Expert Insights

You are here:

Home
Expert Insights
In-Depth Virtual Currency Regulation

In-Depth Virtual Currency Regulation: United Arab Emirates

13 August 2024

Introduction

The United Arab Emirates (UAE) comprises a federation of seven Emirates (Abu Dhabi, Ajman, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah and Umm Al Quwain). UAE Federal Law is a civil law system that incorporates elements of Egyptian and French civil law, as well as the principles of Islamic Sharia.^[1] The federal financial regulators are the UAE Central Bank and the Securities and Commodities Authority (SCA). In addition to the federal jurisdiction, each of the Emirates is entitled to choose to maintain their own separate local courts to deal with matters that are not reserved to federal jurisdiction in the Constitution. Abu Dhabi, Dubai and RAK maintain their own independent judiciaries, which apply civil law and Sharia principles. This chapter refers to these jurisdictions collectively as 'Onshore UAE'.

Article 121 of the UAE Constitution also permits the establishments of free zones. Federal Law No 8 of 2004 specifically permits a subset of the free zones called Financial Free Zones. The key elements of a Financial Free Zone (set down in Article 3 of Federal Law No 8 of 2004) are that they are exempt from all federal civil and commercial laws, but they remain bound by federal criminal laws, including federal anti-money laundering legislation.^[2] The UAE has established two Financial Free Zones: the Abu Dhabi Global Market (ADGM)^[3] and the Dubai Internal Financial Centre (DIFC).^[4]

Within the ADGM, there is a separate financial regulator, the Financial Services Regulatory Authority (FSRA), and separately the ADGM Courts. The ADGM Courts, Civil Evidence, Judgments, Enforcement and Judicial Appointments Regulations 2015 make English Common Law directly applicable in the ADGM, marking a clear distinction from the civil law applicable at the federal level and in onshore UAE. Similarly, within the DIFC, there is also a separate financial regulator, the Dubai Financial Services Authority (DFSA), and separately the DIFC courts. The DIFC courts also apply a common law system (ie DIFC law) modelled on the English Common Law (with its court rules closely modelled on the English Civil Procedure Rules) albeit, unlike in the ADGM, English law is persuasive but not directly applicable. In both the ADGM and DIFC courts, proceedings are conducted in English with judgments written in English. Both the ADGM and DIFC are dealt with separately in this chapter where appropriate.

Year in review

The past year has been notable for the deeper embedding of the UAE’s virtual currency regulatory framework. As a snapshot, the Dubai Virtual Assets Regulatory Authority received 133 applications for various licences and issued 19 VASP licences in its first year of operation, with a further 72 Initial Approvals granted. It also issued several new regulations including regulations relating to Staking from Custody Services and relating to stablecoins and other virtual assets backed by real-world assets. The DIFC enacted its new Digital Assets Law (Law No 2 of 2024) in March 2024. Binance announced it had been granted a full Virtual Asset Service Provider licence in Dubai in April 2024.

Legal and regulatory framework

In 2018, the FSRA published extensive regulations making the ADGM:

the first jurisdiction in the world to introduce a comprehensive and bespoke regulatory framework for the regulation of spot virtual asset activities, including those undertaken by multilateral trading facilities, brokers, custodians, asset managers and other intermediaries.^[5]

These laws, regulations and guidance have since been regularly updated, with the latest iterations issued in September 2022.

The period since 2020 has seen the onshore federal regulators publish their first regulations affecting cryptoassets. The SCA passed Decision No 23 of 2020 Concerning Crypto Assets Activities Regulation (the SCA Virtual Asset Regulation)^[6] and the UAE Central Bank published both its Stored Value Facilities Regulation^[7] and the Retail Payment Services and Card Schemes Regulation.^[8] These regulations cover payment tokens (or stablecoins)^[9] but expressly exclude security and commodity tokens.^[10] However, in May 2023, the SCA issued two new regulations relating to virtual assets: the SCA Chairman of the Board of Directors’ Decision No 26/RM of 2023 in relation to Virtual Assets Platform Operators (the SCA VA Exchange Regulation); and the SCA Chairman of the Board of Directors’ Decision No 27/RM of 2023 amending Decision No 13/RM of 2021 in relation to the SCA Rulebook (the SCA Rulebook Amendment Regulation). The SCA VA Exchange Regulation covers the licensing of virtual assets and only virtual assets that are listed in the SCA’s official list or that are licensed by VARA may be traded in the UAE. The SCA Rulebook Amendment Regulation amends the SCA Rulebook in relation to virtual assets and adds such assets to the list of products that can be dealt or brokered by SCA-regulated firms.

Since the issuance of Federal Cabinet Decision No 111 of 2022 on the regulation of virtual assets and their service providers, no person has been permitted to engage in virtual asset activities in Onshore UAE without first obtaining approval and a licence from the SCA or a local licensing authority. From March 2022 onward, the Emirate of Dubai and the DIFC’s DFSA have both taken significant steps towards regulating virtual currency.

On 9 March 2022, Dubai Law No 4 of 2022 Concerning the Regulation of Virtual Assets (the Virtual Asset Law) established the (onshore) Dubai Virtual Asset Regulatory Authority (VARA). VARA’s remit is very wide and incorporates regulating and licensing issuers, exchanges and custodial and management services providers.

Under Article 15(a), the effect of the Virtual Assets Law is to prohibit, in lieu of a licence issued by VARA, any activity in respect of virtual currencies (among other operations) that falls under Article 16. The activities requiring permits listed at Article 16 include:

provision of virtual asset platform operation and management services;
provision of services for the exchange between virtual assets and national or foreign currencies;
provision of services for the exchange between one or more forms of virtual assets;
provision of virtual asset transfer services;
provision of virtual asset safekeeping, management or control services;
provision of services related to virtual asset wallets; and
provision of services related to offering, and trading in, virtual tokens.

VARA’s jurisdiction does not extend to the DIFC and only covers activities in respect of virtual currencies that are carried out in onshore Dubai (but outside of the DIFC). At present, no passporting regime exists between Onshore Dubai and the DIFC, meaning that companies must choose which jurisdiction to become licensed in. Companies who wish to operate in both onshore UAE and the DIFC need to be licensed in both jurisdictions.

