Key points
- Crypto is regulated in Dubai, not banned. VARA was established in March 2022 under Law No. 4 of 2022 and covers the whole emirate except the DIFC.
- The licence belongs to the firm. VARA licenses eight activities, and a customer who buys through a licensed firm needs no licence.
- A licence reference looks like VL/25/04/001. Anyone can look one up on VARA's public register.
- An In-Principle Approval is not a licence. VARA bars its holders from servicing clients until the full licence is granted.
- Payment tokens have a federal rulebook as well: the Central Bank's Payment Token Services Regulation has been in force since 31 August 2024.
- A licence does not protect the value of what you hold. No financial protection scheme covers virtual assets.
The short answer
Cryptocurrency is legal in Dubai, and it is regulated. Law No. 4 of 2022 created VARA, which describes itself as the entity in charge of regulating, supervising and overseeing virtual assets in every zone of the emirate, free zones included, except the Dubai International Financial Centre (DIFC). The duty to hold a licence sits on the firm: VARA requires a provider to obtain a licence before it carries out a virtual asset activity in Dubai. A resident who buys Bitcoin or USDT through such a firm is its client and needs no licence. This guide is part of MKX Learn: guides to crypto in the UAE.
Who regulates crypto in the UAE
Five authorities share the map, and the one that matters to you depends on where the firm is established and what it does. VARA covers most of Dubai. Two financial free zones, the DIFC and Abu Dhabi Global Market (ADGM), have their own regulators. Two federal bodies, the Capital Market Authority and the Central Bank, set rules that reach across the emirates.
| Regulator | Where it applies | What it covers | Where to check |
|---|---|---|---|
| VARA | Dubai mainland and free zones, except the DIFC | Virtual assets and eight licensed activities | VARA public register |
| DFSA | Dubai International Financial Centre | Financial services that involve Crypto Tokens, the term its rulebook uses | DFSA Rulebook, GEN 3A, and the DFSA public register |
| FSRA | Abu Dhabi Global Market | Virtual asset activities, under a Financial Services Permission | FSRA public register |
| Capital Market Authority | Federal level | A Virtual Assets Framework issued in April 2026, with eight regulated activities | Capital Market Authority website |
| Central Bank of the UAE | Federal level | Payment Token Services: issuance, conversion, custody and transfer | Payment Token Services Regulation |
VARA is the Dubai Virtual Assets Regulatory Authority, the DFSA is the Dubai Financial Services Authority and the FSRA is the Financial Services Regulatory Authority of ADGM.
VARA: Dubai outside the DIFC
VARA is the virtual asset regulator for Dubai's mainland and free zones. By its own account it was established in March 2022, once Law No. 4 of 2022 took effect, with a remit that covers every zone of the Emirate of Dubai, free zones included, and stops at the DIFC. It issued its Virtual Assets and Related Activities Regulations in 2023 and publishes a register of the firms it has licensed. If a firm serves you from Dubai and is not in the DIFC, VARA is the name to look for.
The DIFC and ADGM financial free zones
Two financial free zones apply their own rules, and a VARA licence reaches into neither. In the DIFC, the DFSA regulates what its rulebook calls Crypto Tokens: rule GEN 3A.2.1 bars a financial service relating to one, carried on in or from the DIFC, unless the rule's suitability conditions are met. In ADGM, firms that wish to carry on virtual asset activities must apply for a Financial Services Permission from the FSRA. A firm in either zone should name its regulator, and you check that regulator's register instead of VARA's.
The federal Capital Market Authority
A federal framework now sits beside the emirate-level regimes. The Capital Market Authority (CMA) announced its Virtual Assets Framework on 13 April 2026: five core modules, and an increase in the activities it regulates from three to eight. Law firm Clyde & Co, a secondary source, describes the framework as operating in parallel with VARA's Dubai regime, with VARA continuing to regulate activity within Dubai. This guide goes no further than that general description. How the federal rules apply to any one firm is a matter for that firm and its regulators.
