The short answer to “is crypto legal in the UAE?” is yes. The longer answer is that the UAE did not legalise crypto by leaving it alone; it built one of the most detailed licensing systems in the world, split between emirate, free-zone and federal regulators. Which rulebook applies depends on where the firm is based and what it does.
For an individual, that split mostly matters in one way: it tells you where to look up the platform you are about to send money to. For anyone running a crypto business, it decides which regulator you answer to.
This guide is independent general information, not legal advice. Regulations here move quickly, so we link the official registers and notices for every claim you would want to verify.
Is crypto legal in the UAE? Yes, under licences
Buying, holding and selling crypto as an individual is legal in every emirate. What is regulated is the business of providing crypto services: running an exchange, acting as a , holding client assets in , lending, managing portfolios or issuing tokens. A company doing any of these for UAE customers needs a licence from the regulator responsible for its location.
Crypto is not legal tender. The dirham is the national currency, and the Central Bank has separate rules for using tokens as a means of payment (covered below). So “legal to own and trade” and “accepted as money” are two different questions.
The practical consequence for you: a licensed platform has to run checks, keep client money in UAE bank accounts, follow conduct rules and publish risk warnings. An unlicensed platform owes you none of that, and regulators have said clearly that they will not help you recover funds lost there.
Who regulates crypto in the UAE: the map
| Where the firm operates | Regulator | What to know |
|---|---|---|
| Dubai, incl. its free zones, except DIFC | VARA | Licences by activity; public register online |
| DIFC (Dubai) | DFSA | Recognised token list abolished from 12 Jan 2026 |
| ADGM (Abu Dhabi) | FSRA | Financial Services Permissions; accepted assets |
| Rest of the UAE, onshore | CMA (formerly SCA) | Federal regime; renamed 1 Jan 2026 |
| Payments, stablecoins, banks | CBUAE | Payment token rules; new Central Bank law |
VARA (Virtual Assets Regulatory Authority) was created by Dubai Law No. 4 of 2022 and covers all of Dubai, including free zones like DMCC, except the DIFC. The DFSA regulates the Dubai International Financial Centre, a separate common-law free zone. The FSRA (Financial Services Regulatory Authority) regulates the Abu Dhabi Global Market. The CMA (Capital Market Authority), which replaced the Securities and Commodities Authority, covers onshore activity in the other emirates and in Abu Dhabi outside ADGM. The CBUAE (Central Bank) sits across all of them for payments, stablecoins and banking.
Firms in or from Dubai are licensed by VARA, firms elsewhere by the CMA, and reports describe the two licences as mutually recognised. That is why a large exchange can hold more than one UAE licence through different entities.
A quick way to apply the map: ask where the firm is, not where you are. A Sharjah resident using an app run by a Dubai-licensed entity is a client of a VARA-regulated firm; the same person using a platform licensed in ADGM is protected by FSRA rules. If a platform cannot tell you which UAE entity serves you and under which regulator, treat that as your answer. Our comparison of licensed exchanges lists the entity and regulator for each platform it covers.
VARA in Dubai: rulebooks, activities and IPA vs full licence
VARA licenses specific activities, not companies in general. Its categories include Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, and Virtual Asset Issuance. A firm can only offer what its licence covers. For example, the register shows Binance FZE (VL/24/04/001) with broker-dealer, exchange (including derivatives), lending and management activities, while BitOasis Technologies FZE holds a broker-dealer licence only. Bybit Fintech FZE’s VARA licence, announced in October 2026, is for spot trading; derivatives are excluded.
The detailed rules sit in VARA’s rulebooks at rulebooks.vara.ae. Version 2.0 was published in May 2025, with a 30-day transition, tightening rules on margin trading, leverage and the definition of a qualified investor (VARA news). Retail clients can only use services VARA expressly allows for them, which is why some licensed exchanges offer derivatives only to qualified or institutional investors.
IPA vs full licence: the distinction that matters most
Licensing at VARA happens in stages. An means the regulator has accepted an application to proceed; it is not permission to operate. VARA states that IPA holders are strictly prohibited from initiating operations until they receive a full licence. When a firm’s press release says “approved by VARA”, check which stage it means. The public register currently lists 60 active licensees; an IPA alone does not put a firm in a position to serve you.