On 7 February 2023, VARA published its Virtual Assets and Related Activities Regulations (the VARA Regulations) and associated rulebooks, which, together with the VARA Regulations, form the Virtual Asset Framework (the VA Framework). The VA Framework took immediate effect in the Emirate of Dubai and applies to all firms providing services to or from Dubai other than firms conducting business in the DIFC. The VA Framework provides a framework for the licensing of Virtual Asset Service Providers (VASPs) and rules for their operation.

On 1 June 2023, VARA issued Administrative Resolution No 1 of 2023, which established its Grievance Committee. The purpose of the Grievance Committee is to consider and resolve grievances submitted by parties operating in the virtual asset space in Dubai. The Grievance Committee is empowered to issue penalties and other sanctions for breaches of the VARA Regulations and rulebooks.

In 2021, the DFSA updated its Rulebook to include Investment Tokens. Then in March 2022, the DFSA launched Consultation Paper No 143 setting out its proposal for the regulatory framework for cryptocurrencies. This resulted in the DFSA’s new Crypto Token Regime coming into force on 1 November 2022.^[11]

After a year of consultations and legislative review in 2023, on 8 March 2024, the DIFC enacted the Digital Assets Law – DIFC Law No 2 of 2024, as well as a new Law of Security. The DIFC also enacted DIFC Amendment Law – No 3 of 2024, which updates the Contracts Law, Law of Obligations, Law of Damages and Remedies, Trust Law and Foundations Law in reference to digital assets.

Cabinet Decision No 111 of 2022 confirms that overall federal authority rests with the SCA, which can delegate this authority, for instance, to VARA. Questions remain as to how the overlapping jurisdictions of the UAE Central Bank, SCA and VARA over virtual currencies will be reconciled in practice, the extent to which VARA will continue to issue regulations and make decisions that are specific to virtual currencies within its jurisdiction or that have wider, national effect and whether general securities, investment and banking laws, for instance, will be issued with specific applicability to virtual currencies. The SCA and VARA announced in July 2023 that it had received licensing requests and inquiries from companies intending to provide Virtual Asset services following the issuance of the necessary regulations. Since July 2023, all companies operating in Dubai must only obtain a license from VARA, which will then inform the SCA to have a unified register of all licensed Virtual Asset service providers in the UAE.^[12] In April 2024, Binance announced that it had been granted a full Virtual Asset Service Provider licence from VARA.

Securities and investment laws

Onshore UAE

A notable development in 2020–2021 was the issue of the SCA Virtual Asset Regulation,- ^[13] which regulates the 'Offering, issuing, listing and trading of Crypto Assets in the State and related Financial Activities' (Article 2(1)) by creating a licensing regime, issuing directives and facilitating (and responding to) inquiries relating to the licensing regime (Article 2(2)). The scope of the regulation is set out in Articles 3 to 5. 'General Obligations in respect of Crypto Assets' are set out in Chapter 2, including the Offering of Crypto Assets (Article 6) and the Offering of Security Tokens (Article 7) in the State, and Crypto Assets listing on a Crypto Asset Exchange (Article 8).

In the Emirate of Dubai, Article 6(1) of the Virtual Assets Law empowers VARA to, among other duties, develop the general policy and the strategic plans related to regulating Virtual Asset services in the Emirate. Since the last edition of this volume, amendments to Dubai laws relating to securities and investment that are specific to the creation, trade and storage of virtual currencies have been issued, namely the VARA Regulations^[14] along with associated rulebooks; altogether, they form the VA Framework.

The VA Framework was published on 7 February 2023 and took effect immediately in the Emirate of Dubai but not in the DIFC. Described as the world’s first tailor-made virtual asset regime, the VARA Regulations and the wider VA Framework are designed to provide permissible activities and services to customers, investors and traders in digital assets.

The VARA Regulations^[15] contain provisions relating to securities and investments and, in particular, entities that are categorised as being VASPs. The licensing regime for a VASP is linked to the type of service the VASP offers. VARA recognises seven distinct categories of virtual asset activities that interlock to provide coverage of the spectrum of services a VASP may offer. It treats each category as modular, so a VASP may apply for multiple activities and aggregate them under a single overarching licence provided there is no specific need to segregate any of those activities. In overview, the seven types of licence cover: advisory services; broker-dealer services; custody services; exchange services; services for the lending and borrowing of virtual assets; services for the payment and remittance of virtual assets; and virtual asset management and investment services.^[16]

Any VASP carrying out regulated activities will need to apply for a licence from VARA. Application fees, extension fees and annual supervision fees apply at various rates. An adviser services licence comes with a 40,000 dirhams application fee and an annual supervision fee of 80,000 dirhams, whereas the equivalent exchange services licence fees come in at 100,000 dirhams and 200,000 dirhams, respectively.

VASPs who fulfil VARA’s licensing requirements will be required to comply with four compulsory rulebooks on the themes of company,^[17] compliance and risk management,^[18] technology and information^[19] and market conduct.^[20]In addition, seven activity-specific rulebooks have been developed to cater for risks associated with the provision of each virtual asset activity, namely advisory services,^[21] broker-dealer services,^[22] custody services,^[23] exchange services,^[24] lending and borrowing services,^[25] payments and remittances services^[26] and management and investment services.^[27] VARA has also established rules for the issuance of all virtual assets (Issuance Rulebook).^[28]

All market participants, whether licensed by VARA or otherwise, must adhere to the Marketing, Advertising and Promotions Regulations (the MAP Regulations, set out in VARA’s Administrative Order No 1 of 2022), which cover virtual asset marketing activities^[29]. VASPs, businesses offering non-virtual asset activities and individuals, should be aware of VARA’s Administrative Order No 2, which sets out the penalties for non-compliance.^[30]

There are several sections of the VARA Regulations of particular note and relating to securities and investment law. Part II covers the issuance of virtual assets, including issuance rules, the power to classify virtual assets and prohibited virtual assets. Part III covers regulated activities in respect of virtual assets, setting out the general prohibition on activities and exemptions to the general prohibition. Part IV covers licensing including licensing requirements and VARA’s licensing and authorisation powers. However, VASPs will only be required to comply with each activity rulebook if they are licensed by VARA to offer the activity; securities and investment laws cut across many of the rulebooks listed above, including the four compulsory rulebooks and those on advisory, broker-dealer, exchange and management and investment services, plus the Issuance Rulebook and the MAP Regulations.

