Crypto regulation in the UAE: VARA licences explained and how to check one

Is crypto legal in the UAE?

Yes. Crypto is legal in the UAE when you buy, sell or hold it through a provider that is licensed for the service it gives you. The duty to hold a licence sits with the firm, not with the customer. VARA, the Dubai regulator set up in March 2022, says a firm must apply for and receive a licence before it carries out virtual asset activities in Dubai, and that no virtual asset activity is exempt from supervision.

Two points of nuance. Legal does not mean legal tender: the BitOasis Risk Disclosure Statement says virtual assets have no legal tender status in the UAE. And the rules license activities, not individual coins, so the answer is the same for Bitcoin, USDT or any other asset. What matters is whether the firm that sells it to you is licensed for that activity in the place where it operates. Paying for goods with stablecoins is a separate question, covered by the Central Bank rules described below.

The rest of this guide explains who issues the licences, what a VARA licence covers and how to check one yourself. For other topics, see all guides in BitOasis Learn. If you want the practical steps instead, read how to buy Bitcoin in the UAE step by step.

Who regulates crypto in the UAE

Five authorities share the work, and the one that applies depends on where a firm is established and what kind of token it handles. Dubai has VARA. Two financial centres, ADGM in Abu Dhabi and the DIFC in Dubai, have regulators of their own. Federal rules come from the Capital Market Authority and the Central Bank of the UAE.

Dubai: VARA

VARA regulates virtual assets everywhere in Dubai except the DIFC. Its About page says it was established in March 2022 under Dubai Law No. 4 of 2022 and is in charge of regulating, supervising and overseeing virtual assets and virtual asset activities in all zones of the emirate, including special development zones and free zones. A firm with its address in a Dubai free zone such as Dubai Silicon Oasis, where BitOasis Technologies FZE is based, therefore answers to VARA.

Abu Dhabi Global Market: FSRA

In Abu Dhabi Global Market (ADGM) the regulator is the Financial Services Regulatory Authority (FSRA). ADGM is a financial centre in Abu Dhabi with its own legal framework. Its digital assets page lists four groups under that framework: virtual assets, fiat-referenced tokens, digital securities, and derivatives and funds of digital assets. A firm that wants to carry on these activities in ADGM applies to the FSRA for a Financial Services Permission. That permission is a different document from a VARA licence and is not listed on the VARA register.

Dubai International Financial Centre: DFSA

The DIFC is the one part of Dubai that VARA does not cover. VARA's scope statement excludes it, and financial services there are regulated by the Dubai Financial Services Authority (DFSA), which has a separate regime for crypto tokens. If a platform says it is based in the DIFC, a VARA reference is the wrong thing to ask for. Ask which DFSA licence it holds and look the firm up on the DFSA's own register.

Federal level: the Capital Market Authority and the Central Bank

Two federal bodies complete the picture. The federal securities regulator now presents itself as the Capital Market Authority (CMA): the former sca.gov.ae address redirects to uaecma.gov.ae, and each of the 57 licensed-firm entries on the VARA register carried a CMA Registration Number next to its VARA reference when we read the list. The CMA home page also lists an announcement dated 13 April 2026 that it has issued a Virtual Assets Framework with eight regulated activities.

The Central Bank of the UAE regulates payment tokens, meaning tokens designed to hold a stable value against a currency, which most people call stablecoins. Its Payment Token Services Regulation has been in force since 31 August 2024. It covers issuing, converting, holding and transferring payment tokens, and it limits when foreign payment tokens may be accepted as a means of payment.

What a VARA licence is

A VARA licence is a Virtual Asset Service Provider (VASP) Licence that names the specific activities a firm may carry out in or from Dubai. It is not a general permission to do anything with crypto. A firm may offer only the activities listed on its licence, to the investor classes named in its licence condition.

Five terms recur in the rest of this guide.

Virtual asset

The regulators' term for what most people call crypto, such as Bitcoin or USDT. The Central Bank regulation defines it as a digital representation of value, or of a right, that can be transferred and stored electronically using distributed ledger technology.

VASP

Virtual Asset Service Provider: a firm that provides one or more of the licensed virtual asset activities.

Licensed activity

One of the eight services VARA licenses, such as Broker-Dealer Services. The register lists each activity on a licence by name.

In-Principle Approval (IPA)

A conditional step on the way to a licence. An IPA holder may not start operations or serve clients.

Licence condition

The line on a register entry that says which investor classes the firm may serve: institutional, qualified or retail.

The eight licensed activities

VARA licenses eight activities, and Broker-Dealer Services is the one most firms hold: 42 of the 57 licensed firms on the register when we counted them in October 2026. The table lists all eight from VARA's Licensed Activities page, with our count for each.