The Central Bank: payment tokens
The Central Bank of the UAE regulates services built on payment tokens, its term for virtual assets that aim to hold a stable value against a currency. Its Payment Token Services Regulation (Circular 2/2024), in force since 31 August 2024, covers three services: payment token issuance, payment token conversion, and payment token custody and transfer. Article 2 bars any person from performing one of them within the UAE, or directing one at people in the UAE, without a Central Bank licence or registration. The section on USDT returns to this.
What a VARA licence covers: the eight activities
A VARA licence is granted activity by activity, and VARA lists eight. A firm may hold several under one licence, but it applies for each one explicitly and must meet the rules for each in full. The names below are VARA's. The line after each name is a plain description of what a customer would notice, based on Schedule 1 of VARA's Regulations; it is not the legal definition.
- Advisory Services. You receive a personal recommendation about a transaction in a virtual asset.
- Broker-Dealer Services. The firm takes your order, and the dirhams or crypto that pay for it, and may fill it from its own account.
- Custody Services. The firm keeps virtual assets for you and acts only on your verified instructions.
- Exchange Services. A venue converts between virtual assets and money, matches buyers with sellers or keeps an order book.
- Lending and Borrowing Services. Virtual assets pass from a lender to a borrower, who must return them on the agreed terms.
- Management and Investment Services. The firm manages or administers virtual assets on your behalf. Staking for clients sits here.
- Transfer and Settlement Services. The firm transmits or settles virtual assets from one person or wallet to another.
- VA Issuance Category 1. The firm issues a token in VARA's first issuance category, which VARA's FAQ links to fiat-referenced virtual assets.
Custody stands apart. It is the one activity VARA requires to be separated from the rest: a custodian must be set up as a separate legal entity with a licence of its own. A firm licensed only for Broker-Dealer Services is therefore not a licensed custodian, and it is fair to ask who holds client assets and on what terms. MKX's terms name Fireblocks as its wallet custody services provider, and the security page sets out what protects client assets at MKX.
One more detail from VARA's FAQ helps when you read a register entry: the licence is annual and is renewed for 12 months at a time. A status that read Active last year is worth checking again.
Terms used in this guide
- Virtual Asset Service Provider (VASP)
- A firm that carries out one or more virtual asset activities for clients. In Dubai outside the DIFC it needs a VARA licence first.
- Licensed activity
- One of the eight categories of service that VARA licenses separately. A firm's entry on the register lists the ones it holds.
- In-Principle Approval (IPA)
- A conditional step on the way to a licence. It is not permission to serve clients.
- Broker-dealer
- A VASP licensed for Broker-Dealer Services. It takes a client's order and fills it at a quoted price.
- Payment token
- The Central Bank's term for a virtual asset that sets out to hold a stable value by reference to a fiat currency.
The glossary has VASP, broker-dealer and other terms defined in one place.
Broker-dealer or exchange: why the activity on the licence matters
The activity named on a licence tells you how your order will be handled. MKX's register entry lists Broker-Dealer Services and no other activity. In VARA's definitions, Broker-Dealer Services include "soliciting or accepting orders" for virtual assets, taking fiat currency for them and dealing on the firm's own account, while Exchange Services include "maintaining an order book". In practice a client of a broker-dealer such as MKX is shown a quoted price and accepts it or walks away. There is no order book to place bids in.
The Broker-Dealer Services Rulebook adds duties that matter to a client. Rule II.A.1 requires the firm to use reasonable diligence to get the client the most favourable price that market conditions allow, weighing cost, speed and the likelihood of execution. Rule I.B requires it to publish how it manages conflicts of interest and how it handles complaints. MKX states that Binance is its primary external liquidity provider and that the final price and fee appear on the trade execution screen before you confirm.
The practical test is simple: the service you are offered should appear among the Licensed Activities on the firm's entry. Lending offered by a firm licensed only for Broker-Dealer Services, for example, is worth a question before you send anything.
