Bitcoin, DeFi and Crypto Regulation in the UAE: Part 2

This is the second part in a multi-part series of articles by our Cairo, Egypt-based MENA Editor Ahmed discussing the regulation of decentralized finance and cryptocurrency assets in the United Arab Emirates and more broadly, the Gulf Cooperation Council (GCC) countries.

For an overview of Islamic finance and its relationship to Bitcoin, click here.

-- James Smith

Publisher and Editor-in-Chief, ExitStrategy.World

January 31, 2024

The Abu Dhabi Global Market (ADGM) released its Guiding Principles for the Financial Services Regulatory Authority’s Approach to Virtual Asset Regulation and Supervision on September 22, 2022. These principles influence the FSRA’s risk approach and regulatory interpretation.

In the Dubai International Financial Centre (DIFC), key laws governing licensed businesses include the Regulatory Law 2004, the Law Regulating Islamic Financial Business 2004, the Investment Trust Law 2006, the Collective Investment Law 2010, and the Markets Law 2012. The DFSA, under the Regulatory Law 2004, issued a Rulebook with subsidiary legislation.

The DIFC introduced a consultation in March 2021 on a framework for security tokens, leading to the DFSA's regulatory framework for investment tokens in October 2021. In March 2022, the DFSA proposed a framework for crypto tokens through Consultation Paper No. 143, followed by the implementation of the Crypto Token Regime on November 1, 2022. The Rulebook now defines a crypto token and includes utility tokens, NFTs, and government-issued digital currencies, subject to anti-money laundering regulations. Financial services related to crypto tokens in the DIFC are no longer limited to entities incorporated under DIFC law. Branches of financial institutions can provide crypto token services if authorized by the head office.

Permitted services for crypto tokens in DIFC include dealing, arranging deals, managing assets, advising, operating an exchange, providing custody, arranging custody, operating a clearing house, and operating an alternative trading system. In May 2023, Standard Chartered signed an MOU with DIFC to launch digital asset custody services.

In the Onshore UAE, virtual currency-specific legislation is primarily governed by the UAE Central Bank's 2020 Stored Value Facilities Regulation (SVF Regulation). This regulation covers the storage of non-cash mediums of exchange, including virtual currencies, allowing customers to purchase, transfer, and exchange them for goods and services.

A significant development since 2021 is the introduction of the Virtual Assets Law in the Emirate of Dubai, effective until 2023. Article 6 of this law grants authority to the Virtual Asset Regulatory Authority (VARA) to regulate and oversee virtual asset services, including activities related to management, clearing, settlement, and safekeeping services. While initially focused on exchanges, these activities also intersect with traditional banking and money transmission operations, suggesting the potential for additional regulations in onshore Dubai.

The Virtual Assets (VA) Framework, operational since 2023, aligns with VARA's responsibilities under the Virtual Assets Law. VARA Regulations and Rulebooks outline obligations for Virtual Asset Service Providers (VASPs), covering banking and money transmission services. These obligations extend across various Compulsory and activity-specific Rulebooks, along with the Issuance Rulebook and the MAP Regulations.

In the Dubai International Financial Centre (DIFC), investment tokens pose challenges in fitting within the traditional regulatory framework for fiat currency banking and money transmission services. The DFSA Rulebook defines investment tokens as cryptographically secured digital representations of rights and obligations issued, transferred, and stored using Distributed Ledger Technology (DLT) or similar technology.

The DFSA Rulebook, however, addresses the custody of both investment tokens and crypto tokens by Digital Wallet Service Providers. Specific requirements include the resilience, reliability, and compatibility of the DLT application used for custody, clear identification and segregation of investment tokens for different clients, and the implementation of procedures for confirming client instructions, maintaining records, and conducting reconciliations. These rules apply to both types of tokens.

Digital Wallet Service Providers must ensure that the technology used, along with associated procedures, incorporates adequate security measures, including cybersecurity, for the safe storage and transmission of data related to investment tokens. Additionally, the DFSA introduced a technology audit requirement for Authorized Firms providing services related to crypto tokens.

The DFSA's Money Service regime, established in January 2020, permits previously prohibited activities within the DIFC. However, the DFSA maintains that authorized Money Services Providers cannot use crypto tokens. They are only allowed to use DFSA-recognized Fiat Crypto Tokens for money transmission or executing a payment transaction in the provider's name, not the client's.

In the UAE, anti-money laundering (AML) and countering the financing of terrorism (CFT) laws are governed by federal statutes, the federal penal code, and specific legislation across the country, including financial and commercial free zones. The UAE Central Bank plays a key role in AML, coordinating with various authorities such as the Dubai Multi Commodities Centre (DMCC), the Dubai Financial Services Authority (DFSA), and the Financial Services Regulatory Authority (FSRA).

