Virtual Asset and Cryptocurrency Regulation in the UAE and Saudi Arabia

UAE Virtual Asset Regulatory Framework

The UAE has developed a multi-regulator approach to virtual asset supervision that spans its free zone structure.

VARA (Virtual Assets Regulatory Authority) is the dedicated virtual asset regulator for the emirate of Dubai, established as the world’s first independent virtual asset regulator. VARA operates under the Virtual Assets and Related Activities Regulations 2023, which set out a comprehensive framework for virtual asset licensing and supervision.

VARA’s mandate covers the provision, use and exchange of virtual assets in and from Dubai, except within DIFC which has its own regulatory framework. The VARA licensing process involves a two-step procedure, and VARA maintains a public register of licensed VASPs. In June 2026, VARA published AML/CFT Business Risk Assessment Guidance to support VASPs in implementing risk-based AML programmes.

The DFSA regulates virtual asset activities within the DIFC. The DIFC Virtual Assets regime applies to firms authorised by the DFSA to conduct virtual asset activities, with AML obligations under the DIFC AML Regulations 2020.

The FSRA regulates virtual asset activities within ADGM under the ADGM Virtual Assets framework, with AML obligations under the ADGM AML Regulations 2018.

This means that a VASP operating in Dubai must determine whether it operates in VARA jurisdiction, DIFC or ADGM, and comply with the applicable regulatory framework. The frameworks share common objectives but have distinct licensing requirements and ongoing obligations.

FATF Recommendation 15 and VASPs

The FATF Recommendations provide the international framework for virtual asset regulation. Recommendation 15 requires countries to apply AML/CFT measures to virtual asset service providers (VASPs) equivalent to those applied to financial institutions.

The FATF has published multiple targeted updates on VA/VASP implementation, most recently in June 2026. The FATF’s position is clear: VASPs must implement customer due diligence, record keeping and suspicious transaction reporting, and must securely transmit originator and beneficiary information when making transfers (the travel rule).

For UAE VASPs, FATF Recommendation 15 is implemented through the applicable regulatory framework. VARA, DFSA and FSRA each require licensed VASPs to implement AML/CFT programmes that satisfy FATF requirements.

The FATF’s seventh targeted update (July 2026) highlights where stronger action is needed globally to safeguard the international financial system from virtual asset-related illicit finance. The UAE’s comprehensive regulatory approach positions it as a leader in FATF-aligned VA regulation.

The Travel Rule and IVMS101

The travel rule, established in FATF Recommendation 16, requires VASPs to obtain, hold and securely transmit originator and beneficiary information for virtual asset transfers. This is a critical AML control for preventing the anonymity of virtual asset transactions from being exploited by criminals.

The InterVASP Messaging Standard (IVMS101) provides the technical standard for implementing the travel rule. IVMS101 defines the data format for exchanging originator and beneficiary information between VASPs, enabling compliant implementation of the travel rule across different platforms and jurisdictions.

For UAE VASPs, the travel rule applies under VARA, DFSA and FSRA frameworks. The implementation of IVMS101 is increasingly expected as the standard for cross-VASP transfers.

Peer-to-peer (P2P) cryptocurrency exchanges present a specific travel rule challenge because they facilitate direct transfers between individuals without a regulated intermediary. Regulators are examining how travel rule obligations apply to P2P platforms and how P2P activity can be monitored for AML purposes.

UAE VASP Licensing Process

The VARA licensing process in Dubai follows a two-step procedure. Applicants must demonstrate that they meet the applicable regulatory requirements, including AML programme standards, before a licence is granted.

The licensing process involves:

Application stage: Submission of detailed documentation including business plans, AML/CFT programmes, beneficial ownership information and fit and proper assessments of key personnel.

Assessment stage: Regulatory review of the application, including evaluation of the AML/CFT framework, systems and controls.

Licence grant: Issuance of the relevant VASP licence upon satisfaction of all requirements.

The DFSA and FSRA processes follow similar principles within their respective jurisdictions, with specific documentation and assessment requirements.

VARA maintains a public register of licensed VASPs, which provides transparency about which entities are authorised to conduct virtual asset activities in Dubai. The publication of enforcement actions further demonstrates regulatory oversight.

Saudi Arabia SAMA Virtual Assets Guidance

Saudi Arabia’s approach to virtual assets differs from the UAE’s comprehensive licensing framework. The Saudi Central Bank (SAMA) has issued guidance on virtual assets, but Saudi Arabia has not established a dedicated VASP licensing regime comparable to VARA.

SAMA’s guidance addresses the risks of virtual assets for Saudi financial institutions and sets out expectations for how banks and other financial institutions should manage those risks. The guidance is more restrictive than UAE frameworks, reflecting Saudi Arabia’s more cautious approach to virtual asset market development.

Financial institutions in Saudi Arabia dealing with virtual assets (such as banks processing virtual asset transactions for customers) must comply with SAMA guidance and applicable AML/CFT obligations. The SAMA Virtual Assets guidance is an evolving document that reflects the regulator’s risk concerns.

For VASPs seeking to operate in Saudi Arabia, the current regulatory environment means that formal licensing pathways may be limited compared to the UAE. Businesses should engage directly with SAMA and relevant Saudi authorities to understand the current regulatory requirements.

