Five UAE regulators license payment and crypto businesses, and which one applies turns on two questions: what the business does, and where the entity sits. Onshore payment activity belongs to the Central Bank of the UAE (CBUAE) and virtual asset activity in Dubai to the Virtual Assets Regulatory Authority (VARA). The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) each have their own regulator, rulebook and courts.
| Where the entity sits | Payments, stored value and payment tokens | Virtual assets |
|---|---|---|
| Dubai mainland and Dubai free zones other than the DIFC | CBUAE | VARA |
| Other emirates, mainland and non-financial free zones | CBUAE | Securities and Commodities Authority (SCA) |
| DIFC | Dubai Financial Services Authority (DFSA) | DFSA |
| ADGM | Financial Services Regulatory Authority (FSRA) | FSRA |
Many groups hold more than one licence: a Dubai exchange that also converts fiat into stablecoins deals with VARA and the CBUAE. The perimeter widened in September 2025: Article 62 of Federal Decree-Law No. 6 of 2025, in force from 16 September 2025, brings any person who offers or facilitates a licensed financial activity through virtual assets, payment tokens, decentralised finance, decentralised applications or protocols within the CBUAE's licensing and oversight, whatever the technology used.
Capital figures are the prescribed minimums; each regulator may require more.
| Licence | What it covers | Minimum capital |
|---|---|---|
| CBUAE retail payment services, Categories I to IV | Nine retail payment services, from payment accounts and acquiring to transfers, payment tokens and open banking | AED 100,000 to AED 3 million by category and volume |
| CBUAE stored value facility | Prepaid balances and wallets redeemable with third parties | AED 15 million paid-up capital |
| CBUAE payment token issuer | Issuing a dirham-backed payment token | AED 15 million, plus 0.5% of tokens in issue |
| CBUAE payment token conversion, custody and transfer | Converting fiat into payment tokens and back; holding and moving payment tokens for customers | AED 1.5 million or AED 3 million by volume |
| VARA virtual asset licence | Eight virtual asset activities in or from Dubai outside the DIFC | AED 100,000 to AED 1.5 million per activity, or a share of fixed overheads if higher |
| DFSA authorisation | Financial services in or from the DIFC, including money services and crypto token services | Set by the prudential category the DFSA assigns |
| ADGM FSRA authorisation | Financial services in or from ADGM, including money services, virtual assets and fiat-referenced tokens | Set by the FSRA prudential rules for the activity |
BCC's pages on the UAE payment and stored value licences, the Dubai VARA virtual asset licence and the DIFC DFSA licence give the full requirements for each regime.
The Retail Payment Services and Card Schemes Regulation (Circular 15/2021) prohibits any person from providing or promoting retail payment services in the UAE without a CBUAE licence. It defines nine services and groups them into four licence categories. Operators of card schemes hold a separate card scheme licence under Article 18.
| Category | Services | Initial capital (at or above / below AED 10 million monthly) |
|---|---|---|
| Category I | All nine services, including payment token services | AED 3,000,000 / AED 1,500,000 |
| Category II | All services except payment token services | AED 2,000,000 / AED 1,000,000 |
| Category III | Payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation and domestic fund transfers | AED 1,000,000 / AED 500,000 |
| Category IV | Payment initiation and payment account information, individually or together | AED 100,000, regardless of volume |
The volume threshold is the monthly average value of payment transactions, calculated on a three-month moving basis under Article 6. A firm that grows through the threshold steps up to the higher figure, so the capital plan follows the business plan's growth curve.
The applicant is a company incorporated in the UAE under the Commercial Companies Law. The chief executive and the alternates must be natural persons ordinarily resident in the UAE, and personal and payment data must be stored and maintained in the UAE (Article 14(22)).
A payment service provider may hold customer funds only while they are in transit. Where settlement takes place within 24 hours, the funds are kept apart from other funds and protected from other creditors. Where settlement takes longer, they sit in a separate escrow account at a bank or are covered by an insurance policy or a guarantee from an unaffiliated insurer or bank (Article 14(3) and (4)). Holding balances for longer makes the business a stored value facility.
Wallets, prepaid cards and other balances that customers can spend with third parties fall under the Stored Value Facilities Regulation (Circular 6/2020). Under Article 7 the licensee maintains paid-up capital of at least AED 15 million, or an approved equivalent in another currency, and total capital funds of at least 5% of the float received from customers. The regulation provides for an unconditional, irrevocable bank guarantee for the full paid-up capital, payable on first demand to the CBUAE.
Under Article 3 the applicant is a company incorporated in the UAE, including the general free zones but excluding the financial free zones. The board, senior management and controlling shareholder are approved by the CBUAE as fit and proper before the licence is granted.
