🇦🇪UAE financial and crypto licences: CBUAE, VARA, DFSA, FSRA and SCA

Five Licensing Perimeters, One Market

"A UAE licence" is an empty phrase until you name the regulator: the country's financial market is carved into five supervisory perimeters. Onshore, the Central Bank (CBUAE) covers banks, payments, stored value and payment tokens, while the federal Securities and Commodities Authority (SCA) has also been in charge of crypto outside Dubai since late 2022. Within Dubai, virtual assets answer to a dedicated regulator, VARA. On top sit two English common law financial free zones carved out of federal financial regulation: ADGM in Abu Dhabi, supervised by the FSRA, and the DIFC in Dubai, supervised by the DFSA.

The perimeter is chosen by the product, not by prestige: who your client is and where they sit, whether you hold client money or assets, and what currency your token references. The map cuts both ways: for counterparty checks — a bank offering private banking holds a CBUAE licence, a Dubai exchange a VARA one, a DIFC asset manager a DFSA one, and every regulator keeps a public register — and for picking the perimeter for your own project, because an application to the wrong perimeter costs a year.

The Map in One Table

The first cut is perimeter and audience: where each regulator operates and who belongs there.

Client geography and product type rule out the wrong perimeters before capital enters the conversation.

The second cut is what is licensed and what capital it takes.

Capital follows the activity category inside each perimeter; the published figures, fees and decision clocks are laid out regime by regime in the capital and fees table below.

CBUAE: Bank, PSP, Wallet and the Dirham Stablecoin

The banking licence exists on paper but is closed in practice: the CBUAE has not granted new universal banking licences in years — the market is consolidated, and the regulator's licensing page describes existing regimes rather than inviting applicants. Since 2025 the sector operates under a new central bank law: Federal Decree-Law No. 6 of 2025 replaced the 2018 statute. The practical way into banking is a digital brand backed by heavyweight shareholders: Zand received the first digital banking licence in July 2022, Wio launched in 2022 backed by ADQ, Alpha Dhabi, e& and FAB, and ruya, an Islamic digital bank headquartered in Ajman, opened in 2024.

Payments without a banking licence live under two regimes. The Retail Payment Services and Card Schemes Regulation (in force since July 2021) splits retail payment services into four categories:

• IV — payment initiation and account information.
• III — domestic transfers and aggregation.
• II — the same plus cross-border transfers.
• I — the full set up to payment account issuance and merchant acquiring.

Initial capital scales from AED 100k in Category IV to AED 3m in Category I at a monthly average volume of AED 10m or more, and the requirement ratchets up as volumes grow. Wallets and prepaid products that hold customer balances need a separate SVF licence under the 2020 regulation: AED 15m of capital, never less than 5% of the customer float, and segregation of client money.

Stablecoins belong to the CBUAE outright. The Payment Token Services Regulation (June 2024) admits only dirham-denominated tokens from licensed issuers for payments inside the country; algorithmic stablecoins and privacy tokens are banned, and foreign-currency tokens from registered issuers may be used solely to purchase virtual assets. The transition period expired in June 2025 — beyond that date, no licence or registration means no business.

Four names show what the regime looks like in practice.

The Universal Digital precedent matters for its limits rather than its status: USDU is admitted for professional clients only and solely for digital asset settlement, not for payments.

In parallel the central bank is building its own Digital Dirham CBDC: a retail launch has been announced, but no date is confirmed by primary sources — check CBUAE materials. How this design compares globally is covered in the analyses of stablecoins and Asia's stablecoin regimes.

VARA: Crypto Dubai

VARA was created by Dubai Law No. 4 of 2022 — the world's first specialised virtual asset regulator. Its perimeter is the whole emirate, commercial free zones included, except the DIFC. Activity is sliced into seven licensable categories — advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement — plus a separate token issuance regime; the full set lives in the VARA rulebooks. Licensing is two-stage: an initial approval first, then an operational licence with capital and staffing conditions per category.

