The Virtual Currency Regulation Review: United Arab Emirates

I - Introduction to the legal and regulatory framework

The United Arab Emirates (UAE) comprises a federation of seven Emirates (Abu Dhabi, Ajman, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah and Umm Al Quwain). UAE Federal Law is a civil law system that incorporates elements of Egyptian and French civil law, as well as the principles of Islamic Sharia.² The federal financial regulators are the UAE Central Bank and the Securities and Commodities Authority (SCA). In addition to the federal jurisdiction, each of the Emirates is entitled to choose to maintain their own separate local courts to deal with matters that are not reserved to federal jurisdiction in the Constitution. Abu Dhabi, Dubai and RAK maintain their own independent judiciaries, which apply civil law and Sharia principles. This chapter refers to these jurisdictions collectively as ‘Onshore UAE’. 

Article 121 of the UAE Constitution also permits the establishments of free zones. Federal Law No. 8 of 2004 specifically permits a subset of the free zones called ‘Financial Free Zones’. The key elements of a Financial Free Zone (set down in Article 3 of Federal Law No. 8 of 2004) are that they are exempt from all federal civil and commercial laws, but they remain bound by federal criminal laws, including federal anti-money laundering legislation.³ The UAE has established two Financial Free Zones: the Abu Dhabi Global Market (ADGM)⁴ and the Dubai Internal Financial Centre (DIFC).⁵

Within the ADGM, there is a separate financial regulator, the Financial Services Regulatory Authority (FSRA), and separately the ADGM Courts. The ADGM Courts, Civil Evidence, Judgments, Enforcement and Judicial Appointments Regulations 2015 make English Common Law directly applicable in the ADGM, marking a clear distinction from the civil law applicable at the federal level and in onshore UAE. Similarly, within the DIFC, there is also a separate financial regulator, the Dubai Financial Services Authority (DFSA), and separately the DIFC courts. The DIFC courts also apply a common law system (i.e., DIFC law) modelled on the English Common Law (with its court rules closely modelled on the English Civil Procedure Rules) albeit, unlike in the ADGM, English law is persuasive but not directly applicable. In both the ADGM and DIFC courts, proceedings are conducted in English with judgments written in English. Both the ADGM and DIFC are dealt with separately in this chapter where appropriate.

In 2018, the FSRA published extensive regulations making the ADGM:

the first jurisdiction in the world to introduce a comprehensive and bespoke regulatory framework for the regulation of spot virtual asset activities, including those undertaken by multilateral trading facilities, brokers, custodians, asset managers and other intermediaries.⁶

These laws, regulations and guidance have since been regularly updated, with the latest iterations issued in September 2022 (see Section II).

The period since 2020 has seen the onshore federal regulators publish their first regulations affecting cryptoassets. The SCA passed Decision No. 23 of 2020 Concerning Crypto Assets Activities Regulation (the SCA Virtual Asset Regulation)⁷ (see Section II) and the UAE Central Bank published both its Stored Value Facilities Regulation⁸ and the Retail Payment Services and Card Schemes Regulation.⁹ These regulations cover payment tokens (or stablecoins)¹⁰ but expressly exclude security and commodity tokens.¹¹

Since the issuance of Federal Cabinet Decision No. 111 of 2022 on the regulation of virtual assets and their service providers, no person has been permitted to engage in virtual asset activities in Onshore UAE without first obtaining approval and a licence from the SCA or a local licensing authority. From March 2022 onward, the Emirate of Dubai and the DIFC’s DFSA have both taken significant steps towards regulating virtual currency.

On 9 March 2022, Dubai Law No. 4 of 2022 Concerning the Regulation of Virtual Assets (the Virtual Asset Law) established the (onshore) Dubai Virtual Asset Regulatory Authority (VARA). VARA’s remit is very wide and incorporates regulating and licensing issuers, exchanges and custodial and management services providers.

Under Article 15(a), the effect of the Virtual Assets Law is to prohibit, in lieu of a licence issued by VARA, any activity in respect of virtual currencies (among other operations) that falls under Article 16. The ‘activities requiring permits’ listed at Article 16 include:

1. provision of virtual asset platform operation and management services;
2. provision of services for the exchange between virtual assets and national or foreign currencies;
3. provision of services for the exchange between one or more forms of virtual assets;
4. provision of virtual asset transfer services;
5. provision of virtual asset safekeeping, management or control services;
6. provision of services related to virtual asset wallets; and
7. provision of services related to offering, and trading in, virtual tokens.

VARA’s jurisdiction does not extend to the DIFC and only covers activities in respect of virtual currencies that are carried out in onshore Dubai (but outside of the DIFC). At present, no passporting regime exists between Onshore Dubai and the DIFC, meaning that companies must choose in which jurisdiction to become licensed. Companies who wish to operate in both Onshore UAE and the DIFC need to be licensed in both jurisdictions.

On 7 February 2023, VARA published its Virtual Assets and Related Activities Regulations (VARA Regulations) and associated rulebooks which, together with the VARA Regulations, form the Virtual Asset Framework (VA Framework). The VA Framework took immediate effect in the Emirate of Dubai and applies to all firms providing services to or from Dubai other than firms conducting business in the DIFC. The VA Framework provides a framework for the licensing of Virtual Asset Service Providers (VASPs) and rules for their operation.

In 2021, the DFSA updated its Rulebook to include Investment Tokens. Then in March 2022, the DFSA launched Consultation Paper No. 143 setting out its proposal for the regulatory framework for cryptocurrencies. This resulted in the DFSA’s new Crypto Token Regime coming into force on 1 November 2022.¹²

Cabinet Decision No. 1111 of 2022 confirms that overall federal authority rests with the SCA, which can delegate this authority, for instance to VARA. Questions remain as to how the overlapping jurisdictions of the UAE Central Bank, SCA and VARA over virtual currencies will be reconciled in practice, the extent to which VARA will continue to issue regulations and make decisions that are specific to virtual currencies within its jurisdiction or that have wider, national effect, and whether general securities, investment and banking laws, for instance, will be issued with specific applicability to virtual currencies.

