Home › Crypto Regulation › United Arab Emirates

Quick answer — United Arab Emirates, 2026

• Legal: Legal to own and trade, not legal tender
• Tax: No personal income or capital gains tax on individuals
• Buying: Via exchanges licensed by VARA, CMA or free-zone regulators

The United Arab Emirates is one of the most actively regulated crypto jurisdictions in the world. Buying, selling, holding and building with virtual assets is legal, but the sector sits inside a detailed, multi-layered licensing system rather than a free-for-all. Federal authorities set baseline policy and run a national regime for onshore activity, while the Emirate of Dubai and the two financial free zones (ADGM in Abu Dhabi and the DIFC in Dubai) operate their own separate rulebooks. Which regulator applies to you depends on where you are based and what you do.

This page is a general overview of how Bitcoin and other virtual assets are treated in the UAE as of 2026, covering legal status, the main regulators, key laws, exchange and VASP licensing, taxation, AML and KYC rules, buying and using crypto in practice, mining, recent developments, consumer risks, and how to verify the rules with official sources. This is general information as of 2026 and is not legal, tax or financial advice; UAE crypto rules change frequently and differ by emirate and free zone, so always confirm the current position with the named official regulator or a qualified UAE adviser before acting. For wider context, see our guide to crypto regulation and our country regulation hub.

Next: How crypto is taxed · Sending crypto safely
Nearby: Syria · Turkey · Yemen · Bahrain
All countries: browse the 205 country guides

On this page: Legal status · Who regulates it · Taxes · How to buy · Mining

Yes. Owning, trading and using Bitcoin and other virtual assets is legal in the UAE, and the country has built dedicated regulatory frameworks rather than banning the sector. However, cryptocurrency is not legal tender. The UAE dirham (AED) remains the only official currency, so businesses are not obliged to accept crypto as payment, and crypto is treated as a virtual asset rather than money.

The practical position is that activity is legal but conditional. Individuals can generally buy, hold and sell virtual assets, but any business that provides crypto services to the public, such as exchanges, brokers, custodians and certain payment providers, must hold a licence from the relevant authority. Operating an unlicensed virtual asset business, or marketing one to UAE residents without authorisation, can carry significant penalties. The UAE also enforces strict anti-money-laundering (AML) and counter-terrorism-financing standards across the sector.

Regulation is shared across several authorities, and identifying the right one is the single most important step before doing business here:

• Capital Market Authority (CMA) is the federal regulator for virtual assets in onshore (mainland) UAE outside Dubai and outside the two financial free zones. The CMA is the former Securities and Commodities Authority (SCA), renamed and reconstituted with effect from 1 January 2026 under Federal Decree-Laws No. 32 and No. 33 of 2025. Its official website is still hosted at sca.gov.ae.
• Virtual Assets Regulatory Authority (VARA) is the dedicated regulator for virtual assets in the Emirate of Dubai, including Dubai's commercial free zones but excluding the DIFC. VARA runs a detailed rulebook covering exchanges, broker-dealers, custody, lending, advisory and issuance. See vara.ae.
• Central Bank of the UAE (CBUAE) oversees the payments system, stored-value facilities and payment tokens (including stablecoins used for payments). Its Payment Token Services Regulation (PTSR), issued on 7 June 2024 and in force from 6 July 2024, is the dedicated stablecoin framework: dirham-pegged payment tokens require a full CBUAE Issuer Licence, foreign payment tokens require registration, and algorithmic and privacy-focused tokens are not permitted for payments. Its remit over virtual-asset payment services was further supported by Federal Decree-Law No. 6 of 2025. See centralbank.ae.
• Abu Dhabi Global Market (ADGM) / FSRA is a financial free zone in Abu Dhabi with its own established digital-asset regime under the Financial Services Regulatory Authority.
• Dubai International Financial Centre (DIFC) / DFSA is a separate financial free zone with its own crypto-token regime under the Dubai Financial Services Authority.

The CMA framework operates alongside the others and expressly excludes the two financial free zones; it does not override VARA in Dubai. A firm must work out which regulator governs its location and activity, then obtain the matching licence.