In August 2023, VARA published a revised Custody Services Rulebook permitting Staking from Custody Services. VASPs licensed to carry out Custody Services may now, with specific additional approval from VARA, provide staking services to their customers from the same legal entity without obtaining a separate license for Virtual Assets Management and Investment Services.^[31]

Since the VA Framework was published, VARA has been busy issuing licences: 133 applications for various licences had been acknowledged and 19 regulated VASP licences were issued in the regulator’s first year of operation, with a further 72 Initial Approvals issued to new market participants who had already commenced the licensing process. VARA also announced the phasing-out of its Minimum Viable Product (MVP) licensing programme, which had covered the period from VARA’s launch through to the coming into force of the VA Framework when full market regulations had not been effective. The MVP programme was described as allowing established digital asset providers with a ring-fenced testbed in which to operate without exposure to consumer and other retail markets. In May 2023, VARA published a new Licence Code for Virtual Asset Proprietary Trading, which mandated the issuance of a No Objection Certificate prior to the commencement of virtual asset proprietary trading activities within the Emirate of Dubai.^[32] In the same month, it expanded the availability of places where its services could be accessed to centres run by the Dubai Department of Economy and Tourism.^[33] Further regulations relating to Staking from Custody Services were released by VARA in August 2023.^[34] In October, VARA issued regulations for stablecoins and other virtual assets backed by real world assets.^[35]

ADGM

The ADGM has not legislated for, nor passed any regulation that governs, the mining of cryptoassets. Paragraph 11(b)(ii) of the FSRA Guidance on the Regulation of Virtual Asset Activities in the ADGM expressly confirms that the Virtual Asset Framework is not intended to apply to the development, dissemination or use of software for the purpose of creating or mining a Virtual Asset.

DIFC

Currently, the core laws regulating licensed business in the DIFC and administered by the DFSA are as follows:

the Regulatory Law 2004, as amended;
the Law Regulating Islamic Financial Business 2004;
the Investment Trust Law 2006;
the Collective Investment Law 2010; and
the Markets Law 2012.

Under the Regulatory Law 2004, the DFSA has also issued its Rulebook that contains further subsidiary legislation.

In March 2021, the DIFC launched a consultation on its proposed framework for security tokens (Consultation Paper No 138 – Regulation of Security Tokens).^[36] This Consultation ended in the second quarter of 2021 and, in October 2021, the DFSA announced the introduction of its regulatory framework for investment tokens, marking the first phase of its Digital Assets Regime.^[37]As part of the second phase of its Digital Assets Regime, in March 2022, the DFSA launched Consultation Paper No 143 on the Regulation of Crypto Tokens, which sets out its proposed framework for crypto tokens. This was followed by the introduction of the DFSA’s Crypto Token Regime on 1 November 2022. Accordingly, the DFSA’s Rulebook has been updated to incorporate the Crypto Token Regime.^[38]

The Rulebook now provides the following definition of a crypto token:

[a Token which] (a) is used, or intended to be used, as a medium of exchange or for payment or investment purposes; or (b) confers a right or interest in another Token that meets the requirements in (a).^[39]

Notably, utility tokens (ie tokens that have a specific use cased within a closed ecosystem), NFTs and digital currencies issued by any government, government agency, central bank or other monetary authority are expressly designated as excluded tokens^[40] but are nevertheless brought within the remit of the DFSA’s anti-money laundering and counter terrorist funding regime. Under the Crypto Token Regime, the DFSA published^[41] and maintains^[42] an initial list of recognised crypto tokens. Furthermore, although it was initially proposed that entities intending to offer financial services in relation to crypto tokens must establish in the DIFC as a body corporate and be incorporated under DIFC law, that is no longer the case under the implemented rules.^[43] Branches of financial institutions may provide services relating to crypto tokens provided that the head office of such branch is authorised to carry out the crypto activity.

The following services are permitted in respect of crypto tokens:^[44]

dealing in investments as principal;
dealing in investments as agent;
arranging deals in investments;
managing assets;
advising on financial products;
operating an exchange;
providing custody;
arranging custody;
operating a clearing house; and
operating an alternative trading system.

In May 2023, Standard Chartered signed a memorandum of understanding with DIFC to launch digital asset custody services.^[45]

On 8 March 2024, the DIFC’s new Digital Assets Law No 2 of 2024 was enacted^[4] to provide legal clarity within a solid framework for investors in digital assets within the DIFC. The Digital Assets Law recognises and defines things as a digital asset if:

(a) it exists as a notional quantity unit manifested by the combination of the active operation of software by a network of participants and network-instantiated data; (b) it exists independently of any particular person and legal system; and (c) the thing is not capable of duplication and use or consumption of the thing by one person or specific group of persons necessarily prejudices the use or consumption of that thing by one or more other persons.

The Digital Assets Law sets out a framework for control, title, transfer of title and recovery of control of a digital asset.

The enactment of the new Digital Assets Law also required consequential amendments to other DIFC legislation such as the Contracts Law, the Law of Obligations, the Law of Damages and Remedies, the Trust Law and the Foundations Law (which were all updated via the DIFC Amendment Law No 3 of 2024) in order to make provision for the new asset class of digital assets. As part of this legislative revamp, the DIFC also enacted the new Law of Security No 4 of 2024 (which replaces the previous 2005 Law of Security) to help align the DIFC’s regime with international best practice and provide clarity in relation to taking security over digital assets.

Banking and money transmission

Onshore UAE

The key onshore virtual currency-specific legislation is the UAE Central Bank’s 2020 Stored Value Facilities Regulation (the SVF Regulation), which regulates the storage of non-cash mediums of exchange that can be purchased, transferred and exchanged for goods and services.^[47] The SVF Regulation expressly includes virtual currencies as virtual assets that customers can purchase, transfer and exchange.

