# UAE financial and crypto licences: CBUAE, VARA, DFSA, FSRA and SCA

> Compare UAE financial and crypto licensing under CBUAE, VARA, DFSA, FSRA and SCA: activities, capital, local substance, stablecoin rules, distribution limits and regulator selection.

Author: Dana Berzeg — Attorney-at-law, Family Office (https://wiki.private.law/en/authors/berzegova)
Last modified: 2026-09-26T23:08:00.000Z
Canonical: https://wiki.private.law/en/uae-license-map
Publisher: wiki.private.law (https://wiki.private.law)
Version: 334dbdc305a7c441882009fc413cf134f146bf31912fca53cfe86807c9e3bef5
Cite as: UAE financial and crypto licences: CBUAE, VARA, DFSA, FSRA and SCA. wiki.private.law. https://wiki.private.law/en/uae-license-map. Version 334dbdc305a7c441882009fc413cf134f146bf31912fca53cfe86807c9e3bef5.
Topics: banking
Jurisdictions: uae
Product tags: banking, stablecoin, crypto, compliance
Semantic tags: banking, stablecoin, crypto, compliance

---

## Five Licensing Perimeters, One Market

"A UAE licence" is an empty phrase until you name the regulator: the country's financial market is carved into five supervisory perimeters. Onshore, the Central Bank (CBUAE) covers banks, payments, stored value and payment tokens, while the federal Securities and Commodities Authority (SCA) has also been in charge of crypto outside Dubai since late 2022. Within Dubai, virtual assets answer to a dedicated regulator, VARA. On top sit two English common law financial free zones carved out of federal financial regulation: ADGM in Abu Dhabi, supervised by the FSRA, and the DIFC in Dubai, supervised by the DFSA.

The perimeter is chosen by the product, not by prestige: who your client is and where they sit, whether you hold client money or assets, and what currency your token references. The map cuts both ways: for counterparty checks — a bank offering [private banking](https://wiki.private.law/en/uae-private-banking) holds a CBUAE licence, a Dubai exchange a VARA one, a DIFC asset manager a DFSA one, and every regulator keeps a public register — and for picking the perimeter for your own project, because an application to the wrong perimeter costs a year.

## The Map in One Table

The first cut is perimeter and audience: where each regulator operates and who belongs there.

| **Regulator** | **Perimeter** | **Who comes here** |
| --- | --- | --- |
| CBUAE | onshore: banks, payments, wallets, stablecoins | challenger bank, PSP, wallet, AED stablecoin issuer |
| VARA | Emirate of Dubai, incl. free zones, except DIFC | exchange, broker, custodian, crypto manager in Dubai |
| ADGM FSRA | Abu Dhabi financial free zone | institutional crypto, funds, stablecoin issuer in ADGM |
| DFSA | DIFC | DIFC managers and brokers, tokenisation |
| SCA (CMA from 01.01.2026) | onshore outside Dubai: securities and crypto | onshore broker or exchange outside Dubai, security tokens |

Client geography and product type rule out the wrong perimeters before capital enters the conversation.

The second cut is what is licensed and what capital it takes.

| **Regulator** | **Key regimes** | **Capital (guide)** |
| --- | --- | --- |
| CBUAE | banking licence; RPSCS I–IV; SVF; Payment Token Services | RPSCS — AED 100k … 3m; SVF — AED 15m + 5% of float |
| VARA | 7 VASP activity categories + token issuance regime | AED 100K–1.5M by activity (Company Rulebook VI.B) |
| ADGM FSRA | crypto framework (2018); FRTs from 01.01.2026; funds and managers | Category 3C base US$250K; FRT issuer US$2M |
| DFSA | Investment Tokens (2021); Crypto Token regime (2022) with recognised tokens | by prudential category; Category 4 base US$10K, US$140K with money transmission |
| SCA (CMA from 01.01.2026) | brokers, funds, custody; VASP licences; registration of Dubai VASPs | per activity |

Capital follows the activity category inside each perimeter; the published figures, fees and decision clocks are laid out regime by regime in the capital and fees table below.