II - Securities and investment laws

i Onshore UAE

A notable development in 2020–2021 was the issue of the SCA Virtual Asset Regulation,¹³ which regulates the ‘Offering, issuing, listing and trading of Crypto Assets in the State and related Financial Activities’ (Article 2(1)) by creating a licensing regime, issuing directives and facilitating (and responding to) inquiries relating to the licensing regime (Article 2(2)). The scope of the regulation is set out in Articles 3 to 5. ‘General Obligations in respect of Crypto Assets’ are set out in Chapter 2, including the Offering of Crypto Assets (Article 6) and the Offering of Security Tokens (Article 7) in the State, and Crypto Assets listing on a Crypto Asset Exchange (Article 8).

In the Emirate of Dubai, Article 6(1) of the Virtual Assets Law empowers VARA to, among other duties, ‘develop the general policy and the strategic plans related to regulating Virtual Asset services in the Emirate’. Since the last edition of this volume, amendments to Dubai laws relating to securities and investment that are specific to the creation, trade and storage of virtual currencies have been issued, namely the Virtual Assets and Related Activities Regulations (VARA Regulations)¹⁴ along with associated rulebooks; all together, they form the Virtual Asset Framework (VA Framework)

The VA Framework was published on 7 February 2023 and took effect immediately in the Emirate of Dubai but not in the DIFC. Described as the ‘world’s first tailor-made virtual asset regime’, the VARA Regulations and the wider VA Framework are designed to provide permissible activities and services to customers, investors and traders in digital assets.

The VARA Regulations¹⁵ contain provisions relating to securities and investments, and in particular entities that are categorised as being VASPs. The licensing regime for a VASP is linked to the type of service the VASP offers. VARA recognises seven distinct categories of virtual asset activities which interlock to provide coverage of the spectrum of services a VASP may offer. It treats each category as modular, so a VASP may apply for multiple activities and aggregate them under a single overarching licence provided there is no specific need to segregate any of those activities. In overview, the seven types of licence cover advisory services; broker-dealer services; custody services; exchange services; services for the lending and borrowing of virtual assets; services for the payment and remittance of virtual assets; and virtual asset management and investment services.¹⁶

Any VASP carrying out regulated activities will need to apply for a licence from VARA. Application fees, extension fees and annual supervision fees apply at various rates. An adviser services licence comes with an 40,000 dirhams application fee and an annual supervision fee of 80,000 dirhams, whereas the equivalent exchange services licence fees come in at 100,000 dirhams and 200,000 dirhams, respectively.

VASPs who fulfil VARA’s licensing requirements will be required to comply with four ‘compulsory rulebooks’ on the themes of company,¹⁷ compliance and risk management,¹⁸ technology and information,¹⁹ and market conduct.²⁰ In addition, seven activity-specific rulebooks have been developed to cater for risks associated with the provision of each virtual asset activity, namely advisory services,²¹ broker-dealer services,²² custody services,²³ exchange services,²⁴ lending and borrowing services,²⁵ payments and remittances services,²⁶ and management and investment services.²⁷ VARA has also established rules for the issuance of all virtual assets (issuance rulebook).²⁸

All market participants, whether licensed by VARA or otherwise, must adhere to the Marketing, Advertising and Promotions Regulations (MAP Regulations, set out in VARA’s Administrative Order No.1 of 2022) which cover virtual asset marketing activities²⁹; VASPs, businesses offering non-virtual asset activities and individuals should be aware of VARA’s Administrative Order No.2 setting out the penalties for non-compliance.³⁰

There are several sections of the VARA Regulations of particular note and relating to securities and investment law. Part II covers the issuance of virtual assets, including issuance rules, the power to classify virtual assets and prohibited virtual assets. Part III covers regulated activities in respect of virtual assets, setting out the general prohibition on activities and exemptions to the general prohibition. Part IV covers licensing including licensing requirements and VARA’s licensing and authorisation powers. However, VASPs will only be required to comply with each activity rulebook if they are licensed by VARA to offer the activity; securities and investment laws cut across many of the rulebooks listed above, including the four compulsory rulebooks and those on advisory, broker-dealer, exchange, and management and investment services, plus the Issuance Rulebook and the MAP Regulations.

ii ADGM

After its initial flurry of activity in 2018, which saw the ADGM become the first jurisdiction globally to produce a regulatory framework for cryptoassets, followed by extensive updates to its framework in 2020, the past 12 months have been comparatively quiet. The current framework comprises:

1. the Financial Services and Markets Regulations (FSMR);
2. Guidance on Regulation of Digital Securities Activities in ADGM;
3. Guidance on Regulation of Digital Security Offerings and Virtual Assets under the FSMR; and
4. Guidance on Regulation of Virtual Asset Activities in ADGM.

The table below provides a helpful summary of the position as set out on page 7 of the Guidance on Regulation of Digital Securities Activities in the ADGM.³¹

The ADGM also published its Guiding Principles for the Financial Services Regulatory Authority’s Approach to Virtual Asset Regulation and Supervision on 22 September 2022, which inform the FSRA’s attitude to risk and interpretation of the regulations.

iii DIFC

Currently, the core laws regulating licensed business in the DIFC and administered by the DFSA are as follows:

1. the Regulatory Law 2004, as amended;
2. the Law Regulating Islamic Financial Business 2004;
3. the Investment Trust Law 2006;
4. the Collective Investment Law 2010; and
5. the Markets Law 2012.

Under the Regulatory Law 2004, the DFSA has also issued its Rulebook, which contains further subsidiary legislation.

