A general introduction to the regulation of virtual currencies in United Arab Emirates

Charles Russell Speechlys | Dalal Alhouti | James Colautti | Karl Masi | Max Davis | Peter Smith | Sara Sheffield

Introduction to the legal and regulatory framework

The United Arab Emirates (UAE) comprises a federation of seven Emirates (Abu Dhabi, Ajman, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah and Umm Al Quwain). UAE Federal Law is a civil law system that incorporates elements of Egyptian and French civil law, as well as the principles of Islamic Sharia.² The federal financial regulators are the UAE Central Bank and the Securities and Commodities Authority (SCA). In addition to the federal jurisdiction, each of the Emirates is entitled to choose to maintain their own separate local courts to deal with matters that are not reserved to federal jurisdiction in the Constitution. Abu Dhabi, Dubai and RAK maintain their own independent judiciaries, which apply civil law and Sharia principles. This chapter refers to these jurisdictions collectively as ‘Onshore UAE’.

Article 121 of the UAE Constitution also permits the establishments of free zones. Federal Law No. 8 of 2004 specifically permits a subset of the free zones called ‘Financial Free Zones’. The key elements of a Financial Free Zone (set down in Article 3 of Federal Law No. 8 of 2004) are that they are exempt from all federal civil and commercial laws, but they remain bound by federal criminal laws, including federal anti-money laundering legislation.³ The UAE has established two Financial Free Zones: the Abu Dhabi Global Market (ADGM)⁴ and the Dubai Internal Financial Centre (DIFC).⁵

Within the ADGM, there is a separate financial regulator, the Financial Services Regulatory Authority (FSRA), and separately the ADGM Courts. The ADGM Courts, Civil Evidence, Judgments, Enforcement and Judicial Appointments Regulations 2015 make English Common Law directly applicable in the ADGM, marking a clear distinction from the civil law applicable at the federal level and in onshore UAE. Similarly, within the DIFC, there is also a separate financial regulator, the Dubai Financial Services Authority (DFSA), and separately the DIFC courts. The DIFC courts also apply a common law system (i.e., DIFC law) modelled on the English Common Law (with its court rules closely modelled on the English Civil Procedure Rules) albeit, unlike in the ADGM, English law is persuasive but not directly applicable. In both the ADGM and DIFC courts, proceedings are conducted in English with judgments written in English. Both the ADGM and DIFC are dealt with separately in this chapter where appropriate.

In 2018, the FSRA published extensive regulations making the ADGM:

the first jurisdiction in the world to introduce a comprehensive and bespoke regulatory framework for the regulation of spot virtual asset activities, including those undertaken by multilateral trading facilities, brokers, custodians, asset managers and other intermediaries.⁶

These laws, regulations and guidance have since been regularly updated, with the latest iterations issued in September 2022 (see Section II).

The period since 2020 has seen the onshore federal regulators publish their first regulations affecting cryptoassets. The SCA passed Decision No. 23 of 2020 Concerning Crypto Assets Activities Regulation (the SCA Virtual Asset Regulation)⁷ (see Section II) and the UAE Central Bank published both its Stored Value Facilities Regulation⁸ and the Retail Payment Services and Card Schemes Regulation.⁹ These regulations cover payment tokens (or stablecoins)¹⁰ but expressly exclude security and commodity tokens.¹¹

Since the issuance of Federal Cabinet Decision No. 111 of 2022 on the regulation of virtual assets and their service providers, no person has been permitted to engage in virtual asset activities in Onshore UAE without first obtaining approval and a licence from the SCA or a local licensing authority. From March 2022 onward, the Emirate of Dubai and the DIFC’s DFSA have both taken significant steps towards regulating virtual currency.

On 9 March 2022, Dubai Law No. 4 of 2022 Concerning the Regulation of Virtual Assets (the Virtual Asset Law) established the (onshore) Dubai Virtual Asset Regulatory Authority (VARA). VARA’s remit is very wide and incorporates regulating and licensing issuers, exchanges and custodial and management services providers.

Under Article 15(a), the effect of the Virtual Assets Law is to prohibit, in lieu of a licence issued by VARA, any activity in respect of virtual currencies (among other operations) that falls under Article 16. The ‘activities requiring permits’ listed at Article 16 include:

1. provision of virtual asset platform operation and management services;
2. provision of services for the exchange between virtual assets and national or foreign currencies;
3. provision of services for the exchange between one or more forms of virtual assets;
4. provision of virtual asset transfer services;
5. provision of virtual asset safekeeping, management or control services;
6. provision of services related to virtual asset wallets; and
7. provision of services related to offering, and trading in, virtual tokens.

