Crypto funding compliance for brokers in UAE / Dubai
CMA (formerly SCA) · VARA · DFSA · FSRA (by zone) · Depends on zone: CMA (mainland), DFSA (DIFC), FSRA (ADGM), VARA (Dubai VAs)
Four regulators in one country: a large opportunity, with a perimeter map you need to read closely.
On this page
Which of the four regulators covers youThe CMA, DFSA, FSRA and VARA divide the country between them, and a brokerage licence from one is not a virtual-asset permission from another.
The UAE is the fastest-growing booking centre for brokers targeting MENA and Asia, but 'licensed in Dubai' can mean four different things. The Capital Market Authority regulates mainland securities and FX. The DFSA covers the DIFC and the FSRA covers ADGM. VARA, the world's first standalone virtual-asset regulator, covers virtual-asset activities in Dubai outside the DIFC.
The federal regulator was the Securities and Commodities Authority until Federal Decree-Laws 32 and 33 of 2025, effective 1 January 2026, renamed it the Capital Market Authority. Older sources, including many compliance manuals still in circulation, say SCA, as does the mainland regulator's former domain, which now redirects. If a document you rely on names the SCA as the current regulator, check how old the rest of it is.
The split matters for crypto funding. A brokerage licence from the CMA or DFSA does not authorise virtual-asset services, and handling client crypto directly can require a VARA permission (or an FSRA or DFSA crypto permission). As elsewhere, the common structure is a licensed VA intermediary that handles conversion. The UAE's federal AML framework, including goAML reporting, still holds the broker responsible for monitoring the funds it credits.
The federal AML law changed in 2025Federal Decree-Law No. 10 of 2025 repealed the 2018 decree that almost every broker's AML manual still cites.
From 2018 to 2025 the UAE's AML statute was Federal Decree-Law No. 20 of 2018, now repealed. Federal Decree-Law No. 10 of 2025, issued 30 September 2025 and in force two weeks after publication, replaced it, and its Article 41 repeals the 2018 decree in terms. If your policy document cites the 2018 law as current, it is citing a repealed statute. An examiner who opens your manual at page one will notice that before anything else.
A supervisor will not fine a broker for a stale citation. They will conclude that the manual has not been read since it was written, and read the rest of it in that light.
What UAE banks ask a brokerThe UAE left the FATF grey list by demonstrating enforcement, and its banks onboard brokers accordingly.
UAE supervision has modernised fast and enforcement is real. Demonstrating that is how the country got off the FATF grey list. Banks and PSPs in the UAE run demanding onboarding on brokers, and crypto-funding flows are a standard line of questioning. Clear screening records and a documented decision policy shorten those conversations considerably.
KYTGate works the same whichever regulator you answer to. The same screening, policy and signed-receipt trail serves a CMA examiner, a DFSA visit or a bank's compliance questionnaire. When your VA partner supplies KYT results, they are recorded as evidence instead of being lost in an inbox.
Questions brokers ask about UAE / Dubai
Do the UAE regulators allow brokers to accept crypto deposits?
It depends on which regulator licenses you. A CMA (formerly SCA), DFSA or FSRA brokerage licence does not by itself authorise virtual-asset activity; touching client crypto directly may need a VARA permission (Dubai, outside the DIFC) or the relevant FSRA/DFSA crypto permission. The common structure is a licensed VA intermediary handling conversion. Read your own licence conditions and confirm with UAE counsel before accepting the first deposit.
Which rules apply to crypto funding for a UAE broker?
Your zone regulator's rulebook (the CMA, formerly the SCA, or DFSA, FSRA or VARA), the federal AML law (since 2025, Federal Decree-Law No. 10 of 2025, which repealed the Federal Decree-Law No. 20 of 2018 that most manuals still cite) and its implementing regulations, goAML reporting to the UAE FIU, and UAE and UN sanctions obligations including targeted financial sanctions. The federal AML framework holds the broker responsible for monitoring the funds it credits even when a VA intermediary handles the crypto leg.
What evidence do UAE regulators and banks expect?
Documented screening of crypto-origin funds, a written decision policy, a record per deposit of what was checked and decided, and STR filings through goAML when warranted. UAE banks and PSPs run demanding onboarding on brokers, and crypto-funding flows are a standard line of questioning. A per-deposit record shortens those conversations.
What is the Travel Rule status in the UAE?
The UAE applies it through the federal AML framework and the zone regulators' rulebooks. VARA's is the most specific and the easiest to check: its rulebook requires a VASP to obtain and hold required originator and beneficiary information before initiating a virtual-asset transfer above AED 3,500. The DIFC and ADGM regimes have their own provisions. A broker using a licensed VA intermediary generally receives that data rather than originating it; how much you must keep depends on your zone and structure, so check with counsel.
What does KYTGate provide for a UAE broker?
A regulator-agnostic record: the same screening, versioned policy and signed receipt serve a CMA examiner, a DFSA visit or a bank questionnaire. Your VA partner's KYT results are recorded as evidence, Travel Rule data it hands over is stored as received, and the STR draft is exported in a goAML v4-style shape for completion in the FIU portal. KYTGate does not file it.
General information, not legal advice. Where an answer says to check with counsel, the point depends on your structure and needs a lawyer's view.
Sources
Official documents only: the regulator, the FIU, a government legislation portal or an official law-report site. We read each one before citing it here. Where a document is dated or superseded, the note says so.
- Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation FinancingThe AML law in force. Article 41 repeals Federal Decree-Law No. 20 of 2018; Article 42 sets entry into force two weeks after publication.
- Two Federal Decree-Laws on the Capital Market Authority and the Regulation of Capital Markets · CMAThe regulator's own announcement of Federal Decree-Laws 32 and 33 of 2025, effective 1 January 2026, including "Renaming the Securities and Commodities Authority as the Capital Market Authority".
- FATF Travel Rule · VARA RulebookVARA's Travel Rule provision, with its AED 3,500 threshold above which originator and beneficiary information must be obtained and held.
- Rulebooks · VARAThe four mandatory rulebooks and the eight activity-specific ones. Which apply to your VA partner depends on what it is licensed to do.
- Crypto Token Regulation · DFSAThe DIFC regime, including the January 2026 changes that moved token recognition from a DFSA-maintained list to firm-level assessment.
- Guidance: Regulation of Virtual Asset Activities in ADGM · FSRAThe ADGM position, current version dated June 2025. It applies the AML Rulebook in full to authorised persons but does not itself set out Travel Rule mechanics.
- Services, including the goAML portal · UAE Financial Intelligence UnitThe FIU's own description of goAML, the UNODC-built system through which suspicious transaction and activity reports are filed.
Links to third-party and government sites; KYTGate does not control their content and they may move. If one is dead or has been superseded, tell us and we will fix the page.