In March 2021, the DIFC launched a consultation on its proposed framework for security tokens (Consultation Paper No. 138 – Regulation of Security Tokens).³² This Consultation ended in the second quarter of 2021 and, in October 2021, the DFSA announced the introduction of its regulatory framework for investment tokens , marking the first phase of its Digital Assets Regime.³³ As part of the second phase of its Digital Assets Regime, in March 2022, the DFSA launched Consultation Paper No. 143 on the Regulation of Crypto Tokens, which sets out its proposed framework for crypto tokens. This was followed by the introduction of the DFSA’s Crypto Token Regime on 1 November 2022. Accordingly, the DFSA’s Rulebook has been updated to incorporate the Crypto Token Regime.³⁴

The Rulebook now provides the following definition of a crypto token:

[a Token which] (a) is used, or intended to be used, as a medium of exchange or for payment or investment purposes, or (b) confers a right or interest in another Token that meets the requirements in (a).³⁵

Notably, utility tokens (i.e., tokens that have a specific use case within a closed ecosystem), NFTs and digital currencies issued by any government, government agency, central bank or other monetary authority are expressly designated as excluded tokens³⁶ but are nevertheless brought within the remit of the DFSA’s anti-money laundering and counter terrorist funding regime. Under the Crypto Token Regime, the DFSA published³⁷ and maintains³⁸ an initial list of recognised crypto tokens. Furthermore, although it was initially proposed that entities intending to offer financial services in relation to crypto tokens must establish in the DIFC as a body corporate and be incorporated under DIFC law, that is no longer the case under the implemented rules.³⁹ Branches of financial institutions may provide services relating to crypto tokens provided that the head office of such branch is authorised to carry out the crypto activity.

The following services are permitted in respect of crypto tokens:⁴⁰

1. dealing in investments as principal;
2. dealing in investments as agent;
3. arranging deals in investments;
4. managing assets;
5. advising on financial products;
6. operating an exchange;
7. providing custody;
8. arranging custody;
9. operating a clearing house; and
10. operating an alternative trading system.

In May 2023, Standard Chartered signed a memorandum of understanding with DIFC to launch digital asset custody services.⁴¹

III - Banking and money transmission

i Onshore UAE

The key onshore virtual currency-specific legislation is the UAE Central Bank’s 2020 Stored Value Facilities Regulation (the SVF Regulation), which regulates the storage of non-cash mediums of exchange that can be purchased, transferred and exchanged for goods and services.⁴² The SVF Regulation expressly includes virtual currencies as virtual assets that customers can purchase, transfer and exchange.

Until 2023, the main change in regulation since 2021 has been in the Emirate of Dubai with the introduction of the Virtual Assets Law. Article 6 of the Virtual Assets Law empowers VARA in numerous ways to regulate, supervise and oversee virtual asset services within the Emirate. Article 6(4) obliges VARA to ‘regulate, and establish rules and controls to govern, the conduct of [regulated activities under the Virtual Assets Law] in the Emirate, including the activities related to Virtual Asset management, clearing, settlement and safekeeping services’. While pertinent to the regulation of exchanges (see Section V below), these activities also fall within traditional banking and money transmission operations and may be expected to lead, in due course, to further virtual currency-related regulations being issued in onshore Dubai.

The VA Framework came into effect in 2023 pursuant to VARA’s obligations under Article 6(4) of the Virtual Assets Law. As explained in Section II.i, the VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide banking and money transmission services. As well as the VARA Regulations, banking and money transmission services cut across many if not all of the requirements set out in the Compulsory and activity-specific Rulebooks, plus the Issuance Rulebook and the MAP Regulations.

ii DIFC

Investment tokens do not fit easily with the rules and regulations that govern traditional fiat currency banking and money transmission services. The Rulebook defines investment tokens as:

the Security or Derivative in the form of a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology; or a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology.

However, the DFSA Rulebook regulates the custody of Investment Tokens and Crypto Tokens by Digital Wallet Service Providers.⁴³ For example, under conduct of business model (COB) 14.3.3 of the DFSA Rulebook, a digital wallet service provider must ensure:

1. any Distributed Ledger Technology application used in providing custody of the investment tokens must be resilient, reliable and compatible with any relevant facility on which the investment tokens are traded or cleared;
2. it is able to clearly identify and segregate investment tokens belonging to different clients; and
3. it has in place appropriate procedures to enable it to confirm client instructions and transactions, maintain appropriate records and data relating to those instructions and transactions and to conduct a reconciliation of those transactions at appropriate intervals.⁴⁴

These rules are applicable to providing custody for both Investment Tokens and Crypto Tokens.⁴⁵

Furthermore, the Digital Wallet Service Provider must ensure that the technology used and its associated procedures have adequate security measures (including cyber security) to enable the safe storage and transmission of data relating to the investment tokens and the DFSA has introduced a technology audit requirement for Authorised Firms providing services in respect of Crypto Tokens.⁴⁶

The DFSA’s Money Service regime was established in January 2020 to allow various previously prohibited activities to be carried out in or from the DIFC. However, the DFSA has maintained its position that authorised Money Services Providers may not use Crypto Tokens and can only use DFSA recognised Fiat Crypto Tokens provided they are a Recognised Crypto Token and used only for the purposes of money transmission or executing a payment transaction in the name of the Money Services Provider and not in the Client’s name.⁴⁷

IV - Anti-money laundering

The UAE’s anti-money laundering (AML) and countering the financing of terrorism (CTF) laws are covered under an extensive suite of federal statutes and the federal penal code. This is in addition to specific legislation and implementing regulations in force throughout the UAE (including in the financial and commercial free zones) covering these crimes.