VARA’s jurisdiction does not extend to the DIFC and only covers activities in respect of virtual currencies that are carried out in onshore Dubai (but outside of the DIFC). At present, no passporting regime exists between Onshore Dubai and the DIFC, meaning that companies must choose in which jurisdiction to become licensed. Companies who wish to operate in both Onshore UAE and the DIFC need to be licensed in both jurisdictions.

On 7 February 2023, VARA published its Virtual Assets and Related Activities Regulations (VARA Regulations) and associated rulebooks which, together with the VARA Regulations, form the Virtual Asset Framework (VA Framework). The VA Framework took immediate effect in the Emirate of Dubai and applies to all firms providing services to or from Dubai other than firms conducting business in the DIFC. The VA Framework provides a framework for the licensing of Virtual Asset Service Providers (VASPs) and rules for their operation.

In 2021, the DFSA updated its Rulebook to include Investment Tokens. Then in March 2022, the DFSA launched Consultation Paper No. 143 setting out its proposal for the regulatory framework for cryptocurrencies. This resulted in the DFSA’s new Crypto Token Regime coming into force on 1 November 2022.¹²

Cabinet Decision No. 1111 of 2022 confirms that overall federal authority rests with the SCA, which can delegate this authority, for instance to VARA. Questions remain as to how the overlapping jurisdictions of the UAE Central Bank, SCA and VARA over virtual currencies will be reconciled in practice, the extent to which VARA will continue to issue regulations and make decisions that are specific to virtual currencies within its jurisdiction or that have wider, national effect, and whether general securities, investment and banking laws, for instance, will be issued with specific applicability to virtual currencies.

Securities and investment lawsi Onshore UAE

A notable development in 2020–2021 was the issue of the SCA Virtual Asset Regulation,¹³ which regulates the ‘Offering, issuing, listing and trading of Crypto Assets in the State and related Financial Activities’ (Article 2(1)) by creating a licensing regime, issuing directives and facilitating (and responding to) inquiries relating to the licensing regime (Article 2(2)). The scope of the regulation is set out in Articles 3 to 5. ‘General Obligations in respect of Crypto Assets’ are set out in Chapter 2, including the Offering of Crypto Assets (Article 6) and the Offering of Security Tokens (Article 7) in the State, and Crypto Assets listing on a Crypto Asset Exchange (Article 8).

In the Emirate of Dubai, Article 6(1) of the Virtual Assets Law empowers VARA to, among other duties, ‘develop the general policy and the strategic plans related to regulating Virtual Asset services in the Emirate’. Since the last edition of this volume, amendments to Dubai laws relating to securities and investment that are specific to the creation, trade and storage of virtual currencies have been issued, namely the Virtual Assets and Related Activities Regulations (VARA Regulations)¹⁴ along with associated rulebooks; all together, they form the Virtual Asset Framework (VA Framework)

The VA Framework was published on 7 February 2023 and took effect immediately in the Emirate of Dubai but not in the DIFC. Described as the ‘world’s first tailor-made virtual asset regime’, the VARA Regulations and the wider VA Framework are designed to provide permissible activities and services to customers, investors and traders in digital assets.

The VARA Regulations¹⁵ contain provisions relating to securities and investments, and in particular entities that are categorised as being VASPs. The licensing regime for a VASP is linked to the type of service the VASP offers. VARA recognises seven distinct categories of virtual asset activities which interlock to provide coverage of the spectrum of services a VASP may offer. It treats each category as modular, so a VASP may apply for multiple activities and aggregate them under a single overarching licence provided there is no specific need to segregate any of those activities. In overview, the seven types of licence cover advisory services; broker-dealer services; custody services; exchange services; services for the lending and borrowing of virtual assets; services for the payment and remittance of virtual assets; and virtual asset management and investment services.¹⁶

Any VASP carrying out regulated activities will need to apply for a licence from VARA. Application fees, extension fees and annual supervision fees apply at various rates. An adviser services licence comes with an 40,000 dirhams application fee and an annual supervision fee of 80,000 dirhams, whereas the equivalent exchange services licence fees come in at 100,000 dirhams and 200,000 dirhams, respectively.

