Regulatory overview
- Scope
- Dubai · DIFC
- Authorities
- Business environment
- Latest regulatory change
Dubai has two regulatory perimeters that must be distinguished. VARA regulates virtual asset activities across the emirate, including its free zones, except DIFC. Within DIFC, financial services fall under the DFSA. Real estate tokenization led by the Dubai Land Department retains a controlled scope and does not permit every platform to issue, distribute or trade property tokens.
In Dubai, a digital asset business should first identify where it will operate and which functions it will perform for clients. VARA regulates virtual asset activities in the emirate, with a decisive territorial exception: the Dubai International Financial Centre, or DIFC, has its own financial regulator, the DFSA. A free-zone commercial licence and permission to provide regulated services address different questions.
This distinction is particularly important when combining custody, trading and real estate tokenization. A project may need to coordinate intermediary authorisation, asset rules and the involvement of the property register. This guide explains how those requirements fit together and what official programmes and registers establish before a business relies on another platform’s regulatory status.
Which framework applies inside and outside DIFC
Dubai Law 4/2022 and the Virtual Assets and Related Activities Regulations establish VARA's framework for virtual asset activities in or from Dubai. Its scope includes the emirate's free zones, except Dubai International Financial Centre, or DIFC. The entity's location and the services it actually performs determine the applicable regime.
Within DIFC, the DFSA regulates financial services that may involve Crypto Tokens or Investment Tokens according to their classification. A VARA licence and a DFSA authorisation are therefore not interchangeable. Applicable federal legislation must also be considered, particularly where a product performs payment functions or seeks to operate outside the permission's territorial scope.
What VARA, DFSA and the property register supervise
VARA authorises and supervises activities within its regulations, including custody, exchange, brokerage and management. DIFC is a distinct financial jurisdiction and the DFSA is its financial supervisor. The Dubai Land Department, or DLD, oversees real estate registration and its tokenization project. Each authority's role follows a particular legal function rather than the technology used by a project.
The Central Bank of the UAE maintains a separate payment token services framework. Article 2.7 distinguishes commercial use of dirham-denominated tokens from permitted use of foreign tokens to purchase virtual assets or their derivatives. The latter must not be extended to every commercial payment, and a VARA licence must not be assumed to permit issuance or distribution of every stablecoin.
In practice, three assessments should be separated: the company being established, the activity it will provide to clients and the product it plans to offer. Company registration does not settle the other two. If the token represents a security, fund unit or property-related right, the rules governing that right and the authorities involved in issuance or transfer must also be identified.
What authorisation a project needs to operate
For new firms, VARA's published procedure distinguishes Approval to Incorporate from the VASP licence. The first stage allows incorporation and operational preparation, but does not permit virtual asset activities to begin. The subsequent licence may contain operational conditions. Those conditions and the authorised activities must be checked before the service is marketed.
VARA's general rulebooks are supplemented by activity-specific rules. The application must explain governance, beneficial ownership, financial resources, controls and technology. In DIFC, amendments applying from 12 January 2026 place responsibility on firms to document Crypto Token suitability under the relevant rules. The DFSA provides separate treatment for Fiat Crypto Tokens; trading on another platform is not sufficient evidence of suitability.
The VARA public register, consulted on 10 October 2026, identifies active licences and their activities, including exchange, brokerage and custody. It distinguishes these from in-principle approval, which does not permit operations or client servicing. This provides evidence of effective access to the framework without extending an entity’s permission to its subsidiaries, products or partners.
How tokens connect with real estate rights
The DLD announced its real estate pilot in March 2025, involving VARA and other bodies. In February 2026 it announced a second phase involving resale mechanisms. VARA's alert of 19 February clarifies that this remains a controlled testing and evaluation phase. Participation requires the relevant licences and approvals; commercial references to the programme do not establish that a firm has been admitted.
Assessing an investment requires identifying the property, registered right, relationship with the token, transfer restrictions and party responsible for implementing holders' rights. A pilot involving official records does not turn every property token into a title deed. Resale within the programme also does not guarantee buyers, stable valuations or access to an unrestricted secondary market.