The UAE Central Bank is the key authority on AML in the state, with assistance from the different authorities across the UAE when it comes to supervision, enforcement and industry related policies. These include the Dubai Multi Commodities Centre (a commercial free zone) (DMCC), the DFSA and the FSRA.⁴⁸

The principal legislation in this area has undergone substantial amendment and modernisation in recent years. Federal Decree-Law No. 20 of 2018 on Facing Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations (the AML Law), and its implementing regulation, Cabinet Decision No. 10 of 2019 on the Implementing Regulation of Federal Decree-Law No. 20 of 2018 on the Criminalisation of Money Laundering and Combating the Financing of Terrorism and the Financing of Unlawful Organisations (the AML Implementing Regulation) have both been subject to amendment to bring them into line with international standards.⁴⁹

In the context of virtual assets, Article 1 of the AML Law defines ‘funds’ as including assets, ‘whatever their form . . . including . . . electronic, digital or crypto . . . and instruments in any form, including electronic or digital, that evidence ownership of those assets or the shares or rights related thereto . . .’ This broad definition of funds means that money laundering in the UAE incorporates acts involving cryptoassets, including virtual or cryptocurrencies.⁵⁰ However, the definition of ‘virtual assets’ in the AML Implementing Regulation excludes ‘digital representations of fiat currencies, securities and other financial assets’.⁵¹

Penalties for money laundering range from a monetary fine of between 100,000 dirhams and 5 million dirhams to imprisonment for up to 10 years.⁵² In addition, confiscation will apply to the funds the subject of the crime or owned by the perpetrator.⁵³ The AML Law applies broadly to local authorities that are entrusted under legislation with the control of financial institutions, designated non-financial businesses and professions, virtual asset service providers (VASP) and non-profit organisations.⁵⁴

The changes to the AML Law incorporate recommendations from the Financial Action Task Force (FATF) that VASPs be registered as a VASP if there is a commercial nexus between the legal entity releasing the software protocol and the decentralised finance (DeFi) solutions provider.⁵⁵ The penalty for operating an unregistered or unlicensed VASP attracts a prison sentence or a fine, or both. On 31 May 2023, the UAE Central Bank issued guidance for its Licensed Financial Institutions (LFIs) dealing with virtual assets and VASPs, including an outline of the due diligence and enhanced due diligence required in respect of potential VASP customers and counterparties. Scheduled to come into force from 1 July 2023, this is a welcome addition to the development of virtual assets in the jurisdiction as it provides for qualitative governance systems and record-keeping requirements in aid of de-risking the industry.⁵⁶

Those subject to the AML Law are subject to AML Suspicious Transaction reporting obligations if they suspect a transaction or funds fully or partially constitute the proceeds of any felony or misdemeanor.⁵⁷ There is a penalty of imprisonment or a fine, or both, to anyone who intentionally or negligently violates these obligations.

The DFSA Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (Annex I) contained rules in its appendix. These rules were amended by DIFC Law No. 1/2004 (the Regulatory Law) on 26 February 2020, which came into force on 1 April 2020 and assists entities falling under its remit with minimum requirements for due diligence and required procedures when conducting KYC.

As described further in Section VIII below, a new specialist Anti-Money Laundering Court has been established within the onshore Dubai Courts.

V - Regulation of exchanges

i Onshore UAE

The SCA Virtual Asset Regulation is still the main, UAE-wide onshore regulation that governs and controls the operation of virtual currency exchanges. The requirements for obtaining and continuing a licence for the operation of a virtual currency exchange and the listing and trading of virtual currencies are set out at Articles 8, 16, 17 and 21 therein.

In the Emirate of Dubai, the Virtual Asset Law obliges VARA to ‘develop the general policy and the strategy places related to . . . dealing and trading in Virtual Assets in the Emirate’ (Article 6(1)), including ‘classify, and determine the types of, Virtual Assets and Virtual Tokens; and prescribe the standards and rules for trading in the same’ (Article 6(5)). The VA Framework came into effect in 2023 pursuant to VARA’s obligations under Article 6(5). As explained in Section ii.i, the VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide exchange services. As well as the VARA Regulations, exchange services cut across many if not all of the requirements set out in the Compulsory and activity-specific Rulebooks, plus the Issuance Rulebook and the MAP Regulations.

The Enabling Technologies Guidelines contain guidelines for all financial institutions licensed by the SCA, Central Bank, DFSA or FSRA. Sections 2.31 to 2.36 of the Guidelines contain specific principles for the operation of a DLT, including technologies that use blockchains like virtual currency exchanges, covering their governance, auditability, design, anonymity and pseudonymity, management and monitoring and business continuity. The specific (and detailed) guidelines for a DLT are at Sections 3.115 to 3.156 of the Guidelines. The DMCC is one of the non-financial free zones in Dubai and has been at the forefront of developing an infrastructure for the growth of a prosperous and sophisticated environment for the cryptoasset industry. In 2017, the DMCC recognised proprietary trading in cryptoassets as a licenced activity. The launch in May 2021 of the DMCC Crypto Centre,⁵⁸ in partnership with the Swiss-Government backed CV Labs, has provided a platform for a huge increase in blockchain and decentralised finance projects and related businesses in Dubai.⁵⁹ The success of this venture is due in large part to the Memorandum of Understanding signed between the DMCC and the SCA in March 2021, establishing a regulatory framework for businesses offering, issuing, listing and trading cryptoassets in the freezone, including cryptoasset trading platforms. The DMCC offers bespoke licences for crypto-related business⁶⁰ for which the SCA will be responsible for issuing approvals and regulating the crypto activities in line with the SCA Virtual Asset Regulation.

Currently, the DMCC is also working on establishing the first precious metals refinery and storage facility in the GCC to be completely enabled by blockchain. The facility will cater for gold, silver and other precious metals, to be tokenised to back a set of stable coins.⁶¹

ii ADGM

Paragraph 54(1), Chapter 9, Schedule 1 of the FSMR provides that the operation of a Multilateral Trading Facility (MTF) on which Virtual Assets are traded is a Regulated Activity.⁶² Regulated Activities can only be carried out by Authorised Persons. Authorised Persons operating an MTF may also provide Custody Services.

Paragraphs 125–134 of the Guidance on the Regulation of Virtual Asset Activities set out the requirements for those operating an MTF and Virtual Assets. Paragraph 129 makes it clear that an MTF includes trades not only made from fiat currency (or other value) to accepted virtual assets and vice versa but also from one accepted virtual asset to another.

