By: Ahmed Adly, Founder of Al Adly & Co.
Key Takeaways
- The UAE is now the second-largest crypto economy in the MENA region, with an estimated USD 53–56 billion in crypto value moving through the market in the past year, but it also ranks among the countries where investors lose the most to crypto crime.
- Providing a virtual asset service in or into the UAE without the correct licence from VARA, the FSRA, the DFSA, or the SCA is not a technicality. It is an enforcement priority, with fines reaching into the tens of millions of dirhams and, in serious cases, criminal referral.
- Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, closed the ambiguity that previously surrounded digital assets under UAE anti-money laundering law. Virtual assets are now expressly caught, penalties are higher, and there is no statute of limitations on money laundering offences.
- Not every regulatory breach is a crime. The Dubai courts have shown they will distinguish unlicensed trading from money laundering where there is no proof of an illicit source of funds or deliberate concealment, but the line is fact-specific and unforgiving of poor documentation.
- Directors, founders, and family principals face personal exposure, not just corporate exposure. Beneficial ownership misstatements, facilitation by professionals, and failures of ongoing due diligence all now carry direct individual consequences.
BACKGROUND A MARKET BUILT FOR CRYPTO, AND A REGULATOR BUILT TO MATCH
The UAE has spent the past four years building one of the most developed virtual asset regulatory ecosystems in the world. Roughly a third of the UAE’s Population now holds crypto assets in some form, and the country has become the region’s second largest crypto economy after turkey. The growth was not accidental. Dubai, Abu Dhabi, and the DIFC have each built dedicated regulatory regimes VARA, the FSRA under ADGM, and the DFSA specifically to attract legitimate virtual assets businesses, exchanges, and institutional investors to the UAE rather than push them offshore.
The same conditions that make the UAE Attractive to genuine crypto businesses deep liquidity, a large expatriate investor base, fast company formation, and a currency pegged to the US dollar and attract fraudsters, unlicensed operators, and money launders. Chainalysis’ 2025 midyear crime update placed the UAE among the countries with the highest total value of crypto stolen from victims globally, on a par with the United States. Dubai police have separately disclosed tens of millions of dollars in crypto linked money laundering investigations opened in recent years, and cases now regularly reach the UAE courts.
The result is a market where the Regulatory and criminal law framework has matured quickly, and where enforcement activity against unlicensed platforms, fraudulent schemes, and laundering network alike has intensified markedly through 2025 and into 2026. For anyone operating in or transacting through this space, understanding where regulatory line sits, where it hardens into a criminal one, is no longer optional.
THE REGULATORY PERIMETER: WHO NEEDS A LICENCE, AND WHAT HAPPENS WITHOUT ONE
The UAE does not have a single crypto regulator. Converge is split by jurisdictions, and the obligation to hold a license applied on a substance over a form basis and the meaning it can extend to firms with no physical presence in the UAE at all, if they are serving UAE resident.
Regulator | Jurisdiction | Position on Unlicensed Activity |
|---|---|---|
VARA | Dubai mainland and most Dubai free zones (excluding DIFC) | Actively pursuing unlicensed operators and unlicensed marketing, enforcement notices, cease-and-desist orders, and fines are published regularly. |
FSRA (ADGM) | Abu Dhabi Global Market | Requires a Financial Services Permission before any regulated digital asset activity, over 40 licensed entities as at early 2026. |
DFSA (DIFC) | Dubai International Financial Centre | Institutionally focused regime, market abuse and misleading disclosure rules apply on an extraterritorial basis to tokens admitted to DIFC venues. |
VARA’s marketing regulations, in force in October 2024, make it unlawful for any unlicensed entity UAE based or overseas to advertise or promote virtual asset services to the UAE resident through any channel. VARA has applied this rule against firms with no physical presence in Dubai, including, in March 2026, entities operating under a major international exchange brand that were ordered to cease all activity in the Emirate. Enforcement to date has produced fines ranging from roughly AED 50,000 For smaller marketing breaches up to AED 600,000 per entity for more serious unlicensed activity, with the regulatory ceiling for certain violations reaching AED 10 million, and doubling for repeat offences within a year.
The message from regulators is consistent: a UAE domain, or UAE directed marketing is enough to trigger the licensing requirement, regardless of where the platform is incorporated or hosted.
WHERE OPPORTUNITY TIPS INTO CRIME: THE FOUR RISK ZONE
1- Operating without a license
The most common exposure is also the most avoidable: providing exchange, custody, broker-dealer, advisory, or token issuance services to UAE residents without the licence the activity requires. This applies equally to UAE-incorporated start-ups moving faster than their licensing process and to offshore platforms that assume UAE law does not reach them. It does.
2- Money Laundering Through Virtual Assets
Federal Decree-Law No. 10 of 2025 replaced the UAE's 2018 AML law on 14 October 2025, with Cabinet Resolution No. 134 of 2025 following in December 2025 to set out the implementing regulations. The reform matters directly to anyone dealing in crypto in three respects. First, it expressly brings virtual assets and virtual asset transactions within the definition of property capable of being laundered, removing an ambiguity that previously gave defendants room to argue. Second, conviction of the underlying predicate offence is no longer required to prosecute laundering, prosecutors need only show the proceeds derive from unlawful activity, with knowledge inferred from the surrounding facts. Third, there is now no statute of limitations on money laundering offences, meaning a compliance failure today can still be the subject of enforcement action a decade from now. The law also introduces a standalone offence for promoting or using privacy-enhancing virtual asset products designed to conceal identity or defeat transaction tracing, directly targeting privacy coins and mixing services.
