Payment, Crypto and Financial Services Licences in Dubai and the UAE (2026)

Which UAE regulator licenses your business

Five UAE regulators license payment and crypto businesses, and which one applies turns on two questions: what the business does, and where the entity sits. Onshore payment activity belongs to the Central Bank of the UAE (CBUAE) and virtual asset activity in Dubai to the Virtual Assets Regulatory Authority (VARA). The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) each have their own regulator, rulebook and courts.

Many groups hold more than one licence: a Dubai exchange that also converts fiat into stablecoins deals with VARA and the CBUAE. The perimeter widened in September 2025: Article 62 of Federal Decree-Law No. 6 of 2025, in force from 16 September 2025, brings any person who offers or facilitates a licensed financial activity through virtual assets, payment tokens, decentralised finance, decentralised applications or protocols within the CBUAE's licensing and oversight, whatever the technology used.

The UAE licence options compared

Capital figures are the prescribed minimums; each regulator may require more.

BCC's pages on the UAE payment and stored value licences, the Dubai VARA virtual asset licence and the DIFC DFSA licence give the full requirements for each regime.

CBUAE retail payment services: the four categories and their capital

The Retail Payment Services and Card Schemes Regulation (Circular 15/2021) prohibits any person from providing or promoting retail payment services in the UAE without a CBUAE licence. It defines nine services and groups them into four licence categories. Operators of card schemes hold a separate card scheme licence under Article 18.

The volume threshold is the monthly average value of payment transactions, calculated on a three-month moving basis under Article 6. A firm that grows through the threshold steps up to the higher figure, so the capital plan follows the business plan's growth curve.

Legal form, residence and data

The applicant is a company incorporated in the UAE under the Commercial Companies Law. The chief executive and the alternates must be natural persons ordinarily resident in the UAE, and personal and payment data must be stored and maintained in the UAE (Article 14(22)).

Funds in transit

A payment service provider may hold customer funds only while they are in transit. Where settlement takes place within 24 hours, the funds are kept apart from other funds and protected from other creditors. Where settlement takes longer, they sit in a separate escrow account at a bank or are covered by an insurance policy or a guarantee from an unaffiliated insurer or bank (Article 14(3) and (4)). Holding balances for longer makes the business a stored value facility.

Stored value facilities and payment tokens: the CBUAE's two higher-capital licences

Stored value facilities

Wallets, prepaid cards and other balances that customers can spend with third parties fall under the Stored Value Facilities Regulation (Circular 6/2020). Under Article 7 the licensee maintains paid-up capital of at least AED 15 million, or an approved equivalent in another currency, and total capital funds of at least 5% of the float received from customers. The regulation provides for an unconditional, irrevocable bank guarantee for the full paid-up capital, payable on first demand to the CBUAE.

Under Article 3 the applicant is a company incorporated in the UAE, including the general free zones but excluding the financial free zones. The board, senior management and controlling shareholder are approved by the CBUAE as fit and proper before the licence is granted.

Payment token services

The Payment Token Services Regulation (Circular 2/2024) governs stablecoins used as a means of payment onshore. It licenses three services: payment token issuance, payment token conversion, and payment token custody and transfer.

• Dirham token issuers are licensed by the CBUAE and incorporated in the UAE outside the financial free zones. Capital is AED 15 million plus at least 0.5% of the face value of tokens in issue, rising to 2% for an issuer using the alternative reserve arrangement (Article 13). An unconditional, irrevocable bank guarantee for the full paid-up capital is submitted with the application.
• Reserves equal at least the face value of tokens in circulation. The default is 100% cash in a separate escrow account, in the token's currency, at a UAE-licensed bank outside the issuer's group. A bank-owned issuer may hold at least 50% in cash and the balance in UAE government bonds and CBUAE M-bills with an average duration of six months or less. Reserves are reconciled and reported daily and audited externally each month (Article 22).
• Redemption is at par, generally by the same time on the next business day, and issuers may not pay interest or any reward linked to how long a customer holds a token.
• Conversion, custody and transfer providers hold capital of AED 3 million where monthly average transfers reach AED 10 million, and AED 1.5 million otherwise (Article 14). Virtual asset exchange platforms, banks and exchange houses may apply for a non-objection to perform payment token conversion or foreign payment token custody and transfer (Article 8).
• Foreign stablecoins are registered through a foreign payment token issuer registration, which requires a non-objection from the SCA or a local licensing authority. Foreign payment tokens may be used as a means of payment only to buy virtual assets or virtual asset derivatives.
• Algorithmic stablecoins and privacy tokens may not be issued, serviced or promoted in the UAE.