In May 2025 VARA reissued all rulebooks as Version 2.0, tightening margin trading and token distribution and giving existing VASPs until 19 June 2025 to comply. Supervision is no longer theoretical: in October 2025 the regulator fined 19 unlicensed operators AED 100k–600k each with cease-and-desist orders — unlicensed marketing is sanctioned too.

ADGM FSRA: The Oldest Framework, Now with FRTs

Abu Dhabi entered crypto before everyone else: the FSRA introduced a comprehensive virtual asset regime back in 2018. Crypto here is not a standalone licence but a Regulated Activity inside the general Financial Services Permission — exchange, custody, broking, management — with token-by-token admission (Accepted Virtual Assets) and capital set per activity. It is the most institutional track, sitting next to funds, managers and ADGM fund platforms. The newest layer is stablecoins: on 31 October 2025 the FSRA finalised its Fiat-Referenced Token framework, and from 1 January 2026 issuing and handling FRTs is a regulated activity with reserve and client asset rules.

DFSA: The Cautious DIFC

The DIFC is excluded from VARA's perimeter — it answers to the DFSA, the most conservative of the five. Security-type tokens fall under the Investment Tokens regime (2021); everything else sits in the Crypto Token regime (November 2022) originally with a closed list of recognised tokens; since 12 January 2026 the DFSA no longer publishes that list, and each firm decides whether a token is suitable on a reasoned, documented basis. In February 2025 USDC and EURC became the first recognised stablecoins, in March 2025 Ripple obtained a DFSA licence as the zone's first blockchain payments provider, and later in 2025 the DFSA tightened its recognition criteria for fiat-referencing tokens. This is the route for firms adding tokens to a classic DIFC asset management or brokerage licence, and for fund tokenisation.

SCA: Onshore Outside Dubai and the Dual Track

The federal virtual asset framework was set by Cabinet Decision No. 111 of 2022: the SCA licenses, financial free zones are carved out. An onshore VASP outside Dubai applies to the SCA; a Dubai one goes to VARA. The SCA–VARA agreement of 9 September 2024 closed the loop: a VARA-licensed VASP is registered with the SCA by default and may operate nationwide, with supervision staying with VARA. The SCA's second track is classic securities: brokers, investment funds, custody and security tokens onshore.

From 1 January 2026 the authority has been renamed: the SCA became the Capital Market Authority (CMA) under Federal Decree-Laws No. 32 and 33 of 2025, keeping its functions, registers and existing arrangements — the VARA registration loop included; the old sca.gov.ae domain redirects to uaecma.gov.ae.

On 13 April 2026 the CMA issued its Virtual Assets Framework, a dedicated regime built from five modules — General Requirements, Conduct of Business, Alternative Trading System, AML/CFT and Prudential Requirements. It widens the list of regulated activities from three to eight: dealing in virtual assets as principal and as agent, providing custody, arranging custody, arranging investment deals, providing investment advice, portfolio management and operating a multilateral trading facility. The Alternative Trading System module reaches beyond virtual-asset venues to conventional multilateral trading facilities for securities and for tokenised securities.

Capital, Fees and Timelines by Regime

The two tables above say where each regulator operates. This one puts the published numbers side by side, regime by regime, because the five regulators price the same activity very differently and none of them publishes a processing target.

The CBUAE writes capital into its regulations and leaves process to separate guidelines. The Retail Payment Services and Card Schemes Regulation fixes initial capital in article 6 — AED 100,000 for Category IV, AED 500,000 or AED 1 million for Category III, AED 1 million or AED 2 million for Category II, AED 1.5 million or AED 3 million for Category I, the higher figure once monthly payment volume reaches AED 10 million — but sends the procedure to the Central Bank's Licensing Guidelines and names neither a fee nor a deadline. The Payment Token Services Regulation is the heaviest door on the grid: a dirham token issuer holds AED 15 million of initial and ongoing capital plus 0.5% of the face value of tokens outstanding, or 2% where it uses the alternative reserve arrangement, and posts an unconditional bank guarantee for the paid-up amount; a firm that only custodies, transfers or converts payment tokens needs AED 1.5 million, or AED 3 million once monthly transfers pass AED 10 million.