Accepted virtual asset in this context is specific to each authorised person, creating bespoke licences for each authorised person and MTF trading virtual assets. For that reason, the FRSA does not maintain a public list of accepted virtual assets.⁶³ 

A key point to note is the attitude that the FRSA has taken to the location of MTFs operating in the ADGM. Paragraphs 128–129 of the Guidance on Virtual Asset Activities make it clear that the FRSA will have extensive regulatory oversight for both start-ups and established exchanges. The FRSA recognises that, in this respect, its level of oversight may differ from other regulators globally.

In practical terms, for a start-up MTF, its entire order book and the functionality of its matching engine will be subject to FSRA oversight. For existing operational virtual asset exchanges that already have their order book or matching engine outside the ADGM prior to making an application, a determination of which parts (if not all) of its order book (and how its matching engine) will come under FSRA regulatory oversight needs to be made by the applicant, to allow it to apply to become authorised as an MTF.

FSRA-COBS Rule 8.2.1 sets out various rules in MIR that MTFs (using virtual assets) are required to comply with to the satisfaction of the FSRA. 

There is also a requirement that the authorised person operating the MTF maintain a minimum regulatory capital in fiat equivalent to 12 months’ operational expenses.

In addition to Kraken, BitOasis, Matrix Exchange, DEX and MidChains having obtained permission from the FSRA to operate in the ADGM, in May 2022 Binance, the largest cryptocurrency exchange in terms of daily trading volume, also obtained a licence to operate in the ADGM.

iii DIFC

NASDAQ Dubai, one of the largest stock exchanges in the Middle East, has been present in the DIFC since 2004 while the Dubai Mercantile Exchange, an energy-focused commodities exchange that is home to the world’s third crude benchmark, has been located in the DIFC since 2005. Historically, the DFSA has issued licences for and regulated the operation of an exchange, a multilateral trading facility or an alternative trading platform in the DIFC, and it has since extended these financial services to include activities related to investment tokens. This means that companies wishing to operate an alternative trading platform for investment tokens will have to comply with the same requirements that are applicable to operators of other types of exchange. In particular, admitting securities tokens to an exchange or trading platform in the DIFC will require the publication of a prospectus in compliance with the DIFC Markets Law 2012.

A technology audit requirement is also imposed on all authorised firms operating a facility for investment tokens, holding or controlling investments that include investment tokens, relying on DLT or similar technology to carry out financial services in relation to investment tokens, or managing a fund where either 10 per cent or more of the asset value of the fund comprises investment tokens; or the units are in security tokens.

In Consultation Paper No. 143, the DFSA proposed that it would be possible to operate a crypto trading venue as either an Exchange or a Multilateral Trading Facility (MTF).⁶⁴ However, under the Crypto Token Regime, the DFSA has confirmed that it will only be possible to carry out crypto trading through an MTF.⁶⁵ In order to operate an MTF which allows crypto trading, the Authorised Firm must conduct an appropriateness assessment to determine whether the Person has adequate skills and expertise to understand the risks involved in trading crypto and has the ability to absorb potentially significant losses as a result of doing so.⁶⁶

In June 2021, the Bitcoin Fund (QBTCu.TO) listed on NASDAQ Dubai, making it the Middle East’s first indexed cryptocurrency-based fund. The issuer, Canadian digital asset management firm 3iQ, received approval from the DFSA to list the Bitcoin Fund under the DFSA’s then current securities framework in April 2021.

VI - Regulation of miners

i Onshore UAE

In Dubai, the Virtual Asset Law obliges VARA to ‘regulate, supervise, and oversee the issuance, offering and relevant disclosure processes of Virtual Assets and Virtual Tokens’ (Article 6(2)) and to:

regulate, and issue Permits to, Virtual Asset Service Providers in accordance with the requirements, procedures, and rules adopted by it; and oversee and supervise them to ensure their compliance with the provisions of this Law, the resolutions issued in pursuance hereof, and other Legislation in force in the Emirate (Article 6(3)).

The VA Framework came into effect in 2023 pursuant to VARA’s obligations under Article 6(2). As explained in Section II.i, the VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide mining services. As well as the VARA Regulations, mining services cut across many of the requirements set out in the VARA Regulations, compulsory and activity-specific rulebooks (particularly those covering broker-dealer, custody and exchange services), the Issuance Rulebook and the MAP Regulations.

While the Virtual Assets Law apparently spurred a number of applications to VARA for relevant ‘mining’ licences, the VA Framework now provides the full, effective licensing framework for mining activities in Dubai.

ii ADGM

The ADGM has not legislated for, nor passed any regulation that governs, the mining of cryptoassets. Paragraph 11(b)(ii) of the FRSA Guidance on the Regulation of Virtual Asset Activities in the ADGM expressly confirms that the Virtual Asset Framework is not intended to apply to ‘the development, dissemination or use of software for the purpose of creating or mining a Virtual Asset’.⁶⁷

iii DIFC

At present, there is no proposed regulation of miners insofar as crypto tokens are concerned. However, as noted in Section VII below, the DFSA has said that, at present, it does not intend to allow for the issuance of new crypto tokens, although it intends to revisit this in the future. If the DFSA were to permit the issuance of new crypto tokens in the future, it is possible that a regulatory regime applicable to miners might also be introduced.

VII - Regulation of issuers and sponsors

The SCA Virtual Asset Regulation is still the main, UAE-wide onshore regulation that governs and controls the operation of persons offering, issuing or promoting virtual assets. The requirements for obtaining and continuing a licence for these activities are set out in various articles in the regulations, and particularly at Article 14.

As regards Dubai, the VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide issuing and sponsor services. The main guidelines for issuing services specifically are found in the Issuance Rulebook, which sets out the requirements for registration prior to the issuance of permitted virtual assets and all virtual assets other than permitted assets (as defined in the Rulebook). The MAP Regulations set out the obligations on all issuers and sponsors in respect of financial promotion activities.