Until 2023, the main change in regulation since 2021 has been in the Emirate of Dubai with the introduction of the Virtual Assets Law. Article 6 of the Virtual Assets Law empowers VARA in numerous ways to regulate, supervise and oversee virtual asset services within the Emirate. Article 6(4) obliges VARA to regulate, and establish rules and controls to govern, the conduct of [regulated activities under the Virtual Assets Law] in the Emirate, including the activities related to Virtual Asset management, clearing, settlement and safekeeping services. While pertinent to the regulation of exchanges, these activities also fall within traditional banking and money transmission operations and may be expected to lead, in due course, to further virtual currency-related regulations being issued in onshore Dubai.

The VA Framework came into effect in 2023 pursuant to VARA’s obligations under Article 6(4) of the Virtual Assets Law. The VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide banking and money transmission services. As well as the VARA Regulations, banking and money transmission services cut across many if not all of the requirements set out in the Compulsory and activity-specific Rulebooks, plus the Issuance Rulebook and the MAP Regulations.

As noted in the securities and investment laws section above, in its first year of operating, VARA was busy. With respect to banking and money transmission activities, 116 Proprietary Trading Non-Objection Certificates were issued and a further 37 were assessed and ready for issue. An additional 97 non-virtual asset activity confirmation notices were also issued.

In June 2023, VARA published its Transfer and Settlement Services Rulebook (Settlement Rulebook), which forms part of VARA’s Virtual Assets and Related Activities Regulations 2023. The Settlement Rulebook applies to all VARA-licensed VASPs which carry out virtual asset settlement and transfer services in or out of the Emirate of Dubai. The Settlement Rulebook sets out certain compliance requirements imposed on VASPs to ensure that they are able to correct any erroneous virtual asset transmissions or transfers or provide refunds to customers if needed.

In September 2023, the UAE Central Bank announced the launch of the Central Bank Digital Currency Strategy^[48], one of the initiatives under the Financial Infrastructure Transformation Programme that aims to accelerate the digital transformation of the financial services sector. The Central Bank Digital Currency (also known as the Digital Dirham) is a type of digital money that is issued and guaranteed by the central banks and it is intended to address and resolve the obstructions of domestic and cross-border payments. On 30 January 2024, the UAE completed its first cross-border payment using the Digital Dirham by making a transfer of 50 million dirhams.^[49]

DIFC

Investment tokens do not fit easily with the rules and regulations that govern traditional fiat currency banking and money transmission services. The Rulebook defines investment tokens as:

the Security or Derivative in the form of a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology; or a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology.

However, the DFSA Rulebook regulates the custody of Investment Tokens and Crypto Tokens by Digital Wallet Service Providers.^[50] For example, under conduct of business model (COB) 14.3.3 of the DFSA Rulebook, a digital wallet service provider must ensure:

any Distributed Ledger Technology application used in providing custody of the investment tokens must be resilient, reliable and compatible with any relevant facility on which the investment tokens are traded or cleared;
it is able to clearly identify and segregate investment tokens belonging to different clients; and
it has in place appropriate procedures to enable it to confirm client instructions and transactions, maintain appropriate records and data relating to those instructions and transactions and to conduct a reconciliation of those transactions at appropriate intervals.^[51]

These rules are applicable to providing custody for both investment tokens and crypto tokens.^[52]

Furthermore, the Digital Wallet Service Provider must ensure that the technology used and its associated procedures have adequate security measures (including cyber security) to enable the safe storage and transmission of data relating to the investment tokens and the DFSA has introduced a technology audit requirement for Authorised Firms providing services in respect of crypto tokens.^[53]

The DFSA's Money Service regime was established in January 2020 to allow various previously prohibited activities to be carried out in or from the DIFC. However, the DFSA has maintained its position that authorised Money Services Providers may not use crypto tokens and can only use DFSA recognised Fiat Crypto Tokens provided they are a recognised crypto token and used only for the purposes of money transmission or executing a payment transaction in the name of the Money Services Provider and not in the Client's name.^[54]

In May 2024, the DFSA announced certain amendments to its Crypto Token Framework^[55], which came into force on 3 June 2024. These now include the criteria for the recognition of stablecoins (Fiat Crypto Tokens):

the crypto token must be able to maintain a stable price relative to the fiat currency it references;
the reserves must be at least equal in value to the notional value of the outstanding crypto tokens in circulation, must be denominated in the reference currency, must be held in assets that are likely to maintain their value, are suitably diversified and carry minimal credit risk, are valued daily and are held in segregated accounts with properly regulated banks;
a person is clearly responsible and liable to investors for the crypto token;
information demonstrating that the reserves meet the specified criteria is published at least monthly; and
the published information is verified by a suitably qualified third-party professional who is independent of the issuer of the crypto token.

The new DFSA amendments also update the regulatory position regarding custody of crypto tokens.

At the time of writing, it is also reported that the UAE Central Bank has also approved its new stablecoin licensing regulations but further details are awaited. ^[56]

Anti-money laundering

The UAE's anti-money laundering (AML) and countering the financing of terrorism laws are covered under an extensive suite of federal statutes and the federal penal code. This is in addition to specific legislation and implementing regulations in force throughout the UAE (including in the financial and commercial free zones) covering these crimes.