DIFC and ADGM: the two financial free zones
DIFC (DFSA). Dubai’s financial centre has its own crypto token regime. Until recently the DFSA kept a central list of recognised crypto tokens (bitcoin, ether and a handful of others). Under updated rules in force from 12 January 2026, that list was abolished and firms must run and document their own suitability assessment for each token (DFSA). The DFSA still recognises fiat-backed tokens separately; USDC, EURC and RLUSD were recognised at that date.
ADGM (FSRA). Abu Dhabi’s international financial centre licenses exchanges, multilateral trading facilities and custodians through Financial Services Permissions, and only “accepted” virtual assets may be used. The FSRA also keeps a list of Accepted Fiat-Referenced Tokens; USDT, for example, is accepted on a growing list of networks. Major names have moved here: Binance announced three FSRA authorisations in December 2025 for its global platform. The FSRA is also an active enforcer: in April 2025 it cancelled Hayvn’s permission and fined the group USD 8.85 million (ADGM). If you live in Abu Dhabi, our Abu Dhabi crypto guide covers the local options.
Federal level: the CMA and the Central Bank
CMA (formerly SCA). Since 1 January 2026, the federal Securities and Commodities Authority has been replaced by the Capital Market Authority under Federal Decree-Law No. 32 of 2025. The federal virtual asset framework rests on Cabinet Resolution No. 111 of 2022, with the CMA issuing a new virtual asset resolution in 2026 that replaced the former SCA rules, according to law-firm summaries. Covered firms were given until 1 January 2027 (extendable) to regularise. In practice, the CMA licenses crypto platforms serving the UAE outside Dubai and the financial free zones; Bybit’s federal entity, for instance, holds a Virtual Asset Platform Operator licence and does not serve Dubai.
CBUAE — payment tokens. The Central Bank’s Payment Token Services Regulation (PTSR), issued in June 2024, governs issuing, converting and transferring payment tokens (stablecoins) in or into the UAE, excluding the DIFC and ADGM. It separates Dirham Payment Tokens, which need a licence, from foreign payment tokens such as USDT and USDC. In broad terms, foreign stablecoins cannot be used to pay for goods and services priced in AED; merchant payments are meant to run through licensed AED tokens or regulated providers (Hadef summary). It is not a ban on owning or trading stablecoins.
CBUAE — the new Central Bank law. Federal Decree-Law No. 6 of 2025, in force from September 2025, brings crypto payments, digital stored value and technology that “facilitates” licensed activity (reports say this reaches DeFi infrastructure) into Central Bank licensing, with very large maximum fines. The transition period for existing operators was reported to run to around September 2026.
AML law. Federal Decree-Law No. 10 of 2025 replaced the previous anti-money-laundering law in October 2025. It explicitly covers virtual asset service providers, which now carry bank-level customer due diligence and direct reporting duties.
RAK Innovation City, DMCC and other free zones: registrars, not regulators
Several free zones market themselves to crypto companies, and this causes confusion. RAK DAO (Ras Al Khaimah Digital Assets Oasis) was rebranded Innovation City in September 2025. It is a free-zone business registrar for Web3, AI and tech companies, issuing commercial licences for activities like software and protocol development. It is not a financial regulator: its own site says regulated activities must be approved by the CMA before they start. An exchange or custodian based there still needs a financial licence. More on the emirate on our Ras Al Khaimah page.
The same logic applies to the DMCC Crypto Centre in JLT, which hosts hundreds of crypto companies: a DMCC trade licence registers the company, but any virtual asset service it provides to the public still needs VARA. A company’s trade licence from any free zone does not, by itself, make it a licensed crypto platform.
Rules you will notice as a user
The travel rule. Under VARA’s Compliance and Risk Management Rulebook, for virtual asset transfers above AED 3,500, the sending provider must collect and hold originator and beneficiary information (names, account or wallet address, originator’s address), and the receiving provider must have it before releasing the funds (VARA rulebook). That is why a licensed exchange asks who you are sending to. The is a global standard; the AED 3,500 threshold is VARA’s.
