised infrastructure providers. These companies are drawn to the UAE for its founder-friendly environment, streamlined company formation, ease of relocating global teams, and high quality of life.

Supporting this vibrant ecosystem is a growing number of crypto-native service providers, such as software and infrastructure companies and professional services providers.

Additionally, a large number of venture capital funds are actively deploying capital into the ecosystem – some using proprietary funds (and thus unregulated), and others raising external capital, making them subject to regulation as a fund.

This dual-track structure – regulated and unregulated – has enabled the UAE to cultivate a uniquely dynamic crypto economy where both licenced institutions and permissionless innovators can thrive.

Onshore UAE

Under UAE federal law, there is currently no specific definition of digital asset ownership, nor established criteria for determining it. There has also not been clear case law in that regard. 

In a recent update, VARA clarified that virtual assets may be classified as either objects or rights under the UAE Civil Transactions Law (Federal Law No 5 of 1985). This distinction directly affects how ownership is recognised, transferred and protected. Treatment will depend on the nature of the virtual asset and the legal context and must be assessed case by case. This provision takes effect on 19 June 2025.

Financial Free Zones

In DIFC, a financial freezone in the UAE with its own legal framework, ownership and control of digital assets has been specifically addressed. Under the DIFC’s Digital Assets Law No 2 of 2024 (effective 8 March 2024), legal ownership (title) of a digital asset is acquired when a person gains control of the asset and intends to exercise such control. “Control” is defined as the exclusive ability to prevent others from accessing, benefiting from or transferring the asset.

A transfer of a digital asset is considered final when the transferee obtains control of the asset, such as through control of the relevant private key or access mechanism, and when the transferor has the intention to transfer title.

ADGM does not specifically address the ownership of digital assets.

The characterisation of digital assets is primarily based on their function and the regulatory body exercising jurisdiction.

Onshore UAE

The SCA distinguishes between “virtual assets” and “virtual assets for payment purposes”, the latter also being referred to as “payment tokens” by the CBUAE. The SCA and CBUAE regulate these categories separately. The SCA applies the term “virtual assets” to assets used for investment purposes and classifies them into three categories within its regulatory framework:

• digital securities, which are encrypted assets tradable on distributed ledger technology and regulated similarly to traditional securities;
• digital commodity derivatives contracts, which are treated as securities linked to traditional derivatives; and
• virtual assets for investment purposes, which refer to digital representations of value used for investment and that are not fiat currency, securities or other financial instruments.

These three categories fall under the SCA’s jurisdiction.

In contrast, virtual assets used for payment purposes, known as stablecoins in the industry, are classified by the SCA as “virtual assets for payment purposes” and by the CBUAE as “payment tokens” and are regulated exclusively by CBUAE.

The SCA’s Virtual Asset Framework expressly excludes service tokens and non-fungible tokens (NFTs) that do not represent virtual assets for investment purposes; notably, these terms are not defined by the SCA and are currently outside its regulatory scope. The Framework also does not apply to loyalty programmes, mining software, or any digital assets not evaluated by the SCA. Only virtual assets listed with and traded through licensed Virtual Asset Platform Operators, in accordance with the SCA’s official asset list, fall within the regulatory perimeter.

VARA

VARA categorises virtual assets to determine their regulatory treatment in relation to issuance. The framework distinguishes between three categories of VA issuances.

• Category 1 includes those that require a VARA licence and covers fiat-referenced virtual assets (eg, stablecoins), asset-referenced virtual assets (ie, tokenised representations of real-world assets) and any other virtual asset that may be designated by VARA.
• Category 2 captures all VA issuances that do not fall within Category 1 and are not exempt. These do not require a VARA licence; however, placement or distribution must be conducted through or by a licensed distributor.
• Exempt VA issuances include non-transferable virtual assets, redeemable closed-loop virtual assets, and any other asset VARA may exempt through future guidance.

Financial Free Zones

Within the ADGM, the FSRA determines the characterisation of digital assets under its Virtual Asset Framework and broader Financial Services and Markets Regulations 2015 (FSMR), based primarily on the nature, function and economic characteristics of the asset.

