A crypto company in Dubai needs two licences, not one

You have an exchange, a custody product or a treasury desk, and someone has told you the answer is a DMCC crypto licence. That is about half an answer, and the missing half is the expensive one. A free zone issues your company. A different body decides whether that company may hold a client's coin, quote a price, move a transfer or advise anybody on any of it. Since 2022 the two decisions have sat with two separate authorities in Dubai, and which authority you face depends on an address boundary rather than on what your product does.

Which authority owns your business, and why the free zone is not the answer

The first question is not which zone. It is which supervisor reads your file. Get this wrong and you will pay a year of office rent inside a zone that cannot grant the thing you came for. Making that determination, and recording it before you pay a deposit, is the subject of deciding which authority is entitled to read your file.

The legacy version of this advice, which is still repeated across the market, presents DMCC as the licensing body for crypto in Dubai. DMCC is a free zone. It houses a large cluster of these businesses and it issues the commercial licence. It does not supervise virtual asset activity, and an approval from the zone is not an approval to operate.

The commercial licence and the activity licence do different work

The commercial licence says a company exists, has a permitted scope of business and has premises. The activity licence says a supervisor has examined your controllers, your capital, your systems and your compliance function, and will accept responsibility for letting you serve clients.

They also move at different speeds, which is the practical trap. Founders take the zone package first because it is quick and quotable, then discover that the activity file is the long pole: document production, an appointed compliance officer, an independent technology assessment, policies that describe a business you have not started yet. Approval arrives in stages, with conditions attached before a single client may be onboarded. Budget for a period in which you hold premises, pay staff and earn nothing.

There is a second-order effect worth planning for. Your bank will not open the operating account on the strength of the trade licence alone. A virtual asset business is a high-risk customer in every bank's own framework, and the account application tends to follow the activity approval rather than precede it. Our page on virtual asset licensing in the UAE treats that account as one of five gates, and it is the gate that stops most ventures.

The activity categories, and why most plans touch more than one

Dubai's framework licenses activities, not companies. A single product often spans several, and each one carries its own conditions. The categories below are the working set; their names and boundaries are set by the authority's rulebooks and have been revised, so treat this as a map of the terrain rather than a quotation.

Two things follow. First, scope your product against the categories before you choose a jurisdiction, because the combination you need may be cheaper or simply possible in one and not another. Second, do not apply for categories you might use later. Each one adds conditions, capital and reporting you must satisfy continuously, whether or not you have switched the feature on.

Because the permission is granted activity by activity, the activities not printed on it are not included — which is a separate question from this one, worked through in what a Dubai crypto licence actually covers.

What the file is actually testing

Not your pitch deck. The examination is unglamorous and it concentrates on four things.

Who controls this. Shareholders, ultimate beneficial owners and senior appointments are assessed individually. A nominee arrangement that obscures the chain will fail, and a founder with an unexplained regulatory history elsewhere is a problem you should surface yourself rather than have found.

Whether the money and the systems are real. Capital and liquidity requirements are set per activity. Client assets must be segregated in a way an auditor can trace. Technology and information controls — key management, incident response, business continuity, penetration testing — are assessed against a written standard, usually with an independent report.

Whether someone is accountable for compliance. A named compliance officer with authority, present in the country, is a structural requirement rather than a title. Outsourcing the function to a consultant who signs a policy pack is the most common reason a file stalls.

Whether your conduct rules bind you. Marketing restrictions apply to how you describe returns and risk. Complaints handling, disclosure and fair-dealing obligations apply to customers you do not have yet, and the policies have to exist before you do.

The federal obligations underneath, whichever authority licenses you

Anti-money laundering law is federal and applies regardless of zone: Federal Decree-Law No. 10 of 2025 and its executive regulation, Cabinet Resolution No. 134 of 2025. In practice that means customer due diligence proportionate to risk, sanctions screening against the local and United Nations lists, record retention, and suspicious transaction reports filed through the goAML platform operated by the Financial Intelligence Unit. Beneficial ownership information is maintained under the real beneficiary regime and kept current, not filed once.

Expect a transfer-information obligation of the kind applied internationally to virtual asset transfers, and confirm its current UAE form directly. It changes your engineering, not only your paperwork, because it requires counterparty data to travel with the transfer.

Tax, and the claim that crypto in a Dubai free zone is tax free

It is not, and the claim has survived long past the law. Corporate tax is federal. No free zone can exempt you from a federal tax, and no zone authority has the power to try. The rate is 9% on taxable income above AED 375,000, and 0% at or below it.

A free zone company may access a 0% rate on qualifying income if it meets the conditions for qualifying free zone status, and those conditions are the whole argument. The list of qualifying activities is closed. Do not assume a virtual asset service appears on it, and do not build a model that depends on the assumption — read the operative ministerial decision and take advice before the first invoice. Income from the mainland, and transactions with individuals rather than businesses, can pull you outside the status. Losing it is not a one-year event.

VAT is 5% and sits separately. The treatment of a token transfer or conversion is its own question with its own history, and it does not change the treatment of whatever you actually supplied.

Sorting the models: inside or outside the licensed perimeter

Where Dubai is the wrong home for a crypto company

Where the plan depends on not being supervised. The framework exists to bring these businesses inside a perimeter. If the appeal was the absence of one, the appeal has gone.

Where the token is a fundraise wearing a product name. Selling units, promising a return or distributing profits makes this a securities question, and the authority who reads it is not the one who issues trade licences. Answer that question first, elsewhere in the structure.

Where nobody is moving here. Senior functions, the compliance officer and decision-making have to be genuinely present. A structure run from another time zone by people who visit fails both the licensing test and the tax substance test, and it fails them separately.

Where the runway cannot absorb a revenue-free licensing period. Premises, salaries, professional fees and audit all begin before onboarding does. This is the most common reason a credible plan dies.

Where the customer is retail in a country that has prohibited the product. A Dubai licence authorises you here. It does not make you lawful in the market you were planning to sell into, and the marketing restrictions bite on how you reach those customers.

Where the business only accepts tokens from customers. If you sell software and a client pays in USDT, you are not a virtual asset service provider and this entire article is the wrong document. The questions that actually apply to you are accounting classification and free zone status.

What we would want to know before pricing this

Which of the activity categories your product genuinely touches, today and in the first year. Where your customers are and whether any of them are individuals. Whether client assets will be held, and by whom. Who is moving to the UAE, in what role, and on what timetable. Whether any founder has a regulatory or criminal history anywhere. Whether the model needs a bank account before revenue, or can survive without one. How long the business can run with costs and no income. Answer those and the jurisdiction usually chooses itself.

Frequently asked questions