Crypto regulation in the UAE has entered a new phase. Dubai, the emirate that attracts the most exchanges, custodians and tokenisation projects in the region, has moved from publishing rules to actually enforcing them.
The ambition is not accidental. The emirate wants to position itself as a global financial hub for digital assets, competing with Singapore, Hong Kong and the European Union under MiCA.
2025 was the year that framework was completed on paper. 2026 is the year it is actually enforced.
The Virtual Assets Regulatory Authority (VARA) has moved from publishing rules to actively supervising them. In parallel, the new federal anti-money laundering decree requires virtual asset service providers to meet standards equivalent to those of a bank.
This shift has a direct consequence for any crypto platform operating in the country. Identity verification is no longer an onboarding formality. It is the first line of compliance.
What VARA is and what changes in its approach for 2026
VARA is Dubai’s virtual assets regulator, created in 2022 to supervise exchanges, custodians, lending platforms and token issuers operating outside the DIFC financial centre.
Dubai chose to create a dedicated authority rather than expand the mandate of a general financial regulator. The decision reflects a declared ambition: to become the reference market for virtual assets in the Gulf region, with its own rules distinct from those applied by the DFSA within the DIFC.
Between 2023 and 2025, VARA progressively published its Rulebooks: rules on marketing, custody, token issuance and risk management. The sector interpreted this as the closing of a chapter.
2026 disproves that reading. The regulatory framework was already practically complete by the end of 2025; what was missing was enforcement. VARA has adopted a stance of active supervision, focused on governance, capital discipline, internal controls and ongoing compliance, not just licences on paper.
The following table summarises the key milestones of this transition.
| Year | Milestone |
| 2018 | First guidelines on virtual assets from the UAE Central Bank, focused on AML |
| 2022 | Creation of VARA as Dubai’s dedicated regulator for virtual assets |
| 2023-2025 | Progressive publication of VARA’s Rulebooks (marketing, custody, risk) |
| Oct. 2025 | Federal Decree-Law 10/2025 comes into force: VASPs fall under the full AML/CFT regime |
| 2026 | Active supervision phase: inspections, sanctions and enforcement of the FATF Travel Rule |
Source: own compilation based on UAE federal regulation and VARA’s public Rulebooks.
Facephi documents this regulatory complexity in its compliance analysis for the MENA region, where the UAE coexists with Saudi Arabia, Qatar, Bahrain, Kuwait and Oman under different AML/CFT frameworks.
Crypto regulation in the UAE, in figures
The available data show the scale of the sector and the tightening of supervision.
More than 80 virtual asset service providers now operate under licence in the UAE, spread across the country’s four regulators. The figure has grown steadily since 2023, when most entities were still operating in a regulatory limbo.
The Central Bank imposed more than AED 370 million in sanctions during 2025, including an individual fine of AED 200 million against an exchange house for failures in its AML framework.
The FATF Travel Rule, which requires transmitting originator and beneficiary data in virtual asset transfers, applies in the UAE from AED 3,500 per transaction, as set out in the VARA Rulebook.
| Data point | Figure |
| VASPs with an active licence in the UAE | 80+, spread across 4 regulators |
| UAE Central Bank sanctions in 2025 | AED 370 million+ |
| Largest individual fine (exchange house) | AED 200 million |
| FATF Travel Rule threshold at VARA | AED 3,500 per transfer |
| Arrests for crypto scams in Dubai (April 2026) | 275, part of a joint operation of 276 |
Sources: UAE Central Bank, VARA Rulebook, Facephi Observatory (2026).
Facephi analyses the identity verification requirements for crypto platforms aligned with these regulatory thresholds, from document capture to biometric verification of the account holder.
What the licence figure doesn’t tell you
The headline is tempting: the UAE has a complete crypto framework and more than 80 licensed entities. The operational reality is more fragmented.
The country does not have a single virtual assets regulator, but four with different rules. VARA supervises Dubai outside the DIFC. The DFSA regulates the DIFC itself, with the Travel Rule applied to every transfer with no threshold. The FSRA covers the ADGM, Abu Dhabi’s free zone, with its own regime aligned with the FATF. The rest of the federal territory falls under the general supervision of the Central Bank and the CMA, without a uniform, specific VASP licence.
| Regulator | Jurisdiction | Travel Rule specifics |
| VARA | Dubai (outside the DIFC) | AED 3,500 threshold per transfer |
| DFSA | DIFC (Dubai free zone) | Applies to every transfer, no threshold |
| FSRA | ADGM (Abu Dhabi free zone) | Own regime aligned with the FATF |
| Central Bank / SMA | Rest of the federal territory | General AML supervision, no uniform VASP licence |
Source: public rulebooks from VARA, DFSA and FSRA.
This fragmentation is not a minor detail. Any platform operating in more than one zone must interpret and apply several verification and reporting frameworks at once, not just one.
The other figure the regulatory headline leaves out is the volume of fraud that continues despite the supervision. On 29 April 2026, the FBI, Dubai Police and Chinese authorities announced a joint operation that arrested 276 people and dismantled at least nine cryptocurrency scam centres. 275 of those arrests took place in Dubai, according to confirmation from the US Department of Justice.
Matthew White, CEO of VARA, summed up the underlying dilemma in an analysis published in July 2026:
«Financial centres still running on PDF manuals are almost out of time. Supervisors that modernise will inherit the next era of finance.»
— Matthew White, CEO of VARA (Fortune, July 2026; translated from the Spanish rendering of the original English quote)
The practical takeaway is clear. Completing a rulebook doesn’t eliminate fraud; it only changes the terrain on which it competes with supervision. Facephi has examined this paradox on its compliance blog, including a review of Federal Decree-Law 10/2025 and its Article 30, which bans virtual assets that conceal transaction traceability.
Challenges for crypto platforms in the UAE and the role of identity verification
The combination of more supervision and more fraud shifts the pressure to a single point: identity verification at onboarding and at every relevant transaction.
Crypto platforms operating in the UAE face specific challenges, not just regulatory ones.
| Challenge | Why it matters | What it requires or solves |
| AI-driven KYC evasion | Synthetic documents and deepfake selfies bypass traditional verification | Passive liveness detection and defence against injection attacks during capture |
| Travel Rule compliance | Each UAE regulator applies a different threshold and scope | Originator and beneficiary verification built into onboarding |
| Mule accounts and traceability | Article 30 of Decree-Law 10/2025 bans assets that conceal the origin of funds | Network analysis and behavioural biometrics |
| Friction in user onboarding | Slow registration processes increase drop-off | Biometric verification in seconds, no passwords |
Facephi offers identity verification solutions for the crypto ecosystem that integrate document capture, facial biometrics with liveness detection and continuous fraud monitoring.
The goal is not to add isolated controls, but to connect onboarding, authentication and behavioural analysis into a single flow. This way, a platform can demonstrate to VARA, the DFSA or the FSRA that each user is who they say they are, without slowing down registration or day-to-day operations.
