CyphrQ
Menu

UAE Crypto Regulation for Businesses: VARA, ADGM, DIFC and Saudi

Who regulates crypto in the UAE and Saudi Arabia, what VARA's technology rulebook demands of firms, and which GCC rules I could not confirm.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

UAE crypto regulation depends on where a firm sits. Dubai's VARA licenses virtual asset firms it supervises, Abu Dhabi Global Market has the FSRA, the DIFC has the DFSA, and the Central Bank and the federal markets regulator cover the rest. VARA publishes the most detailed security rules. Saudi Arabia has no crypto licensing regime I could confirm. This is not legal or investment advice.

This post is part of our Crypto Regulation coverage, for businesses that deal with GCC crypto firms and the security teams who check them. It covers regulation and security only, not tokens or investments. I only state what I read on a regulator's own page. Where a site blocked me, I say so.

Who is responsible for UAE crypto regulation?

The UAE has several regulators, and each covers a different place or activity. The table shows what I could confirm on each regulator's site on 25 October 2026.

Regulator Covers What I could confirm
Virtual Assets Regulatory Authority (VARA) Virtual asset service providers (VASPs) it licenses in Dubai Read the Technology and Information Rulebook in full
Financial Services Regulatory Authority (FSRA) Abu Dhabi Global Market (ADGM) Read the 2020 framework update; the current guidance PDF would not load
Dubai Financial Services Authority (DFSA) Dubai International Financial Centre (DIFC) Read its 12 January 2026 framework update
Central Bank of the UAE (CBUAE) Payment tokens across the UAE Read the scope of its Payment Token Services Regulation
Securities and Commodities Authority (SCA), now branded Capital Market Authority Onshore capital markets Virtual assets page returned "Page Not Found"

So "licensed in the UAE" is not one claim. Ask which regulator, which licence, and which legal entity.

VARA does act on firms without a licence. On 7 October 2025 it announced penalties on 19 firms for unlicensed virtual asset activity and breaches of its marketing rules. Fines ranged from AED 100,000 to AED 600,000, and every firm was told to stop operating. Check a firm on VARA's public register before you send it money.

What does VARA's Technology and Information Rulebook require?

VARA's Technology and Information Rulebook sets the security baseline for every firm VARA licenses. It is one of VARA's compulsory rulebooks, issued under the Virtual Assets and Related Activities Regulations 2023, and it says that unless stated otherwise, its requirements "are Rules and have binding effect". The PDF linked from the rulebook page carries a 19 May 2025 version stamp in its file name. VARA lists the other compulsory rulebooks on its licence applications page.

Here are the main binding rules, with their rule numbers:

  • A named security lead. Firms "must appoint a Chief Information Security Officer" (CISO), and the CISO "must be a separate individual from the CO", the compliance officer (Rule I.I.1).
  • A written cybersecurity policy. It goes to VARA as part of licensing and on request (I.B.1), and the CISO must review and update it "at least annually" (I.B.2).
  • Independent testing. A "qualified and independent third-party auditor" must run vulnerability assessments and penetration tests "at least on an annual basis and prior to the introduction of any new systems, applications and products" (I.E.1). VARA can also require threat-led penetration testing (TLPT), meaning tests modelled on real attacker behaviour (I.E.5).
  • Independent audit. Firms must be "regularly audited by independent auditors" (I.E.4). The rule gives no fixed frequency.
  • Key protection. Keys stored online or in any one physical location must not be enough to complete a transaction, with limited exceptions (I.D.2.b), and access to keys needs "strict access management controls" (I.D.2.c).
  • Continuity. A business continuity and disaster recovery plan must be implemented, tested and updated "on an annual basis" (I.H.1).

The rulebook does not name ISO 27001, NIST or the CryptoCurrency Security Standard (CCSS). It refers to "international standards and industry best practice codes" (I.A.3.b) and to the electronic security standards of the Dubai Electronic Security Center (I.C.1.a). Picking and evidencing a framework is left to the firm.

Key handling, multisig and backups are a topic of their own. My guide to crypto custody security for businesses goes through VARA's custody rules control by control, so I won't repeat them here.