While the Virtual Assets Law apparently spurred a number of applications for relevant issuer and sponsor licences from VARA, the VA Framework now provides the full, effective licensing framework for providing those services in Dubai.

i DIFC

Financial promotion

Financial promotions (i.e., the marketing of financial products and financial services) are generally prohibited under Article 41A of the Regulatory Law 2004, unless certain requirements relating to marketing in the GEN Module Chapter 3 (of the DFSA Rulebook) are met. As such, financial promotions can only be made or approved by authorised persons, although other persons may also make them in very limited circumstances, which are subject to additional requirements. This applies to investment tokens and crypto tokens and the narrow exceptions in which a financial promotion can be made are set out in the General Module (GEN) 3.4.1⁶⁸ and 3.4.2⁶⁹.

The Crypto Token Regime prohibits authorised firms from offering or providing to retail clients any incentive which influences, or is reasonably likely to influence, them to trade in a crypto token or crypto token derivative.⁷⁰ Such prohibition is also applied to crypto tokens that are not accepted crypto tokens, algorithmic tokens and privacy tokens.

Issuance of tokens

Issuers of securities are required to have a prospectus that meets the DFSA’s requirements set out in the DIFC Markets Law 2012. Issuers of security tokens must also provide a prospectus, although the rules for prospectuses relating to security tokens and crypto tokens are somewhat more onerous in their requirements, as set out in MKT A7.1.2.⁷¹

It is also important to remember that any authorised firm that wishes to provide a financial service in respect of investment tokens and crypto tokens must provide a key features document, per COB 14.4.2⁷² and per COB 15.3.1,⁷³ respectively. There are some differences in the type of information that must be provided in the key features document for investment tokens and crypto tokens. For example, the information for crypto tokens must include details of the regulatory status of the crypto token in other jurisdictions, details about how ownership of the crypto token is established, advice of risks related to the volatility of the price of the crypto token and advice on cybersecurity risks associated with the crypto token as well as the risks related to fraud, hacking and financial crime.

With regard to crypto tokens, the DFSA has said that initially it intends to focus on crypto tokens that have already been issued and therefore it does not intend to allow for the issuance of new crypto tokens. However, the DFSA has also stated that it will consider this matter again at a later stage, suggesting that the issuance of new crypto tokens may become permitted in the future. An issuer or developer of a crypto token may apply to the DFSA to have the crypto token recognised in the DIFC.⁷⁴

VIII - Criminal and civil fraud and enforcement

As part of general legal reforms introduced within the UAE at the start of 2022, Federal Decree Law No. 5/2012 on Combatting Cybercrime was repealed and replaced by Federal Decree-Law No. 34/2021 Concerning the Fight Against Rumours and Cybercrime (the Cybercrime Law), which came into effect on 2 January 2022. The Cybercrime Law includes a number of offences prevalent in cryptoasset fraud, from hacking and compromising information systems to the unauthorised obtaining of third-party symbols and codes of electronic information technology (passwords), to the fabrication of websites, mail and electronic accounts.⁷⁵ It also criminalises acts related to unlicensed cryptocurrency trading and behaviour that promote or encourage the unlicensed dealing in cryptocurrency that is not officially recognised in the UAE.⁷⁶ Unsurprisingly, the full scope of federal civil and criminal penalties is applicable to all activities related to cryptoassets, and regulated persons must comply with AML/CFT laws.⁷⁷

While at the forefront of regulatory development in the cryptoasset field, regulatory bodies in the UAE continue to urge caution in dealing with crypto-related financial products.

The SCA has publicised warnings for investors against dealing with certain crypto or initial coin offering companies as a result of concerns about fraud.⁷⁸ The DFSA has highlighted fraud and money laundering among key risk factors when buying cryptoassets and advises potential investors and consumers to undertake due diligence and exercise caution before entering a transaction.⁷⁹

Operators of a virtual asset business in the ADGM are subject to the full remit of financial crime offences, including making misleading statements and market abuse.⁸⁰ To reduce the risk of financial crime, the FSRA regulates cryptoassets and continues to issue warnings about suspect companies.⁸¹

To help combat the rise in crypto fraud, on 22 August 2021, the Dubai courts announced the establishment of a specialist criminal court focused on combating money laundering. The new court will sit within the Court of First Instance and Court of Appeal. Additionally, in October 2021, the Dubai police launched a specialist virtual asset crime department to investigate crypto fraud⁸² and announced that it will be collaborating with a cryptocurrency trading platform and other industry experts to fight crime within the space.⁸³ In the past year, the Dubai police have arrested 40 members of a crypto laundering scheme and successfully investigated the theft of an NFT from a Dubai resident.

The VA Framework sets out various penalties, mainly in the MAP Regulations, with penalties for non-compliance contained in Administrative Order No.2.

Furthermore, the UAE’s civil courts are able to assist victims of fraud. The DIFC and ADGM courts have the full arsenal of interim measures available to common law courts, including freezing and proprietary injunctions and asset disclosure orders. These interim measures have been successfully used in other common law jurisdictions and, provided the jurisdictional requirements of the UAE’s common law courts are met, it is highly likely that similar measures could be wielded by the DIFC and ADGM under their existing laws and court rules. The UAE’s onshore courts may also be able to make orders in support of claims by fraud victims, notable in the form of the precautionary attachment, which is similar to a freezing order in the common law courts and can be easily notified to banks and other financial institutions under existing processes.

IX - Looking ahead

Looking ahead to the future of virtual currency in the UAE requires considerably less speculation than in other jurisdictions. In the short-to-medium term from a regulatory standpoint:

1. there will be considerable interest in how VARA establishes itself, how its remit interacts with the SEC and Central Bank, and the how the industry responds to the new VA Framework;
2. responses were due to the DFSA’s Consultation Paper No.150 containing proposals in relation to money services, crypto tokens and crowdfunding by 26 May 2023 and the outcome is expected later this year;
3. responses were also due to the ADGM’s Consultation Paper No.3 of 2023 on Proposals for a Legislative Framework for Distributed Ledger Technology Foundations on 12 May 2023 (which can be used by issuers of non-regulated utility tokens) and the outcome is expected later this year; and
4. the UAE Central Bank launched its strategy for ‘The Digital Dirham’ on 23 March 2023. Phase one comprises three major pillars, the soft launch of mBridge to facilitate real value cross-border transactions for international trade settlement, proof-of-concept work for bilateral bridges with India, one of the UAE’s top trading partners and finally, proof-of-concept work for domestic Central Bank Digital Currency issuance covering wholesale and retail usage.

