Crypto Regulatory Monitoring in the Middle East

The Middle East has become one of the most active regions for crypto regulation. Dubai established the world's first dedicated virtual asset regulator in 2022, Abu Dhabi licenses crypto exchanges through its financial free zone, and Saudi Arabia is quietly building a framework while its central bank experiments with a digital riyal. For crypto firms operating across the Gulf, the regulatory environment is both welcoming and increasingly complex — each emirate and country has its own rules, its own licensing requirements, and its own pace of change.

Key Regulatory Bodies

• Virtual Assets Regulatory Authority (VARA) — Dubai's dedicated virtual asset regulator, established in 2022. Issues four license categories: broker-dealer, exchange, custody, and lending. Published its full Virtual Assets and Related Activities Regulations in 2023, with ongoing updates to marketing and disclosure rules.
• ADGM Financial Services Regulatory Authority (FSRA) — Regulates digital assets within Abu Dhabi Global Market under its comprehensive crypto framework, including spot crypto, derivatives, and stablecoins. Has licensed over 20 virtual asset firms.
• Dubai Financial Services Authority (DFSA) — Operates a separate crypto token regime within DIFC, covering investment tokens and recognized crypto tokens. Stepped up unannounced inspections of crypto firms in 2025.
• Central Bank of the UAE (CBUAE) — Regulates stored value facilities and payment tokens onshore. Published its Payment Token Services Regulation in 2024, requiring dirham-backed stablecoins to hold reserves with UAE-licensed banks.
• Saudi Central Bank (SAMA) — While Saudi Arabia has not formally licensed crypto exchanges, SAMA regulates payment systems and is piloting Project Aber, a cross-border CBDC initiative with the CBUAE.

Critical Regulations

• VARA Virtual Assets and Related Activities Regulations (2023) — The most comprehensive crypto-specific regulatory framework in the Middle East. Covers licensing, conduct, custody segregation, marketing restrictions, and consumer protection for all virtual asset activities in Dubai (outside DIFC).
• CBUAE Payment Token Services Regulation (2024) — Requires any entity issuing or facilitating payment tokens in the UAE to be licensed by the Central Bank. Stablecoins pegged to the UAE dirham must maintain full reserves with a UAE-licensed bank.
• ADGM Guidance on Regulation of Virtual Asset Activities (2023) — Sets capital requirements, technology governance standards, and custody safeguards for virtual asset firms operating in Abu Dhabi Global Market.
• DFSA Crypto Token Regime (2024) — Allows the recognition and trading of specific crypto tokens within DIFC. Firms must apply for a DFSA license and comply with the Conduct of Business and AML modules.
• UAE Federal AML/CFT Framework — All licensed virtual asset service providers must comply with Federal Decree-Law No. 20 of 2018 (amended 2024), including transaction monitoring, suspicious activity reporting, and Travel Rule compliance.

What You're Missing

• Three crypto regulators in one city. A crypto firm in Dubai could fall under VARA, DFSA, or CBUAE depending on its activity type and location. Each regulator publishes independently, and their rules don't always align.
• VARA's evolving rulebook. VARA published major updates to its marketing and disclosure rules in late 2025 with short implementation windows. Firms that aren't tracking VARA publications in real time risk non-compliance within weeks of a new rule.
• Saudi Arabia's quiet build-up. While no formal licensing framework exists yet, SAMA and the CMA have issued warnings, guidance notes, and consultation papers signaling incoming regulation. Firms planning Saudi market entry need to track these signals early.

How RegPulse Helps

RegPulse tracks VARA, DFSA, ADGM FSRA, CBUAE, SAMA, and the Central Bank of Bahrain for all crypto and virtual asset-related publications. New licensing requirements, consultation papers, enforcement actions, and rulebook changes are delivered to your inbox within 24 hours of publication — tagged by topic and jurisdiction.

Stop checking five regulator websites across three time zones. Get one unified feed for crypto regulation across the Gulf.