Five Crypto Regulators in the UAE - What German Token Founders Need to Know About CMA, VARA, DFSA, ADGM and CBUAE

The UAE consist of seven emirates - Abu Dhabi, Dubai, Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah and Fujairah. Each emirate has a degree of autonomy, particularly in commercial law. In addition, there are Financial Free Zones, namely the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM), each maintaining their own legal systems, courts and financial supervisory authorities. This system explains why the UAE have not one but five authorities supervising crypto businesses.

The term "virtual asset" (VA) encompasses, under the definition in Federal Decree-Law No. 32/2025, any digital representation of value that can be electronically transferred, stored or traded. This includes cryptocurrencies such as Bitcoin and Ether as well as utility tokens, security tokens and non-fungible tokens (NFTs), provided they are not expressly excluded. Excluded are in particular traditional securities, which continue to fall under general capital markets law, and central bank digital currencies (CBDCs).

For German entrepreneurs, the crucial point is this: the UAE draw a strict distinction between regulated and prohibited activities. Regulated means that a license must be applied for and granted before business activity commences. Prohibited are in particular privacy tokens (such as Monero or Zcash) and algorithmic stablecoins (such as the failed TerraUSD).

With Federal Decree-Law No. 32/2025 (transformation of the former Securities and Commodities Authority - SCA - into the Capital Market Authority - CMA) and Federal Decree-Law No. 33/2025 (extension of CMA jurisdiction to virtual assets), both in force since January 1, 2026, the UAE federal legislator fundamentally restructured the regulatory architecture.

The former SCA was primarily responsible for traditional securities and commodities. The new CMA has now received explicit jurisdiction over virtual assets, providing it with a federal-level regulatory competence that exists alongside the existing special regimes of VARA, DFSA and ADGM.

CMA Decision No. 4/R.M/2026 of February 13, 2026 specifies the new requirements in detail:

Eight licensed activities. The CMA defines eight activities requiring a license: (1) operation of a virtual asset trading platform, (2) broker-dealer activity, (3) custody, (4) advisory services, (5) portfolio management, (6) token issuance, (7) lending (credit provision against crypto collateral) and (8) staking.

Capital requirements. Depending on the activity, the CMA requires a paid-up minimum capital of between AED 500,000 (approx. EUR 125,000) and AED 4 million (approx. EUR 1 million). These amounts must be maintained as liquid capital - subordinated loans or crypto holdings are not counted.

Prohibitions. Privacy tokens and algorithmic stablecoins are expressly prohibited (CMA Decision No. 4/R.M/2026, Art. 12(3)). Violations may be sanctioned with fines of up to AED 10 million (approx. EUR 2.5 million) and revocation of the license.

The UAE regulatory system for crypto businesses is distributed across five authorities, each with clearly delineated but in practice sometimes overlapping jurisdictions:

CMA (Capital Market Authority). Federal-level jurisdiction covering all seven emirates - with the exception of areas falling under the jurisdiction of DIFC, ADGM or VARA Dubai. The CMA is thus the "catch-all regulator" for all crypto businesses that do not fall within one of the special zones. Legal basis: Federal Decree-Law No. 32/2025 in conjunction with CMA Decision No. 4/R.M/2026.

VARA (Virtual Assets Regulatory Authority). Responsible for the Emirate of Dubai - with the exception of the DIFC. VARA is the world's first specialized crypto regulatory authority and has built a comprehensive rulebook since 2023 covering seven activity categories. Legal basis: Dubai Law No. 4 of 2022 (Virtual Assets Regulation Law).

DFSA (Dubai Financial Services Authority). Responsible exclusively for the DIFC, a Financial Free Zone in the heart of Dubai with its own common law legal system and courts (DIFC Courts). The DFSA regulates crypto businesses through its Investment Token Regime. Legal basis: DIFC Regulatory Law 2004, supplemented by the DFSA Crypto Token Rules.