Several instruments make up the current framework, and the most significant ones are recent:

• Federal Decree-Laws No. 32 and No. 33 of 2025 reconstituted the SCA as the Capital Market Authority from 1 January 2026 and expanded the definition of regulated financial products to include virtual assets, bringing crypto-asset service providers within the federal capital-markets perimeter.
• CMA Decision No. 4/R.M/2026 introduced a comprehensive new framework for virtual-asset activities, replacing the previous SCA virtual-asset regime in full. It expands the number of regulated activities (for example dealing, custody, arranging deals and advice) and sets higher capital, governance and compliance thresholds, with transitional arrangements for existing firms.
• Federal Decree-Law No. 6 of 2025 (on the Central Bank, regulation of financial institutions and activities, and insurance) brought payment services using virtual assets more explicitly under CBUAE supervision.
• VARA's Virtual Assets and Related Activities Regulations 2023 and its rulebooks govern Dubai. VARA activated its Issuance Rulebook for fiat-referenced and asset-referenced tokens in mid-2025, moving from sandbox programmes to full commercial operations, and has issued updated versions of its rulebooks.
• Federal Law No. 10 of 2025 on combating money laundering, terrorism financing and the financing of proliferation, which took effect on 14 October 2025 and replaced the earlier Federal Decree-Law No. 20 of 2018.

Because these frameworks are updated often, treat any specific rule as a starting point and confirm the latest version directly with the relevant regulator.

Any virtual-asset service provider (VASP) serving or targeting the UAE must be licensed. Under UAE AML law it is prohibited for natural or legal persons to act as a VASP without authorisation from the competent regulator. The right licence depends on location:

• VASPs operating in or targeting Dubai (outside the DIFC) apply to VARA, typically through a two-stage process that moves from an initial approval to a full operating licence, with licensed activities such as exchange, broker-dealer, custody, lending and advisory services.
• VASPs in onshore UAE outside Dubai and outside the free zones apply to the CMA under its activity-based licensing model.
• Firms in ADGM are licensed by the FSRA, and firms in the DIFC by the DFSA, each under its own framework.

Common obligations across all regimes include fit-and-proper assessments, minimum capital, robust governance, custody safeguards, technology and cybersecurity controls, AML/KYC programmes, and marketing rules. Under the cooperation arrangement between the federal regulator and VARA, a Dubai-licensed firm can also be recognised at federal level so it can operate more widely in the UAE. Always check a provider's current licence on the regulator's public register before depositing funds; VARA, for example, maintains a public register at vara.ae.

The UAE is widely seen as tax-light for individual crypto holders, but the detail matters and differs for businesses. The UAE does not levy a personal income tax or a capital gains tax on individuals, so personal gains from buying, holding and selling crypto in a private capacity are generally not taxed at the individual level. This is a major reason the UAE attracts crypto investors.

For businesses, federal corporate tax applies at 0% on taxable income up to AED 375,000 and 9% above that, under Federal Decree-Law No. 47 of 2022, effective for financial years starting on or after 1 June 2023. A separate Domestic Minimum Top-up Tax sets a 15% minimum effective rate for UAE members of multinational groups with global revenues of EUR 750 million or more, for financial years starting on or after 1 January 2025. Individuals are only drawn into corporate tax where turnover from a business or business activity exceeds AED 1,000,000 in a Gregorian calendar year; wages and personal investment income are excluded from that calculation, under Cabinet Decision No. 49 of 2023. On indirect tax, Cabinet Decision No. 100 of 2024 amended the VAT Executive Regulations to exempt the transfer and conversion of virtual assets, and the safeguarding and management of virtual assets, from value-added tax (VAT). The change took effect on 15 November 2024, and the exemption for transfers and conversions applies retroactively from 1 January 2018, which may require some businesses to review their historic VAT position. Note that crypto mining is treated differently from trading for VAT purposes, so mining businesses should not assume the same exemption applies.

