VARA / ADGM FSRA / DFSA / UAE CMA / CBUAE — by territory and activity
Who regulates crypto in the UAE — VARA, the FSRA, or the CMA?
Content reviewed 2026-09-12 · How we check sources
Short answer
Several regulators can apply. VARA regulates virtual-asset activities in Dubai outside DIFC; the DFSA regulates the DIFC; the FSRA regulates ADGM; the federal Capital Market Authority (CMA) now has a broader Virtual Assets Framework within its jurisdiction; and the CBUAE regulates payment-token services.
What this means
There is no single UAE-wide crypto licence. The correct regulator depends on both territory and activity: exchange, brokerage, custody, investment advice, portfolio management, trading facilities and payment-token services can fall into different regulatory frameworks depending on where the business is established and where the regulated activity is carried on.
The federal position changed materially in 2026. The UAE Capital Market Authority, formerly the Securities and Commodities Authority, published its Virtual Assets Framework in April 2026, comprising five modules and eight regulated activities. The official listing now includes the General, Business Regulation and Alternative Trading System modules. The CMA should no longer be described as only regulating securities-type tokens or as awaiting its entire implementing framework.
A licence from one UAE financial centre or virtual-asset jurisdiction should not be assumed to passport automatically into another. Marketing, customer location, legal entity, token function and the exact regulated service all need to be mapped before relying on a particular licence.
Official sources
VARA — Virtual Asset regulatory rulebooks ↗UAE CMA — Virtual Assets Framework announcement (13 April 2026) ↗ADGM FSRA — Digital Assets ↗DFSA — current official rulebook modules ↗CBUAE — Payment Token Services Regulation ↗CMA — published virtual-assets regulation and modules ↗Ask with your entity, activity and regulator.
Regulatory research, not legal advice. This answer has the scope and review date shown above; your institution decides applicability.