How fast must a VARA-licensed firm report a cyber incident?

A VARA-licensed firm has two separate reporting clocks.

  • Cyber and continuity events: VARA must be told "no later than seventy-two (72) hours from detection" (Rule I.K.1).
  • Personal data incidents: Part II adds a notice to VARA "within twenty-four (24) hours" after the firm notifies other parties (Rule II.C.2). Read the rule itself to see which parties start that clock.

If your incident log only records "incident opened", you cannot show you met either deadline. My comparison of breach notification deadlines worldwide shows how these clocks sit next to other regimes.

What does the ADGM FSRA framework cover for virtual assets?

The part I could read is an FSRA announcement dated 24 February 2020. It says the FSRA changed its term from "crypto asset" to "virtual asset" to align with FATF (Financial Action Task Force) terminology. It also moved virtual asset rules into the regulated activities they resemble, such as custody, multilateral trading facilities and dealing in investments.

That structure matters for due diligence. In ADGM, the question is not "does this firm have a crypto licence" but "which regulated activities is it permitted to carry on with virtual assets".

I could not open the FSRA's current guidance on virtual asset activities, dated December 2023 in its file name. The download failed. I am not summarising its custody, technology or AML rules for that reason.

What changed in the DFSA's crypto token rules in 2026?

The DFSA's updated Crypto Token framework came into force on 12 January 2026, according to its announcement. The big change is who judges a token. Firms now decide, "on a reasoned and documented basis", whether each crypto token they deal in meets the DFSA's suitability criteria. The DFSA no longer publishes a list of Recognised Crypto Tokens.

For due diligence, that moves the evidence. Don't look for a token on a DFSA list. Ask the DIFC firm for its documented suitability assessment.

What does the UAE Central Bank regulate?

The Central Bank regulates payment tokens. Its Payment Token Services Regulation, C 2/2024, has been in force since 31 August 2024. It covers three services: issuing payment tokens, converting them, and holding and transferring them for customers. It also prohibits certain services involving algorithmic stablecoins and privacy tokens.

The SCA's virtual assets page redirects to uaecma.gov.ae, branded "Capital Market Authority", where it returned "Page Not Found". I am not describing the onshore markets regime for that reason.

If you rely on any of these regimes, read the current rule on the regulator's own site. Don't rely on a summary, including this one.

Is crypto regulated in Saudi Arabia by SAMA or the CMA?

I could not confirm a Saudi crypto licensing regime on an official page during this research.

A 2018 Saudi Central Bank (SAMA) statement on virtual currencies is often quoted, but its page on sama.gov.sa now returns "Page Not Found", so I am not quoting it. I did not reach a Capital Market Authority (CMA) page on crypto-assets either. Treat any claim that a firm is "licensed in Saudi Arabia" for crypto as something to verify directly with SAMA or the CMA.

What about Bahrain's CBB crypto-asset module?

The Central Bank of Bahrain (CBB) describes itself as overseeing Bahrain's crypto-asset market. I have not read its current crypto-asset rules, so I am not describing them.

What I could confirm is newer. On 4 July 2025 the CBB announced a licensing framework for stablecoin issuers. Licensed issuers may issue single-currency stablecoins backed by the Bahraini dinar, the US dollar or another fiat currency the CBB accepts. The rules sit in a new Stablecoin Issuance and Offering (SIO) Module, also in Volume 6.

Where do the Travel Rule and AML screening fit in GCC crypto rules?

The Travel Rule is the FATF requirement for virtual asset providers to pass originator and beneficiary details along with transfers. I could not confirm how any GCC regulator applies it from the pages I read. I won't guess at thresholds or formats.

What I can confirm is one AML control in VARA's technology rulebook. Firms "must implement and maintain distributed ledger tracing software" to screen incoming and outgoing virtual asset transactions and wallet addresses (Rule I.F.2). Distributed ledger tracing software, often called blockchain analytics, follows funds across addresses to flag links to sanctioned or illicit wallets.

Going deeper: for security and IT teams

This section is for the people who turn VARA's rules into controls, or who assess a VARA-licensed supplier. Everything cited here is from the Technology and Information Rulebook. Rules in Parts I to III are binding. Schedule 1 is guidance.