BCC's stablecoin licensing page compares the UAE position with other issuer regimes.

VARA in Dubai: activities, capital and fees per licence

Any firm carrying on virtual asset activities in or from Dubai, on the mainland or in any free zone other than the DIFC, needs a VARA licence under Dubai Law No. 4 of 2022 and the Virtual Assets and Related Activities Regulations 2023. Each activity is licensed separately. Capital is the higher of a fixed amount and a percentage of the activity's fixed annual overheads, under Part VI of the Company Rulebook; fees are set in Schedule 2 of the Regulations.

Each additional activity carries a licence extension fee of 50% of the lower application fee, and VARA may impose additional or varied fees according to a firm's risk profile. Paid-up capital is held at all times in a trust account with a licensed UAE bank naming VARA as beneficiary, or by a surety bond with no end date, and is reconciled monthly. In addition, every licensed firm holds net liquid assets of at least 1.2 times its monthly operating expenses (Company Rulebook, Part VI.C).

The two-stage process

VARA's licence applications page describes two stages. First, the firm submits an initial disclosure questionnaire through Dubai Economy and Tourism or a Dubai free zone, with the business plan and owner and management details, and pays typically 50% of the application fee. VARA then issues an approval to incorporate, which allows the firm to incorporate, lease an office and hire staff, but not to trade. Second, the firm files the full licence pack, answers VARA's questions and pays the fee balance and first-year supervision fee before the licence issues.

The licence pack includes the regulatory business plan, projections, governance framework, key personnel files, proof of paid-up capital, a reserve account report, insurance certificates and wind-down plan. Firms comply with four compulsory rulebooks, Company, Compliance and Risk Management, Technology and Information, and Market Conduct, plus the rulebook for each activity.

The DIFC and ADGM: licensing inside the financial free zones

DFSA in the DIFC

Any firm carrying on a financial service in or from the DIFC is authorised by the DFSA, which issues an electronic licence listing the permitted services. Money services and services in relation to crypto tokens are both within its perimeter. The DFSA treats crypto tokens as financial instruments, so a crypto business applies for ordinary permissions such as dealing, arranging or custody.

The DFSA updated its crypto token framework with effect from 12 January 2026. Firms now assess, on a reasoned and documented basis, whether each crypto token meets the suitability criteria in GEN Rule 3A.2.1, and the DFSA no longer publishes a list of recognised tokens. Fiat crypto tokens are outside that suitability assessment.

The DFSA states that the application fee varies with the financial services applied for and ranges from US$15,000 to US$70,000; its services portal lists service fees from US$2,000 to US$140,000 by nature and scale, with the detail in the Fees Module of the DFSA Rulebook. Every authorised firm appoints a senior executive officer, finance officer, compliance officer and money laundering reporting officer, each an individual the DFSA approves (GEN 7.5.1). The authorisation process runs in five stages: enquire, apply, evaluate, fulfil the conditions of the in-principle letter, and approve.

FSRA in ADGM

ADGM in Abu Dhabi is the alternative financial free zone. Its Financial Services Regulatory Authority licenses money services, virtual asset activities and activities involving fiat-referenced tokens under its own Financial Services and Markets Regulations and rulebooks, with fees set in its FEES Rulebook. The FSRA finalised an expanded fiat-referenced token framework on 31 October 2025, effective 1 January 2026, widening the regulated activities that may be carried on with fiat-referenced tokens the FSRA accepts.

Neither free zone licence covers onshore customers in its own right, and the CBUAE's stored value and dirham token licences cannot be held by a financial free zone entity.

People, local substance and AML: what each regulator expects

Every regime licenses a real operating presence: a local entity, resident leadership, approved controllers and an AML framework built for the UAE.

• CBUAE. A UAE company, a resident chief executive and alternate, payment data held in the UAE and fit and proper controllers.
• VARA. Two responsible individuals of sufficient seniority, each a full-time employee, a UAE resident or UAE passport holder, and approved by VARA during licensing, with any change pre-approved. The compliance officer is also a full-time employee and a UAE resident or passport holder. The approval to incorporate allows the firm to lease its Dubai office and hire staff before the full submission.
• DFSA and FSRA. A DIFC or ADGM entity or branch with a registered address in the zone and the approved individuals each regulator requires, such as the DFSA's senior executive officer, finance officer, compliance officer and MLRO.