Licence, in-principle approval or nothing
A firm is in one of three positions: licensed, holding an In-Principle Approval, or absent from VARA's register. The public register lists the first two groups separately. VARA describes an IPA as a conditional step towards a licence and states that its holders are "strictly prohibited" from starting operations, carrying out virtual asset activities or servicing clients until the full licence is granted.
| Position | May it serve clients? | What it means for you |
|---|---|---|
| Licensed VASP, status Active | Yes | Within its licensed activities and its licence condition |
| In-Principle Approval | No | It may prepare to launch. It may not take clients for virtual asset services |
| Not on the register | Not under VARA | It holds neither. Ask which regulator covers it and check that register |
A firm that is missing from the register is not always unregulated: it may sit in the DIFC or ADGM, or operate from another country. It cannot truthfully call itself VARA-licensed, though, and VARA takes reports of unauthorised virtual asset activity through the same page that handles complaints.
Who a licensed firm may serve
A licence also says which investors the firm may serve: retail, qualified or institutional. VARA's FAQ states that a provider can serve retail customers once its licence is approved, and that VARA may, at its discretion, approve certain firms for Qualified Investors and institutional clients only. The answer for a given firm is on its register entry, under Licence Condition. MKX's reads: "Permitted to serve Institutional Investors, Qualified Investors and Retail Investors."
If you are an individual customer and the condition on a firm's entry leaves out retail investors, its services are not meant for you. VARA's marketing rules point the same way: an advert for a service restricted to certain investor classes must be shown only to those classes.
How to check a firm on the VARA public register
Checking a firm takes three steps and one public web page. The example below is first-hand: it uses MKX's own entry, read on 11 October 2026, because a licensed firm can show its own record field by field.
1. Open the register and search the legal name
Go to the VARA public register and search for the firm's legal name, which is not always its brand. The legal name is usually in the footer of the firm's website. MKX's is MKX Virtual Assets Broker & Dealer Services L.L.C. The register can be filtered by activity and keeps separate lists for licensed firms and for In-Principle Approvals. Each row includes the name, licence type, reference, licensed activities, issue date and status. Select the firm to open its full entry.
2. Read the fields that identify the firm and its licence
Nine fields on the entry identify the firm and its licence, and each one helps to answer one of three questions.
| Field | MKX's entry shows | What to check |
|---|---|---|
| 1. VASP Name | MKX Virtual Assets Broker & Dealer Services L.L.C. | It is the legal name in the site footer and the terms |
| 2. Address | Office No 4001, Concorde Tower 1, Al Thanyah Fifth, Dubai, UAE. | It is the address on the firm's contact page |
| 3. Website URL | https://www.mkx.ae/ | It is the address in your browser |
| 4. Licence Type | VASP Licence | The firm is in the licensed list, not the In-Principle Approval list |
| 5. Licensed Activities | Broker-Dealer Services | The service you want is named here |
| 6. Licence Condition | Permitted to serve Institutional Investors, Qualified Investors and Retail Investors. | Your investor class is included |
| 7. Reference | VL/25/04/001 | It is the reference the firm quotes |
| 8. Licence Issued | 2025/04/18 | The licence had been issued before the firm served you |
| 9. Status | Active | Any other status is a reason to ask the firm in writing |
3. Compare it with the firm's own website
The last step is to hold the entry against the firm's site. Three comparisons catch most impersonation:
- The Website URL on the register is the address in your browser. A copycat site can quote a real reference, but it cannot change the URL that VARA publishes.
- The legal name on the register is the legal name in the footer and in the terms.
- The Status reads Active, and the service you want appears under Licensed Activities.
If one of the three fails, stop and ask the firm in writing. MKX sets out the same record, with dates, on its page of MKX licences and regulatory disclosures, and there is more background on the page about MKX and its leadership.