The UAE has also signed the OECD's multilateral agreement to adopt the Crypto-Asset Reporting Framework (CARF), with reporting expected to go live in 2027 and the first automatic exchanges of information in 2028. CARF increases transparency but does not in itself create a new personal tax. The headline figures are a 0% and 9% corporate tax split at AED 375,000 of taxable income, a 5% standard VAT rate, and no personal income tax at federal or Emirate level. What varies is whether your particular activity counts as a business at all, and whether a free zone or top-up tax rule applies to your structure. Confirm your position with the Federal Tax Authority or a qualified UAE adviser. See also our crypto tax guide. This is general information, not tax advice.

AML and counter-terrorism-financing compliance is a foundational requirement for crypto in the UAE, not an optional extra. The governing federal law is now Federal Law No. 10 of 2025, in effect since 14 October 2025, which replaced Federal Decree-Law No. 20 of 2018 and is reinforced by implementing regulations.

Licensed VASPs must run full customer due diligence, verify identity and (where relevant) source of funds, monitor and report suspicious transactions, keep records for set periods, appoint qualified compliance and money-laundering reporting officers, and train staff. The UAE applies the FATF Travel Rule, requiring originator and beneficiary information to accompany qualifying virtual-asset transfers, consistent with FATF Recommendation 15. The CBUAE has issued guidance for licensed financial institutions on the risks of dealing with virtual assets and VASPs. For users this means you should expect identity verification at sign-up, possible proof-of-address and source-of-funds requests, and transaction screening on any regulated platform.

Residents can buy crypto through licensed exchanges and brokers, and several major global and regional platforms have obtained UAE licences via VARA, ADGM, the DIFC or the CMA. The general rule is to favour platforms that clearly state which UAE regulator licenses them, and to verify that on the regulator's register. Expect full KYC at sign-up.

The dirham is freely convertible and the UAE does not run restrictive foreign-exchange capital controls, so funding and withdrawing from exchanges is relatively straightforward compared with many emerging markets. Even so, banks apply their own compliance policies, and large or unusual crypto-related transfers can trigger additional checks, so use an account in your own name and keep records. A practical buying path is: choose a regulated platform; create and verify your account; deposit dirhams; place a modest first order; enable two-factor authentication and consider qualified custody or reputable self-custody for longer-term holdings; and keep transaction confirmations. Crypto ATMs and conversion kiosks exist in parts of the UAE, especially Dubai, but operators are regulated VASPs subject to KYC and monitoring; their fees and spreads are usually higher than a licensed online exchange, and unlicensed kiosks should be avoided. Promotions of unlicensed virtual-asset products to the public are restricted, so be sceptical of peer-to-peer offers and guaranteed-return schemes.

Bitcoin mining is not prohibited in the UAE, and relatively low industrial energy costs in some areas, combined with heavy investment in data-centre and energy infrastructure, have attracted large-scale and institutional mining interest. Mining is generally treated as a commercial activity rather than a hobby, which means operators should expect to deal with business licensing, metered and legitimate energy supply arrangements, and tax treatment.

Two points deserve emphasis. First, mining is taxed differently from personal investing: the Federal Tax Authority set the position out in VAT Public Clarification VATP039, issued on 13 January 2025. Mining on your own account is outside the scope of VAT, which also means input VAT on rigs, electricity and maintenance cannot be recovered, because there is no taxable supply. Mining performed on behalf of another person is a taxable supply of services, taxed at the 5% standard rate, with input tax recovery available against it and possible zero-rating where the recipient is outside the UAE and the conditions are met, and mining profits can fall within the corporate tax regime, so professional advice is important before scaling up. Second, the UAE has national clean-energy and net-zero ambitions, and the policy direction favours efficient operations and renewable or surplus power. Miners should plan around energy-efficiency expectations and stay current with both federal and emirate-level rules, which continue to evolve.

The pace of change has been rapid. The headline development is the reconstitution of the federal securities regulator: the SCA became the Capital Market Authority (CMA) on 1 January 2026 under Federal Decree-Laws No. 32 and No. 33 of 2025, and in 2026 the CMA issued Decision No. 4/R.M/2026, a comprehensive virtual-asset framework that replaces the old SCA regime, broadens the list of licensed activities and raises capital and governance standards, with transitional arrangements for existing firms.

