UAE Virtual Asset Licence: Who Needs One Under the New Central Bank Law and How to Get It

A UAE virtual asset licence is official permission to carry on a regulated financial activity involving crypto assets in the United Arab Emirates. Since 16 September 2025, the federal licensing power over that activity sits with the Central Bank of the UAE. The Securities and Commodities Authority, Dubai's VARA, and the two financial free zones still license their own perimeters alongside it.

That first paragraph is the part most founders get wrong. They search for a crypto licence, find a Dubai story, and never reach the federal law that now decides whether they need one at all. This guide sets out who is caught, which regulator covers which territory, what the law actually says about penalties, and the honest cases where you need no licence.

One thing to settle up front. Licensing status is not something a blog can grant you. The Central Bank, the Securities and Commodities Authority or VARA determines it on your specific facts, and you should obtain a written regulatory opinion before you launch.

Who needs a UAE virtual asset licence?

You need one if you carry on a licensed financial activity, and virtual assets are part of how you do it. That is the whole test, and it is broader than most people expect.

The old mental model was product-based. People asked, "Is crypto regulated here?" The new model is activity-based. The law asks what you are doing, not what the thing is called. If the activity is on the licensed list, the technology you use to deliver it does not save you.

Three groups are caught more often than they realise. The first is anyone taking customer money and moving it. Payment flows, remittances, stored value, wallets that hold client balances. If clients hand you funds and you route them, you are in licensing territory.

The second is anyone building the rails rather than the product. Platforms, protocols, decentralised applications and technical infrastructure that let other people make payments or move value. The law reaches the infrastructure, not only the front end.

The third surprises people most. Arranging, promoting and marketing a licensed financial activity is itself a licensed financial activity. An affiliate driving signups to an unlicensed platform is not a bystander here.

The law that changed the answer

Federal Decree-Law No. 6 of 2025 replaced the previous central banking law. The CBUAE Rulebook records it as effective from 16 September 2025, with In-Force status. Article 188 puts the decree-law in force on the day after its publication in the Official Gazette.

Article 185 repeals Decretal Federal Law No. 14 of 2018 and its amendments, and Decretal Federal Law No. 48 of 2023 on insurance activities. It also repeals any provision of any UAE law that conflicts with it. It does not name Cabinet Resolution 111 of 2022 or Dubai Law 4 of 2022. Those instruments, which the SCA and VARA work from, are still standing.

The provision that matters for crypto is Article 62. Article 62 of Federal Decree-Law No. 6 of 2025 reads:

Without prejudice to the Licensed Financial Activities referred to in item (1) of Article (61) of this decree-law, any Person carrying on, offering, issuing, or facilitating, whether directly or indirectly, any Licensed Financial Activity, regardless of the medium, technology, or form employed, shall be subject to the licensing, regulatory, and oversight jurisdiction of the Central Bank.

Article 62 then names what "this includes". Virtual assets, payment tokens, decentralised finance and other emerging technology used in connection with licensed financial activities. And the offering or operation of platforms, decentralised applications, protocols or technological infrastructure that facilitate, intermediate or enable payments, credit, deposits, money exchange, remittances or investment services.

Read the phrase "regardless of the medium, technology, or form employed" twice. It is the whole point of the article. There is no technology carve-out.

Why your research probably missed this

Here is the trap. The UAE government's own public explainer on the regulation of digital properties was last updated on 24 November 2025, more than two months after the decree-law came into force. It describes Cabinet Resolution 111 of 2022, the SCA, VARA under Dubai Law 4 of 2022, the DIFC exclusion and Cabinet Resolution 99 of 2024. It does not mention Decree-Law 6 of 2025.

So a founder doing the obvious research, on the obvious government page, will not find the federal law that now governs them. That is why so much of the advice circulating online is a year out of date.

Which regulator applies to you

Four regulators can license virtual asset work in the UAE, and they do not overlap the way people assume. The table below sets out each one across the axes that decide your answer.

Where the DIFC and the ADGM sit

The two financial free zones are separate legal jurisdictions with their own civil and commercial law. A firm authorised by the DFSA in the DIFC is regulated by the DFSA. A firm authorised by the FSRA in the ADGM is regulated by the FSRA. Neither falls under VARA. That is worth stating plainly, because a lot of online commentary gets it backwards.

What a free zone does not give you is an exemption from the federal layer where the federal layer applies. Article 61(3) requires a licensed financial institution that wants to carry on free-zone-licensed activities beyond the Article 61(1) list to obtain Central Bank approval first. The perimeters are separate, not sealed off from each other.

If you want the wider background on how the emirate-level rules developed, our overview of crypto regulation in Dubai covers the VARA framework and its use cases.

The licensed financial activity list in Article 61(1)

Article 61(1) lists the activities that require a Central Bank licence. There are ten of them:

1. Taking deposits of all types, including Shariah-compliant deposits.
2. Providing credit facilities of all types.
3. Providing funding facilities of all types, including Shariah-compliant funding facilities.
4. Providing open finance services.
5. Providing currency exchange and money transfer services, including instant money transfer services.
6. Providing payment services using virtual assets.
7. Providing stored value services, retail payments and digital money services.
8. Arranging, promoting and marketing licensed financial activities.
9. Acting as a principal in financial products that affect the financial position of the institution, including foreign exchange, derivatives, bonds and sukuk, equities and commodities.
10. Providing insurance, reinsurance and insurance-related professions business, including Takaful and Re-Takaful.