What VARA's marketing rules tell you about adverts
VARA's marketing rules double as a checklist for an advert you should not rely on. The Regulations on the Marketing of Virtual Assets and Related Activities 2024 apply to marketing carried out in the UAE or aimed at it, whoever publishes it. Five tests follow from the text:
- Are the two risk statements there? Marketing of a virtual asset must carry a prominent disclaimer about loss of value and volatility, and must say that the investor can lose everything and has no financial protection. They are the two sentences at the top of this page.
- Does it push you to hurry? Marketing must not imply urgency or play on the fear of missing out.
- Does it lean on past gains? It must not state or imply that past performance indicates future results.
- Does it make investing sound easy? It must not present investment decisions as trivial or easy.
- Who is speaking? Marketing of a virtual asset activity may be carried out only by the firm licensed for that activity, or by someone acting on its behalf with its approval. A third party that is paid to post must say so.
The same regulations count educational content, articles and tutorials included, among the forms that marketing can take. That is why this guide states MKX's interest under the byline and repeats the risk statements. Anyone who markets a virtual asset in the UAE must also keep a record of that marketing for at least eight years.
Is USDT legal in the UAE?
Buying and selling USDT through a licensed firm is legal, and two rulebooks are relevant to it. As a virtual asset, USDT falls under the same licensing regime as Bitcoin: in Dubai outside the DIFC, a firm needs a VARA licence for the activity through which it offers USDT. MKX converts between AED and USDT as a broker-dealer.
Separately, the Central Bank's Payment Token Services Regulation treats a token that references a currency other than the dirham as a Foreign Payment Token, with rules of its own, and makes the issuance, conversion, and custody and transfer of payment tokens services that the Central Bank licenses or registers. USDT is designed to track the US dollar. These rules are addressed to providers, and for a customer the practical point is the same as for any other asset: use a firm whose licence covers the service.
The mechanics are in two step-by-step guides: how to buy USDT in Dubai and how to sell USDT in Dubai for AED.
What a licence does not protect you from
A licence regulates the firm. It does not insure your money and it does not vouch for any asset. Three limits are worth stating plainly:
- No protection scheme. The statement VARA requires in marketing says that an investor in a virtual asset has no form of financial protection. MKX's terms add that clients' assets are "not covered by any deposit protection mechanism from MKX".
- No floor under the price. A virtual asset can lose its value in full, whoever sold it to you.
- No endorsement. A licence covers the firm's conduct in a named activity. It is not VARA's opinion of Bitcoin, USDT or any other asset.
| Scenario | Value | Loss | Paid by a protection scheme |
|---|---|---|---|
| Amount converted to a virtual asset | AED 12,000 | AED 0 | AED 0 |
| After a 30% fall in price | AED 8,400 | AED 3,600 | AED 0 |
| If the price falls to zero | AED 0 | AED 12,000 | AED 0 |
If the problem is the firm and not the market, complain to the firm first; VARA's own complaints page asks for that. Under the MKX complaints handling policy, a complaint is acknowledged in writing within one week and answered in writing within four weeks, or within eight weeks in extraordinary cases, at no charge. After that, VARA accepts complaints about licensed firms through its online complaints form, and it notes that fraud may be a matter for the police. The MKX risk disclosure statement lists the wider risks.
Tax in brief
The UAE does not tax the income of individuals, and that is as far as this guide goes on tax. The UAE Government portal says: "The UAE does not levy income tax on individuals." The same page describes a 5 per cent value added tax and a corporate tax on business profits. Those are separate regimes and are not summarised here. If you trade as a business, or you are tax-resident in another country, ask a qualified adviser. This is not tax advice. A dedicated guide to crypto and tax is planned for MKX Learn.
How MKX is licensed
MKX Virtual Assets Broker & Dealer Services L.L.C. is licensed by VARA for Broker-Dealer Services under reference VL/25/04/001, issued on 18 April 2025, with the status Active on the register on 11 October 2026. The licences page repeats the record and the steps to verify it, and the product page shows how clients buy USDT with AED through a licensed broker-dealer. Nothing here is a recommendation to buy, hold or sell an asset.
See MKX's licence and how to verify it
Frequently asked questions
Is Bitcoin legal in the UAE?