ADGM FSRA (Financial Services Regulatory Authority). Responsible for the Abu Dhabi Global Market (ADGM), a Financial Free Zone on Al Maryah Island in Abu Dhabi. ADGM also maintains its own common law system and courts. The FSRA introduced one of the world's first crypto regulatory frameworks in 2018. Legal basis: ADGM Financial Services and Markets Regulations 2015, supplemented by the Virtual Asset Framework.

CBUAE (Central Bank of the UAE). Responsible for payment tokens (stablecoins pegged to a fiat currency) and since 2025 also for DeFi protocols offering payment services. The CBUAE has established its own rulebook for dirham-based and other stablecoins through the Payment Token Services Regulation Framework (PTSR). Legal basis: Federal Decree-Law No. 14 of 2018 (Central Bank Law), supplemented by CBUAE Circular No. 2/2025.

The crucial point: compliance with one regulator does not mean compliance with another. A VARA license for Dubai does not automatically permit operations in Abu Dhabi or Sharjah. A CMA registration does not permit operations in the DIFC. Each regulator requires its own license, its own compliance structures and its own reporting obligations.

For most German founders, a central practical question arises: should the crypto project be licensed under VARA (Dubai) or under the CMA (federal level) - or under both?

VARA (Dubai) offers a more elaborate and practically proven rulebook. Dubai has the larger talent pool in the crypto sector, an established infrastructure of specialized lawyers, compliance service providers and auditors, as well as strong international brand recognition. VARA licenses are designed for retail and institutional clients.

CMA (federal level) provides access to all emirates outside Dubai, which is particularly relevant for projects with clients in Abu Dhabi, Sharjah or Ras Al Khaimah. The CMA has a more institutional orientation and is suitable for projects aiming for a multi-emirate presence.

In practice, many projects require both licenses: VARA for serving clients in Dubai and CMA for all other emirates. The costs and administrative burden do not exactly double, as certain compliance structures (such as AML/KYC systems) can be used for both regulators - but the regulatory complexity increases considerably.

The VARA Issuance Guidance of April 2026 fundamentally revised the rules for token issuance in Dubai. German founders planning a token launch must distinguish three categories:

Category 1 - Full Regulated Virtual Assets (FRVA) and Associated Regulated Virtual Assets (ARVA). This covers tokens independently conceived as investment assets or means of payment, or linked to a regulated asset. Issuing such tokens requires a dedicated issuance license. Capital requirements are at least AED 1 million (approx. EUR 250,000), plus extensive whitepaper requirements and a mandatory external smart contract audit.

Category 2 - Licensed Distributor. Tokens issued through an already licensed distributor are subject to reduced requirements. The founder does not need their own issuance license but must work with a licensed partner and remains responsible for the whitepaper requirements.

Exempt Virtual Assets. Tokens that function exclusively within a closed ecosystem (such as in-game currencies without a secondary market) may be exempt from regulation. However, the exemption must be applied for and approved by VARA in advance - a self-assessment by the issuer is not sufficient.

A whitepaper requirement with specific risk disclosures applies to all categories, informing the investor about technical risks, market risks, regulatory risks and the risk of total loss.

Important: tokenized real-world assets (RWAs) - such as tokenized real estate, bonds or art - may additionally fall under CMA regulation if they exhibit characteristics of a security. In that case, a CMA registration is required in addition to the VARA license.

Licensing a crypto business in the UAE is among the most cost-intensive globally. The total costs comprise: minimum capital requirements between AED 500,000 (approx. EUR 125,000) and AED 4 million (approx. EUR 1 million), license fees of AED 100,000 to AED 500,000, compliance infrastructure with personnel costs of AED 500,000 to AED 1 million annually, and legal and advisory costs of AED 200,000 to AED 500,000.

The typical duration of a licensing process is six to twelve months. The reasons: five parallel regulators, extensive documentation, fit-and-proper tests, evidence of functional AML/KYC systems and ongoing reporting obligations.