The AML legislation, notably Federal Decree-Law No. 20 of 2018 and its implementing regulation (Cabinet Decision No. 10 of 2019), has undergone amendments to align with international standards. In the context of virtual assets, the AML Law broadly defines 'funds,' encompassing electronic, digital, or crypto assets. However, the AML Implementing Regulation excludes digital representations of fiat currencies, securities, and other financial assets from the definition of 'virtual assets.'

Penalties for money laundering in the UAE range from monetary fines to imprisonment for up to 10 years, along with confiscation of the funds involved. The AML Law applies broadly to various entities, including financial institutions, designated non-financial businesses and professions, virtual asset service providers (VASPs), and non-profit organizations.

Changes to the AML Law incorporate recommendations from the Financial Action Task Force (FATF), requiring VASPs to be registered if there is a commercial nexus between the legal entity releasing the software protocol and the decentralized finance (DeFi) solutions provider. Operating an unregistered or unlicensed VASP incurs penalties. The UAE Central Bank issued guidance for Licensed Financial Institutions (LFIs) dealing with virtual assets and VASPs, outlining due diligence and enhanced due diligence requirements.

Entities subject to the AML Law must comply with reporting obligations for suspicious transactions, with penalties for intentional or negligent violations. The DFSA has its Anti-Money Laundering, Counter-Terrorist Financing, and Sanctions Module, providing rules for due diligence and procedures, updated through DIFC Law No. 1/2004. Additionally, a specialist Anti-Money Laundering Court has been established within the onshore Dubai Courts.

In the onshore UAE, the SCA Virtual Asset Regulation remains the primary regulation governing virtual currency exchanges nationwide. The regulation outlines requirements for obtaining and maintaining a license for operating a virtual currency exchange, as well as for the listing and trading of virtual currencies.

In Dubai, the Virtual Asset Law mandates VARA to develop general policies and strategies related to dealing and trading in virtual assets. This includes classifying and determining types of virtual assets and virtual tokens, as well as prescribing standards and rules for their trading. The VA Framework, effective since 2023, incorporates VARA's obligations. The VARA Regulations and Rulebooks specify obligations for Virtual Asset Service Providers (VASPs), including those providing exchange services, in alignment with other rulebooks such as Compulsory and activity-specific ones, Issuance Rulebook, and MAP Regulations.

The Enabling Technologies Guidelines by the SCA contain principles for the operation of Distributed Ledger Technology (DLT), including virtual currency exchanges. These cover aspects like governance, auditability, design, anonymity, pseudonymity, management, monitoring, and business continuity. Specific guidelines for DLT are detailed in the guidelines.

The Dubai Multi Commodities Centre (DMCC), a non-financial free zone in Dubai, has played a significant role in fostering a cryptoasset industry. Recognizing proprietary trading in cryptoassets as a licensed activity in 2017, the DMCC Crypto Centre, launched in May 2021 in partnership with CV Labs, has become a hub for blockchain and decentralized finance projects. A Memorandum of Understanding between DMCC and the SCA in March 2021 established a regulatory framework for businesses involved in offering, issuing, listing, and trading cryptoassets in the free zone, including cryptoasset trading platforms. The DMCC provides customized licenses for crypto-related businesses, with the SCA responsible for approvals and regulation in line with the SCA Virtual Asset Regulation.

The DMCC is also working on establishing the first blockchain-enabled precious metals refinery and storage facility in the GCC. This facility will tokenize gold, silver, and other precious metals to back a set of stable coins.

In the Abu Dhabi Global Market (ADGM), the operation of a Multilateral Trading Facility (MTF) involving the trading of Virtual Assets is considered a Regulated Activity under Paragraph 54(1), Chapter 9, Schedule 1 of the Financial Services and Markets Regulations (FSMR). Only Authorised Persons are permitted to conduct Regulated Activities, and those operating an MTF can also provide Custody Services. The Guidance on the Regulation of Virtual Asset Activities provides detailed requirements for MTF operators, including oversight by the Financial Services Regulatory Authority (FSRA). Accepted virtual assets are specific to each authorized person, resulting in bespoke licenses for each authorized person and MTF trading virtual assets.