Other notable moves include Federal Decree-Law No. 6 of 2025 expanding the Central Bank's oversight of virtual-asset payment services; the new AML law (Federal Law No. 10 of 2025) taking effect on 14 October 2025; VARA activating its stablecoin and token Issuance Rulebook in mid-2025 and updating its rulebooks; ADGM's FSRA refining its digital-asset framework (including notification-based listing criteria, fiat-referenced-token rules effective from 1 January 2026, and a consultation on staking); the DFSA consulting on enhancements to its crypto-token regime; and the UAE signing the OECD CARF agreement in 2025 ahead of a 2027 go-live. Treat federal references as evolving and verify the current rulebook before relying on it.

On the market side, activity has grown alongside the rules, with 52 entries on VARA's public register of licensed VASPs when checked in August 2026, alongside separate licensees in ADGM, the DIFC and under the Central Bank. VARA introduced a framework for exchange-traded crypto derivatives through Version 2.1 of its Exchange Services Rulebook, adding suitability checks and leverage, margin and segregation controls for leveraged products. On stablecoins, the CBUAE approved a dirham-backed stablecoin (DDSC) for launch on the ADI Chain, and RAKBank received in-principle approval to issue an AED-backed stablecoin, both under the Payment Token Services Regulation. In May 2026, Crypto.com became the first virtual-asset service provider to receive a full Stored Value Facilities licence from the CBUAE, tied to crypto payments for Dubai government services, with settlement in dirhams or approved dirham-backed stablecoins.

The UAE's frameworks emphasise consumer protection through licensing conditions, custody safeguards, disclosure and marketing rules, audits and ongoing supervision, and regulators do impose penalties and publish them. VARA fined 19 unlicensed firms between AED 100,000 and AED 600,000 on 7 October 2025, and in June 2026 issued notices of fines against MX Global LTD (MEXC), licensed VASP CoinMENA FZE and Peken Global Limited (KuCoin), followed by Shelbit General Trading L.L.C on 24 July 2026. Under Federal Decree-Law No. 6 of 2025 the Central Bank can fine licensed financial institutions up to AED 1,000,000,000. That structure reduces some risks but does not remove the risks inherent in the assets themselves.

Crypto prices are highly volatile, markets can move sharply, and past performance does not predict future results; we make no price predictions and nothing here is a recommendation. For individuals, the biggest day-to-day risks are scams, custody mistakes (lost keys or recovery phrases), and using unlicensed services. Sensible precautions include using only regulated and verified platforms, enabling two-factor authentication, never sharing private keys or recovery phrases, diversifying rather than concentrating, investing only what you can afford to lose, and being cautious of unlicensed peer-to-peer deals and guaranteed-return schemes. If you are unsure, speak to a licensed UAE financial adviser. This section is general information, not financial advice.

Because UAE crypto rules change frequently and vary by emirate and free zone, always confirm the current position with the official regulator rather than relying on summaries. Useful starting points include:

• Capital Market Authority (CMA, formerly SCA) for the federal onshore virtual-asset framework.
• Virtual Assets Regulatory Authority (VARA) for Dubai, including its rulebooks and public register.
• Central Bank of the UAE (CBUAE) for payments, stablecoins and AML guidance.
• UAE Government portal (u.ae) for a plain-language overview of virtual-asset regulation.
• UAE Ministry of Finance for CARF and tax-transparency commitments, and the Federal Tax Authority for VAT and corporate tax.

For free-zone matters, consult ADGM and the DIFC directly. To check whether a specific platform is authorised, look it up on the relevant regulator's public register before depositing funds. This page is general information as of 2026, not legal advice, and you should verify the rules with the named official regulator.

Facts reviewed: 3 August 2026. Page updated: 3 August 2026.

More countries in the region

• Crypto regulation in Qatar
• Crypto regulation in Saudi Arabia
• Crypto regulation in Iran
• Crypto regulation in Iraq
• Browse all 205 country guides

Practical guides

• How crypto is taxed
• Setting up a hardware wallet
• Why exchange custody is risky