Fintech, Payments and Digital Assets in the UAE

The regulator and jurisdiction your fintech routes to - payments, stablecoins or virtual assets, onshore or in a financial free zone.

• No single licence, no single regulator. You route by activity (payments / stored value / AED payment token / virtual asset) and by jurisdiction (CBUAE or CMA onshore; VARA in Dubai; DFSA in DIFC; FSRA in ADGM). That routing decision largely sets cost, timeline and feasibility.
• Payments and e-money = CBUAE onshore. Retail payment services sit under the CBUAE Retail Payment Services and Card Schemes Regulation (RPSCS, in force 15 July 2021); wallets and prepaid under the Stored Value Facilities framework (SVF, Circular 6/2020).
• AED stablecoin vs foreign stablecoin are not the same product. Under the CBUAE Payment Token Services Regulation (PTSR, issued 7 June 2024, effective 6 July 2024), an AED-referenced Dirham Payment Token can be a domestic means of payment; a foreign (e.g. USD) payment token cannot be used to buy goods or services in the UAE - only to purchase virtual assets.
• Virtual assets in Dubai = VARA - across Dubai mainland and free zones except the DIFC; seven licensed activities under the Virtual Assets and Related Activities Regulations 2023 (current version effective 19 June 2025).
• DIFC and ADGM are separate common-law regimes (DFSA and FSRA), outside VARA and CMA; ADGM also offers a Fiat-Referenced Token regime and DLT Foundations.
• One Dubai licence can reach the whole UAE. Under the CMA-VARA cooperation agreement (signed 5 September 2024, when the regulator was the SCA), a VARA licence brings default federal CMA registration - subject to coordination protocols and regulatory checks, not an automatic passport - while DIFC and ADGM sit outside both.
• 0% free-zone tax is conditional. It applies only to a Qualifying Free Zone Person on qualifying income (de minimis: the lower of AED 5m or 5% of revenue), and regulated banking, finance and insurance are excluded activities - so a regulated free-zone fintech often pays 9% on that income.

The most expensive mistake in this sector is incorporating first and asking about the licence second. Setting up in a crypto-friendly free zone - the DMCC Crypto Centre, RAK DAO, the DIFC Innovation Hub or ADGM - gives you a company and an address; it does not, by itself, give you permission to provide a regulated virtual-asset or payment service. That permission comes from the activity's regulator (CBUAE, VARA, the DFSA or the FSRA), on its own timeline and its own evidence. Pick the formation home before you have confirmed that the regulator and the activity fit, and you can spend six months and real money building the wrong vehicle. Fix the regulator and the activity first; choose the formation home to match.

For a virtual-asset or fintech builder, the jurisdiction choice is a choice between parallel regimes, and it drives market access, applicable law and feasibility. VARA is Dubai's purpose-built VA regulator, covering Dubai mainland and free zones but not the DIFC, and pairs with CMA mutual recognition (below) for UAE-wide reach. The DIFC, regulated by the DFSA with its own common-law courts, runs Crypto Token and Investment Token regimes; from 12 January 2026 the DFSA scrapped its prescribed Recognised Crypto Tokens list in favour of a firm-led, documented suitability test - so the question "is BTC or ETH recognised in the DIFC?" becomes "does the firm's suitability assessment pass?" ADGM, regulated by the FSRA, operates one of the world's earliest VA frameworks (2018, repeatedly updated): spot-VA activities, a dedicated Fiat-Referenced Token (FRT) stablecoin regime carrying reserve, redemption, white-paper and assurance duties, and the DLT Foundations Regulations (issued 2 October 2023) - a legal-entity wrapper for blockchain foundations and DAOs, among the first such frameworks globally. Both the DIFC and ADGM sit outside VARA and CMA.

Onshore, outside the financial free zones and outside Dubai, virtual assets fall to the federal CMA. Under the CMA-VARA cooperation agreement (signed 5 September 2024, when the regulator was the SCA), a VARA licence brings default federal CMA registration - subject to coordination protocols and regulatory checks rather than an automatic passport - so a Dubai-licensed virtual-asset service provider (VASP) can generally serve the whole UAE; firms operating from other Emirates license directly with the CMA. As a rough decision rule: VARA suits a Dubai-centric VA business wanting UAE-wide reach; the DIFC or ADGM suit a builder wanting common-law comfort, institutional capital, FRT issuance or a DLT-foundation token structure; and CBUAE onshore is the home if the core product is money, payments or an AED stablecoin rather than virtual assets.

Mapped to the route you select above, a typical entry runs across:

• Activity-and-jurisdiction routing - confirming the precise regulated activity, the binding regulator (CBUAE / VARA / DFSA / FSRA / CMA) and whether onshore, DIFC, ADGM or Dubai-VARA fits the product and market access.
• The licensing application - the regulator-specific pack (business plan, governance, AML/CFT framework, capital and reserve evidence, fit-and-proper submissions), including an early regulator pre-assessment of feasibility and likely conditions, since regulators gate hard and can return applications.
• Stablecoin and payment-token analysis - under the PTSR, distinguishing a Dirham Payment Token (full CBUAE licence, domestic-payment use) from a Foreign Payment Token (Registered Foreign Payment Token Issuer, VA-purchase-only), and the reserve, redemption and marketing duties.
• VARA activity scoping - which of the seven activities (and the separate Issuance regime) the build triggers, plus the custody segregation and Marketing Regulations constraints.
• Corporate formation and substance - the free-zone or onshore vehicle, ownership, directors and the economic-substance footprint to match the licence.
• Technology and vendor controls - the technology-risk, cyber, key-management and custody controls and the third-party/outsourcing approvals the rulebooks require (in VARA, segregated client wallets; CBUAE and DFSA/FSRA outsourcing rules).
• Tax and VAT structuring - the QFZP analysis (qualifying income, de minimis, the regulated-finance excluded-activity trap) and the VAT-on-virtual-assets position, including any historic back-years from 2018.
• AML/CFT, data and outsourcing - the conduct framework the regulator requires before and after authorisation.
• Founder and investor structure - the cap table, the founder and investor holding structure, and the fit-and-proper and controller approvals the regulator will test.

ATB Corporate advises India-UAE founders, CFOs and general counsel on the activity-and-jurisdiction routing that determines a UAE fintech entry, and on the structuring, tax and corporate-formation workstreams that follow. We map the regulated activity to the binding regulator - CBUAE, VARA, the DFSA, the FSRA or the CMA - frame the licensing application and supporting governance, analyse the PTSR stablecoin position and the VARA activity scope, and work through the QFZP and VAT-on-virtual-assets questions alongside formation and substance. We do not determine regulatory outcomes - the regulators gate applications and set their own timelines - and we keep the analysis current and dated. A typical starting point is a regulatory route map: the activity classification, a jurisdiction shortlist, a licence-or-no-licence assessment, the regulator pathway, and the AML, tax and substance implications - settled before any licensing spend.