Answered plainly
There is no UAE crypto regulator. There are five, and the verb your company has not chosen yet decides which one reads your file.
The question reaches a board as one question — do we need a crypto licence — and it has four different answers, because holding, accepting, trading and issuing are separate decisions answering to separate authorities.
The question arrives as one word too few
The paper in front of you asks whether the company needs a crypto licence. That question cannot be answered, because it is missing a verb. Holding tokens, being paid in them, dealing in them for your own account and creating one and putting it in somebody's hands are four separate decisions. They are decided by different people, they carry different consequences, and only some of them involve a regulator at all.
Most of what is written about crypto in this country is written for a company that sells virtual asset services to other people. That is a real business with a real licensing path, and it is a small fraction of the companies that end up with crypto somewhere on the balance sheet. The larger group is a design studio whose client wants to settle in USDT, a trading company whose founder wants part of the reserve in bitcoin, a software firm asked to hold a customer's wallet for a fortnight, and a startup whose investor deck contains the word token. None of those four is the same question.
Four verbs, and whose asset moves is what separates them
Sort by the only distinction the law actually cares about: whether the asset or the order belongs to somebody else.
Rows one to three are commercial decisions with accounting and tax consequences. Row four is the only one that buys you a supervisor. Row five is a funding plan that usually does not survive contact with the rulebook. If somebody has quoted you a compliance officer's salary and you are in row one, you are being sold the wrong product. Where exactly the line between the unlicensed rows and the licensed one falls, and how a company steps over it without meaning to, is worked through on holding, receiving and spending crypto without a licence.
| Row | What the company is doing | What comes with it |
|---|---|---|
| Row one | Holding tokens the company owns itself | No permission needed, but the classification and the free zone exposure change |
| Row two | Being paid in tokens by a customer | A Central Bank question on that token; the sale is taxed as the sale it was |
| Row three | Dealing for the company's own account | Outside the perimeter while there are no clients, on a published carve-out |
| Row four | Handling somebody else's asset or order | The only row that comes with a supervisor |
| Row five | Creating a token and putting it in somebody's hands | A funding plan that usually does not survive the rulebook |
Geography picks the authority, and the zone that sold you the company is not on the list
Once a business does cross into row four or row five, the authority is not chosen by the activity. It is chosen by where the company physically sits, and the answer changes across a boundary drawn through the middle of Dubai. Settling which of them is entitled to read your file, before anything is applied for, is the whole of which crypto regulator applies to you.
- Dubai, outside DIFC
VARA
- Inside DIFC
The DFSA
- Inside ADGM
The FSRA
- The remainder of the country
The SCA
- Anywhere in the UAE, where a payment token settles a sale
The Central Bank
The body absent from that table is the free zone authority that issued your trade licence. A zone can put a crypto-sounding activity on your licence and it has not authorised you to do any of it; the two documents answer different questions, and your licence is an emirate licence and not a UAE one explains why permissions do not travel the way founders assume. Our cryptocurrency licence page sets out what each authority actually requires of an applicant, including the capital formulas and the banking constraint that decides most of these ventures before a regulator ever sees the file.
Holding: the decision is which company holds it, not whether you may
Nobody's permission is needed for a UAE company to own tokens. Three other things follow immediately, and the first of them is an entity decision that gets taken by default.
A holding of cryptocurrency is not cash and it is not a financial asset — the IFRS Interpretations Committee settled that in June 2019, leaving inventory treatment where the holding is for sale in the ordinary course of business and intangible asset treatment in every other case. So the reserve you thought you were showing is not presented as a reserve, and the write-down model that comes with an intangible asset is not symmetrical on the way back up.
Then the free zone problem. Virtual assets do not appear on the closed list of Qualifying Activities in Ministerial Decision No. 229 of 2025, and a token does not fit the definition of a Qualifying Commodity. Gains are therefore non-qualifying revenue, and under Cabinet Decision No. 100 of 2023 non-qualifying revenue above the de minimis costs qualifying status for that tax period and the four that follow. A single good year on a position nobody thought hard about can cost five years of the status the company was built around.
Which makes the real question narrow and answerable: which entity holds this. An operating company that relies on qualifying status is the worst available answer. Being paid in crypto does not make you a crypto business works the accounting and tax consequences through in detail, and our corporate tax page covers how the qualifying test is run each year.
Accepting: the token is the decision, and it is not yours to make
A customer paying you in tokens is not receiving a service from you, so no virtual asset authority is engaged. One live question remains and it belongs in a different building: whether that specific token may lawfully settle a sale inside the UAE is a Central Bank matter under its Payment Token Services Regulation. Read that instrument against the actual token before anybody accepts anything, and read the current text rather than a summary of it.
What acceptance does not do is move the transaction somewhere quieter. The consultancy you supplied is still the supply, valued as it was, and the 5% VAT and the corporate tax on it are owed in dirhams whatever arrived in the wallet.
Trading for your own account: the exemption rests on a sentence about clients
VARA's published position is that trading with your own funds, with no clients, does not require a licence at present, and that a rolling thirty-day volume changes that. Both halves matter, and the first half is more fragile than it looks.
The carve-out exists because no third party is exposed. It survives exactly as long as that stays true. The first outside dirham in the same position ends it — a friend who wants in, a shareholder contributing cash for a share of the upside, an investor whose money you agreed to run alongside your own. At that point you are managing another person's asset, which is row four, and no amount of informality in how it was agreed changes what it is. The threshold figure is worth confirming with VARA directly rather than taking from any article, this one included.
whose asset sits in the position
- Trade only funds the company already ownsNo third party is exposed, which is why the carve-out exists
- Take no client and no client orderHandling another person's asset or order is row four, whatever it was called
- Watch the rolling thirty-day volumeVARA's published position changes above it, and the figure moves
- Has anybody else's money been placed in the same position
- Nobody else's, at any pointOutside the licensed perimeter at present, on VARA's own published wording
- A friend, a shareholder or an investor is inYou are managing another person's asset, and informality does not change it
- The fragile part is the phrase our ownConfirm the volume qualification with VARA directly, not from an article
The verb changes underneath you, and nothing in the company records the moment
This is how ordinary companies end up outside the perimeter they thought they were inside. Each step below is individually unremarkable. Each one crosses a line.