AML for VA Transactions

AML obligations for virtual asset transactions in the UAE arise under the applicable regulatory framework (VARA, DFSA or FSRA) and reflect FATF requirements.

Customer due diligence must be conducted when establishing a business relationship with a customer or when conducting occasional transactions above applicable thresholds. CDD includes identification and verification of identity, beneficial ownership verification where applicable, and understanding the nature and purpose of the relationship.

Transaction monitoring must cover virtual asset transactions to identify suspicious activity. The characteristics of virtual asset transactions, including pseudonymity, speed and cross-border reach, require monitoring systems designed for the specific risks of virtual asset activity.

Sanctions compliance for virtual assets requires screening against applicable sanctions lists at onboarding and on an ongoing basis. The pseudonymous nature of some virtual asset transactions does not reduce sanctions screening obligations.

Record keeping must be maintained for all CDD information and transaction records to support investigations and regulatory requests.

For VASPs operating across multiple UAE jurisdictions, the AML programme must satisfy the requirements of each applicable regulator.

Peer-to-Peer Crypto Exchange Risks

Peer-to-peer (P2P) cryptocurrency exchanges, which facilitate direct transfers between users without a central intermediary, present specific AML challenges.

Absence of intermediary controls: Unlike licensed exchanges, P2P platforms do not hold customer funds or control transactions. This means that AML controls that apply to licensed exchanges (CDD, transaction monitoring, STR reporting) may not apply in the same way to the P2P platform itself.

Jurisdictional ambiguity: P2P platforms may operate from jurisdictions with limited VA regulation, creating ambiguity about which regulatory framework applies.

Use in layering: Criminals may use P2P exchanges to break the chain between illegal proceeds and subsequent transactions, making attribution more difficult.

Regulatory authorities in the UAE are examining P2P activity and considering how AML obligations should apply. Licensed VASPs that interface with P2P platforms face particular scrutiny.

UAE as Regional VA Hub

The UAE has positioned itself as a regional hub for virtual asset businesses, attracting significant VASP interest from both global operators and regional businesses.

This positioning reflects several factors:

Comprehensive regulatory framework: VARA’s establishment as a dedicated regulator, along with DFSA and FSRA frameworks, provides clarity for operators.

Geographic advantage: The UAE’s location between key markets in Asia, Europe and Africa supports cross-border virtual asset activity.

Regulatory engagement: VARA’s engagement with the industry through rulebook development, guidance publications and fintech forums demonstrates a regulatory approach that balances innovation with risk management.

FATF alignment: The UAE’s regulatory approach aligns with FATF Recommendations, supporting operators seeking to meet international standards.

For CCOs at VASPs, the regulatory clarity in the UAE comes with high compliance expectations. Regulated VASPs must implement comprehensive AML programmes that satisfy VARA, DFSA or FSRA requirements.

Cross-Border VA AML Compliance

VASPs operating across the UAE and Saudi Arabia face the challenge of managing AML obligations under two different regulatory approaches.

In the UAE , the regulatory framework is defined for each jurisdiction (VARA, DFSA or FSRA). VASPs must identify which framework applies to their activities and comply accordingly.

In Saudi Arabia , the more restrictive approach means that VASP operators may face significant regulatory barriers. Financial institutions in Saudi Arabia dealing with virtual assets must comply with SAMA guidance.

Cross-border transfers between UAE VASPs and counterparties in other jurisdictions require compliance with the travel rule and applicable sanctions obligations. The use of IVMS101 facilitates compliant cross-border transfers.

Sanctions compliance for virtual assets is particularly complex given the speed of transactions and the potential for pseudonymity. VASPs must maintain robust sanctions screening programmes that can operate at the speed of virtual asset transactions.

Practical Recommendations

For compliance leaders at VASPs and financial institutions with virtual asset exposure, several steps are critical.

Determine applicable regulatory framework. Identify which regulatory authority has jurisdiction over your activities (VARA, DFSA, FSRA or SAMA) and understand its specific requirements.

Implement FATF-aligned AML programme. Regardless of the specific regulator, FATF Recommendation 15 and its Interpretive Note provide the baseline for AML obligations.

Deploy travel rule compliance. Implement IVMS101 for cross-VASP transfers and develop policies for how travel rule obligations apply to your specific operations.

Monitor for P2P and DeFi risks. Understand how P2P activity and decentralised finance (DeFi) platforms may create AML exposure for your operations.

Engage with regulators proactively. The UAE’s regulatory authorities, particularly VARA, engage actively with the industry. Proactive engagement can clarify expectations and reduce regulatory risk.

Conclusion

The UAE and Saudi Arabia have taken significantly different approaches to virtual asset regulation, with the UAE establishing a comprehensive multi-regulator framework and Saudi Arabia maintaining a more cautious stance.

For VASPs and financial institutions with virtual asset exposure in the Gulf, the regulatory landscape requires careful navigation. In the UAE, multiple regulatory frameworks (VARA, DFSA, FSRA) each set specific requirements that must be identified and complied with. In Saudi Arabia, engagement with SAMA guidance is essential for financial institutions, while formal VASP licensing pathways remain limited.

The FATF’s continued focus on virtual assets, including its June 2026 targeted update, signals that international AML standards for VASPs will continue to strengthen. Compliance leaders must ensure their AML programmes keep pace with both regulatory developments and the evolving tactics of those who would misuse virtual assets.

This article was accurate at the time of publication in August 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.