Five bodies split UAE crypto oversight: VARA (Dubai, excluding DIFC), DFSA (DIFC), FSRA (ADGM), CBUAE (payment tokens and stablecoins nationally), and the CMA, which took over federal securities and investment tokens from the SCA on 1 January 2026. Free zone licensing authorities like DMCC or IFZA aren't your AML regulator — they license the company, not the activity.
The federal law raised the baseline
Federal Decree-Law No. 10 of 2025 gave virtual asset service providers the same core AML duties banks already carry: risk assessment, customer due diligence, screening, monitoring, suspicious transaction reporting through goAML, record-keeping, and independent audit. Cabinet Resolution No. 134 of 2025 filled in the operational detail — including the federal Travel Rule.
The key point for anyone reviewing their existing framework: your regulator's rulebook doesn't replace this federal law, it builds on top of it. A programme designed around only one layer is incomplete.
The AED 3,500 Travel Rule threshold
Above AED 3,500, both the sending and receiving VASP must hold originator and beneficiary information under VARA and federal rules. ADGM is different — no threshold applies there at all, so data must travel with every transfer. Firms with entities in both Dubai and ADGM need separate threshold settings for each, not one shared configuration.
Four things you simply can't do
- Execute transfers involving privacy or anonymity-enhancing tokens
- Transact with counterparty VASPs unregulated in their home market
- Commingle client assets instead of holding them 1:1
- Market into the UAE without proper licensing, even from a DIFC or ADGM base
Eight years of records, not five
Most reporting entities in the UAE keep records for five years. Dubai VASPs specifically need eight. It's a detail that's easy to miss in AML manuals adapted from generic templates, and it has real implications for how customer and transaction data needs to be stored and retrieved.
What a complete programme needs
A risk assessment built for virtual asset typologies, an AML policy that maps to both your regulator and federal law, KYC that reaches wallet-level attribution, continuous screening of people and addresses, blockchain analytics that actually informs decisions, a working Travel Rule process, transaction monitoring tuned for on-chain behavior, an MLRO with genuine authority, completed goAML registration, eight-year retention capability, evidenced training, and an independent audit.
The cost of falling short
Fines under Article 17 of the Decree-Law run from AED 10,000 to AED 5,000,000 per violation — and that's separate from licence conditions, cease-and-desist directions, or the commercial fallout of a compliance finding surfacing in a banking relationship or investor due diligence file.
Read the complete regulator breakdown and FAQ
If your current AML framework hasn't been reviewed since the new law took effect, Ontrax can walk you through a gap analysis.
Category: Business/Finance Tags: AML Compliance, Crypto Regulation, UAE Business, VARA, Fintech Law
Sign in to leave a comment.