The FSRA defines a “virtual asset” as a digital representation of value that can be digitally traded and functions as a medium of exchange, unit of account or store of value, but is not legal tender and is not issued or guaranteed by any jurisdiction.

The FSRA classifies digital assets into five categories:

• virtual assets (eg, non-fiat cryptocurrencies like Bitcoin), which are treated as commodities and not regulated as “specified investments” under FSMR, but require licensing for activities such as custody, brokering and operating exchanges;
• digital securities, which have features akin to traditional securities and are fully regulated as such under FSMR;
• fiat tokens, including stablecoins backed by fiat currency, which are treated as digital representations of fiat and regulated as money transmission services if used as payment instruments;
• utility tokens, which provide access to specific products or services and are generally treated as commodities, provided they are not deemed regulated investments; and
• derivatives and collective investment funds involving digital assets, which are regulated under traditional capital markets provisions.

Notably, the FSRA limits its Virtual Asset Framework to activities involving “accepted virtual assets”, and excludes initial coin offerings (ICOs), capital formation activities, loyalty points, mining software and virtual asset schemes not recognised under its regulatory perimeter.

In DIFC, the DFSA does not adopt a formal categorisation of digital assets into types such as securities, commodities or utilities. Instead, it applies a recognition-based model focused on whether a digital asset qualifies as a “crypto token”, a cryptographically secured token intended to be used as a medium of exchange or for investment purposes.

Only crypto tokens that are individually recognised by the DFSA may be used for regulated financial services, while unrecognised tokens are restricted. DFSA also has a category of “prohibited tokens”, being algorithmic tokens and privacy tokens.

Investment tokens and excluded tokens, such as NFTs and utility tokens used for non-financial access purposes, are not treated as crypto tokens under this framework.

Onshore UAE

Under its existing framework and guidelines, the SCA classifies and regulates tokenised securities as “digital securities”, where they are considered to be traditional securities represented and transferred using distributed ledger technology. Although these instruments take the form of encrypted digital assets, they are treated as traditional securities for legal and regulatory purposes.

However, their digital nature requires compliance with technological requirements set by the SCA, which may evolve over time to ensure secure and reliable deployment within a DLT-based environment. Accordingly, such tokenised securities do not fall under the SCA’s broader “virtual assets” framework for investment tokens, but are regulated under existing capital markets rules with modifications to accommodate their digital form.

In January 2025, the SCA issued a draft law that proposed clear definitions for various types of tokens. It defined security tokens, with examples including equity tokens and bond tokens, and also introduced the concept of commodity tokens, such as gold tokens and oil tokens.

The draft was open for public consultation until mid-February 2025, and the industry is now awaiting the release of the final version of the law.

Financial Free Zones

In ADGM, tokenised securities are classified as “digital securities” if they possess the features and characteristics of conventional securities such as shares, debentures or fund units. Digital securities are legally deemed to be securities and are regulated accordingly. All related financial services activities, including issuance, trading, custody and investment management, must comply with FSMR requirements.

Firms conducting these activities must be licensed or approved by the FSRA as Financial Services Permission holders.

The FSRA applies a technology-neutral approach, treating digital securities under the same framework as traditional securities while ensuring compliance with standards relevant to distributed ledger environments.

In DIFC, tokenised securities are classified as “investment tokens” if they represent rights or obligations substantially similar in nature, purpose or effect to traditional financial instruments. Where a token is the same as, or substantially similar to, a share, debenture, warrant, certificate, fund unit or structured product, it is classified as a security token and is treated as a security under DFSA rules. Tokens that mirror the features of options or futures are classified as “derivative tokens”.

Investment tokens are regulated in the same way as their underlying traditional instruments and are subject to the full scope of financial services regulation, including licensing, disclosure and conduct of business obligations. The DFSA uses a substance-over-form approach, focusing on the economic characteristics and legal rights associated with the token to determine its regulatory treatment.