From a jurisprudential standpoint, the UAE continues to grapple with issues confronting jurisdictions worldwide. Notable cases have included:

1. a Dubai court awarding payment of damages in cryptocurrency in October 2022;
2. a landmark case concerning how to account for the fluctuating values of cryptocurrency in the context of a crypto mining investment dispute in April 2023; and
3. a case before the court in RAK in which a cryptocurrency sale agreement was rescinded on the basis that it was not a recognised commodity or currency under Sharia law.

In January 2024 the DIFC Court of Appeal will hear the appeal in TCD-001-2020 Huobi MENA & Ano v. Tabarak Investment Capital Limited & Ano. The claimants have obtained permission to appeal on eight separate grounds and the appeal judgment will provide some useful guidance for those in the industry on a wider range of topics, including when to value losses for misappropriated digital assets and what constitutes best practice for fiduciaries and custodians of digital assets.

1. Sara Sheffield is a partner, Max Davis and Peter Smith are legal directors, Karl Masi is a senior associate, James Colautti is an associate and Dalal Alhouti is a knowledge development lawyer at Charles Russell Speechlys.
2. https://u.ae/en/about-the-uae/the-uae-government/the-federal-judiciary.
3.  ibid.
4. Federal Decree No. (15) of 2013 and Cabinet Resolution No. (4) of 2013.
5. Federal Decree No. (35) of 2004.
6.  https://www.adgm.com/setting-up/virtual-asset-activities/overview.
7.  https://www.sca.gov.ae/en/regulations/regulations-listing.aspx#page=1.
8.  https://centralbank.ae/sites/default/files/2020-11/Stored%20Value%20Facilities%20%28SVF%29%20Regulation%20AR%20%26%20EN.pdf.
9. https://www.centralbank.ae/sites/default/files/2021-08/2021%20C%2015-2021%20Retail%20Payment%20Services%20and%20Card%20Schemes%20Reg.pdf.
10. These are defined as ‘a type of Crypto-Asset that is backed by one or more Fiat Currencies, can be digitally traded and functions as (i) a medium of exchange; and/or (ii) a unit of account; and/or (iii) a store of value, but does not have legal tender status in any jurisdiction’.
11. These are defined as ‘means a type of Crypto-Asset that provides its holder with rights and obligations that represent a debt or equity claim against the issuer of that token’, https://dfsaen.thomsonreuters.com/rulebook/gen-a211.
12.  https://www.dfsa.ae/news/dfsa-crypto-token-regime-comes-force.
13. All capitalised terms are as defined in the Virtual Asset Regulation.
14. https://www.vara.ae/en/#varaGuidelinesDownloads_5.
15. https://www.vara.ae/media/Virtual%20Assets%20and%20Related%20Activities%20Regulations%202023.pdf.
16. https://www.vara.ae/en/#0.
17.  https://www.vara.ae/media/Company%20Rulebook.pdf.
18.  https://www.vara.ae/media/Compliance%20and%20Risk%20Management%20Rulebook.pdf.
19.  https://www.vara.ae/media/Technology%20and%20Information%20Rulebook.pdf.
20.  https://www.vara.ae/media/Market%20Conduct%20Rulebook.pdf.
21.  https://www.vara.ae/media/Advisory%20Services%20Rulebook.pdf.
22.  https://www.vara.ae/media/Broker-Dealer%20Services%20Rulebook.pdf.
23. https://www.vara.ae/media/Custody%20Services%20Rulebook.pdf.
24. https://www.vara.ae/media/Exchange%20Services%20Rulebook.pdf.
25.  https://www.vara.ae/media/Lending%20and%20Borrowing%20Services%20Rulebook.pdf.
26.  Not yet available online.
27.  https://www.vara.ae/media/VA%20Management%20and%20Investment%20Services%20Rulebook.pdf.
28.  https://www.vara.ae/media/Virtual%20Asset%20Issuance%20Rulebook.pdf.
29. https://www.vara.ae/media/Administrative-Order-01-%20Regulatory-Guidelines-on-Marketing-Advertising-and-Promotions-related-to-Virtual-Assets-27Jan2023.pdf.
30.  https://www.vara.ae/media/Administrative-Order-02-Penalties-for-Non-Compliance-27Jan2023.pdf.
31. https://www.sca.gov.ae/assets/747a7cdf/guidelines-for-financial-institutions-adopting-enabling-technologies-2021.aspx.  See also https://www.dfsa.ae/news/uae-regulatory-authorities-jointly-issue-guidelines-financial-institutions-adopting-enabling-technologies. https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_19883_VER02240220.pdf.
32. Consultation Paper No. 138 – Regulation of Security Tokens | Rulebook (thomsonreuters.com).
33. DFSA introduces regulatory framework for Investment Tokens, DFSA, The Independent Regulator of Financial Services.
34. https://dfsaen.thomsonreuters.com/rulebook/feedback-statement-consultation-paper-no-143-regulation-crypto-tokens.
35.  https://dfsaen.thomsonreuters.com/rulebook/gen-a251.
36.  https://dfsaen.thomsonreuters.com/rulebook/gen-a252.
37.  https://www.dfsa.ae/news/notice-amendments-legislation-october-2022-2.
38.  https://dfsaen.thomsonreuters.com/rulebook/gen-3a41.
39.  https://dfsaen.thomsonreuters.com/rulebook/gen-722.
40.  https://dfsaen.thomsonreuters.com/rulebook/gen-3a-guidance.
41. https://ibsintelligence.com/ibsi-news/standard-chartered-and-difc-to-launch-digital-asset-custody-services/.
42. https://dfsaen.thomsonreuters.com/rulebook/gen-722.