Yes. Bitcoin is a virtual asset, and buying or selling it through a licensed firm is lawful. In Dubai outside the DIFC that firm needs a VARA licence for the activity it offers, and VARA's FAQ confirms that a licensed provider can serve retail customers. In the DIFC and ADGM, the DFSA and the FSRA apply their own rules. Check the firm's register entry before you send money.
Is crypto trading legal in Dubai for expats?
Yes, on the same terms as for anyone else. The rules cited in this guide turn on the firm and its licence, not on the customer's nationality. What a firm asks of you is identity verification: MKX, for example, checks an Emirates ID or a passport and requires clients to be at least 18. The tax and reporting rules of your home country may still apply to you.
Do I need a licence to buy crypto for myself?
No. VARA licenses providers, not their customers. Its FAQ says that any entity wishing to carry out regulated virtual asset activities in or from Dubai must apply for a licence. Buying through a licensed firm makes you a client. The position changes if you start to offer a service to other people, such as trading or holding assets for them, because that is what the eight licensed activities describe.
What does a VARA licence number look like?
A VARA reference is the letters VL followed by three groups of digits separated by slashes. MKX's is VL/25/04/001, on a licence issued on 18 April 2025. To check one, search the public register for the firm's legal name, open its entry and compare the reference there with the one in the footer of the firm's website. The reference alone proves little, so compare the Website URL as well.
What is the difference between in-principle approval and a full VARA licence?
An In-Principle Approval is a conditional step towards a licence. It is not permission to operate. VARA's register page says that IPA holders are strictly prohibited from starting operations, carrying out virtual asset activities or servicing clients until they hold the full licence. A licensed firm appears in the licensed list with its activities, an issue date and a status. Treat a request for money from a firm that holds only an IPA as a warning sign.
Does a VARA licence cover Abu Dhabi or the DIFC?
No. VARA describes its remit as every zone of the Emirate of Dubai, free zones included, except the Dubai International Financial Centre. Inside the DIFC the Dubai Financial Services Authority sets the rules, and in Abu Dhabi Global Market a firm needs a permission from the Financial Services Regulatory Authority. Whether a Dubai-licensed firm may take on a customer who lives in another emirate is a question to put to the firm itself.
Sources
Each source was opened on the date shown, and nothing longer than a short phrase is quoted from any of them. MKX's own register entry, VARA's activity definitions and rulebook, the DFSA and ADGM pages and the Capital Market Authority's announcement are linked in the text where they are used. Statements about MKX's terms, complaints policy, identity check and liquidity provider come from its live site.
- Dubai Virtual Assets Regulatory Authority (VARA), About VARA: https://www.vara.ae/en/about-vara/ (accessed 11 October 2026)
- VARA, Licensed Activities: https://www.vara.ae/en/licenses-and-register/licensed-activities/ (accessed 11 October 2026)
- VARA, Public Register: https://www.vara.ae/en/licenses-and-register/public-register/ (accessed 11 October 2026)
- VARA, Regulations on the Marketing of Virtual Assets and Related Activities 2024: https://rulebooks.vara.ae/entiresection/419 (accessed 11 October 2026)
- VARA, Frequently Asked Questions: https://www.vara.ae/en/faq/ (accessed 11 October 2026)
- Central Bank of the UAE, Payment Token Services Regulation, Circular 2/2024: https://rulebook.centralbank.ae/en/rulebook/payment-token-services-regulation (accessed 11 October 2026)
- Clyde & Co, A UAE virtual assets update, 7 May 2026 (secondary source): https://www.clydeco.com/en/insights/2026/05/uae-virtual-assets-update-q2-2026 (accessed 11 October 2026)
- UAE Government portal, Taxation: https://u.ae/en/information-and-services/finance-and-investment/taxation (accessed 11 October 2026)
For information only, not investment advice, legal advice or tax advice. This guide describes the rules as the regulators published them on 11 October 2026. Rules change, so read the sources before you act.