Onshore UAE

CBUAE regulates “payment tokens” under its Payment Token Services Regulation (PTSR) (effective 21 August 2024), where a payment token is defined as a virtual asset that purports to maintain a stable value by referencing the value of either:

• the same fiat currency in which the token is denominated; or
• another payment token that is also denominated in the same fiat currency.

This definition is designed to capture fiat-backed stablecoins, which aim to maintain price stability through underlying fiat reserves.

While the definition of payment token under the PTSR is broad enough to include various token types, the regulation itself is intended to apply to stablecoins, specifically those that maintain a stable value through reference to fiat currency or fiat-pegged tokens.

Certain low-risk tokens that technically fall within the definition of payment token are, however, explicitly exempted from the scope of the PTSR. These include tokens used in closed-loop schemes such as loyalty or bonus point programmes, and tokens used exclusively for purchasing non-financial goods or services from the issuer or affiliated merchants. Examples include airline miles or supermarket reward tokens that cannot be redeemed for cash.

Under the PTSR, algorithmic stablecoins, which seek to maintain their value through programmed supply adjustments or mathematical formulas rather than fiat reserves, are strictly prohibited across the UAE.

VARA classifies stablecoins as Fiat-Referenced Virtual Assets (FRVAs). These are defined as a type of virtual asset that purports to maintain a stable value by referencing one or more fiat currencies, while not holding legal tender status in any jurisdiction. FRVAs are regulated under VARA’s dedicated FRVA Rules, which establish the framework for their issuance and oversight within the Emirate of Dubai.

Financial Free Zones

The FSRA characterises fiat-backed stablecoins as “fiat tokens”, which are treated as a form of digital representation of fiat currency. The FSRA permits only those stablecoins that are fully backed 1:1 by the same fiat currency they purport to represent, allowing no fractional or synthetic backing mechanisms. When used as a payment instrument, a fiat token is regulated as Providing Money Services under the FSMR, specifically under the framework applicable to Money Transmission.

Importantly, the FSRA views fiat tokens as a mechanism for storing value, similar to e-money. This aligns with its regulatory approach of ensuring stablecoins used in ADGM offer full redemption at par value, backed by high-quality, liquid fiat reserves. Algorithmic stablecoins, which rely on supply manipulation or other non-collateral-based mechanisms to maintain a peg, are not permitted within the FSRA framework, consistent with broader UAE policy prohibiting such models across all jurisdictions.

The DFSA characterises fiat-backed stablecoins as “fiat crypto tokens”, which are a subset of crypto tokens. A crypto token qualifies as a fiat crypto token if its value is intended to be stabilised or its volatility reduced by reference to a single fiat currency. Typically, these tokens are backed by financial assets that correspond to the fiat currency they reference and are commonly referred to as stablecoins.

DFSA explicitly prohibits the use, or proposed use, of crypto tokens that employ algorithmic mechanisms to stabilise price through supply adjustments.

The DFSA also recognises that other types of stablecoins exist, such as those pegged to commodities, gold, or baskets of currencies. While these do not meet the definition of a fiat crypto token, they may still fall under the broader definition of a crypto token if used in the DIFC. However, unless they qualify as an investment (eg, a derivative or a fund unit), they would be subject to DFSA’s crypto token recognition regime and would need to be separately assessed.

Onshore UAE

The SCA and VARA do not define NFTs or utility tokens separately, instead applying broad definitions of virtual assets. The SCA excludes NFTs and service tokens from its Virtual Asset Framework, while VARA distinguishes only between Virtual Assets and FRVAs, such as stablecoins.

Financial Free Zones

NFTs

In ADGM, NFTs are not classified as virtual assets and are currently outside the FSRA’s formal regulatory perimeter. NFTs are recognised as unique, non-fungible cryptographic tokens that are not interchangeable or tradable at equivalency, and therefore do not fall within the scope of virtual assets regulated under the FSRA’s framework.

