Four Perimeters, One Country: Which Regulator Your Virtual-Asset Model Answers To

The borders below are not inferred. Each one is published by the regulator that owns it, and in the Dubai case by two regulators independently describing the same line the same way — which is rarer than it sounds.

VARA's Regulations define the Emirate as all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre. The footer of every VARA page says the same thing in plainer words: VARA is the sole authority regulating virtual assets across Dubai's free zones and mainland, except within the jurisdiction of DIFC.

The federal regulator describes VARA's perimeter identically. Its own 2024 release on the cooperation agreement records that VARA is responsible for regulating, supervising and overseeing virtual assets and related activities across Dubai, including Special Development Zones and Free Zones, excluding the Dubai International Financial Centre. Two regulators publishing the same border in their own words is about as settled as this gets.

So the general prohibition attaches to territory, not to zone branding. VARA's Regulations state that no entity may carry out any virtual-asset activity by way of business, or purport to do so, in the Emirate, unless it is licensed by VARA, is an employee acting for a licensed employer, or is an Exempt Entity — and Exempt Entity is defined as government and government-affiliated public, non-profit and charitable bodies. It is not a small-firm, own-funds or business-to-business exemption, and it is routinely misread as one.

This is the asymmetry that catches groups out. The federal virtual-asset regime reaches ordinary commercial free zones — the regulator's own guidance says its approach applies to virtual assets used as an investment instrument in the state, with the exception of financial free zones, and the release on the underlying Cabinet decisions says the federal remit covers the sector in the UAE including in free zones.

DIFC and ADGM are financial free zones, and they are outside the federal virtual-asset perimeter entirely. A commercial free zone in Sharjah, Ajman or Ras Al Khaimah is not. The two share a word and nothing else that matters here.

One deliberate crossing exists. The federal regulator's fintech sandbox expressly admits companies registered in UAE financial free zones, subject to conditions — so a DIFC or ADGM entity can enter the federal sandbox while remaining outside the federal licensing perimeter. The sandbox page also states, in terms, that participation does not constitute licensing or imply regulatory approval. It is a testing arrangement, not a route in.

The Payment Token Services Regulation describes payment token services as digital payment services in the UAE comprising three categories: payment token issuance, payment token conversion, and payment token custody and transfer. Article 2(1) then states that no person shall perform any payment token service within the UAE, or directed to persons in the UAE, unless licensed or registered by the Central Bank to perform that service.

That paragraph settles the overlap question by itself. It is a prohibition on every person, and it carries no exception for a firm already licensed under another UAE regime — so an existing virtual-asset licence is not an answer to a payment-token question. The regulation also spells the point out, but at the paragraphs that follow: Article 2(2) and Article 2(3) each state that the prohibition applies to all persons, including any person acting in the course of performing virtual-asset activities for which it is licensed or regulated by the federal securities regulator or a local licensing authority.

VARA cross-refers to the same boundary from its side. All virtual-asset activities relating to UAE central bank digital currencies remain under the sole and exclusive purview of the Central Bank, and VARA's issuance rulebook states that the issuance of a fiat-referenced virtual asset purporting to maintain a stable value against the dirham shall not be approved under that rulebook and remains with the Central Bank. VARA also retains a standing power to classify a virtual asset as being regulated by the Central Bank.

A caution on this section, stated plainly because it is the corner of the map that has moved most recently. We cite the Central Bank's own rulebook text here rather than a summary of it, and anyone building a stablecoin or settlement model should have that text re-verified at the regulator before committing to a structure. This is the one boundary in the cluster where a stale reading is likely to be an expensive reading.

Founders reach for geography to escape a regime, and the regulators have written that door shut from both sides. VARA states that a licence is required whether the activity is offered to customers resident in the Emirate or to global customers where the activity is permissible — so serving only offshore clients does not remove the Dubai perimeter. The Central Bank's prohibition reaches services performed within the UAE or directed to persons in the UAE — so being offshore does not remove the UAE perimeter either.