## CBUAE: Bank, PSP, Wallet and the Dirham Stablecoin

The banking licence exists on paper but is closed in practice: the CBUAE has not granted new universal banking licences in years — the market is consolidated, and the regulator's [licensing page](https://www.centralbank.ae/en/licensing/) describes existing regimes rather than inviting applicants. Since 2025 the sector operates under a new central bank law: Federal Decree-Law No. 6 of 2025 replaced the 2018 statute. The practical way into banking is a digital brand backed by heavyweight shareholders: [Zand](https://wiki.private.law/en/zand-bank) received the first digital banking licence in July 2022, [Wio](https://wiki.private.law/en/wio-bank) launched in 2022 backed by ADQ, Alpha Dhabi, e& and FAB, and ruya, an Islamic digital bank headquartered in Ajman, opened in 2024.

Payments without a banking licence live under two regimes. The [Retail Payment Services and Card Schemes Regulation](https://rulebook.centralbank.ae/en/rulebook/retail-payment-services-and-card-schemes-regulation) (in force since July 2021) splits retail payment services into four categories:

- IV — payment initiation and account information.
- III — domestic transfers and aggregation.
- II — the same plus cross-border transfers.
- I — the full set up to payment account issuance and merchant acquiring.
Initial capital scales from AED 100k in Category IV to AED 3m in Category I at a monthly average volume of AED 10m or more, and the requirement ratchets up as volumes grow. Wallets and prepaid products that hold customer balances need a separate [SVF licence](https://rulebook.centralbank.ae/en/rulebook/stored-value-facilities-svf-regulation) under the 2020 regulation: AED 15m of capital, never less than 5% of the customer float, and segregation of client money.

Stablecoins belong to the CBUAE outright. The Payment Token Services Regulation (June 2024) admits only dirham-denominated tokens from licensed issuers for payments inside the country; algorithmic stablecoins and privacy tokens are banned, and foreign-currency tokens from registered issuers may be used solely to purchase virtual assets. The transition period expired in June 2025 — beyond that date, no licence or registration means no business.

Four names show what the regime looks like in practice.

| Issuer | Token | Status and date |
| --- | --- | --- |
| AED Stablecoin | AE Coin | first AED stablecoin issuer licence, December 2024 |
| Zand | dirham token on public blockchains | issued, November 2025 |
| RAKBANK | — | in-principle approval |
| Universal Digital | USDU, US dollar | first registered foreign issuer, January 2026 |

The Universal Digital precedent matters for its limits rather than its status: USDU is admitted for professional clients only and solely for digital asset settlement, not for payments.

In parallel the central bank is building its own Digital Dirham CBDC: a retail launch has been announced, but no date is confirmed by primary sources — check [CBUAE materials](https://www.centralbank.ae/media/lczb23l4/cbdc-short-report_july.pdf). How this design compares globally is covered in the analyses of [stablecoins](https://wiki.private.law/en/stablecoins) and [Asia's stablecoin regimes](https://wiki.private.law/en/asia-stablecoin-regimes).

## VARA: Crypto Dubai

VARA was created by Dubai Law No. 4 of 2022 — the world's first specialised virtual asset regulator. Its perimeter is the whole emirate, commercial free zones included, except the DIFC. Activity is sliced into seven licensable categories — advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement — plus a separate token issuance regime; the full set lives in the [VARA rulebooks](https://rulebooks.vara.ae/). Licensing is two-stage: an initial approval first, then an operational licence with capital and staffing conditions per category.

In May 2025 VARA reissued all rulebooks as Version 2.0, tightening margin trading and token distribution and giving existing VASPs until 19 June 2025 to comply. Supervision is no longer theoretical: in October 2025 the regulator [fined 19 unlicensed operators](https://www.vara.ae/en/regulations/regulatory-notices/vara-steps-up-enforcement-to-safeguard-dubai-s-virtual-asset-market-19-unlicensed-firms-penalised-and-public-warning-issued/) AED 100k–600k each with cease-and-desist orders — unlicensed marketing is sanctioned too.

