Dubai's VARA Surpasses 85 Licences as UAE Unified VASP Register Goes Live

Q: What are the risks of using a crypto platform not on the UAE's licensed register?

Using an unlicensed platform means no regulatory protection in the UAE, no formal recourse for disputes, hacks, or operational failures, and potential exposure to weaker AML or KYC standards. VARA has confirmed through recent enforcement actions that operating or marketing virtual asset services without a licence is a direct regulatory breach.

Dubai's VARA Surpasses 85 Licences as UAE Unified VASP Register Goes Live

{getToc} $title={Table of Contents}

UAE crypto licensing milestone: 85+ VARA licences issued. Unified VASP register operational. Full briefing for crypto advisers.

Dubai's Virtual Assets Regulatory Authority has now licensed more than 85 virtual asset service providers across seven activity categories.
A Unified UAE VASP Register - jointly maintained by VARA and the Securities and Commodities Authority - is now operational.
The Central Bank of the UAE's Payment Token Services Regulation governs stablecoin issuance and transfer across most of the UAE, effective from July 2024.
Only dirham-backed stablecoins approved by the Central Bank are currently permitted for designated domestic use cases, including real estate transactions.
Advisors must assess client activity against both VARA's emirate-level licensing regime and the federal payment token framework.
Recent cease-and-desist orders against unlicensed exchanges confirm that regulators are actively enforcing the licensing requirements.

How Dubai Law No. 4 of 2022 and the CBUAE's Payment Token Framework Are Reshaping UAE Crypto Compliance

The UAE's digital asset sector now operates under a structured, multi-layered regulatory architecture. Dubai Law No. 4 of 2022 established the Virtual Assets Regulatory Authority (VARA) as Dubai's dedicated licensor and supervisor of virtual asset activity, while the Securities and Commodities Authority (SCA) governs crypto-related activity across the UAE mainland. A Unified UAE VASP Register - now operational - allows authorised firm status to be tracked at both emirate and federal level, significantly improving cross-jurisdictional transparency.

Beneath these two bodies sits the Central Bank of the UAE's Payment Token Services Regulation (PTSR), which came into force in July 2024. The PTSR brings stablecoins and digital payment instruments under direct federal oversight, creating a second, parallel compliance track for firms handling payment-style crypto transactions. For advisors and intermediaries, understanding which framework applies to a given client activity is now a baseline regulatory requirement - not an optional consideration.

VARA Crosses 85 Licences Across Seven Activity Categories

By March 2026, VARA has granted licences to more than 85 companies active in Dubai's virtual asset sector. These licences span seven categories: advisory, brokerage, custody, exchange, lending, transfer services, and virtual asset management. Authorised capital requirements range from approximately AED 500,000 to AED 15 million, depending on licence type and activity scope. Major global players - including Binance, Crypto.com (operating locally as Foris DAX Middle East FZE), OKX, and several Bybit-linked entities - are already listed on VARA's public register.

All licensed virtual asset service providers (VASPs) are subject to strict anti-money laundering (AML) rules, Know Your Customer (KYC) obligations, suspicious transaction reporting, and data-sharing requirements aligned with FATF travel-rule standards. The 2025-2026 VARA rulebook updates - analysed by Solidus Labs - add stricter market-abuse standards, enhanced AML obligations for high-risk jurisdictions, and expanded reporting requirements. These updates raise the operational bar materially for any firm seeking or maintaining a VARA licence.

Unified VASP Register Creates a Single Point of Oversight

A strategic partnership between VARA and the SCA has produced the Unified UAE VASP Register, now live and operational. Under this mechanism, a firm holding a VARA licence in Dubai is simultaneously visible on the SCA's federal register, and vice versa. This reduces duplication in licensing and reporting obligations for firms that operate across multiple UAE jurisdictions. The two regulators also enable mutual recognition of licences and information-sharing to strengthen consolidated supervision of the sector.