The UAE Central Bank is the key authority on AML in the state, with assistance from the different authorities across the UAE when it comes to supervision, enforcement and industry related policies. These include the Dubai Multi Commodities Centre (a commercial free zone) (DMCC), the DFSA and the FSRA.^[57]

The principal legislation in this area has undergone substantial amendment and modernisation in recent years. Federal Decree-Law No. 20 of 2018 on Facing Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations (the AML Law), and its implementing regulation, Cabinet Decision No. 10 of 2019 on the Implementing Regulation of Federal Decree-Law No. 20 of 2018 on the Criminalisation of Money Laundering and Combating the Financing of Terrorism and the Financing of Unlawful Organisations (the AML Implementing Regulation) have both been subject to amendment to bring them into line with international standards.^[58]

In the context of virtual assets, Article 1 of the AML Law defines 'funds' as including assets, 'whatever their form . . . including . . . electronic, digital or crypto . . . and instruments in any form, including electronic or digital, that evidence ownership of those assets or the shares or rights related thereto . . .' This broad definition of funds means that money laundering in the UAE incorporates acts involving cryptoassets, including virtual or cryptocurrencies.^[59]However, the definition of 'virtual assets' in the AML Implementing Regulation excludes 'digital representations of fiat currencies, securities and other financial assets'.^[60]

Penalties for money laundering range from a monetary fine of between 100,000 dirhams and 5 million dirhams to imprisonment for up to 10 years.^[61] In addition, confiscation will apply to the funds the subject of the crime or owned by the perpetrator.^[62]

The AML Law applies broadly to local authorities that are entrusted under legislation with the control of financial institutions, designated non-financial businesses and professions, VASPs and non-profit organisations.^[63]

The changes to the AML Law incorporate recommendations from the Financial Action Task Force (FATF) that VASPs be registered as a VASP if there is a commercial nexus between the legal entity releasing the software protocol and the decentralised finance solutions provider.^[64] The penalty for operating an unregistered or unlicensed VASP attracts a prison sentence or a fine, or both. On 31 May 2023, the UAE Central Bank issued guidance for its Licensed Financial Institutions dealing with virtual assets and VASPs, including an outline of the due diligence and enhanced due diligence required in respect of potential VASP customers and counterparties. It came into force from 1 July 2023 and is a welcome addition to the development of virtual assets in the jurisdiction as it provides for qualitative governance systems and record-keeping requirements in aid of de-risking the industry.^[65]

Those subject to the AML Law are subject to AML Suspicious Transaction reporting obligations if they suspect a transaction or funds fully or partially constitute the proceeds of any felony or misdemeanor.^[66] There is a penalty of imprisonment or a fine, or both, to anyone who intentionally or negligently violates these obligations.

The DFSA Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (Annex I) contained rules in its appendix. These rules were amended by DIFC Law No. 1/2004 (the Regulatory Law) on 26 February 2020, which came into force on 1 April 2020 and assists entities falling under its remit with minimum requirements for due diligence and required procedures when conducting a know-your-customer process.

On 31 May 2023, the UAE Central Bank issued Guidance for Licensed Financial Institutions on Risks related to Virtual Assets and Virtual Asset Service Providers (the CBUAE VA Guidance). The CBUAE VA Guidance came into force in July 2023 and although it does not have regulatory force, it is a useful indicator of the UAE Central Bank's expectations for licensed financial institutions to demonstrate their compliance with statutory obligations when dealing in virtual assets or with VASPs. The CBUAE VA Guidance focuses on anti-money laundering and anti-terrorist financing and forms part of the framework for statutory obligations on licensed financial institutions, alongside the Procedures for Anti-Money Laundering and Combating the Financing of Terrorism and Illicit Organisations (issued by Notice No. 74/2019) and the Guidelines on Anti-Money Laundering and Combating the Financing of Terrorism and Illicit Organisations for Financial Institutions (issued by Notice No. 3090/2021).

In December 2023, the FSRA announced certain revisions to its AML Rulebook, specifically including the FATF's Travel Rule, which necessitates VASPs to gather and disseminate vital transaction data, with a view to improve transparency and reduce anonymity of transactions.^[67]

A new specialist Anti-Money Laundering Court has been established within the onshore Dubai courts.

Regulation of exchanges

Onshore UAE

The SCA Virtual Asset Regulation is still the main, UAE-wide onshore regulation that governs and controls the operation of virtual currency exchanges. The requirements for obtaining and continuing a licence for the operation of a virtual currency exchange and the listing and trading of virtual currencies are set out at Articles 8, 16, 17 and 21 therein.

In the Emirate of Dubai, the Virtual Asset Law obliges VARA to 'develop the general policy and the strategy places related to . . . dealing and trading in Virtual Assets in the Emirate' (Article 6(1)), including 'classify, and determine the types of, Virtual Assets and Virtual Tokens; and prescribe the standards and rules for trading in the same' (Article 6(5)). The VA Framework came into effect in 2023 pursuant to VARA's obligations under Article 6(5). The VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide exchange services. As well as the VARA Regulations, exchange services cut across many if not all of the requirements set out in the Compulsory and activity-specific Rulebooks, plus the Issuance Rulebook and the MAP Regulations.

The Enabling Technologies Guidelines contain guidelines for all financial institutions licensed by the SCA, Central Bank, DFSA or FSRA. Sections 2.31 to 2.36 of the Guidelines contain specific principles for the operation of a DLT, including technologies that use blockchains like virtual currency exchanges, covering their governance, auditability, design, anonymity and pseudonymity, management and monitoring and business continuity. The specific (and detailed) guidelines for a DLT are at Sections 3.115 to 3.156 of the Guidelines. The DMCC is one of the non-financial free zones in Dubai and has been at the forefront of developing an infrastructure for the growth of a prosperous and sophisticated environment for the cryptoasset industry. In 2017, the DMCC recognised proprietary trading in cryptoassets as a licensed activity. The launch in May 2021 of the DMCC Crypto Centre,^[68] in partnership with the Swiss-Government backed CV Labs, has provided a platform for a huge increase in blockchain and decentralised finance projects and related businesses in Dubai.^[69] The success of this venture is due in large part to the Memorandum of Understanding signed between the DMCC and the SCA in March 2021, establishing a regulatory framework for businesses offering, issuing, listing and trading cryptoassets in the freezone, including cryptoasset trading platforms. The DMCC offers bespoke licences for crypto-related business^[70] for which the SCA will be responsible for issuing approvals and regulating the crypto activities in line with the SCA Virtual Asset Regulation.