Worked example: a German start-up with a VARA license (Exchange) must expect total costs of AED 4,200,000 (approx. EUR 1,050,000) in the first year, of which AED 2,000,000 is tied-up minimum capital and AED 2,200,000 represents actual expenditure. From the second year onward, ongoing annual costs amount to approximately AED 1,300,000 (approx. EUR 325,000).

Despite the high costs, the UAE are among the most sought-after locations worldwide: zero percent income tax for individuals, corporate tax of only 9 percent, strategic time zone, regulatory clarity, access to MENA and Asian markets, English-language common law courts, rapid company formation and Golden Visa for investors.

German founders building a crypto business in the UAE remain subject to German taxation in many cases. Since January 1, 2026, crypto service providers are subject to a reporting obligation (Meldepflicht) to the Federal Central Tax Office (BZSt) under the Crypto-Asset Tax Transparency Act (KStTG). Private disposal transactions involving cryptocurrencies are taxable within the one-year holding period (Haltefrist) under section 23 of the German Income Tax Act (EStG). Passive crypto income through a UAE company may be attributed to the German shareholder under sections 7-14 of the German Foreign Tax Act (AStG) through CFC taxation (Hinzurechnungsbesteuerung).

Worked example: a German founder holds 100 percent of a Free Zone LLC in Dubai with staking rewards of AED 2,000,000 (approx. EUR 500,000). UAE corporate tax: AED 146,250 (approx. EUR 36,563, effective rate 7.3 percent). CFC taxation applies because the effective tax burden is below 25 percent. German tax liability: approximately EUR 219,982 less creditable UAE tax of approximately EUR 36,563. Remaining German tax liability: approximately EUR 183,419. Effective total tax burden: approximately 44 percent.

CFC taxation thus virtually eliminates the tax advantage of the UAE as long as the founder remains subject to unlimited tax liability in Germany.

German founder with token project, company domiciled at DMCC (Dubai), annual revenue AED 5,000,000 (approx. EUR 1,250,000): regulatory costs (VARA license, CMA registration, compliance personnel) of AED 1,150,000 to AED 3,700,000 annually. UAE corporate tax: 9 percent on profit exceeding AED 375,000. Ongoing costs (office, IT, audits) of AED 350,000 to AED 950,000 annually.

Clarify the jurisdictional question before company formation. Plan for both licenses in multi-emirate operations. Integrate the KStTG reporting obligation from the outset. Avoid privacy tokens and algorithmic stablecoins entirely. Build substance in the UAE. Coordinate the token categorization with the regulator at an early stage.

Advice from a specialized law firm: Cross-border matters between Europe and the UAE are complex. The right approach must take into account the legal situation in both jurisdictions - corporate, tax, regulatory, and personal considerations. Eisenberg Europe & Middle East is a German law firm with offices in Abu Dhabi, Dubai, Frankfurt, Hamburg, and Tel Aviv. We advise individuals, families, and companies on structuring their affairs between the German-speaking region and the UAE - from relocation planning and company formation to real estate transactions, asset protection, and intergenerational succession. If you would like to learn which options may suit your situation, we would be pleased to offer you a confidential initial consultation.

Expert Review by: Dr. Fabian Ibel, Corporate and Compliance Lawyer

Cross-border matters between Europe and the UAE are complex. The right approach must take into account the legal situation in both jurisdictions - corporate, tax, regulatory, and personal considerations.

Eisenberg Europe & Middle East is a German law firm with offices in Abu Dhabi, Dubai, Frankfurt, Hamburg, and Tel Aviv.

We advise individuals, families, and companies on structuring their affairs between the German-speaking region and the UAE - from relocation planning and company formation to real estate transactions, asset protection, and intergenerational succession.

If you would like to learn which options may suit your situation, we would be pleased to offer you a confidential initial consultation.