## ADGM FSRA: The Oldest Framework, Now with FRTs

Abu Dhabi entered crypto before everyone else: the FSRA introduced a comprehensive virtual asset regime back in 2018. Crypto here is not a standalone licence but a Regulated Activity inside the general Financial Services Permission — exchange, custody, broking, management — with token-by-token admission (Accepted Virtual Assets) and capital set per activity. It is the most institutional track, sitting next to funds, managers and [ADGM fund platforms](https://wiki.private.law/en/uae-fund-manager-adgm-difc). The newest layer is stablecoins: on 31 October 2025 the FSRA [finalised its Fiat-Referenced Token framework](https://www.adgm.com/media/announcements/adgm-fsra-finalises-regulatory-framework-for-regulated-activities-involving-fiat-referenced-tokens), and from 1 January 2026 issuing and handling FRTs is a regulated activity with reserve and client asset rules.

## DFSA: The Cautious DIFC

The DIFC is excluded from VARA's perimeter — it answers to the [DFSA](https://www.dfsa.ae/), the most conservative of the five. Security-type tokens fall under the Investment Tokens regime (2021); everything else sits in the Crypto Token regime (November 2022) originally with a closed list of recognised tokens; since 12 January 2026 the DFSA no longer publishes that list, and each firm decides whether a token is suitable on a reasoned, documented basis. In February 2025 USDC and EURC became the first recognised stablecoins, in March 2025 Ripple obtained a DFSA licence as the zone's first blockchain payments provider, and later in 2025 the DFSA tightened its recognition criteria for fiat-referencing tokens. This is the route for firms adding tokens to a classic DIFC asset management or brokerage licence, and for fund tokenisation.

## SCA: Onshore Outside Dubai and the Dual Track

The federal virtual asset framework was set by Cabinet Decision No. 111 of 2022: the SCA licenses, financial free zones are carved out. An onshore VASP outside Dubai applies to the SCA; a Dubai one goes to VARA. The [SCA–VARA agreement of 9 September 2024](https://www.uaecma.gov.ae/en/media-center/news/9/9/2024/sca-and-vara-set-regulatory-framework-for-the-uaes-virtual-assets-sector-in-boost-to-the-countrys-.aspx) closed the loop: a VARA-licensed VASP is registered with the SCA by default and may operate nationwide, with supervision staying with VARA. The SCA's second track is classic securities: brokers, investment funds, custody and security tokens onshore.

From 1 January 2026 the authority has been renamed: the SCA became the [Capital Market Authority (CMA)](https://www.uaecma.gov.ae/en/new-cma-law) under Federal Decree-Laws No. 32 and 33 of 2025, keeping its functions, registers and existing arrangements — the VARA registration loop included; the old [sca.gov.ae](http://sca.gov.ae/) domain redirects to [uaecma.gov.ae](http://uaecma.gov.ae/).

On 13 April 2026 the CMA issued its [Virtual Assets Framework](https://www.uaecma.gov.ae/en/media-center/news/13/4/2026/%D9%87%D9%8A%D8%A6%D8%A9-%D8%B3%D9%88%D9%82-%D8%A7%D9%84%D9%85%D8%A7%D9%84-%D8%AA%D8%B5%D8%AF%D8%B1-%D8%A5%D8%B7%D8%A7%D8%B1-%D8%AA%D9%86%D8%B8%D9%8A%D9%85-%D8%A7%D9%84%D8%A3%D8%B5%D9%88%D9%84-%D8%A7%D9%84%D8%A7%D9%81%D8%AA%D8%B1%D8%A7%D8%B6%D9%8A%D8%A9-%D9%85%D8%A4%D8%B3%D9%91%D9%90%D8%B3%D8%A9%D9%8B-%D9%86%D8%B8%D8%A7%D9%85%D8%A7%D9%8B-%D9%85%D8%AA%D9%83%D8%A7%D9%85%D9%84%D8%A7%D9%8B-%D9%8A%D8%AA%D9%83%D9%88%D9%91%D9%86-%D9%85%D9%86-%D8%AE%D9%85%D8%B5-%D9%88%D8%AD%D8%AF%D8%A7%D8%AA), a dedicated regime built from five modules — General Requirements, Conduct of Business, Alternative Trading System, AML/CFT and Prudential Requirements. It widens the list of regulated activities from three to eight: dealing in virtual assets as principal and as agent, providing custody, arranging custody, arranging investment deals, providing investment advice, portfolio management and operating a multilateral trading facility. The Alternative Trading System module reaches beyond virtual-asset venues to conventional multilateral trading facilities for securities and for tokenised securities.