3- Fraud, Deception, and Fake Digital Asset Schemes
Dubai's courts are seeing a steady flow of fraud cases built around fictitious or misrepresented crypto investments. Reported outcomes include a defendant ordered to repay over AED 1.29 million following a fake digital asset deal, a woman ordered to pay AED 4.3 million in compensation after defrauding an investor of USD 1 million through a fabricated cryptocurrency transaction carried out with a since-fugitive accomplice, and a AED 2.4 million fraud case in which an appellate court overturned an acquittal and imposed three-year custodial sentences. At the more serious end, UAE authorities have pursued cross-border networks combining forged documentation, shell companies, and in one landmark case, deep-fake voice cloning to authorise fraudulent transfers, resulting in sentences of five to ten years' imprisonment and multi-million-dirham corporate fines.
4- Personal and Director-Level Exposure
The 2025 AML reform widens exposure beyond the corporate entity. Individuals who intentionally provide incorrect or misleading beneficial ownership information face imprisonment and fines of up to AED 20,000. Professionals whose role facilitates a laundering offence face aggravated penalties. There is no longer an upper limit on the fine for tipping off a person who may be the subject of a suspicious transaction report. For founders, family principals, and directors of crypto-adjacent businesses, this means personal liability can attach even where the underlying business was not primarily built around virtual assets.
THE DISTINCTION THAT MATTERS: REGULATORY BREACH VS. CRIMINAL LAUNDERING
It is worth being precise about what the UAE courts have and have not said. In May 2025, the Dubai criminal court of appeal acquitted defendants in a case where the prosecution had sought to treat unlicensed virtual asset trading as money laundering. The court held that trading without a license was, on its own, a regulatory issue and not automatically evidence of laundering, absent proof that the funds involved had an illicit source or that the defendants had deliberately concealed that source. That distinction is significant, and it should not be read as an invitation to treat licensing as optional.
What the case illustrates is that UAE prosecutors and courts are drawing a genuine line between regulatory noncompliance and criminal conduct, and that the line turns evidence: the origin of funds, the intent behind the structure used, and whether concealment was present. For business and individuals, that makes it clean documentation, credible source of records, and demonstrable good faith compliance efforts the difference between a fine and a custodial sentence.
AL ADLY & CO. PRESPECTIVE
The UAE’s ambition to be a serious jurisdiction for virtual assets and its determination to close the space to criminal misuse are not in tension and they are the same policy, pursued on two fronts at once. Firms and individuals who treat licensing, AML controls, and transactions records as genuine legal discipline will find a market that continues to welcome them. Those who treat it as an after though are increasingly likely to meet an enforcement division, a public prosecutor, or both.
We are seeing three patterns most often in practice: founders who assume that operating from a free zone or serving an international customer base places them outside VARA’s reach, investors and family offices who receive crypto linked returns without adequately interrogating the source of the underlying funds, and business that treat a marketing or advertising decision as commercial matter without adequately interrogating the source of the underlying funds, and businesses that treat a marketing or advertising a decision as a commercial matter without checking it against VARA’s marketing Regulations First. Each of these is now a live enforcement risk, not a theoretical one.
For anyone raising capital in virtual assets, accepting crypto as consideration, advising on a token structure, or simply holding a meaningful crypto position through a UAE entity, the practical steps are the same: confirms the correct license before commencing any regulated activity, build and evidence a genuine source of funds and beneficial ownership trail, and treat any request to move funds through unhosted wallets, mixers, or anonymity enhancing tokens as a red flag rather than a convenience. Where a transaction, structure, or existing exposure looks uncertain, early legal advice is materially cheaper than a later investigation.
Frequently Asked Questions
No. Buying, holding, and trading crypto assets through properly licensed platforms is lawful and widely practised in the UAE. The exposure arises from providing unlicensed services, dealing in proceeds of crime, or engaging in fraudulent or deceptive schemes not from ownership itself.
Potentially, yes. UAE law allows prosecution for both intentional and negligent involvement, and knowledge can be inferred from the surrounding facts and objective circumstances. Failing to carry out reasonable due diligence on the source of funds can itself contribute to exposure.
Not necessarily. Under Federal Decree-Law No. 10 of 2025, conviction of the predicate offence is not required to prosecute money laundering, and the punishment or non-punishment of the predicate offence does not preclude prosecution for laundering the related proceeds.
Outcomes have ranged from cease-and-desist orders and fines starting at around AED 50,000 for lower-severity breaches, up to several hundred thousand dirhams or more for repeated or serious unlicensed activity, with the regulatory ceiling reaching into the millions of dirhams for the most serious cases.
No. The 2025 AML law removed the statute of limitations for money laundering offences. A compliance failure or laundering exposure from several years ago can still form the basis of a prosecution today.
Yes, in a growing range of circumstances. Individual directors and officers can face personal fines and imprisonment for matters including beneficial ownership misstatements, facilitation of laundering through their professional role, and failures connected to suspicious activity reporting obligations.
Disclaimer: This article is prepared by Al Adly & Co. for general informational and client advisory purposes only. It does not constitute legal advice and does not create a lawyer-client relationship. Information is based on the UAE Cabinet resolution announced by WAM on 18 June 2026. The regulatory position may be supplemented by implementing regulations, ministerial guidance, or platform-specific directives. For advice specific to your platform, business, or circumstances, please contact our team directly. © 2026 Al Adly & Co. Law Firm. All rights reserved. | www.aladly.co
Ahmed Adly
Founder & Managing Partner
Ahmed Adly is the founder and managing partner of Al Adly & Co, advising international businesses and entrepreneurs operating in the UAE and Egypt. With more than 20 years of legal experience and a background in senior government legal roles, he helps clients navigate regulatory complexity, structure transactions, and resolve high-value disputes.