UAE Federal Crypto Law: Harmonising VARA, DFSA, and ADGM Into One Framework

The United Arab Emirates is a federation of seven emirates — Abu Dhabi, Dubai, Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah, and Fujairah — each with significant retained sovereignty. The federal government in Abu Dhabi exercises authority over areas of shared national interest, while each emirate retains authority over matters within its own domain. Financial regulation has historically been divided: the UAE Central Bank and UAE Securities and Commodities Authority operate at the federal level, while financial free zones such as DIFC and ADGM operate their own regulatory frameworks under their own authorities, insulated from both federal and emirate regulation by the free zone legal architecture.

Virtual assets added a further layer of complexity. Dubai established VARA in 2022 as an emirate-level regulator; the DIFC has the DFSA; ADGM has the FSRA. The result — three significant regulatory regimes for virtual assets within a single country, each operating under different legal frameworks and applying different regulatory requirements — created a fragmentation that was commercially complex for international firms and potentially problematic for the UAE’s international regulatory relationships, particularly with the FATF.

The Federal Virtual Asset Law: Scope and Architecture

The UAE federal virtual asset law establishes a national framework for virtual asset regulation that applies across the federation, including within the financial free zones, at a principle level. Its architecture is designed to create baseline consistency — ensuring that all UAE jurisdictions meet minimum standards for AML/CFT compliance, investor protection, and market integrity — while explicitly preserving the authority of the financial free zone regulators (DFSA and FSRA) to operate their own detailed regulatory frameworks within their jurisdictions.

This dual-level structure reflects the political reality of UAE federalism. Abu Dhabi would not accept a federal law that simply extended VARA’s authority into ADGM; Dubai would not accept a federal law that diluted VARA’s institutional standing. The compromise is a federal framework that sets floors without eliminating ceilings — minimum standards that all regimes must meet, but not a single unified regime that replaces the existing regulatory architectures.

The federal law designates the UAE Central Bank as the authority for payment-related virtual assets at the federal level — stablecoins used for payment and digital dirham infrastructure — while the Securities and Commodities Authority retains authority over virtual assets that constitute securities at the federal level outside the free zones. VARA retains exclusive jurisdiction over virtual asset activities within Dubai outside the DIFC. The DFSA and FSRA retain jurisdiction within their respective free zones.

The FATF Driver: Resolving Grey List Risk

A significant driver of the federal harmonisation effort was the UAE’s experience with FATF oversight. The UAE was placed on the FATF grey list — the list of jurisdictions under enhanced monitoring for AML/CFT deficiencies — in February 2022, and was removed in February 2024 after demonstrating substantial improvements in its AML/CFT framework. The fragmented multi-regulator structure for virtual assets was among the vulnerabilities identified in the FATF’s assessment.

The federal virtual asset law contributes to FATF compliance by ensuring that virtual asset activity across all UAE jurisdictions — including within financial free zones that previously operated with significant AML/CFT autonomy — is subject to consistent minimum standards derived from the FATF’s recommendations for virtual asset service providers. This includes Travel Rule requirements, beneficial ownership identification, and suspicious transaction reporting obligations that apply regardless of which regulatory authority oversees the specific firm.

The UAE’s removal from the FATF grey list was a major policy achievement that required the federal government, Dubai, Abu Dhabi, and the free zone authorities to demonstrate that the UAE’s AML/CFT framework was comprehensive across all sectors — including virtual assets. The federal virtual asset law was part of the package of reforms that produced this outcome.

Regulatory Competition as Feature or Bug

The policy debate within the UAE about regulatory harmonisation is partly about whether the competitive dynamic between Dubai and Abu Dhabi in financial services — and within financial services, in virtual assets — is a feature or a bug.

The case for competition: VARA and the ADGM/FSRA have both developed more sophisticated, more innovative regulatory frameworks than either would have without competitive pressure. The MVP licensing pathway, VARA’s DeFi track, the RegLab — these innovations reflect the institutional imperative to attract and retain business in a competitive environment. A single federal regulator, without competitive pressure, might have produced a more conservative and less innovative framework.

The case for harmonisation: international firms operating across Dubai and Abu Dhabi face duplicated compliance costs, legal complexity in determining which regulatory framework applies to specific activities, and the risk that one jurisdiction’s regulatory decisions affect the other without coordination. For firms from outside the UAE considering establishing regional headquarters, the complexity of the three-regulator structure adds friction relative to single-jurisdiction alternatives like Singapore.

The federal virtual asset law’s design reflects a political resolution rather than a theoretical one. It preserves the competitive dynamic by maintaining distinct regulatory authorities while creating enough baseline consistency to address international concerns about regulatory arbitrage and AML/CFT gaps. Whether this balance is sustainable as the UAE’s virtual asset industry matures — and as FATF expectations evolve — will be determined by how effectively the three regulatory authorities coordinate in practice on the cases that fall at the boundaries of their respective jurisdictions.