And the obligations travel with the licence. VARA's Regulations provide that where a VASP carries out a licensed activity in any jurisdiction outside the Emirate, it must comply with the Regulations, Rules and Directives in respect of that activity as a minimum standard, and that VASPs are obligated to meet the higher of the two regulatory standards at all times. For a group with EU, UK or Singapore arms, that clause can import obligations no Dubai-only reading of the file would ever surface.

VARA publishes eight virtual-asset activities: Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, Management and Investment Services, Transfer and Settlement Services, and Issuance Category 1. They are named for the service being provided.

The federal framework issued on 13 April 2026 also publishes eight: Dealing in Virtual Assets as Principal, Dealing in Virtual Assets as Agent, Providing Custody, Arranging Custody, Arranging Investment Deals, Providing Investment Advice, Portfolio Management, and Operating a Multilateral Trading Facility. They are named in securities-regulation vocabulary.

The regulator's own announcement describes that as expanding the regulated activities from three to eight. Note the count, because it does not obviously line up with the regulator's other live document: the earlier guidelines still on the same site publish six licence types — platform operator, safe custody, financial consulting, portfolio management, broker and dealer. Licence types and regulated activities are not the same unit of measurement, and with the operative resolution unpublished there is no way to reconcile the two from the public record. We report both counts rather than pick one.

They are not the same eight, and a firm cannot map one onto the other by name. Any sentence claiming there are eight regulated virtual-asset activities in the UAE, without naming which regulator, is describing two different lists at once. The federal framework also runs five modules — General Requirements, Conduct of Business, Alternative Trading System, anti-money-laundering and counter-terrorist financing, and Prudential Requirements — with the Alternative Trading System module extending to conventional multilateral trading facilities for securities and to facilities dedicated to tokenised securities.

The Securities and Commodities Authority is now the Capital Market Authority. The federal government portal states it directly and points to Federal Decree-Law No. 32 of 2025 concerning the Capital Market Authority; the regulator's own 2026 chairman's resolutions recite that decree-law alongside Federal Decree-Law No. 33 of 2025 on the regulation of the capital market. Requests to the old domain now resolve to the new one.

The rebrand is incomplete on the regulator's own estate — older PDFs, contact addresses, letterheads on current resolutions and at least one menu item still read SCA. Neither name is wrong at the moment, which means paperwork, constitutional documents and marketing may need re-papering and the timing of that is a judgement call rather than a rule.

One practical trap worth naming: the domain cma.gov.ae belongs to a different body entirely, Abu Dhabi's Creative Media Authority. The federal securities regulator publishes at sca.gov.ae and uaecma.gov.ae. Content and diligence files that link the wrong one are commoner than you would expect.

The map above is publishable. Your position on it is not, and the gaps are specific rather than general.

Where in or from Dubai ends is not resolved by any published test. A company with an Abu Dhabi licence, staff in Dubai and clients in both emirates does not have an answer on the public record, and neither does a financial-free-zone entity marketing outward.

Whether a Dubai licence carries onward into the wider UAE rests on a single permissive phrase in a 2024 press release — that a VARA-licensed provider can be registered by default with the federal regulator to service the wider UAE. That is permissive language about a registration step, published before the April 2026 federal framework existed, and it should not be described as automatic UAE-wide coverage.

The operative federal instrument is a further gap. The eight activity names come from the regulator's own press release; the resolution that defines them is named in later resolutions but its text is not on the regulator's published pages, and the older guidance still on the site describes a superseded six-licence regime. So whether a given model sits inside Arranging Custody or Arranging Investment Deals, or outside both, is not answerable from what is published — and no transition mechanism for firms licensed under the previous regime has been published either.

Classify the token. Classify the activity. Choose the regime that the classification puts you in. Then choose the territory, and only then the zone and the package. Done in that order the zone decision is nearly mechanical; done in reverse it is a re-licensing event dressed up as a saving.

Every step above the zone is a structuring judgement made on your facts against regulators who each reserve discretion over the outcome. That is a conversation, not a form — talk to us before the entity exists.