VARA is the only UAE regulator that publishes both sides of the bill. Capital comes from Company Rulebook section VI.B, fees from Schedule 2 of the Virtual Assets and Related Activities Regulations 2023: AED 40,000 to apply and AED 80,000 a year for advisory and for transfer and settlement, AED 100,000 and AED 200,000 for every other activity, an extension fee for each activity added later, and a discretionary risk-based surcharge on top. The DFSA publishes a range rather than a tariff — an application fee of US$15,000 to US$70,000 depending on the financial services — with the detail in its Fees module; the FSRA's fees sit in its own rulebook and are not reproduced here. None of the five publishes a processing target, so the calendar is set by the pre-application dialogue rather than by a rule.

Retail access splits the grid in two. The CBUAE and VARA license retail activity by default; the ADGM restricts the tokens a firm may use to its Accepted Virtual Assets; and since 12 January 2026 the DFSA no longer keeps a list of recognised crypto tokens, so a DIFC firm decides suitability itself on documented criteria. Payment is the exception everywhere onshore: only a licensed dirham token may be used to pay for goods and services, and a registered foreign token is limited to buying virtual assets.

A worked comparison on one set of inputs. A token broker in Dubai with fixed overheads of AED 2 million a year chooses between keeping client keys and using an approved custodian. With an approved custodian the capital floor is AED 400,000 — the 15–25% overheads test gives AED 300,000 to AED 500,000, so it may bind at the top of the range — and the regulator's bill for the first three years is AED 100,000 to apply plus AED 600,000 of supervision. Holding keys itself lifts the floor to AED 600,000 without changing the fees. Adding custody as a licensed activity brings an extension fee and a second AED 200,000 of annual supervision. For the same firm, a DIFC authorisation starts at an application fee between US$15,000 and US$70,000, with capital set by the prudential category its activities fall into; only the tokens the firm itself judges suitable may be offered, and the DIFC licence does not reach clients on the Dubai mainland.

Which Perimeter Fits Which Product

• Stablecoin issuer. A dirham token for payments — a CBUAE licence under the PTSR; a dollar token for crypto settlement — foreign issuer registration (the USDU precedent); in ADGM — the FRT regime; the DIFC recognises tokens rather than licensing issuance.
• Exchange, broker, custodian. Dubai — VARA plus automatic SCA registration; Abu Dhabi and the institutional circuit — FSRA; onshore outside Dubai — SCA; inside the DIFC — DFSA.
• PSP and wallet. Fiat transfers and acquiring — CBUAE RPSCS categories; holding balances — SVF; token custody, transfer and conversion — PTSR service licences.
• Manager and fund. ADGM or DIFC — your own licence or a host platform; crypto portfolios in Dubai — VARA's VA Management & Investment category.
• Challenger bank. A new banking licence is a long shot — partnering with an incumbent or operating under someone else's licence is more realistic; Zand and Wio show what a successful entry looks like.

Compared with other hubs, the UAE's distinction is the number of doors rather than the height of any one: VARA's exchange capital of AED 800,000 to 1.5 million sits beside MiCA, MAS, the SFC and the AIFC in the crypto licence map, and the CBUAE's payment and wallet regimes beside Singapore, Hong Kong and the EU in the fintech licence map, which also shows why a universal UAE banking licence is the one door the grid marks as effectively closed.

Free zone versus mainland is not just a tax question: each regulator licenses entities within its own perimeter, and both the QFZP relief and a bank account rest on real substance — office, people, management. The list of qualifying activities itself is closed by Ministerial Decision No. 265 of 2023: headquarter services to related parties and group treasury operations are in it, content production, advertising and rights licensing are not, and transactions with natural persons are expressly listed as Excluded Activities.

Above the QFZP sits the global minimum: the Domestic Minimum Top-up Tax of 15% applies to financial periods beginning on or after 1 January 2025 for groups with consolidated revenue of €750 million or more — for a large group the free zone zero stops being a zero. A licence without an account is dead: how banks read an applicant is covered in company and bank account.