## Capital, Fees and Timelines by Regime

The two tables above say where each regulator operates. This one puts the published numbers side by side, regime by regime, because the five regulators price the same activity very differently and none of them publishes a processing target.

| **Regime** | **Minimum capital in the rules** | **Regulator's published fees** | **Decision clock** | **Retail allowed** |
| --- | --- | --- | --- | --- |
| CBUAE RPSCS Category IV (initiation, account information) | AED 100K | not set in the regulation | none in the regulation; Licensing Guidelines | yes |
| CBUAE RPSCS Category I (full set, acquiring) | AED 1.5M; AED 3M at AED 10M+ monthly volume | not set in the regulation | none in the regulation | yes |
| CBUAE SVF (wallet holding balances) | AED 15M paid-up; aggregate capital funds ≥5% of float | not set in the regulation | none in the regulation | yes |
| CBUAE PTSR — dirham payment token issuer | AED 15M plus 0.5% of tokens outstanding (2% on the alternative reserve route); bank guarantee for the paid-up capital | not set in the regulation | none in the regulation | yes, dirham tokens only for payments |
| CBUAE PTSR — token custody, transfer, conversion | AED 1.5M; AED 3M at AED 10M+ monthly transfers | not set in the regulation | none in the regulation | foreign tokens only to buy virtual assets |
| VARA — exchange | AED 800K with an approved custodian, AED 1.5M without; or 15–25% of fixed overheads if higher | AED 100,000 to apply; AED 200,000 a year | not published | yes, by category |
| VARA — broker-dealer | AED 400K / 600K | AED 100,000; AED 200,000 a year | not published | yes |
| VARA — advisory; transfer and settlement | AED 100K advisory; AED 500K transfer and settlement | AED 40,000; AED 80,000 a year | not published | yes |
| ADGM FSRA — virtual asset activities | Category 3C base US$250K plus an expenditure-based minimum; US$2M for a fiat-referenced token issuer | — | not published | yes, Accepted Virtual Assets only |
| DIFC DFSA — crypto inside a financial service | Category 4 base US$10K; US$140K with money transmission | application US$15,000–70,000 by financial service | not published | yes, after the firm's own suitability assessment |
| CMA (ex-SCA) virtual assets framework | Prudential Requirements module, no headline figure | — | not published | per the framework's conduct module |

The CBUAE writes capital into its regulations and leaves process to separate guidelines. The [Retail Payment Services and Card Schemes Regulation](https://rulebook.centralbank.ae/en/rulebook/retail-payment-services-and-card-schemes-regulation) fixes initial capital in article 6 — AED 100,000 for Category IV, AED 500,000 or AED 1 million for Category III, AED 1 million or AED 2 million for Category II, AED 1.5 million or AED 3 million for Category I, the higher figure once monthly payment volume reaches AED 10 million — but sends the procedure to the Central Bank's Licensing Guidelines and names neither a fee nor a deadline. The [Payment Token Services Regulation](https://rulebook.centralbank.ae/en/rulebook/payment-token-services-regulation) is the heaviest door on the grid: a dirham token issuer holds AED 15 million of initial and ongoing capital plus 0.5% of the face value of tokens outstanding, or 2% where it uses the alternative reserve arrangement, and posts an unconditional bank guarantee for the paid-up amount; a firm that only custodies, transfers or converts payment tokens needs AED 1.5 million, or AED 3 million once monthly transfers pass AED 10 million.