The FSRA emphasizes extensive regulatory oversight for both start-ups and established exchanges operating in the ADGM. For start-up MTFs, the entire order book and matching engine functionality are subject to FSRA oversight. Existing operational virtual asset exchanges need to determine which parts of their order book and matching engine will come under FSRA regulatory oversight when applying for authorization as an MTF. The FSRA-COBS Rule 8.2.1 outlines various rules that MTFs using virtual assets must comply with, and there is a requirement for the authorized person operating the MTF to maintain a minimum regulatory capital in fiat equivalent to 12 months' operational expenses.

Several entities, including Kraken, BitOasis, Matrix Exchange, DEX, MidChains, and Binance, have obtained permission or licenses from the FSRA to operate in the ADGM.

In the Dubai International Financial Centre (DIFC), the Dubai Financial Services Authority (DFSA) historically regulated exchanges, multilateral trading facilities, and alternative trading platforms. This oversight has been extended to include activities related to investment tokens. Operating an alternative trading platform for investment tokens requires compliance with the same requirements applicable to other types of exchanges. Admitting securities tokens to an exchange or trading platform in the DIFC necessitates the publication of a prospectus in accordance with the DIFC Markets Law 2012.

A technology audit requirement is imposed on all authorized firms operating facilities for investment tokens, relying on Distributed Ledger Technology (DLT) or similar technology for financial services related to investment tokens. The DFSA, in Consultation Paper No. 143, proposed the possibility of operating a crypto trading venue as either an Exchange or an MTF. However, under the Crypto Token Regime, the DFSA clarified that only crypto trading through an MTF is allowed. To operate an MTF facilitating crypto trading, the authorized firm must conduct an appropriateness assessment of the person's skills, expertise, and ability to understand and absorb risks associated with trading crypto.

In June 2021, the Bitcoin Fund listed on NASDAQ Dubai, marking the Middle East’s first indexed cryptocurrency-based fund. The DFSA had previously approved the listing under its securities framework in April 2021.

In the onshore UAE, Dubai's Virtual Asset Law mandates VARA to regulate, supervise, and oversee the issuance, offering, and disclosure processes of Virtual Assets and Tokens. VARA is also tasked with regulating Virtual Asset Service Providers (VASPs), including those offering mining services, and issuing permits to ensure compliance with relevant laws. The VA Framework, effective from 2023, outlines obligations for VASPs providing mining services, covering requirements from VARA Regulations, compulsory and activity-specific rulebooks, the Issuance Rulebook, and the MAP Regulations.

In the Abu Dhabi Global Market (ADGM), there is no specific legislation or regulation governing the mining of cryptoassets. The FRSA Guidance on the Regulation of Virtual Asset Activities in the ADGM explicitly states that the Virtual Asset Framework does not apply to the development, dissemination, or use of software to create or mine a Virtual Asset.

In the Dubai International Financial Centre (DIFC), there is currently no proposed regulation for miners concerning crypto tokens. The DFSA, as noted in Section VII, does not presently allow for the issuance of new crypto tokens but may reconsider this in the future. If the DFSA decides to permit new crypto token issuance in the future, it might introduce a regulatory framework applicable to miners at that time.

In the onshore UAE, the SCA Virtual Asset Regulation remains the primary regulation governing the operation of individuals offering, issuing, or promoting virtual assets. Licensing requirements for such activities are outlined in various articles of the regulations, particularly in Article 14.

In Dubai, the Virtual Asset Law, along with the VARA Regulations and Rulebooks, specifies obligations for Virtual Asset Service Providers (VASPs), including those offering issuing and sponsor services. Guidelines for issuing services are detailed in the Issuance Rulebook, which outlines requirements for registration before issuing permitted virtual assets and other virtual assets. The MAP Regulations detail the obligations on all issuers and sponsors concerning financial promotion activities. The VA Framework, effective from 2023, provides a comprehensive licensing framework for these services.

In the Dubai International Financial Centre (DIFC), financial promotions (marketing of financial products and services) are generally prohibited unless certain requirements are met under Article 41A of the Regulatory Law 2004. Authorized persons are typically responsible for making or approving financial promotions, with limited exceptions subject to additional requirements. The Crypto Token Regime specifically prohibits authorized firms from offering incentives influencing retail clients to trade in crypto tokens or derivatives.

Issuers of securities, including security tokens, are required to have a prospectus complying with DFSA's requirements outlined in the DIFC Markets Law 2012. The rules for prospectuses related to security tokens and crypto tokens have additional requirements. Authorized firms providing financial services for investment tokens and crypto tokens must provide a key features document. The DFSA focuses on already-issued crypto tokens initially, not allowing the issuance of new crypto tokens. However, the DFSA suggests a reconsideration of this in the future. Issuers or developers of crypto tokens can apply to the DFSA to have the crypto token recognized in the DIFC.