Item six is the one written for this decade. Payment services using virtual assets is a named, enumerated licensed activity in its own right. It needs no catch-all to reach it. Item eight is the quiet one, which is why Article 168 later reaches people who promote without a licence and not only those who operate.

Article 62 sits on top of the whole list and closes the technology gap. The Board of Directors can also add, delete or amend activities under Article 61(2), after consulting the Financial Stability Board in the State. Treat the ten items as today's position, not a permanent boundary.

What happens if you operate without a licence?

This is where almost every competing article gets the number wrong.

You will read everywhere that unlicensed crypto activity in the UAE risks penalties "up to AED 1 billion". That figure comes from Article 168, paragraph 1(m). Read the actual wording: it allows a fine "on the violating Licensed Financial Institution not exceeding one billion (1,000,000,000) Dirhams".

The subject of that sentence is a Licensed Financial Institution. It is the ceiling for a licensed bank, exchange house, insurer or payment firm that breaks the rules it was licensed under. If you never held a licence, that number is not the one attached to you.

Here is what the same article says about the unlicensed operator.

So the correction is not that the risk is smaller. In several respects it is sharper. The billion-dirham figure is a discretionary ceiling for a licensed institution. The one-million-dirham figure in 168(1)(s) is a floor that starts at one million and goes up. Article 168(1)(l) scales a fine to the size of the money involved. Article 170 puts imprisonment on the table. Article 181 puts the manager's own name on it.

Note also who "any Person" reaches in 168(1)(s). It says carrying on or promoting. Marketers, affiliates and introducers sit inside that wording.

Article 168(1) also lets the Central Bank issue a caution, require the violation to be rectified, order funds returned to customers, and publish decisions naming the violating Person on its official website.

The transitional window, and why it is not a cliff

Article 184 gives everyone subject to the decree-law one year from its entry into force to reconcile their positions with it. Counting from 16 September 2025, that period runs to 16 September 2026.

Read the second sentence too. The Board of Directors may extend this period as it deems appropriate. It is a reconciliation window with an express extension power, not a shutter that drops.

Two practical points follow. Do not plan around a date that can move, and do not let anyone sell you urgency on the strength of it. Equally, do not treat the extension power as a reason to wait. Applications of this kind take months, so the window is for using, not for watching.

The practical route to compliance

The route is the same shape whichever regulator you land with, and it is described here in generic terms. This article names no advisers, no law firms and no licensed service providers, and you should be careful with any page that ranks them for you.

Start with a written jurisdiction opinion. Get a regulated-activity analysis of what you actually do, not what you call it. It should say which of the four regulators applies, which activity category you fall into, and whether any part of what you do sits outside the perimeter.

Then choose the entity and the place. The entity must be the right form for the licence you are seeking, and it must sit in the territory that regulator covers. A Dubai mainland company and a DIFC entity are different animals here. Getting this wrong means starting again.

Build real substance. Every one of these regimes expects an actual operation. Office space, resident senior management, fit and proper individuals in the controlled functions, and a compliance officer who genuinely does the job. Where an individual holds a designated function, the regulator authorises the person as well as the firm.

Fund the capital and the governance. Expect paid-up capital requirements, audited financials, professional indemnity cover, custody and client-money arrangements, and full anti-money-laundering systems. These take the longest to build and regulators test them hardest.

Then apply, in stages. Initial approval, detailed submission with your policies and financial model, conditions to satisfy, then the licence. Plan on months rather than weeks.

Two adjacent points are worth flagging while you plan. A licensed operation creates a real taxable presence, so read up on when your activity creates a permanent establishment in the UAE before you finalise the structure. And every licensed firm needs banking, which is its own project. Our guide to opening a corporate bank account in Dubai sets out what the banks ask for.

When you probably do not need one

Most of the field will not tell you this. A great many people who worry about a UAE virtual asset licence do not need one.

If you buy and sell crypto with your own money, for your own account, you are not providing a financial service to anyone. Article 61(1) is a list of things you do for others, or as a principal institution taking positions that affect a licensed balance sheet. Trading your own book is not on it. A company for that activity is a commercial licensing question, not a financial-services one. Our piece on the Dubai trading licence route for day traders covers a different instrument entirely and is not a substitute for a VASP licence.

If you hold crypto as an investor and never touch anyone else's money, the same applies.

If you write software and sell it as software, with no custody, no client funds and no payment flow passing through you, you are selling a product rather than providing a financial service. Be honest about that line. The moment client value moves through your system, the analysis changes.

If you accept crypto as payment for ordinary goods or services you supply, you are a merchant, not a payment service provider.

The pattern is consistent. What triggers licensing is doing something with someone else's money or someone else's assets. Where none of that happens, the licensing question usually falls away. Where it does happen, even a little, get the opinion.