While unregulated, NFT-related activities may be conducted in ADGM under limited conditions. Specifically, FSRA permits regulated MTFs that are also authorised virtual asset custodians to engage in NFT activities, provided they do so through a separately licensed, unregulated NFT entity. This entity may engage commercially with issuers and market participants; while trading and custody functions must be outsourced back to the regulated MTF/Custodian. The FSRA applies AML/CTF requirements to these activities and imposes custody rules for Public Funds holding NFTs.

In DIFC, DFSA defines an NFT as a token that is:

• unique and not fungible with any other token;
• related to an identified asset; and
• used to prove ownership or provenance of that asset.

NFTs typically relate to items such as digital art, music, collectibles or intellectual property. To qualify as an NFT under this definition, the token must be both unique and non-fungible, and clearly linked to a specific, identifiable asset.

The DFSA applies a substance-over-form approach in determining whether a token meets the definition of an NFT. If a token does not qualify, it may instead fall within the definition of a crypto token, and would then be subject to the DFSA’s broader virtual asset regulatory framework,

Utility tokens

In ADGM, utility tokens are treated as commodities and are not classified as specified investments under the FSMR. They are excluded from regulation unless they function as accepted virtual assets or fall under a Recognition Order. As such, transactions involving utility tokens do not constitute regulated activities, provided the tokens are used solely to access a specific product or service and do not carry investment-like features.

In DIFC, DFSA defines a utility token as a token that can be used solely to pay for, receive a discount on, or access a product or service. For a token to qualify as a utility token, its sole purpose must be to grant access to specific goods or services, without conferring financial rights or obligations.

The DFSA adopts a function-based approach, meaning that if a token is used at any point in its lifecycle for other purposes (such as payment, investment or trading as a financial instrument) it is likely to fall outside the definition of a utility token and instead be treated as a crypto token or, depending on its characteristics, an investment token.

Payments using virtual assets are restricted in the UAE under the PTSR. As of August 2025, businesses may only accept:

• approved AED-backed stablecoins (payment tokens issued by licensed entities); and
• approved foreign payment tokens, but only when used to purchase other virtual assets or virtual assets derivatives.

These rules apply to all merchants and persons acting in the course of business within the UAE. A transitional period remains in effect until August 2025, after which full compliance with the PTSR will be mandatory.

Importantly, PTSR does not apply to the Financial Free Zones.

Onshore UAE

There is no explicit legal or regulatory framework governing the use of digital assets as collateral. 

Financial Free Zones

In the DIFC, digital assets are now legally recognised as a form of property and can be used in secured transactions, including as collateral, provided the security interest is properly structured and documented. The legal framework supports the creation, perfection and enforcement of such interests.

In ADGM, while digital assets are regulated and recognised under the Virtual Asset Framework, there is currently no specific regulation addressing their use as collateral. Any such arrangement would need to be assessed on a case-by-case basis under existing commercial and financial services laws.

Onshore UAE

There are currently no specific laws or binding judicial decisions that define or expressly address the enforceability of smart contracts. To date, there appear to be no reported judicial decisions on the enforceability of such contracts. 

Financial Free Zones

In ADGM, the legal framework similarly does not define or directly reference smart contracts. However, the Electronic Transactions Regulations 2021 recognise the legal validity of electronic contracts and records, which could support the use of coded arrangements, provided they satisfy general contract formation principles.

The DIFC, however, has introduced limited legal recognition through the concept of a “Coded Contract” in its Contract Law. A Coded Contract is defined as an agreement composed entirely of “Coded Terms” that are executed by a computer program, with no natural language version. While this represents a step toward legal recognition, enforceability would still depend on satisfying basic contract law requirements such as mutual consent and capacity.

Onshore UAE

There are currently no specific prudential or conduct of business rules that apply exclusively to investment funds or regulated firms with digital asset exposure. However, such firms are expected to operate within the bounds of the SCA’s general Virtual Asset Framework and ensure compliance with applicable licensing and AML/CFT obligations.