As of January 2022, the UAE introduced legal reforms, repealing Federal Decree Law No. 5/2012 on Combatting Cybercrime and replacing it with Federal Decree-Law No. 34/2021 Concerning the Fight against Rumors and Cybercrime (the Cybercrime Law). The new law addresses various offenses related to cryptoasset fraud, including hacking, compromising information systems, unauthorized obtaining of third-party symbols and codes, fabrication of websites, mail, and electronic accounts. It criminalizes acts related to unlicensed cryptocurrency trading and behaviors promoting or encouraging unlicensed dealings in cryptocurrency not officially recognized in the UAE. Federal civil and criminal penalties apply to all cryptoasset activities, and regulated entities must comply with AML/CFT laws.

Regulatory bodies in the UAE, while at the forefront of cryptoasset regulation, caution against dealing with crypto-related financial products. The Securities and Commodities Authority (SCA) and Dubai Financial Services Authority (DFSA) have issued warnings regarding fraud risks in cryptoasset investments, urging investors to exercise caution and undertake due diligence.

In the Abu Dhabi Global Market (ADGM), operators of virtual asset businesses are subject to financial crime offenses, including making misleading statements and market abuse. The Financial Services Regulatory Authority (FSRA) regulates cryptoassets in the ADGM and issues warnings about suspicious companies to reduce financial crime risks.

To combat crypto fraud, Dubai established a specialist criminal court focused on combating money laundering and a virtual asset crime department within the police force. The Dubai police collaborate with a cryptocurrency trading platform and industry experts to combat crime in the crypto space. The UAE's civil courts, including those in the Dubai International Financial Centre (DIFC) and ADGM, have measures such as freezing and proprietary injunctions and asset disclosure orders to assist victims of fraud. Onshore courts in the UAE can also make orders, such as precautionary attachments similar to freezing orders, to support fraud victims.

The future of virtual currency in the UAE presents several notable developments and considerations:

VARA Establishment and Interaction:

There is considerable interest in how the Virtual Asset Regulatory Authority (VARA) establishes itself.

The industry is closely observing how VARA's jurisdiction interacts with regulatory bodies like the Securities and Commodities Authority (SCA) and the Central Bank.

The response of the industry to the new Virtual Assets (VA) Framework will be a key focus.

DFSA Consultation Outcome:

The outcome of the Dubai Financial Services Authority (DFSA)'s Consultation Paper No.150, covering proposals on money services, crypto tokens, and crowdfunding, is expected later in the year.

ADGM Consultation Outcome:

The outcome of the Abu Dhabi Global Market (ADGM)'s Consultation Paper No.3 of 2023 on Proposals for a Legislative Framework for Distributed Ledger Technology Foundations, applicable to issuers of non-regulated utility tokens, is anticipated later in the year.

Digital Dirham Strategy:

The UAE Central Bank launched its strategy for 'The Digital Dirham' in March 2023.

Phase one involves the soft launch of mBridge for real value cross-border transactions, proof-of-concept work for bilateral bridges with India, and proof-of-concept work for domestic Central Bank Digital Currency issuance covering wholesale and retail usage.

From a jurisprudential standpoint:

Cryptocurrency Payments in Damages:

A Dubai court awarded damages in cryptocurrency in October 2022, reflecting the increasing integration of cryptocurrencies into legal proceedings.

Crypto Mining Investment Dispute:

A landmark case in April 2023 dealt with accounting for fluctuating cryptocurrency values in the context of a crypto mining investment dispute.

Sharia-Compliance in Crypto Sale Agreement:

A case in the Ras Al Khaimah (RAK) court involved the rescission of a cryptocurrency sale agreement based on it not being recognized as a commodity or currency under Sharia law.

Upcoming DIFC Court of Appeal Case:

In January 2024, the DIFC Court of Appeal will hear an appeal (Huobi MENA & Ano v. Tabarak Investment Capital Limited & Ano), providing guidance on various industry topics, including the valuation of losses for misappropriated digital assets and best practices for fiduciaries and custodians of digital assets.

--Ahmed

MENA Editor, ExitStrategy.World

Cairo, Egypt

January 30, 2024

Republished February 8, 2025

Disclaimer/s: The above article is provided to ExitStrategy.World's global audience for informational purposes only. None of the articles on the ESW Patreon or opinions expressed on any other ESW social channel shall be construed as legal or tax advice in the United Arab Emirates or any other jurisdiction. Always conduct your due diligence before investing in or establishing a fintech company. When in doubt, always consult a legal or tax professional.