In DIFC, the Digital Assets Law 2024 addresses the property law treatment of digital assets. That recognition must be distinguished from financial services authorisation and the rules governing property outside DIFC. Analysis must connect the digital asset with its contract, issuer and competent registry, without attributing effects from several distinct regimes to a single permission.
Which controls must continue during operations
VARA's framework combines corporate governance, compliance and risk management, technology and information, and market conduct. Activity-specific rules define the firm's obligations. Documentation must support assessment of key control, client asset protection, continuity and incident response. Outsourcing requires an explicit allocation of responsibilities and sufficient access to information for supervision.
Promotion of tokenized real estate products also falls within the regulatory perimeter. VARA warns against claims of participation or approval that official communications do not confirm. For a technology business, the work must distinguish software development from offering, facilitating or marketing the product. That allocation must match the actual operations and the entity contracting with users.
What to check before launching a project
Before launch, each platform screen and function should be connected to a legal responsibility. The participants offering the product, receiving orders, holding keys or facilitating transfers should match the contracts and permissions. User, asset and territorial restrictions must be enforceable through the systems, including where external suppliers are involved.
Neos Legal’s Chambers 2026 analysis helps place Dubai within the UAE regulatory landscape. For an individual transaction, the decision should also rely on the competent authority’s register and conditions. Pilot participation, preliminary approval and an operational licence establish different positions; commercial materials should describe them accurately.
Pre-launch review should also cover title and encumbrances, transfer conditions, payments and distribution markets. A change of product, addition of custody or solicitation in another country calls for a renewed assessment. This helps keep the technical design and commercial scope aligned with the permissions and rights supporting the transaction.
To understand how this framework applies to your project, discuss your case with our team.
Key takeaways
- Dubai free zones are within VARA’s perimeter except DIFC.
- Approval to incorporate does not authorise virtual asset services.
- Phase II of the real estate project remains subject to controlled testing and evaluation.
- A local permission does not provide automatic access to clients or activities in other countries.
Regulatory milestones
DFSA introduces its Investment Token framework
DIFC’s regime addresses digital representations with securities or derivative characteristics. The financial classification of the right determines its treatment.
VARA regulations published
VARA publishes its virtual asset activity framework, with common requirements and service-specific rules.
DIFC Digital Assets Law takes effect
Law 2 of 2024 governs property aspects of digital assets. It is separate from financial services authorisation and property registration outside DIFC.
Real estate tokenization pilot announced
DLD announces the pilot programme involving VARA and other bodies.
Prypco and Ctrl Alt licences recorded by VARA
The register dates the licences of Prypco FZE and Ctrl Alt Solutions DMCC to 24 May. The current entry distinguishes their activities; these permissions do not approve every property product or collaboration.
DFSA Crypto Token amendments
DIFC’s updated framework applies, including firm-level suitability assessments according to token type.
VARA clarifies Phase II scope
The authority confirms that controlled testing and evaluation continue and warns against unauthorised participation claims.
Frequently asked questions
No. VARA’s scope includes Dubai free zones except DIFC. Within DIFC the DFSA framework must be assessed. A commercial incorporation licence and permission to provide financial services serve different purposes.
Not automatically. VARA maintains Phase II as controlled testing and requires the applicable approvals. The entity’s participation and the specific service it may perform must be checked against official sources.
An IPA is conditional approval within the authorisation process. According to VARA’s public register, its holder cannot start operations or service clients until it obtains the full VASP licence. Even after licensing, the authorised services and conditions must be checked. A company’s announcement of regulatory approval is not sufficient.
It depends on the represented right and its connection with the competent register. A token may confer an interest, a claim or another contractual position without direct ownership of the property. Transaction documents, encumbrances, transfer restrictions and enforcement arrangements must be checked. Technology and the token’s marketing name do not replace that assessment.
Since the changes effective on 12 January 2026, firms must perform and document Crypto Token suitability assessments under DFSA rules and monitor suitability continuously. The authority no longer maintains the previous prescribed list of Recognised Crypto Tokens. This does not remove category-specific requirements or authorise an unlicensed firm to provide services.