The last of those is the one founders least expect, and somebody else has to sell your token sets out why the distribution requirement, not the issuance itself, is what usually ends the funding plan.
Five decisions that exist before any authority reads anything
None of these needs a regulator. All of them get made by default if nobody makes them deliberately.
The key-control row is the one with no institutional backstop. A dirham in a bank account has a bank, a court and an estate process behind it. A private key held by one person has none of that, and when a UAE shareholder dies the company stops being able to act describes what happens to everything that depended on a single signature.
Your auditor and your bank ask questions no regulator asks
An authority asks whether you are permitted to do this. Two other readers ask whether it happened, and they are harder to satisfy.
Your auditor has to evidence existence, key control, the valuation source and the impairment position. An intangible asset held in a wallet is not confirmable by writing to a bank, so the audit procedures change and the fee usually changes with them. A free zone company claiming qualifying status already needs audited financial statements, so this is added on top of an obligation you cannot decline. Our audit and accounting page covers what the annual obligation already involves.
Your bank asks something else again: who the counterparty was. The venue you traded through is either authorised somewhere your bank recognises or it is not, and an unrecognised venue is not a legal problem so much as a fact that sits in your file forever. Document the commercial substance at the moment of each transaction — contract, invoice, counterparty identity, wallet, conversion, rate, timestamp — because assembling it afterwards is the situation everybody wants to avoid. Banking advisory covers what banks actually test.
who asks it, test by test
The authority
- Whether the company is permitted to do this at allA permission is prospective and does not cure conduct already engaged in
Your auditor
- That the holding existsNot confirmable by writing to a bank, so the procedures change
- Who controls the keysWho holds them today, and under what written authority
- The valuation sourceInventory where the holding is for sale, an intangible asset otherwise
- The impairment positionA write-down model that is not symmetrical on the way back up
Your bank
- Who the counterparty wasContract, invoice, wallet, conversion, rate and timestamp, at the moment it settled
- Whether the venue is authorised somewhere it recognisesAn unrecognised venue is a fact that sits in your file forever
Where crypto is the wrong thing for this company to touch
We would rather argue a client out of this than unpick it later.
Wrong if the company is a Qualifying Free Zone Person and the position is material. The de minimis cliff and its four following periods are a disproportionate price for a treasury preference. Hold it somewhere else and leave the operating company alone.
Wrong if nobody in the room can name the verb. A discussion that cannot say whether the company will hold, accept, trade or handle for others is not ready for a licensing question, and any adviser who quotes a fee against it is guessing.
Wrong if one person holds the keys. That is not a compliance objection. It is an unmanaged single point of failure with no recovery mechanism, and it fails in exactly the circumstances where nobody is available to fix it.
Wrong if the plan depends on a regulator's silence. Several of the positions above rest on a published carve-out or on a document not addressing your case. Those are real, and they are also revised without notice. A business model whose viability turns on a sentence in an FAQ is a business model with a supervisory letter in its future.
Wrong if the intention is to license it later. A permission is prospective. It does not cure conduct you already engaged in, and an application form that asks what the company has been doing is not a form you want to complete honestly and unhappily.
Wrong if the reason is the price of the asset. A treasury decision justified by where a chart went is not a treasury decision, and your auditor, your bank and your investors will all read it as what it is.
Wrong if the money needs to be liquid. It is not cash, the accounts will not present it as cash, and a lender reading those accounts will not treat it as cash. If the reason was liquidity, the reason already failed.
What we would want to know before advising on this
Which of the four verbs the company will actually perform, and whether any of them involves a third party's asset or order. Where the company sits, because that chooses the authority and nothing else does. Whether the entity carrying the exposure relies on free zone qualifying status. Who controls the keys today, and under what written authority. And whether a single transaction can already be evidenced to the standard a bank will ask for, because testing that on one small conversion costs nothing and is the cheapest piece of diligence available here.
Frequently asked questions
Do we need a licence to hold tokens in the company?
No virtual asset authority licenses a company for owning its own assets. What holding changes is the accounting classification, the audit file and, in a free zone, the qualifying income test. Those are the consequences worth planning for.
Which authority do we answer to?
If you handle nobody else's asset or order, none of the virtual asset authorities. If you do, the answer is set by where the company sits: VARA in Dubai outside DIFC, the DFSA inside DIFC, the FSRA inside ADGM, and the SCA across the remainder of the country. Payment tokens are federal and sit with the Central Bank wherever you are.
Our free zone says it can add a crypto activity to the licence. Does that settle it?
It settles what the zone will let the company call itself. It does not authorise conduct that a virtual asset authority holds, and the two documents are tested by different readers at different moments. Establish the authority position before paying for the activity, not after.
We only trade our own money. Is that genuinely outside?
At present, and on VARA's own published wording, yes — with a volume qualification you should confirm directly. The fragile part is the phrase "our own". Accepting anybody else's money into the same position changes the answer on the day it arrives.
Can we accept any token a customer offers?
That is the Central Bank's question, not ours and not the customer's. Settle it against the specific token before the first payment, and keep in mind that the sale itself is taxed as the sale it was.
Begin with a clear conversation
Tell us what you intend to build.
A consultant will map the structure, jurisdiction, approvals and likely cost against what you actually described — not against a package.