VARA is the only UAE regulator that publishes both sides of the bill. Capital comes from [Company Rulebook section VI.B](https://rulebooks.vara.ae/rulebook/b-paid-capital), fees from [Schedule 2 of the Virtual Assets and Related Activities Regulations 2023](https://rulebooks.vara.ae/rulebook/schedule-2-supervision-and-authorisation-fees): AED 40,000 to apply and AED 80,000 a year for advisory and for transfer and settlement, AED 100,000 and AED 200,000 for every other activity, an extension fee for each activity added later, and a discretionary risk-based surcharge on top. The DFSA publishes a [range rather than a tariff](https://www.dfsa.ae/your-resources/regulatory/fees) — an application fee of US$15,000 to US$70,000 depending on the financial services — with the detail in its Fees module; the FSRA's fees sit in its own rulebook and are not reproduced here. None of the five publishes a processing target, so the calendar is set by the pre-application dialogue rather than by a rule.

Retail access splits the grid in two. The CBUAE and VARA license retail activity by default; the ADGM restricts the tokens a firm may use to its Accepted Virtual Assets; and since 12 January 2026 the DFSA no longer keeps a list of recognised crypto tokens, so a DIFC firm decides suitability itself on documented criteria. Payment is the exception everywhere onshore: only a licensed dirham token may be used to pay for goods and services, and a registered foreign token is limited to buying virtual assets.

A worked comparison on one set of inputs. A token broker in Dubai with fixed overheads of AED 2 million a year chooses between keeping client keys and using an approved custodian. With an approved custodian the capital floor is AED 400,000 — the 15–25% overheads test gives AED 300,000 to AED 500,000, so it may bind at the top of the range — and the regulator's bill for the first three years is AED 100,000 to apply plus AED 600,000 of supervision. Holding keys itself lifts the floor to AED 600,000 without changing the fees. Adding custody as a licensed activity brings an extension fee and a second AED 200,000 of annual supervision. For the same firm, a DIFC authorisation starts at an application fee between US$15,000 and US$70,000, with capital set by the prudential category its activities fall into; only the tokens the firm itself judges suitable may be offered, and the DIFC licence does not reach clients on the Dubai mainland.

## Which Perimeter Fits Which Product

- **Stablecoin issuer.** A dirham token for payments — a CBUAE licence under the PTSR; a dollar token for crypto settlement — foreign issuer registration (the USDU precedent); in ADGM — the FRT regime; the DIFC recognises tokens rather than licensing issuance.
- **Exchange, broker, custodian.** Dubai — VARA plus automatic SCA registration; Abu Dhabi and the institutional circuit — FSRA; onshore outside Dubai — SCA; inside the DIFC — DFSA.
- **PSP and wallet.** Fiat transfers and acquiring — CBUAE RPSCS categories; holding balances — SVF; token custody, transfer and conversion — PTSR service licences.
- **Manager and fund.** ADGM or DIFC — [your own licence or a host platform](https://wiki.private.law/en/uae-fund-manager-adgm-difc); crypto portfolios in Dubai — VARA's VA Management & Investment category.
- **Challenger bank.** A new banking licence is a long shot — partnering with an incumbent or [operating under someone else's licence](https://wiki.private.law/en/license-for-rent) is more realistic; Zand and Wio show what a successful entry looks like.
Compared with other hubs, the UAE's distinction is the number of doors rather than the height of any one: VARA's exchange capital of AED 800,000 to 1.5 million sits beside MiCA, MAS, the SFC and the AIFC in the [crypto licence map](https://wiki.private.law/en/crypto-license-map), and the CBUAE's payment and wallet regimes beside Singapore, Hong Kong and the EU in the [fintech licence map](https://wiki.private.law/en/fintech-license-map), which also shows why a universal UAE banking licence is the one door the grid marks as effectively closed.

Free zone versus mainland is not just a tax question: each regulator licenses entities within its own perimeter, and both the QFZP relief and a bank account rest on [real substance](https://wiki.private.law/en/economic-substance) — office, people, management. The list of qualifying activities itself is closed by [Ministerial Decision No. 265 of 2023](https://tax.gov.ae/Datafolder/Files/Legislation/Corporate%20Tax/MD-No-265-of-2023-Regarding-Qualifying-Activities-and-Excluded-Activities-en.pdf): headquarter services to related parties and group treasury operations are in it, content production, advertising and rights licensing are not, and transactions with natural persons are expressly listed as Excluded Activities.