Activities from the VARA Licensed Activities page. Counts are ours, from the 57 entries on the Licensed VASPs tab of the VARA Public Register. A firm with several activities is counted once for each. The Custody and Exchange figures include entries that carry a qualifier, such as custodial staking or derivatives trading.

Three rules on the same VARA page explain much of what you see on the register. A firm can hold several activities under one licence: 19 of the 57 did. Custody is the exception, because a custodian must be a separate legal entity with a licence of its own. That is why a platform and the custodian that holds its clients' assets often have different names. And a licensed firm may not trade for its own account under the licence: VARA requires a separate company for that. The guide to crypto wallets and custody in the UAE explains what custody means for you.

Licence or in-principle approval

A licence and an In-Principle Approval are different things, and only a licence lets a firm serve you. The VARA Public Register has two tabs, Licensed VASPs and In-Principle Approval. VARA describes an IPA as a conditional step that lets an applicant complete its final requirements. Until the full licence is issued, an IPA holder may not start operations, carry out virtual asset activities or service clients. If a platform advertises VARA approval and you find it only on the IPA tab, it should not be taking customers yet.

Broker-dealer or exchange: why the activity matters

The licensed activity tells you what a firm does with your order. Broker-Dealer Services and Exchange Services are separate entries in VARA's list: 42 of the 57 licensed firms held the first and 16 held the second, a few of them both. To a customer the two can look the same, because either way you open an app that people call a crypto exchange, see a price and place an order.

The difference is behind the screen. In general terms, an exchange runs the marketplace: it keeps an order book and matches buyers with sellers. A broker-dealer stands between you and a market: it takes your order and arranges or executes it with another party. So the useful questions differ. For an exchange, ask how its order book works and who trades on it. For a broker-dealer, ask where your order is sent, who the liquidity providers are and how the price you see is formed. The legal definitions are in Schedule 1 of VARA's Virtual Assets and Related Activities Regulations 2023; the summary here is ours.

The Broker-Dealer Services Rulebook, whose current version took effect on 19 June 2025, shows what the regulator looks at for this activity. Its four parts cover policies, procedures and public disclosures; trading and execution rules, including best execution and dealing as principal; margin trading; and licensed distribution services.

BitOasis is an example of the second model. BitOasis, a VARA-licensed broker-dealer (VASP Licence reference VL/2024/11/001), says in its help centre that it “operates as a brokerage”: orders are routed to liquidity partners, and it does not match buyers and sellers on a matching engine of its own or keep its own order book. Its Terms of Service name the liquidity providers as Bitfinex, Aquanow and BitGo MENA FZE and say that 100% of client spot orders are routed to them. The security page covers BitOasis custody and order routing in more detail.

How to check a VARA licence on the public register

You can check a VARA licence in three steps on the regulator's own website, and the register needs no account or login. Use vara.ae and nothing else: a logo, a certificate image or a link supplied by the platform proves nothing. We read the live register list and the BitOasis entry for this guide, and the steps describe those two screens.

1. Step 1: open the register on vara.ae

   Type vara.ae into the address bar yourself, then choose Public Register under Licenses and Register. Do not follow a link from an advertisement, a chat message or the platform you are checking. The page opens on a list with two tabs, Licensed VASPs and In-Principle Approval, and a filter by activity.

2. Step 2: find the firm and open its entry

   Stay on the Licensed VASPs tab and look for the legal name of the company, not the name of the app. The legal name is usually in the footer of the platform's website and in its terms. Each row shows the VASP name, licence type, reference, licensed activities, issue date, status and CMA Registration Number. Each firm also has an entry page of its own, which you open from its row.

3. Step 3: compare five fields

   Compare the entry with what the platform says about itself.

   • VASP name. It is the same legal entity that appears in the platform's terms and footer.
   • Reference. It matches character for character. Most references use a two-digit year (VL/YY/MM/NNN) and a few use four digits (VL/YYYY/MM/NNN), so copy it exactly as printed.
   • Licensed activities. The service you plan to use is on the list.
   • Status. It says Active.
   • Website URL. The address on the entry is the site you are actually on.

   Then read two more lines: the licence condition, which says whether the firm may serve retail investors, and the date the licence was issued.

Worked example: the BitOasis entry

Here is the same check applied to BitOasis, using the entry as the register showed it on 11 October 2026.