The Payment Token Services Regulation (Circular 2/2024) governs stablecoins used as a means of payment onshore. It licenses three services: payment token issuance, payment token conversion, and payment token custody and transfer.
BCC's stablecoin licensing page compares the UAE position with other issuer regimes.
Any firm carrying on virtual asset activities in or from Dubai, on the mainland or in any free zone other than the DIFC, needs a VARA licence under Dubai Law No. 4 of 2022 and the Virtual Assets and Related Activities Regulations 2023. Each activity is licensed separately. Capital is the higher of a fixed amount and a percentage of the activity's fixed annual overheads, under Part VI of the Company Rulebook; fees are set in Schedule 2 of the Regulations.
| Activity | Paid-up capital (higher of) | Application fee / annual supervision fee |
|---|---|---|
| Advisory services | AED 100,000 | AED 40,000 / AED 80,000 |
| Broker-dealer services | AED 600,000 or 25% of fixed annual overheads; AED 400,000 or 15% with a VARA-licensed custodian | AED 100,000 / AED 200,000 |
| Custody services | AED 600,000 or 25% | AED 100,000 / AED 200,000 |
| Exchange services | AED 1,500,000 or 25%; AED 800,000 or 15% with a VARA-licensed custodian | AED 100,000 / AED 200,000 |
| Lending and borrowing services | AED 500,000 or 25% | AED 100,000 / AED 200,000 |
| Management and investment services | AED 500,000 or 25%; AED 280,000 or 15% with a VARA-licensed custodian | AED 100,000 / AED 200,000 |
| Transfer and settlement services | AED 500,000 or 25% | AED 40,000 / AED 80,000 |
| Category 1 issuance | Set by the VA Issuance Rulebook | AED 100,000 / AED 200,000 |
Each additional activity carries a licence extension fee of 50% of the lower application fee, and VARA may impose additional or varied fees according to a firm's risk profile. Paid-up capital is held at all times in a trust account with a licensed UAE bank naming VARA as beneficiary, or by a surety bond with no end date, and is reconciled monthly. In addition, every licensed firm holds net liquid assets of at least 1.2 times its monthly operating expenses (Company Rulebook, Part VI.C).
VARA's licence applications page describes two stages. First, the firm submits an initial disclosure questionnaire through Dubai Economy and Tourism or a Dubai free zone, with the business plan and owner and management details, and pays typically 50% of the application fee. VARA then issues an approval to incorporate, which allows the firm to incorporate, lease an office and hire staff, but not to trade. Second, the firm files the full licence pack, answers VARA's questions and pays the fee balance and first-year supervision fee before the licence issues.
The licence pack includes the regulatory business plan, projections, governance framework, key personnel files, proof of paid-up capital, a reserve account report, insurance certificates and wind-down plan. Firms comply with four compulsory rulebooks, Company, Compliance and Risk Management, Technology and Information, and Market Conduct, plus the rulebook for each activity.
Any firm carrying on a financial service in or from the DIFC is authorised by the DFSA, which issues an electronic licence listing the permitted services. Money services and services in relation to crypto tokens are both within its perimeter. The DFSA treats crypto tokens as financial instruments, so a crypto business applies for ordinary permissions such as dealing, arranging or custody.
The DFSA updated its crypto token framework with effect from 12 January 2026. Firms now assess, on a reasoned and documented basis, whether each crypto token meets the suitability criteria in GEN Rule 3A.2.1, and the DFSA no longer publishes a list of recognised tokens. Fiat crypto tokens are outside that suitability assessment.
The DFSA states that the application fee varies with the financial services applied for and ranges from US$15,000 to US$70,000; its services portal lists service fees from US$2,000 to US$140,000 by nature and scale, with the detail in the Fees Module of the DFSA Rulebook. Every authorised firm appoints a senior executive officer, finance officer, compliance officer and money laundering reporting officer, each an individual the DFSA approves (GEN 7.5.1). The authorisation process runs in five stages: enquire, apply, evaluate, fulfil the conditions of the in-principle letter, and approve.
ADGM in Abu Dhabi is the alternative financial free zone. Its Financial Services Regulatory Authority licenses money services, virtual asset activities and activities involving fiat-referenced tokens under its own Financial Services and Markets Regulations and rulebooks, with fees set in its FEES Rulebook. The FSRA finalised an expanded fiat-referenced token framework on 31 October 2025, effective 1 January 2026, widening the regulated activities that may be carried on with fiat-referenced tokens the FSRA accepts.
Neither free zone licence covers onshore customers in its own right, and the CBUAE's stored value and dirham token licences cannot be held by a financial free zone entity.