VASPs who fulfil VARA’s licensing requirements will be required to comply with four ‘compulsory rulebooks’ on the themes of company,¹⁷ compliance and risk management,¹⁸ technology and information,¹⁹ and market conduct.²⁰ In addition, seven activity-specific rulebooks have been developed to cater for risks associated with the provision of each virtual asset activity, namely advisory services,²¹ broker-dealer services,²² custody services,²³ exchange services,²⁴ lending and borrowing services,²⁵ payments and remittances services,²⁶ and management and investment services.²⁷ VARA has also established rules for the issuance of all virtual assets (issuance rulebook).²⁸

All market participants, whether licensed by VARA or otherwise, must adhere to the Marketing, Advertising and Promotions Regulations (MAP Regulations, set out in VARA’s Administrative Order No.1 of 2022) which cover virtual asset marketing activities²⁹; VASPs, businesses offering non-virtual asset activities and individuals should be aware of VARA’s Administrative Order No.2 setting out the penalties for non-compliance.³⁰

There are several sections of the VARA Regulations of particular note and relating to securities and investment law. Part II covers the issuance of virtual assets, including issuance rules, the power to classify virtual assets and prohibited virtual assets. Part III covers regulated activities in respect of virtual assets, setting out the general prohibition on activities and exemptions to the general prohibition. Part IV covers licensing including licensing requirements and VARA’s licensing and authorisation powers. However, VASPs will only be required to comply with each activity rulebook if they are licensed by VARA to offer the activity; securities and investment laws cut across many of the rulebooks listed above, including the four compulsory rulebooks and those on advisory, broker-dealer, exchange, and management and investment services, plus the Issuance Rulebook and the MAP Regulations.ii ADGM

After its initial flurry of activity in 2018, which saw the ADGM become the first jurisdiction globally to produce a regulatory framework for cryptoassets, followed by extensive updates to its framework in 2020, the past 12 months have been comparatively quiet. The current framework comprises:

1. the Financial Services and Markets Regulations (FSMR);
2. Guidance on Regulation of Digital Securities Activities in ADGM;
3. Guidance on Regulation of Digital Security Offerings and Virtual Assets under the FSMR; and
4. Guidance on Regulation of Virtual Asset Activities in ADGM.

The table below provides a helpful summary of the position as set out on page 7 of the Guidance on Regulation of Digital Securities Activities in the ADGM.³¹

Category of digital assets or instruments	Regulatory approach
Digital securities (e.g., digital/virtual tokens that have the features and characteristics of a security under the FSMR).	Deemed to be securities pursuant to Paragraph 58(2)(b) of FSMR. All financial services activities in relation to digital securities, such as operating primary or secondary markets, dealing, trading or managing investments in or advising on digital securities, are subject to the relevant regulatory requirements under the FSMR.
Virtual assets (e.g., non-fiat virtual currencies, virtual asset ‘exchange tokens’).	Treated as commodities and therefore not deemed specified investments under the FSMR. Market intermediaries (e.g., broker dealers, custodians, asset managers) dealing in or managing virtual assets, and multilateral trading facilities using virtual assets, need to be licensed or approved by the FSRA. Only activities in accepted virtual assets will be permitted.
Derivatives and collective investment funds of virtual assets, digital securities and utility tokens.	Regulated as specified investments under the FSMR.
Utility tokens (e.g., tokens that can be redeemed for access to a specific product or service).	Treated as commodities and therefore not deemed specified investments under the FSMR.
Fiat tokens (e.g. stablecoins whose value are fully backed by underlying fiat currencies).	Treated as a form of digital representation of fiat currency. Where used as a payment instrument for the purposes of money transmission as defined under the FSMR, the activity will be licensed and regulated as providing money services.

The ADGM also published its Guiding Principles for the Financial Services Regulatory Authority’s Approach to Virtual Asset Regulation and Supervision on 22 September 2022, which inform the FSRA’s attitude to risk and interpretation of the regulations.iii DIFC

Currently, the core laws regulating licensed business in the DIFC and administered by the DFSA are as follows:

1. the Regulatory Law 2004, as amended;
2. the Law Regulating Islamic Financial Business 2004;
3. the Investment Trust Law 2006;
4. the Collective Investment Law 2010; and
5. the Markets Law 2012.

Under the Regulatory Law 2004, the DFSA has also issued its Rulebook, which contains further subsidiary legislation.

In March 2021, the DIFC launched a consultation on its proposed framework for security tokens (Consultation Paper No. 138 – Regulation of Security Tokens).³² This Consultation ended in the second quarter of 2021 and, in October 2021, the DFSA announced the introduction of its regulatory framework for investment tokens , marking the first phase of its Digital Assets Regime.³³ As part of the second phase of its Digital Assets Regime, in March 2022, the DFSA launched Consultation Paper No. 143 on the Regulation of Crypto Tokens, which sets out its proposed framework for crypto tokens. This was followed by the introduction of the DFSA’s Crypto Token Regime on 1 November 2022. Accordingly, the DFSA’s Rulebook has been updated to incorporate the Crypto Token Regime.³⁴

The Rulebook now provides the following definition of a crypto token:

[a Token which] (a) is used, or intended to be used, as a medium of exchange or for payment or investment purposes, or (b) confers a right or interest in another Token that meets the requirements in (a).³⁵

Notably, utility tokens (i.e., tokens that have a specific use case within a closed ecosystem), NFTs and digital currencies issued by any government, government agency, central bank or other monetary authority are expressly designated as excluded tokens³⁶ but are nevertheless brought within the remit of the DFSA’s anti-money laundering and counter terrorist funding regime. Under the Crypto Token Regime, the DFSA published³⁷ and maintains³⁸ an initial list of recognised crypto tokens. Furthermore, although it was initially proposed that entities intending to offer financial services in relation to crypto tokens must establish in the DIFC as a body corporate and be incorporated under DIFC law, that is no longer the case under the implemented rules.³⁹ Branches of financial institutions may provide services relating to crypto tokens provided that the head office of such branch is authorised to carry out the crypto activity.

The following services are permitted in respect of crypto tokens:⁴⁰

1. dealing in investments as principal;
2. dealing in investments as agent;
3. arranging deals in investments;
4. managing assets;
5. advising on financial products;
6. operating an exchange;
7. providing custody;
8. arranging custody;
9. operating a clearing house; and
10. operating an alternative trading system.

In May 2023, Standard Chartered signed a memorandum of understanding with DIFC to launch digital asset custody services.⁴¹

Banking and money transmissioni Onshore UAE

The key onshore virtual currency-specific legislation is the UAE Central Bank’s 2020 Stored Value Facilities Regulation (the SVF Regulation), which regulates the storage of non-cash mediums of exchange that can be purchased, transferred and exchanged for goods and services.⁴² The SVF Regulation expressly includes virtual currencies as virtual assets that customers can purchase, transfer and exchange.

Until 2023, the main change in regulation since 2021 has been in the Emirate of Dubai with the introduction of the Virtual Assets Law. Article 6 of the Virtual Assets Law empowers VARA in numerous ways to regulate, supervise and oversee virtual asset services within the Emirate. Article 6(4) obliges VARA to ‘regulate, and establish rules and controls to govern, the conduct of [regulated activities under the Virtual Assets Law] in the Emirate, including the activities related to Virtual Asset management, clearing, settlement and safekeeping services’. While pertinent to the regulation of exchanges (see Section V below), these activities also fall within traditional banking and money transmission operations and may be expected to lead, in due course, to further virtual currency-related regulations being issued in onshore Dubai.

The VA Framework came into effect in 2023 pursuant to VARA’s obligations under Article 6(4) of the Virtual Assets Law. As explained in Section II.i, the VARA Regulations and Rulebooks set out obligations incumbent on VASPs including those who provide banking and money transmission services. As well as the VARA Regulations, banking and money transmission services cut across many if not all of the requirements set out in the Compulsory and activity-specific Rulebooks, plus the Issuance Rulebook and the MAP Regulations.ii DIFC

Investment tokens do not fit easily with the rules and regulations that govern traditional fiat currency banking and money transmission services. The Rulebook defines investment tokens as:

the Security or Derivative in the form of a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology; or a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology.

However, the DFSA Rulebook regulates the custody of Investment Tokens and Crypto Tokens by Digital Wallet Service Providers.⁴³ For example, under conduct of business model (COB) 14.3.3 of the DFSA Rulebook, a digital wallet service provider must ensure:

1. any Distributed Ledger Technology application used in providing custody of the investment tokens must be resilient, reliable and compatible with any relevant facility on which the investment tokens are traded or cleared;
2. it is able to clearly identify and segregate investment tokens belonging to different clients; and
3. it has in place appropriate procedures to enable it to confirm client instructions and transactions, maintain appropriate records and data relating to those instructions and transactions and to conduct a reconciliation of those transactions at appropriate intervals.⁴⁴

These rules are applicable to providing custody for both Investment Tokens and Crypto Tokens.⁴⁵

Furthermore, the Digital Wallet Service Provider must ensure that the technology used and its associated procedures have adequate security measures (including cyber security) to enable the safe storage and transmission of data relating to the investment tokens and the DFSA has introduced a technology audit requirement for Authorised Firms providing services in respect of Crypto Tokens.⁴⁶

The DFSA’s Money Service regime was established in January 2020 to allow various previously prohibited activities to be carried out in or from the DIFC. However, the DFSA has maintained its position that authorised Money Services Providers may not use Crypto Tokens and can only use DFSA recognised Fiat Crypto Tokens provided they are a Recognised Crypto Token and used only for the purposes of money transmission or executing a payment transaction in the name of the Money Services Provider and not in the Client’s name.

This article first appeared on Lexology. You can find the original version here.