Above the QFZP sits the global minimum: the Domestic Minimum Top-up Tax of 15% applies to financial periods beginning on or after 1 January 2025 for groups with consolidated revenue of €750 million or more — for a large group the free zone zero stops being a zero. A licence without an account is dead: how banks read an applicant is covered in [company and bank account](https://wiki.private.law/en/uae-company-bank-account).

> 🍓 The product picks the perimeter. Anything touching payments, stored value or dirham tokens — CBUAE; trading and custody of virtual assets in Dubai — VARA with SCA registration; institutional common law structures — ADGM or DIFC; onshore securities and crypto outside Dubai — SCA. A single licence for all of the UAE does not exist — combinations do, and the strongest today is VARA + SCA. Capital and timelines grow with the right to hold other people's money: from AED 100k for payment initiation to AED 15m for a wallet holding balances.

## Q/A

### **Can one licence cover the whole UAE**

No. The closest thing is the VARA + SCA crypto combination: since September 2024 a Dubai licence is registered with the federal regulator by default and opens the whole country. Payments and dirham stablecoins require the CBUAE in any scenario, while ADGM and the DIFC remain separate perimeters with their own regulators and registers.

### **What about USDT and USDC at retail**

You cannot pay for goods and services inside the UAE with them: the PTSR admits only dirham tokens from licensed issuers for payments. Foreign stablecoins from registered issuers live in the digital asset settlement niche — like the dollar USDU, admitted in January 2026 for professional clients only. DFSA recognition of USDC and EURC lets regulated DIFC firms use them in services — that is not retail payments.

### **Where is the cheapest entry**

The lowest threshold is RPSCS Category IV: payment initiation and account information from AED 100k of capital. Thresholds climb with functionality: Categories III–I up to AED 3m, SVF at AED 15m. In crypto VARA publishes both sides of the bill: capital from AED 100,000 for advisory to AED 1.5M for an exchange that holds keys itself, and fees of AED 40,000 or AED 100,000 to apply plus AED 80,000 or AED 200,000 a year per activity. The DFSA's application fee runs from US$15,000 to US$70,000, and the FSRA sets capital per Regulated Activity from a Category 3C base of US$250,000. If the economics do not close, start under someone else's licence — renting and white-label work in the UAE as they do everywhere.

### **How does ADGM differ from the DIFC on crypto**

The FSRA has regulated virtual assets since 2018 and covers the full spectrum — exchanges, custody, management, and from 2026 FRT stablecoin issuance. The DFSA is more conservative: no public token list since January 2026 but a documented suitability test each firm must run itself, a focus on managers and tokenisation, and no payment stablecoin issuance regime of its own. Roughly: build crypto infrastructure in ADGM, add tokens to a classic mandate in the DIFC.

### **How long does a UAE licence take**

No UAE regulator publishes a processing target. The CBUAE's retail payments and payment token regulations fix capital but send procedure to separate licensing guidelines without a deadline, and VARA, the FSRA, the DFSA and the CMA publish none either. The calendar is set by the pre-application dialogue and the completeness of the file, which is why the choice of perimeter should be settled before anything is filed.

---

## Factual claims

- Initial capital scales from AED 100k in Category IV to AED 3m in Category I at a monthly average volume of AED 10m or more, and the requirement ratchets up as volumes grow.
- VARA was created by Dubai Law No. 4 of 2022 — the world's first specialised virtual asset regulator.
- In May 2025 VARA reissued all rulebooks as Version 2.0, tightening margin trading and token distribution and giving existing VASPs until 19 June 2025 to comply.
- The federal virtual asset framework was set by Cabinet Decision No. 111 of 2022: the SCA licenses, financial free zones are carved out.
- On 13 April 2026 the CMA issued its Virtual Assets Framework, a dedicated regime built from five modules — General Requirements, Conduct of Business, Alternative Trading System, AML/CFT and Prudential Requirements.
- The CBUAE writes capital into its regulations and leaves process to separate guidelines.

---

Source: wiki.private.law — the private.law legal knowledge base. When quoting, cite the canonical page URL.
Consultation with a lawyer: https://t.me/private_law_bot