Financial Free Zones

The FSRA permits companies to deal only in accepted virtual assets (AVAs). Each company must apply for and obtain FSRA approval for the specific virtual assets it wishes to use. Approval is granted on a firm-specific basis, meaning that an AVA approved for one company is not automatically approved for another. All entities are required to comply with prudential requirements including capital adequacy, custody standards and risk management, in addition to general conduct of business rules under the FSRA Rulebooks.

Similarly, DFSA imposes restrictions through a recognition framework for crypto tokens. Only recognised crypto tokens may be used or held by licensed entities, and exposure must align with the firm’s approved activities. The DFSA also enforces strict conduct of business rules, including requirements on client disclosure, risk warnings, governance and AML/CFT compliance.

In both Financial Free Zones, unauthorised exposure to non-recognised tokens, or insufficient controls around custody or valuation, could lead to regulatory sanctions.

The UAE offers sandbox-like initiatives through certain regulators, particularly within Financial Free Zones, to support blockchain-based projects.

Onshore UAE

CBUAE

In 2023, the CBUAE introduced the Sandbox Conditions Regulation, effective from 15 April 2024. This regulation allows Licensed Financial Institutions, including VASPs, to test innovative financial products, services or business models within a defined, supervised space and time frame. It offers a temporary exemption from the licensing requirement, enabling participants to structure their business in compliance with regulatory standards while allowing the Central Bank to assess the impact on its objectives.

VARA

VARA does not currently operate a formal sandbox programme. However, it has demonstrated a willingness to accommodate innovative business models through bespoke regulatory pathways.

For example, Mantra Chain was granted a VASP licence with DeFi extension, allowing it to offer decentralised finance products under a special licensing regime.

Additionally, in collaboration with the Dubai Land Department (DLD), VARA is exploring frameworks for real estate tokenisation. While not formally announced as a sandbox, this initiative may potentially allow projects intending to tokenise property to benefit from special regulatory treatment under supervisory oversight.

Financial Free Zones

ADGM’s FSRA RegLab sandbox

ADGM launched its Regulatory Laboratory (RegLab) in November 2016, a tailored regulatory framework for innovative financial technology businesses. It allows new and existing companies to test innovative financial technologies in a controlled environment for up to two years, with a customised set of regulatory requirements. At the end of this period, participants may transition to full authorisation or exit if not ready to scale.

DIFC’s DFSA Tokenisation Regulatory Sandbox

In March 2025, the DFSA launched a dedicated Tokenisation Regulatory Sandbox to support firms developing tokenised investment products and services.

This initiative is part of the DFSA’s broader Innovation Testing Licence (ITL) programme and includes two stages:

• expression of interest – firms submit proposals for tokenisation-related innovations; and
• ITL tokenisation cohort – selected firms test their products in a controlled environment with bespoke regulatory guidance.

Successful participants may progress to full licensing. This initiative is tailored to support safe experimentation while preserving market integrity.

The UAE’s regulatory approach is closely aligned with international standards, particularly the recommendations of the Financial Action Task Force (FATF). The existing AML and CFT framework follows key FATF guidelines to mitigate risks associated with the use of blockchain technology and virtual assets.

In addition to the aforementioned requirements related to AML/CFT compliance, VASPs must adopt a risk-based approach, considering factors such as customer profiles, transaction volumes and geographic exposure. They are also obligated to comply with the FATF Travel Rule by collecting and sharing information on parties involved in virtual asset transfers above AED3,500.

Please see 4.1.1 Regulatory Overview.

There are currently no self-regulatory organisations or trade groups in the UAE that perform regulatory or quasi-regulatory roles in relation to blockchain or digital asset activities.

Please see the UAE Trends & Developments chapter in this guide.

There have been a few important judicial decisions interpreting the legal regime applicable to blockchain and virtual assets in both onshore UAE and Financial Free Zones under common law contexts.

Onshore UAE

In the mainland UAE, although court decisions do not create binding precedent, recent judgments illustrate how courts are approaching virtual assets-related disputes. In Dubai Labour Court Case 1739/2024, the court recognised cryptocurrency (specifically project’s issued utility tokens) as a valid part of a bonus scheme under an employment contract, a notable shift from a 2023 decision where similar claims were rejected due to evidentiary deficiencies. This ruling indicates increasing judicial openness to enforcing digital asset transactions within contractual frameworks.