The AML framework

Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing, issued on 30 September 2025, replaced Federal Decree-Law No. 20 of 2018. It expressly covers virtual asset service providers, which must be licensed or registered, carry out customer due diligence, apply targeted financial sanctions and report suspicious transactions. Each regulator applies its own AML rules on top. Regulators and banks read the risk assessment, transaction monitoring and sanctions screening first, so these should describe the firm's actual corridors and customers.

Unlicensed activity carries real consequences. The SCA and VARA announced a unified register of licensed virtual asset service providers in July 2023, and the SCA warned that providers operating without the required licence face a warning, a fine of up to AED 10 million or referral to the Public Prosecution.

Fees and timelines: what the regulators publish

The table records what each regulator states.

For planning, BCC works to six to eight months after submission for a CBUAE licence, six to nine months across both VARA stages, and four to six months after submission for a DFSA authorisation, with eight to twelve weeks of preparation before filing. A complete submission, with capital in place and resident individuals named, sets the pace.

Budget beyond regulator fees covers capital, any bank guarantee, office leases and visas, insurance and external audit.

Banking: the accounts each licence depends on

Several UAE licences build the bank into the licence itself, so banking is planned alongside the application.

• CBUAE payment service providers hold funds in transit in a separate escrow account at a bank, or under insurance or a guarantee from an unaffiliated provider, where settlement takes longer than 24 hours.
• Stored value facilities hold the float in separate accounts with licensed banks and provide a bank guarantee for the paid-up capital.
• Dirham payment token issuers hold the reserve in a separate escrow account at a UAE-licensed bank outside their own group, with daily reconciliation and a monthly external audit.
• VARA licensees hold paid-up capital in a trust account with a licensed UAE bank naming VARA as beneficiary, alongside client fiat accounts and operating accounts.
• DFSA and FSRA firms open client money, operating and settlement accounts with banks that serve the free zone.

UAE banks onboard regulated firms against the evidence the regulator reviews: ownership, source of funds, resident management and the AML framework. BCC arranges these accounts alongside the licence; see banking and payment processing.

After approval: supervision and ongoing obligations

The main continuing obligations are consistent across regimes.

• Capital monitoring. CBUAE payment firms recalculate their volume tier on a three-month moving average; stored value facilities keep capital funds at 5% of float; VARA firms reconcile paid-up capital monthly and keep net liquid assets at 1.2 times monthly operating expenses.
• Safeguarding and reserves. Daily reconciliation of float or token reserves, daily reporting for payment token issuers and monthly external audit of reserves.
• Approvals before change. New controllers, changes to responsible individuals or approved persons, new activities and material outsourcing are approved in advance. A VARA firm adding an activity pays the extension fee and the supervision fee for that activity.
• Annual fees and audits. VARA supervision fees are paid in advance for each activity; DFSA and FSRA annual fees follow their fee modules; financial statements are audited each year.

Rules continue to develop: VARA's current Company Rulebook has applied since 19 June 2025, and the DFSA and FSRA both revised their token frameworks for 2026.

How to choose the right UAE licence for your model

Five questions settle most structures.

1. Who are the customers? Onshore consumers and merchants point to the CBUAE, VARA or the SCA; institutional and international clients point to the DIFC or ADGM.
2. Do you hold customer balances? Funds held only in transit fit a retail payment services category. Balances customers keep and spend later require a stored value facility licence with AED 15 million of capital.
3. Is a stablecoin involved? Issuing a dirham token, converting fiat into payment tokens or holding them for customers onshore falls under the Payment Token Services Regulation. Trading other virtual assets in Dubai falls under VARA.
4. How many activities? Match the CBUAE category or VARA activity set to the three-year plan, not only the launch product.
5. Where will the team live? Every regime expects resident leadership. Naming these individuals early sets the filing date.

Groups building a Gulf hub alongside Europe or North America typically pair a UAE licence with an EU, UK or US authorisation. Buckingham Capital Consulting obtains each of the UAE licences in this guide and arranges the banking and technology around them, so the licence, the accounts and the platform are ready together.

Frequently asked questions

References

1. CBUAE Rulebook: Retail Payment Services and Card Schemes Regulation
2. CBUAE Rulebook: Payment Token Services Regulation
3. CBUAE Rulebook: Stored Value Facilities Regulation, Article 7
4. CBUAE Rulebook: Federal Decree-Law No. 6 of 2025, Article 62
5. VARA: licence applications
6. VARA Regulations 2023, Schedule 2: supervision and authorisation fees
7. VARA Company Rulebook, Part VI.B: paid-up capital
8. DFSA: request for new authorisation (financial services)

Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.