Digital asset regulation and tokenization in Oman

A business seeking to issue a token or provide virtual asset services in Oman must separate AML registration from product authorisation. The 2023 instructions cover VASP services, while the 2026 securities reform concerns a different perimeter.

That distinction changes project preparation. A tokenized investment needs identified rights and a securities-law assessment; a payment service also involves the central bank. The VARF consultation should not be treated as evidence of an available comprehensive licence.

What the VASP instructions cover and what remains pending

Decision E/35/2023, issued on 6 June 2023, establishes registration and anti-money laundering and counter-terrorist financing obligations for virtual asset providers. Articles 1 and 2 cover exchange, transfers, custody and issuance-related services. They exclude digital representations of fiat currency, securities and other assets already regulated and subject to prevention requirements.

The Virtual Assets Regulatory Framework, VARF, was consulted on in July 2023. Its subsequent comprehensive adoption has not been established in the sources examined. The 2026 securities regulations develop a different regime: they do not automatically turn the VASP consultation into an available licence or establish that every token offering is permitted.

Which functions belong to FSA and the central bank

The Financial Services Authority, FSA, established under Royal Decree 20/2024, assumed the former Capital Market Authority's functions. References to CMA in 2023 documents must be read alongside that institutional change. The National Centre for Financial Information receives suspicious-transaction reports; it does not replace the registration supervisor.

Article 3 of the instructions requires Central Bank of Oman, CBO, approval before dealing in virtual assets for payments, including stored-value facilities. The 2025 Banking Law replaced the former 2000 law. Neither FSA registration nor a historical central-bank warning independently determines the current classification of a payment service.

What registration requires and how approval is established

Articles 4 to 9 of the registration instructions cover Oman-incorporated entities, individuals with a place of business and persons offering relevant services in Oman. Applications include identity and ownership, managers, criminal records, services, systems, risk assessments and compliance policies. They also require information about the licensed local bank the provider will use.

Article 8 provides for a decision within thirty days after completing the information; silence constitutes rejection. This is not a promise of an end-to-end one-month process. Registration must be evidenced by a certificate. Failure to commence, inactivity or non-compliance can lead to cancellation; the individual status must be checked without equating an application with effective registration.

How securities reform affects a tokenized issuance

Decision E/11/2026 implements the 2022 Securities Law and applies from 27 July 2026. It regulates institutions, services, funds and issuers, with a general six-month adjustment period and bank-specific arrangements. FSA explains customer-asset segregation and stronger supervision; those protections should not be extended to every VASP without assessment.

Tokens representing securities, interests or property rights require an identified issuer, obligation, register, transfer mechanism and enforcement arrangements. The sources examined do not establish that a token transfer independently changes land ownership. The reform permits authorisation of certain innovative activities through a sandbox, but its conditions and specific permission remain necessary.

Which controls must accompany each transfer

Decision E/35/2023 requires risk assessment before launching products or technologies, identification of customers and beneficial owners, controls and audit. Article 4 prevents dealing in assets concealing the originator's or beneficial owner's identity, transaction value or nature. The restriction needs to be applied to actual operations rather than replaced with commercial labels.

Articles 49 to 54 govern transfer information and its secure transmission to the beneficiary institution. Providing required information after the event is not permitted. Procedures must address incomplete transfers and reporting to the competent centre. These duties affect transfer design and counterparty selection even where the network technically allows a transaction.

What to confirm before offering the service in Oman

Prepare a classification of the token, services and payment flows before selecting providers. The application must identify owners, responsible officers, systems, risks and the banking relationship; retain evidence of effective registration and any additional approvals required by the model.

In transfer architecture, establish how required information is obtained and sent and how incomplete transactions are handled. Also confirm current rules and permission scope with FSA: the reviewed sources do not establish subsequent comprehensive adoption of VARF and the instructions’ official publication date has not been confirmed.

To understand how this framework applies to your project, discuss your case with our team.