Currently, the DMCC is also working on establishing the first precious metals refinery and storage facility in the GCC to be completely enabled by blockchain. The facility will cater for gold, silver and other precious metals, to be tokenised to back a set of stablecoins.^[71]

Dubai has taken considerable steps to assist international exchanges to open in the Emirate. In May 2023, BitOasis became the first broker-dealer to secure a Minimum Viable Product (MVP) Operational Licence, having obtained provisional approval in March 2022. In June that year, the local subsidiary of OKX, the second-largest crypto exchange by trading volume and a leading Web3 technology company, received a MVP Operational Licence too,^[72] as did crypto.com in November.^[73]

ADGM

Paragraph 54(1), Chapter 9, Schedule 1 of the FSMR provides that the operation of a Multilateral Trading Facility (MTF) on which Virtual Assets are traded is a Regulated Activity.^[74] Regulated Activities can only be carried out by Authorised Persons. Authorised Persons operating an MTF may also provide Custody Services.

Paragraphs 125–134 of the Guidance on the Regulation of Virtual Asset Activities set out the requirements for those operating an MTF and Virtual Assets. Paragraph 129 makes it clear that an MTF includes trades not only made from fiat currency (or other value) to accepted virtual assets and vice versa but also from one accepted virtual asset to another.

Accepted virtual asset in this context is specific to each authorised person, creating bespoke licences for each authorised person and MTF trading virtual assets. For that reason, the FSRA does not maintain a public list of accepted virtual assets.^[75]

A key point to note is the attitude that the FSRA has taken to the location of MTFs operating in the ADGM. Paragraphs 128–129 of the Guidance on Virtual Asset Activities make it clear that the FSRA will have extensive regulatory oversight for both start-ups and established exchanges. The FSRA recognises that, in this respect, its level of oversight may differ from other regulators globally.

In practical terms, for a start-up MTF, its entire order book and the functionality of its matching engine will be subject to FSRA oversight. For existing operational virtual asset exchanges that already have their order book or matching engine outside the ADGM prior to making an application, a determination of which parts (if not all) of its order book (and how its matching engine) will come under FSRA regulatory oversight needs to be made by the applicant, to allow it to apply to become authorised as an MTF.

FSRA-COBS Rule 8.2.1 sets out various rules in MIR that MTFs (using virtual assets) are required to comply with to the satisfaction of the FSRA.

There is also a requirement that the authorised person operating the MTF maintain a minimum regulatory capital in fiat equivalent to 12 months' operational expenses.

In addition to Kraken, BitOasis, Matrix Exchange, DEX and MidChains having obtained permission from the FSRA to operate in the ADGM, in May 2022, Binance, the largest cryptocurrency exchange in terms of daily trading volume, also obtained a licence to operate in the ADGM. In November 2023, the FSRA also granted crypto exchange and custody services provider M2 an MTF licence.

DIFC

NASDAQ Dubai, one of the largest stock exchanges in the Middle East, has been present in the DIFC since 2004 while the Dubai Mercantile Exchange, an energy-focused commodities exchange that is home to the world's third crude benchmark, has been located in the DIFC since 2005. Historically, the DFSA has issued licences for and regulated the operation of an exchange, a multilateral trading facility or an alternative trading platform in the DIFC, and it has since extended these financial services to include activities related to investment tokens. This means that companies wishing to operate an alternative trading platform for investment tokens will have to comply with the same requirements that are applicable to operators of other types of exchange. In particular, admitting securities tokens to an exchange or trading platform in the DIFC will require the publication of a prospectus in compliance with the DIFC Markets Law 2012.

A technology audit requirement is also imposed on all authorised firms operating a facility for investment tokens, holding or controlling investments that include investment tokens, relying on DLT or similar technology to carry out financial services in relation to investment tokens, or managing a fund where either 10 per cent or more of the asset value of the fund comprises investment tokens; or the units are in security tokens.

In Consultation Paper No. 143, the DFSA proposed that it would be possible to operate a crypto trading venue as either an Exchange or a Multilateral Trading Facility (MTF).^[76] However, under the Crypto Token Regime, the DFSA has confirmed that it will only be possible to carry out crypto trading through an MTF.^[77] In order to operate an MTF that allows crypto trading, the authorised firm must conduct an appropriateness assessment to determine whether the person has adequate skills and expertise to understand the risks involved in trading crypto and has the ability to absorb potentially significant losses as a result of doing so.^[78]

In June 2021, the Bitcoin Fund (QBTCu.TO) listed on NASDAQ Dubai, making it the Middle East's first indexed cryptocurrency-based fund. The issuer, Canadian digital asset management firm 3iQ, received approval from the DFSA to list the Bitcoin Fund under the DFSA's then current securities framework in April 2021.

Regulation of miners

Onshore UAE

In Dubai, the Virtual Asset Law obliges VARA to 'regulate, supervise, and oversee the issuance, offering and relevant disclosure processes of Virtual Assets and Virtual Tokens' (Article 6(2)) and to:

regulate, and issue Permits to, Virtual Asset Service Providers in accordance with the requirements, procedures, and rules adopted by it; and oversee and supervise them to ensure their compliance with the provisions of this Law, the resolutions issued in pursuance hereof, and other Legislation in force in the Emirate (Article 6(3)).

The VA Framework came into effect in 2023 pursuant to VARA's obligations under Article 6(2). The VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide mining services. As well as the VARA Regulations, mining services cut across many of the requirements set out in the VARA Regulations, compulsory and activity-specific rulebooks (particularly those covering broker-dealer, custody and exchange services), the Issuance Rulebook and the MAP Regulations.

While the Virtual Assets Law apparently spurred a number of applications to VARA for relevant 'mining' licences, the VA Framework now provides the full, effective licensing framework for mining activities in Dubai.

VARA has indicated that mining-adjacent fintech companies have started the application process for registration and authorisation to operate. For instance, in May 2023, Web3 launchpad and advisory company Enjinstarter MENA was granted initial approval by VARA to start the licensing process.^[79] In November 2023, VARA confirmed that entities issuing virtual assets were required either to hold a VA licence or a prior approval from VARA to offer such a service.^[80]

ADGM

The ADGM has not legislated for, nor passed any regulation that governs, the mining of cryptoassets. Paragraph 11(b)(ii) of the FSRA Guidance on the Regulation of Virtual Asset Activities in the ADGM expressly confirms that the Virtual Asset Framework is not intended to apply to 'the development, dissemination or use of software for the purpose of creating or mining a Virtual Asset'.^[81]

DIFC

At present, there is no proposed regulation of miners insofar as crypto tokens are concerned. However, the DFSA has said that, at present, it does not intend to allow for the issuance of new crypto tokens, although it intends to revisit this in the future. If the DFSA were to permit the issuance of new crypto tokens in the future, it is possible that a regulatory regime applicable to miners might also be introduced.