Read against the five fields, the entry says this. The legal entity is BitOasis Technologies FZE, the name in the footer of this site. The reference is VL/2024/11/001, in the four-digit-year format. The one licensed activity is Broker-Dealer Services, so Exchange Services and Custody Services are not on this licence. The status is Active, and the website is on the bitoasis.net domain. The condition line permits retail investors.

One date needs care. The register gives 29 November 2024 as the issue date, while the BitOasis About page gives 9 December 2024 for the full licence. The same facts, with what the licence does not cover, are in the BitOasis licence and regulatory disclosures, and the About page sets out the entity and owners behind BitOasis.

What a licence does not protect you from

A licence tells you who is accountable. It does not protect the value of what you buy. Four risks stay with you on any licensed platform:

• Price falls. The value of a virtual asset can drop sharply and quickly.
• Total loss. You can lose everything you put in.
• Irreversible transfers. VARA's marketing rules note that some transfers may be irreversible. An asset sent to a wrong address or on a wrong network may not come back.
• Issuer failure. A token can fail because of its issuer, whatever licence the platform holds. USDT, for example, is issued by Tether, not by the platform you buy it on.

No financial protection scheme stands behind a virtual asset account. VARA requires marketing of a virtual asset to say so in these words:

Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The owner and/or investor in the Virtual Asset can lose all the money or other value they invest, and does not benefit from any form of financial protection.

VARA, Regulations on the Marketing of Virtual Assets and Related Activities 2024, Part I.C.3(b) and (c)

The BitOasis full risk disclosure makes the same point about its own service: users can lose their entire capital.

Marketing rules you can use as a red-flag test

VARA's marketing rules double as a checklist for judging an advertisement. The Marketing Regulations of 2024 apply to any marketing of virtual assets or virtual asset activities in or targeting the UAE, whether or not the advertiser holds a VARA licence. All of it must be “fair, clear and not misleading” and identifiable as marketing. Ask five questions:

1. Does it state or imply that the investment is safe or low risk? The rules bar that.
2. Does it say that returns are assured, or treat past performance as a sign of future results? Barred as well.
3. Does it press you to act quickly or play on a fear of missing out? Also barred.
4. Does it tell you to buy a named asset? Marketing of a virtual asset must not include a call to buy.
5. Is the loss warning missing or hard to find? Marketing of a virtual asset must carry the prominent disclaimer quoted above.

One failed test does not prove fraud. It does tell you the advertiser is not following rules that VARA can enforce with fines, and that is a reason to check the register before you do anything else.

What regulation changes for you as a user

Regulation shows up in four places you will notice: identity checks, reporting, your client category and the way complaints are handled.

• Identity and source of funds. VARA's framework requires licensed firms to apply anti-money-laundering standards, so sign-up starts with checks. On BitOasis that means a government-issued residency ID or passport, a mobile number, and tiered identity verification with a selfie and a source-of-funds declaration.
• Reporting. BitOasis says it has been registered since September 2021 as a Reporting Entity on goAML, the UAE Financial Intelligence Unit's platform for reporting suspicious transactions. That is a reporting registration, not a licence.
• Client classes. The licence condition names institutional, qualified and retail investors. The VARA FAQ says a firm can serve retail customers once licensed, and that some firms may be approved for qualified and institutional clients only. The BitOasis Terms of Service use three categories: Retail, Qualified Retail and Institutional Investor.
• Complaints. BitOasis publishes a timeline: a first attempt to resolve within 3 business days, resolution within 3 weeks (21 days), a final response from the Compliance Officer within 6 weeks (42 days), and never later than 50 days. A complaint that is still unresolved can be referred to VARA. The steps are in the BitOasis complaints timeline.

Frequently asked questions

Shorter answers about BitOasis itself are among the regulation questions in the FAQ.

Sources

Primary sources for this guide. Each was read on 11 October 2026 and opened again when this page was built.

1. VARA, About VARA. Read 11 October 2026.
2. VARA, Licensed Activities. Read 11 October 2026.
3. VARA, Public Register. Read 11 October 2026.
4. VARA, Public Register entry for BitOasis Technologies FZE. Read 11 October 2026.
5. VARA Rulebooks, Regulations on the Marketing of Virtual Assets and Related Activities 2024. Read 11 October 2026.
6. VARA Rulebooks, Broker-Dealer Services Rulebook. Read 11 October 2026.
7. Abu Dhabi Global Market, Digital Assets. Read 11 October 2026.
8. Capital Market Authority, home page. Read 11 October 2026.

Statements about BitOasis come from its own published documents: the Terms of Service, the Risk Disclosure Statement, the Complaints Handling Procedure, the About page and the help centre. The Central Bank regulation, the VARA FAQ and the VARA licence applications page are linked where they are used.