Similarly, in Dubai Court of First Instance, Case 1024/2024, the court imposed tortious liability for fraudulent crypto investments and affirmed the personal culpability of a director who controlled a crypto wallet, highlighting the necessity of robust evidence and clarifying liability principles in digital asset misuse.

Financial Free Zones

In the DIFC, a common law jurisdiction, the Court of Appeal in Gate Mena DMCC v Tabarak Investment Capital Ltd [2023] DIFC CA 002 recognised Bitcoin as a distinct form of property and ruled that control, not possession, determines legal rights over crypto-assets. As the DIFC operates on a common law model, this decision is particularly important. It was issued prior to the enactment of the DIFC Digital Assets Law and has played a foundational role in shaping the emerging legal framework for digital assets within that jurisdiction.

Onshore UAE

The UAE has established strict requirements for VASPs. Non-compliance can result in severe penalties, including fines of up to AED50 million, the forfeiture of profits and potential criminal investigations by the Public Prosecutor, which can be imposed by each CBUAE, SCA and VARA.

To date, Dubai’s VARA has been the most active regulator in intensifying its enforcement efforts against unlicensed VASPs and other entities that violate VARA regulations. Key enforcement measures include the following.

• Public warning: VARA issued several market-wide public warnings, advising individuals and entities to avoid engaging with unlicensed firms.
• Cease-and-desist orders: VARA has issued cease-and-desist orders to seven entities found operating without the necessary licences or in breach of marketing regulations. Each entity was ordered to immediately halt all virtual asset-related activities and refrain from any further marketing or advertising of such services.
• Fines: Various fines have been imposed on non-compliant entities, ranging from AED50,000 for breaching marketing regulations to AED10 million for serious market offences. Importantly, VARA has also fined individuals, the founders of companies that are in violation of the regulations.
• Ongoing investigations: Additionally, there are ongoing investigations in collaboration with local authorities, suggesting the potential for further enforcement actions.

Financial Free Zones

ADGM and DIFC follow a similar approach: initially, a warning is issued, and if non-compliance persists, fines may be imposed or, in some cases, a licence can be revoked.

For example, in April 2025, the FSRA of ADGM imposed fines totalling USD8.85 million on the Hayvn Group and its founder. The investigation revealed that Hayvn operated unauthorised virtual asset services through unregulated entities, failed to maintain proper risk management systems, and provided false information to regulators and banking partners. As a result, Hayvn’s licence was revoked, and the founder was banned from holding any financial services roles in ADGM.

In June 2023, the UAE introduced a corporate tax regime, according to which all businesses are now subject to a 9% tax on taxable income exceeding AED375,000, while income below this threshold is taxed at 0%. Although certain activities carried out within commercial free zones may be exempt from corporate tax under qualifying conditions, most business activities are still subject to it.

Companies in the virtual assets space should work with specialised tax advisers familiar with both UAE corporate tax regulations and digital assets-based business models to ensure compliance while optimising their tax position.

In November 2024, the UAE Federal Tax Authority (FTA) announced an exemption of all cryptocurrency transactions from value-added tax (VAT). Crucially, this exemption applies retroactively from 1 January 2018, providing clarity and eliminating historical tax liabilities for businesses and individuals involved in virtual assets trading.

There is nothing to report for this jurisdiction.

Onshore UAE

The foundation of data protection for all entities in the UAE, including VASPs, is established by the Federal Decree Law No 45 of 2021 concerning the Protection of Personal Data (PDPL).

Additionally, Dubai’s VARA has set out its own additional comprehensive data protection requirements for VASPs, detailed in the Technology and Information Rulebook.

Financial Free Zones

ADGM and DIFC, however, have their own privacy laws and regulations, specifically Data Protection Law No 5 of 2020 in the DIFC and the Data Protection Regulations of 2021 in the ADGM.