According to Sovereign Group's analysis of the unified framework, the arrangement improves global credibility for UAE-regulated VASPs and provides clearer signals to international counterparties and investors. However, VARA-licensed firms must still comply fully with Dubai-specific rules under the current rulebook - the unified register does not dilute emirate-level obligations in any way.

Central Bank Takes Federal Control of Payment Tokens

The CBUAE's Payment Token Services Regulation, in force since July 2024, makes the Central Bank the sole federal regulator for payment token issuance across the UAE. The PTSR covers three service categories: issuance of payment tokens, conversion of payment tokens, and their custody and transfer. Its scope extends across the mainland UAE, with the DIFC and ADGM remaining exempt as distinct regulatory zones with their own frameworks.

Under the PTSR, only dirham-backed stablecoins approved by the Central Bank are permitted for specified domestic use cases - real estate transactions being a notable example. Foreign-currency or algorithmically backed stablecoins can trigger compliance flags for any institution that accepts or facilitates their use. Linklaters' review of the regulation confirms that any firm providing payment-token services must obtain a formal licence or registration from the CBUAE before operating in this space.

What Crypto Advisors and Financial Intermediaries Must Address Now

The dual-track structure - VARA for VASP licensing in Dubai, CBUAE for payment tokens federally - means advisors must assess client activity against two frameworks simultaneously. Where a client's exposure involves trading, custody, lending, or payment-style transfers, both regimes can apply. Advisors must verify that any platform they recommend to, or that is used by, UAE clients holds a valid licence from VARA, SCA, the Abu Dhabi Global Market Financial Services Regulatory Authority (ADGM FSRA), or the Dubai Financial Services Authority (DFSA) before advising on or facilitating access to it.

VARA's recent enforcement actions - including cease-and-desist orders against KuCoin-linked entities and other unlicensed exchanges - confirm the regulator's readiness to act. Advisors whose clients hold positions on non-authorised platforms face clear compliance triggers: suitability reviews, updated risk disclosures, and an assessment of whether migrating assets to a licensed platform is appropriate. Internal compliance policies should also be reviewed against VARA's expanded 2025-2026 rulebook standards, particularly provisions on market abuse and high-risk jurisdiction AML obligations.

For intermediaries providing advisory or distribution services rather than direct VASP activity, the question of whether their activity falls within a licensable category remains live. VARA has signalled that marketing virtual assets to Dubai residents - even passively - requires either holding a licence or acting through an appropriately licensed provider. MCO's compliance analysis of VARA's framework recommends that any firm with Dubai-facing digital asset activity obtains a formal legal assessment of its licensing position under the current rulebook.

What Clients are Asking their Advisors

What is the Unified UAE VASP Register and who manages it?

The Unified UAE VASP Register is a shared database of licensed virtual asset service providers maintained jointly by VARA and the Securities and Commodities Authority (SCA). It allows a firm's licence status in Dubai to be visible at the federal level, and vice versa, reducing duplication and improving cross-emirate transparency for regulated firms and their clients.

How can I verify that a crypto platform is licensed to operate in the UAE?

The most reliable step is to check VARA's public register at vara.ae, which lists all VARA-licensed VASPs in Dubai. For mainland UAE operations, the SCA register applies. Platforms in the ADGM or DIFC can be verified through the FSRA and DFSA registers respectively - each regulator maintains its own publicly accessible list.

What is the difference between a VARA licence and a CBUAE payment token approval?

A VARA licence authorises a firm to provide virtual asset services in or from Dubai - covering activities such as exchange, custody, lending, or advisory. A CBUAE payment token approval under the PTSR covers the issuance, conversion, and transfer of stablecoins across the broader UAE, excluding the DIFC and ADGM. Depending on its activity, a firm may require authorisation from both regulators.

What are the risks of using a crypto platform not on the UAE's licensed register?

Using an unlicensed platform means having no regulatory protection in the UAE and no formal recourse for disputes, hacks, or operational failures. It also means potential exposure to platforms operating with weaker AML or KYC standards. VARA's recent enforcement actions against non-authorised exchanges confirm that operating or marketing virtual asset services without a licence is treated as a direct regulatory breach.