Every regime licenses a real operating presence: a local entity, resident leadership, approved controllers and an AML framework built for the UAE.
Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing, issued on 30 September 2025, replaced Federal Decree-Law No. 20 of 2018. It expressly covers virtual asset service providers, which must be licensed or registered, carry out customer due diligence, apply targeted financial sanctions and report suspicious transactions. Each regulator applies its own AML rules on top. Regulators and banks read the risk assessment, transaction monitoring and sanctions screening first, so these should describe the firm's actual corridors and customers.
Unlicensed activity carries real consequences. The SCA and VARA announced a unified register of licensed virtual asset service providers in July 2023, and the SCA warned that providers operating without the required licence face a warning, a fine of up to AED 10 million or referral to the Public Prosecution.
The table records what each regulator states.
| Regulator and licence | Published fees | Published timeline |
|---|---|---|
| CBUAE retail payment services | No fee schedule in the regulation | No decision period for payment service providers; one-year transition for existing providers when the regulation came into force |
| CBUAE card scheme licence | No fee schedule in the regulation | Decision within 90 calendar days of the full set of documents (Article 18(3)) |
| CBUAE stored value and payment tokens | No fee schedule in the regulations | No decision period; an incomplete application may be suspended, and a suspension of six months or more requires a new application |
| VARA | AED 40,000 or AED 100,000 application fee per activity; AED 80,000 or AED 200,000 annual supervision fee per activity | No published timeline; two stages, approval to incorporate then the full licence |
| DFSA | US$15,000 to US$70,000 application fee; annual fees in the Fees Module | Five stages; the DFSA portal lists stage durations as to be confirmed |
| ADGM FSRA | Set in the FEES Rulebook by activity | No published timeline |
For planning, BCC works to six to eight months after submission for a CBUAE licence, six to nine months across both VARA stages, and four to six months after submission for a DFSA authorisation, with eight to twelve weeks of preparation before filing. A complete submission, with capital in place and resident individuals named, sets the pace.
Budget beyond regulator fees covers capital, any bank guarantee, office leases and visas, insurance and external audit.
Several UAE licences build the bank into the licence itself, so banking is planned alongside the application.
UAE banks onboard regulated firms against the evidence the regulator reviews: ownership, source of funds, resident management and the AML framework. BCC arranges these accounts alongside the licence; see banking and payment processing.
The main continuing obligations are consistent across regimes.
Rules continue to develop: VARA's current Company Rulebook has applied since 19 June 2025, and the DFSA and FSRA both revised their token frameworks for 2026.
Five questions settle most structures.
Groups building a Gulf hub alongside Europe or North America typically pair a UAE licence with an EU, UK or US authorisation. Buckingham Capital Consulting obtains each of the UAE licences in this guide and arranges the banking and technology around them, so the licence, the accounts and the platform are ready together.
A CBUAE licence covers payment services, stored value and payment tokens used as a means of payment onshore. A VARA licence covers virtual asset activities such as exchange, broker-dealer and custody in or from Dubai outside the DIFC. A crypto exchange that handles dirham tokens or foreign stablecoins may deal with both.
Under the Retail Payment Services and Card Schemes Regulation, AED 3 million for Category I, AED 2 million for Category II and AED 1 million for Category III, halved where monthly payment transactions are below AED 10 million, and AED 100,000 for Category IV. A stored value facility needs AED 15 million.
Under Schedule 2 of the Virtual Assets and Related Activities Regulations 2023, the application fee is AED 100,000 for most activities and AED 40,000 for advisory and transfer and settlement, with annual supervision fees of AED 200,000 or AED 80,000 per activity. About half the application fee is paid at the first stage.
Yes. A dirham payment token is issued by a CBUAE-licensed issuer incorporated onshore, with AED 15 million of capital and full reserves. Foreign-currency stablecoins are registered with the CBUAE and may be used as payment only to buy virtual assets. The DFSA and FSRA run their own fiat token frameworks in the free zones.
The CBUAE sets no decision period for payment and stored value licences, and VARA publishes no timeline. BCC plans for six to eight months after submission for the CBUAE, six to nine months across both VARA stages and four to six months for the DFSA.
For the CBUAE, the chief executive and alternates are ordinarily resident in the UAE. For VARA, two responsible individuals and the compliance officer are full-time employees who are UAE residents or UAE passport holders.
No. Each free zone licence covers financial services in or from that zone. Serving the onshore market draws in the CBUAE for payments and VARA or the SCA for virtual assets.
Buckingham Capital Consulting obtains payment, stored value, payment token and virtual asset licences in the UAE, including CBUAE, VARA and DFSA authorisations, and arranges the banking and technology each licence depends on.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.