Marketing rules. VARA’s Marketing Regulations apply to anyone marketing virtual assets in or into the UAE, licensed or not. Promotions must carry a prominent risk warning, and VARA’s suggested wording is that virtual assets may lose their value in part or in full and can be extremely volatile.
Privacy coins. VARA prohibits issuing anonymity-enhanced cryptocurrencies and all related activity, so coins such as Monero are not offered by Dubai-licensed platforms.
Who can open an account. Licensed platforms require you to be 18 or over and verify your identity with an Emirates ID or passport plus address checks. Client money must sit in a client account at a UAE bank.
Paying with crypto in the UAE
Paying a shop in USDT is not a regulated retail flow onshore. Under the PTSR, accepting tokens as payment for AED-priced goods and services is restricted to licensed Dirham Payment Tokens (and, in limited cases, registered foreign tokens). The first AED stablecoin, AE Coin, received Central Bank in-principle approval in October 2024, and RAKBANK has in-principle approval for its own; how widely they are available to retail users is still unclear.
What you see in practice is conversion: a merchant or developer that “accepts crypto” usually uses a licensed provider that converts your coins to dirhams before settlement. Dubai property deals work this way; see our guide on buying property with crypto in Dubai. Crypto debit cards follow a similar logic: the card spends fiat after a conversion.
Enforcement: what happens to unlicensed firms
The regulators publish enforcement notices, and the pattern is clear: operating without a licence, or beyond its scope, brings fines, cease-and-desist orders and public alerts. Examples from VARA’s regulatory notices:
- October 2025: 19 unlicensed firms fined between AED 100,000 and AED 600,000, with cease-and-desist orders, for unlicensed activity and marketing breaches.
- June 2026: KuCoin (Peken Global) fined for providing broker-dealer and exchange services in Dubai without a licence and ordered to stop; MEXC was also fined that month.
- Licensed firms too: CoinMENA FZE was fined in June 2026 for AML failures, and Fuze (Morpheus Software Technology FZE) was fined in August 2025 for AML failures and for conducting activity beyond its licence conditions.
- Consumer alerts: VARA has publicly warned about brands including BTC Bay, Coincashy and Koto Crypto, none of which is licensed.
Two lessons follow. A licence is not a guarantee of good conduct, but it means a regulator supervises the firm and acts when things go wrong. And an unlicensed platform serving UAE residents is operating against the rules, so you would have no regulator on your side in a dispute. Our guide to crypto scams in the UAE covers how fake platforms imitate licensed ones.
How to check a crypto licence in the UAE
- Step
Find the platform's legal entity name
Look in the app’s or website’s footer, terms of use or legal page for the exact entity that serves UAE customers, such as “Binance FZE” or “OKX Middle East Fintech FZE”. Brand names and legal names often differ, and a global group may serve the UAE through a different entity from other countries.
- Step
Pick the right register for that entity
If the entity is in Dubai outside the DIFC, use the VARA public register. DIFC firms appear on the DFSA’s public register, ADGM firms on the FSRA’s register, and federally licensed firms are listed by the CMA. A firm claiming to be “licensed in Abu Dhabi” should be findable on the FSRA register.
- Step
Check status and licence number
Confirm the entry says Active and note the licence number (VARA numbers look like VL/24/04/001). A suspended, pending or missing entry means the firm should not be onboarding you for that service.
- Step
Check the activities, not just the name
Read which activities are licensed. A broker-dealer licence does not cover running an exchange, and an exchange licence may exclude derivatives or retail clients. Match the licence to what you plan to do.
- Step
Rule out an IPA and check for warnings
Make sure the firm holds a full licence, not just an in-principle approval. Then search the regulator’s notices and alerts page for the brand name, including fines and consumer warnings, before you deposit.
For a list of licensed platforms compared side by side, see our best crypto exchanges in the UAE, and for the first purchase, our guide on how to buy crypto in the UAE.
Related guide Best crypto exchanges in the UAEA brief note on crypto mining
Mining is not one of VARA’s licensed activity categories, and we did not find a dedicated retail mining licence in the regulators’ public material. Running mining equipment as a business still requires a commercial licence from the relevant economic department or free zone, and hosting arrangements should be checked with that authority. Earnings from mining follow the general tax position described in our crypto tax guide: no personal income tax for individuals, with corporate tax for businesses.