43. In respect of Investment Tokens a Digital Wallet Service Provider means ‘an Authorised Firm providing custody of Investment Tokens by holding and controlling the public and private cryptographic keys relating to the Investment Tokens’ and in respect of Crypto Tokens means ‘an Authorised Firm providing custody of Crypto Tokens by holding and controlling the public and private cryptographic keys relating to the Crypto Tokens’.
44. https://dfsaen.thomsonreuters.com/rulebook/cob-1433.
45. https://dfsaen.thomsonreuters.com/rulebook/cob-1542.
46. https://dfsaen.thomsonreuters.com/rulebook/cob-1581.
47.  GEN 3A.2.5 | Rulebook (thomsonreuters.com)
48.  UAE Ministry of Foreign Affairs & International Cooperation (24 February 2021) https://www.mofaic.gov.ae/en/mediahub/news/2021/2/24/24-02-2021-uae-office (last accessed on 31 May 2022).
49. Amended by Federal Decree-Law No. 26/2021 and Cabinet Decision No.24/2022, respectively.
50. See ‘Anti-Money Laundering and Combating the Financing of Terrorism and the Financing of Illegal Organisations Guidelines for Financial Institutions’ available at https://www.centralbank.ae/en (last accessed on 27 May 2022).
51. AML Implementation Regulation, Article 1.
52.  AML Law, Article 22.
53.  AML Law, Article 25.
54.  AML Law, Article 1.
55. Gulf Business (1 March 2022) https://gulfbusiness.com/how-uae-is-fast-becoming-an-ideal-hotspot-forblockchain-startups/ (last accessed on 27 May 2022).
56.  Risks Related to VAs and VASPs (centralbank.ae)
57.  AML Law, Article 15. Cabinet UBO Resolution No. 58 of 2020 on the Regulation of the Procedures of the Real Beneficiary, which came into effect on 28 August 2020 (the UBO Regulations). See ‘Anti-Money Laundering and Combating the Financing of Terrorism and the Financing of Illegal Organisations Guidelines for Financial Institutions’ available at https://www.centralbank.ae/en (last accessed on 27 May 2022).
58.  See DMCC https://www.dmcc.ae/news/dmcc-launches-crypto-centre-champion-cryptographic-andblockchain-technologies-dubai (last accessed on 26 May 2022).
59.  Gulf Business (10 January 2022) https://gulfbusiness.com/dubai-multi-commodities-centre-achievesrecord-growth/ (last accessed on 26 May 2022).
60.  See DMCC website https://www.dmcc.ae/news/crypto-businesses-now-able-set-dmcc-dubai-followingsca-agreement (last accessed on 26 May 2022).
61.  Supra, ii [Gulf News article, 10 January 2022].
62.  https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_12483_VER122021.pdf.
63. See Paragraph 33 of the FRSA Virtual Asset Guidance. https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/GuidanceVirtual_Asset_Activities_in_ADGM_VER03.240220.pdf.
64.  An MTF is defined as a ‘system which brings together multiple third party buying and selling interests in Investments or Crypto Tokens, in accordance with its non-discretionary rules, in a way that results in a contract in respect of such Investments or Crypto Tokens’.
65. https://dfsaen.thomsonreuters.com/rulebook/gen-2221.
66. https://dfsaen.thomsonreuters.com/rulebook/cob-1562.
67.  https://www.adgm.com/documents/legal-framework/guidance-and-policy/fsra/guidance-on-regulation-of-virtual-asset-activities-in-adgm.pdf.
68. https://dfsaen.thomsonreuters.com/rulebook/gen-341.
69. https://dfsaen.thomsonreuters.com/rulebook/gen-342.
70. https://dfsaen.thomsonreuters.com/rulebook/cob-1564.
71. https://dfsaen.thomsonreuters.com/rulebook/mkt-a712.
72. https://dfsaen.thomsonreuters.com/rulebook/cob-1442.
73. https://dfsaen.thomsonreuters.com/rulebook/cob-1531.
74.  https://dfsaen.thomsonreuters.com/rulebook/gen-3a31.
75.  Federal Decree-Law 34/2021 Concerning the Fight Against Rumours and Cybercrime, Articles 2, 5 9 and 11.
76.  ibid, Articles 41 and 48.
77.  SCA Virtual Asset Regulation, Articles 20 and 21.
78.  Thomson Reuters Special Report, ‘Cryptos on the Rise’ 2022 and The National, UAE, ‘DFSA sounds alarm on cryptocurrency fraud as UAE regulators consult on technology guidelines’ (1 June 2021), https://www.thenationalnews.com/business/economy/dfsa-sounds-alarm-on-cryptocurrency-fraud-as-uae-regulators-consult-on-technology-guidelines-1.1233550 (last access 25 May 2022) and https://www.thomsonreuters.com/en/reports/cryptos-on-the-rise-2022.html (last accessed 25 May 2022).
79.  SCA Warnings, available at https://www.sca.gov.ae/en/open-data/violations-and-warnings.aspx (last accessed on 25 May 2022).
80.  Financial Services and Markets (Amendment No. 2) Regulation 2020, Sections 92, 102 and 103 (as amended).
81.  See FSRA Alert, ‘ADGM issues alert concerning misleading claims made by para Holdings’ (14 April 2022) at https://www.adgm.com/media/announcements/adgm-issues-alert-concerning-misleading-claims-made-by-para-holdings (last accessed on 25 May 2022).
82.  Unlock Media, ‘Dubai Police first in MENA Region to launch virtual asset crime department’ (10 October 2021) https://www.unlock-bc.com/81035/dubai-police-first-in-mena-region-to-launch-dedicate-virtual-assets-crime-department (last accessed on 25 May 2022).
83.  Arab News, ‘Dubai crypto platform teams up with police to combat crypto fraud’ (3 October 2021) https://www.arabnews.com/node/1940551/business-economy (last accessed on 25 May 2022).

This article was orignally published by The Law Reviews. To read the full report, please click here.