Regulation of issuers and sponsors

The SCA Virtual Asset Regulation is still the main, UAE-wide onshore regulation that governs and controls the operation of persons offering, issuing or promoting virtual assets. The requirements for obtaining and continuing a licence for these activities are set out in various articles in the regulations, and particularly at Article 14.

As regards Dubai, the VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide issuing and sponsor services. The main guidelines for issuing services specifically are found in the Issuance Rulebook, which sets out the requirements for registration prior to the issuance of permitted virtual assets and all virtual assets other than permitted assets (as defined in the Rulebook). The MAP Regulations set out the obligations on all issuers and sponsors in respect of financial promotion activities.

While the Virtual Assets Law apparently spurred a number of applications for relevant issuer and sponsor licences from VARA, the VA Framework now provides the full, effective licensing framework for providing those services in Dubai.

In September 2023, VARA updated its Issuance Rulebook^[82] to introduce new rules for Fiat-Referenced Virtual Assets (FRVAs) (also commonly referred to as stablecoins). The new rules apply to all FRVAs except those that are linked to the UAE Dirham, since such stablecoins remain under the exclusive purview of the UAE Central Bank. Under the new rules, a category 1 license is required to issue FRVAs and such issuers must provide additional disclosures in the whitepaper to be published ahead of offering a virtual asset.

DIFC

Financial promotion

Financial promotions (i.e., the marketing of financial products and financial services) are generally prohibited under Article 41A of the Regulatory Law 2004, unless certain requirements relating to marketing in the GEN Module Chapter 3 (of the DFSA Rulebook) are met. As such, financial promotions can only be made or approved by authorised persons, although other persons may also make them in very limited circumstances, which are subject to additional requirements. This applies to investment tokens and crypto tokens and the narrow exceptions in which a financial promotion can be made are set out in the General Module (GEN) 3.4.1^[83] and 3.4.2.^[84]

The Crypto Token Regime prohibits authorised firms from offering or providing to retail clients any incentive which influences, or is reasonably likely to influence, them to trade in a crypto token or crypto token derivative.^[85] Such prohibition is also applied to crypto tokens that are not accepted crypto tokens, algorithmic tokens and privacy tokens.

Issuance of tokens

Issuers of securities are required to have a prospectus that meets the DFSA's requirements set out in the DIFC Markets Law 2012. Issuers of security tokens must also provide a prospectus, although the rules for prospectuses relating to security tokens and crypto tokens are somewhat more onerous in their requirements, as set out in MKT A7.1.2.^[86]

It is also important to remember that any authorised firm that wishes to provide a financial service in respect of investment tokens and crypto tokens must provide a key features document, per COB 14.4.2^[87] and per COB 15.3.1,^[88] respectively. There are some differences in the type of information that must be provided in the key features document for investment tokens and crypto tokens. For example, the information for crypto tokens must include details of the regulatory status of the crypto token in other jurisdictions, details about how ownership of the crypto token is established, advice of risks related to the volatility of the price of the crypto token and advice on cybersecurity risks associated with the crypto token as well as the risks related to fraud, hacking and financial crime.

With regard to crypto tokens, the DFSA has said that initially it intends to focus on crypto tokens that have already been issued and therefore it does not intend to allow for the issuance of new crypto tokens. However, the DFSA has also stated that it will consider this matter again at a later stage, suggesting that the issuance of new crypto tokens may become permitted in the future. An issuer or developer of a crypto token may apply to the DFSA to have the crypto token recognised in the DIFC.^[89]

Criminal and civil fraud and enforcement

As part of general legal reforms introduced within the UAE at the start of 2022, Federal Decree Law No. 5/2012 on Combatting Cybercrime was repealed and replaced by Federal Decree-Law No. 34/2021 Concerning the Fight Against Rumours and Cybercrime (the Cybercrime Law), which came into effect on 2 January 2022. The Cybercrime Law includes a number of offences prevalent in cryptoasset fraud, from hacking and compromising information systems to the unauthorised obtaining of third-party symbols and codes of electronic information technology (passwords), to the fabrication of websites, mail and electronic accounts.^[90] It also criminalises acts related to unlicensed cryptocurrency trading and behaviour that promote or encourage the unlicensed dealing in cryptocurrency that is not officially recognised in the UAE.^[91] Unsurprisingly, the full scope of federal civil and criminal penalties is applicable to all activities related to cryptoassets, and regulated persons must comply with AML/CFT laws.^[92]

While at the forefront of regulatory development in the cryptoasset field, regulatory bodies in the UAE continue to urge caution in dealing with crypto-related financial products and to warn of the possible fraud risk.^[93]

The SCA has publicised warnings for investors against dealing with certain crypto or initial coin offering companies as a result of concerns about fraud.^[94] The DFSA has highlighted fraud and money laundering among key risk factors when buying cryptoassets and advises potential investors and consumers to undertake due diligence and exercise caution before entering a transaction.^[95]

Operators of a virtual asset business in the ADGM are subject to the full remit of financial crime offences, including making misleading statements and market abuse.^[96] To reduce the risk of financial crime, the FSRA regulates cryptoassets and continues to issue warnings about suspect companies.^[97]

To help combat the rise in crypto fraud, on 22 August 2021, the Dubai courts announced the establishment of a specialist criminal court focused on combating money laundering. The new court will sit within the Court of First Instance and Court of Appeal. Additionally, in October 2021, the Dubai police launched a specialist virtual asset crime department to investigate crypto fraud^[98] and announced that it will be collaborating with a cryptocurrency trading platform and other industry experts to fight crime within the space.^[99] Recently, notable examples of successful actions by the authorities to tackle crypto-related crime include the Dubai police arresting 40 members of a crypto laundering scheme and successfully investigating the theft of an NFT from a Dubai resident, as well as the conviction of a group of crypto fraudsters who defrauded 180 victims in the UAE out of over 10 million dirhams.^[100]

The VA Framework sets out various penalties, mainly in the MAP Regulations, with penalties for non-compliance contained in Administrative Order No. 2.