Build a rule-to-evidence register. The rulebook is short enough to map line by line. A starting set:

Rule Control Evidence an auditor will ask for
I.I.1 CISO appointed, separate from the compliance officer Org chart, appointment letter, two different names
I.B.2 Policy reviewed at least annually by the CISO Version history with CISO sign-off dates
I.E.1 Independent vulnerability assessment and pen test, annually and before new systems Reports with tester independence statement; change tickets linking launches to pre-launch tests
I.D.2.b No single online store or physical location can complete a transaction Signing architecture diagram listing every path to a valid signature
I.F.2 Tracing software screens inbound and outbound transfers and addresses Screening logs, alert queue, case outcomes
I.H.1 Continuity plan tested and updated annually Test report, gaps found, fixes closed
I.K.1 Cyber and continuity events reported within 72 hours of detection Incident timeline with a detection timestamp

Testing cadence: binding versus guidance. The binding floor is annual independent testing plus testing before new systems (I.E.1). Schedule 1 goes further: it suggests "annual penetration testing by qualified third parties" and "quarterly vulnerability assessments" (B.11), and testing "at least yearly on all systems and applications supporting Critical or Important Functions" (E.1.f). If VARA invokes threat-led testing under I.E.5, scoping starts from a threat picture. Keep an up-to-date asset inventory and list of critical functions so that scoping takes days, not weeks.

Key design. Read I.D.2.b as an architecture test. Draw every route to a valid signature, including recovery and break-glass paths. If any route needs only one online system or one site, it fails. Schedule 1 suggests hardware security modules (HSMs) for key generation "where possible" (B.1.a) and minimum multi-signature thresholds for high-value operations (B.5.a). The FBI attributed the February 2025 Bybit theft of about $1.5 billion to North Korea, and my Bybit case file shows why the signing process, not just key storage, is the target.

Two clocks, two triggers. Model I.K.1 and II.C.2 as separate timers in your incident tooling, with detection, classification and each notification as distinct timestamp fields. Run a tabletop exercise to check that the personal-data timer starts from the right event.

Threat model. Attackers want signing authority. They go after a signer's device, the signing interface or a supplier in the signing path. A cheaper route is impersonation: fake "licensed" firms, or deepfaked executives demanding an urgent transfer. My guide to spotting deepfake scams covers call-back controls.

Detection. Alert on tracing-software hits before an outbound transfer is signed, and on changes to signer sets, thresholds and allowlists. The 72-hour clock starts at detection, so every alert belongs in the incident timeline.

What to ask a VARA-licensed supplier:

  1. Who is your CISO, and who is your compliance officer?
  2. When was your last independent pen test, and did it cover the product we use?
  3. Which tracing software screens our transfers, and what happens on a hit?
  4. Show us the signing paths. Can any one system or site complete a transaction?
  5. When did you last test your continuity plan, and what failed?

Which steps should a business dealing with GCC crypto firms take now?

  • Write down, for each crypto counterparty, the regulator, the licence and the legal entity.
  • Check the licence on the regulator's own register, not the firm's website.
  • For VARA-licensed firms, ask the five questions above and keep the answers on file.
  • Add crypto suppliers to your incident plan, with their reporting clocks.
  • Treat any Saudi or onshore UAE crypto licence claim as unconfirmed until you see it on SAMA, CMA or Capital Market Authority pages.
  • Re-check before relying on this post. Several pages were unreadable when I wrote it.

Learn more

  • MiCA explained: the EU's crypto rulebook, if you also deal with EU firms.

Key takeaways

  • In the UAE, the crypto regulator depends on location and activity, so "licensed in the UAE" needs a regulator, a licence and an entity.
  • VARA's binding technology rules require a CISO separate from the compliance officer, annual independent testing, and cyber event reports within 72 hours of detection.
  • ADGM folded virtual assets into existing regulated activities in 2020.
  • The DFSA now makes firms assess token suitability themselves, and the UAE Central Bank licenses payment token services.
  • I could not confirm current onshore UAE, Saudi or Bahraini crypto-asset rules from official pages. Verify them directly.

Sources