Furthermore, the UAE's civil courts are able to assist victims of fraud. The DIFC and ADGM courts have the full arsenal of interim measures available to common law courts, including freezing and proprietary injunctions and asset disclosure orders. These interim measures have been successfully used in other common law jurisdictions and, provided the jurisdictional requirements of the UAE's common law courts are met, it is highly likely that similar measures could be wielded by the DIFC and ADGM under their existing laws and court rules. The UAE's onshore courts may also be able to make orders in support of claims by fraud victims, notable in the form of the precautionary attachment, which is similar to a freezing order in the common law courts and can be easily notified to banks and other financial institutions under existing processes.

Outlook and conclusions

Looking ahead to the future of virtual currency in the UAE requires considerably less speculation than in other jurisdictions. In the short-to-medium term from a regulatory standpoint:

there will be considerable interest in how VARA establishes itself, how its remit interacts with the SEC and Central Bank, and the how the industry responds to the new VA Framework;
responses were due to the DFSA's Consultation Paper No. 150 containing proposals in relation to money services, crypto tokens and crowdfunding by 26 May 2023 and the outcome is expected later this year;
responses were also due to the ADGM's Consultation Paper No. 3 of 2023 on Proposals for a Legislative Framework for Distributed Ledger Technology Foundations on 12 May 2023 (which can be used by issuers of non-regulated utility tokens) and the outcome is expected later this year; and
the UAE Central Bank launched its strategy for 'The Digital Dirham' on 23 March 2023. Phase one comprises three major pillars, the soft launch of mBridge to facilitate real value cross-border transactions for international trade settlement, proof-of-concept work for bilateral bridges with India, one of the UAE's top trading partners and finally, proof-of-concept work for domestic Central Bank Digital Currency issuance covering wholesale and retail usage.

From a jurisprudential standpoint, the UAE continues to grapple with issues confronting jurisdictions worldwide. Notable cases have included:

a Dubai court awarding payment of damages in cryptocurrency in October 2022;
a landmark case concerning how to account for the fluctuating values of cryptocurrency in the context of a crypto mining investment dispute in April 2023; and
a case before the court in RAK in which a cryptocurrency sale agreement was rescinded on the basis that it was not a recognised commodity or currency under Sharia law.

In January 2024, the DIFC Court of Appeal heard the appeal in TCD-001-2020 Huobi MENA & Ano v. Tabarak Investment Capital Limited & Ano. The claimants obtained permission to appeal on eight separate grounds and the appeal judgment will provide some useful guidance for those in the industry on a wider range of topics, including when to value losses for misappropriated digital assets and what constitutes best practice for fiduciaries and custodians of digital assets.

Reproduced with permission from Lexology In-Depth. For further information, please visit: Virtual Currency Regulation: United Arab Emirates - Lexology

Endnotes

Our thinking

Seminar: National Association of Independent Administrators

Events
12 December 2024
Find out more
Women in Chancery: Speak with Effect and Influence Webinar

Events
19 November 2024
Find out more
City AM quotes Charlotte Duly on the long-awaited SkyKick v Sky Supreme Court decision

Charlotte Duly

In the Press
13 November 2024
Find out more
Document Production in French Set-aside Proceedings: limited powers despite an increasingly extensive scrutiny of the set aside judge

Simon Le Wita

Insights
12 November 2024
Find out more
Navigating the Legal Landscape of Non-Performing Loan Acquisitions in the UAE

William Reichert

Quick Reads
11 November 2024
Find out more
Global Investigations Review quotes Rhys Novak on the UK government’s new guidance on complying with its forthcoming failure to prevent fraud offence

Rhys Novak

In the Press
11 November 2024
Find out more
The new guidance on the offence of failing to prevent fraud – will it lead to a sea-change to anti-fraud compliance mechanisms?

Rhys Novak

Quick Reads
07 November 2024
Find out more
Navigating the Digital Services Act and Online Safety Act: A Quick Guide for Digital Platform Providers on the need to police content

Dillon Ravikumar

Quick Reads
07 November 2024
Find out more
Obtaining civil remedies in criminal cases: the UAE, Switzerland and France

James Colautti

Insights
06 November 2024
Find out more
Qatar's Constitutional Evolution: A New Era of Governance and Unity

Younis Najem

Quick Reads
06 November 2024
Find out more
Insolvency Insights: Cross border recognition – UAE, DIFC & ADGM

Nicola Jackson

Podcasts
06 November 2024
Find out more
The reform of litigation funding edges closer as CJC report is published

James Walton

Insights
04 November 2024
Find out more
Based on a True Story: Disclaimers in Film and Television – Case Update

Anna Hackworth

Quick Reads
31 October 2024
Find out more
Charles Russell Speechlys advises the founders of N2O on its acquisition by GLOBE GROUPE

Mark Howard

News
25 October 2024
Find out more
Abu Dhabi Enhances Film & TV Production Appeal with Increased Cashback Incentive

Anna Hackworth

Quick Reads
23 October 2024
Find out more
Caroline Greenwell writes for Retail Banker International on authorised push payment (APP) fraud

Caroline Greenwell

In the Press
22 October 2024
Find out more
Qatar’s strategic shift to national workforce empowerment

Ahmad Anani

Insights
22 October 2024
Find out more
Charles Russell Speechlys supports the Rashid Equestrian and Horse Racing Club

Mazin Al Mardhi

News
22 October 2024
Find out more
The Swiss Criminal Code on Corruption: Evolution & Developments

Daniela Iselin

Insights
21 October 2024
Find out more
Charles Russell Speechlys welcomes new Partner specialising in Corporate Tax

James Stewart

News
21 October 2024
Find out more