Multi-jurisdiction crypto compliance: frameworks and UAE rules

TL;DR:

• Operating a virtual asset service provider across multiple jurisdictions requires systematic compliance mapping due to divergent regulations and the FATF Travel Rule's uneven adoption worldwide. Even a robust UAE licence does not guarantee compliance in other markets, as each jurisdiction imposes distinct activity scope, AML thresholds, and data requirements. Building an integrated control framework aligned with each regulator's obligations ensures resilience and adaptability in navigating cross-border legal landscapes.

Operating a virtual asset service provider across multiple jurisdictions is not simply a matter of stacking licences. Even the most diligent crypto startups, having secured a robust UAE licence, can find themselves exposed the moment their operations touch a market where the rules diverge. The FATF Travel Rule's uneven adoption across countries creates what regulators call the "Sunrise Issue," a compliance gap that no single jurisdiction's framework can fully resolve on its own. This article sets out how VASPs can approach multi-jurisdiction compliance systematically, with a particular focus on the UAE's layered regulatory environment.

Key Takeaways

Understanding the multi-jurisdiction compliance challenge

Multi-jurisdiction compliance, for a VASP, means satisfying the legal and regulatory obligations imposed by every country in which it operates, solicits clients, or processes transactions. This is categorically different from the compliance challenge facing a traditional financial institution. Crypto assets move across borders in seconds, and the regulatory perimeter for a VASP is defined not only by where it is incorporated, but also by where its users are located, where its servers process data, and where its counterparty VASPs are licenced.

The concept of a compliance "surface" is useful here. Every licenced activity, every user jurisdiction, and every technology system adds to the total surface area that must be governed. A VASP offering exchange, custody, and transfer services to clients in the UAE, the EU, and Singapore simultaneously carries three distinct regulatory surfaces, each with its own rulebook, threshold requirements, and supervisory expectations.

The UAE takes a deliberately layered approach to managing this complexity. Rather than issuing a single omnibus regulation, the country distributes oversight across five regulators: VARA, SCA, DFSA, FSRA, and CBUAE, each with a distinct statutory remit. SCA-regulated activities in the UAE cover a different set of virtual asset services than those governed by VARA in Dubai, which means a VASP must first determine which regulator has jurisdiction over its specific activity set before it can begin mapping its obligations.

Compliance requirements across jurisdictions typically diverge in three principal ways:

• Scope of regulated activities: What counts as a "virtual asset service" varies. Staking, DeFi facilitation, and NFT trading are regulated in some markets and unregulated in others.
• AML/CFT thresholds and controls: Customer due diligence (CDD) trigger amounts, beneficial ownership rules, and suspicious transaction reporting formats differ materially between the UAE Federal AML Law, the EU's AML Directives, and Singapore's MAS Notice PSN02.
• Technology and data obligations: Data localisation requirements, cybersecurity audit standards, and wallet screening mandates are jurisdiction-specific and often conflict with one another.

"A VASP that maps its obligations only to its home jurisdiction's rulebook will, by definition, have compliance gaps wherever its operations extend beyond that jurisdiction's borders."

Understanding the UAE compliance frameworks in detail is the necessary starting point, but it is not the finishing line.

Key components: UAE and global regulatory frameworks

With a shared understanding of compliance scope, it is worth examining the frameworks that actually govern VASP compliance worldwide and in Dubai specifically.

VARA's regulatory architecture is the most structurally sophisticated in the UAE. The VARA Company Rulebook establishes a layered rulebook ecosystem in which every licenced VASP must comply with a set of cross-cutting rulebooks that apply regardless of activity, as well as activity-specific rulebooks that govern particular services. The cross-cutting rulebooks cover four principal domains:

1. Compliance and Risk Management Rulebook: Sets out the governance structure, risk appetite framework, compliance officer requirements, and internal audit obligations.
2. Technology and Information Rulebook: Governs cybersecurity controls, system resilience, wallet custody standards, and data integrity requirements.
3. Market Conduct Rulebook: Addresses fair dealing, disclosure obligations, conflicts of interest, and client asset protection.
4. Company Rulebook: The overarching instrument that ties the ecosystem together and establishes entity-level obligations.

Activity-specific rulebooks then add a further layer of obligations depending on whether the VASP is licenced for exchange services, broker-dealer activities, custody, lending, or transfer and settlement. This means a VASP licenced for both exchange and custody must comply with at least six distinct rulebooks simultaneously.

Globally, most frameworks adopt a single-instrument model, which is simpler to navigate in isolation but creates mapping challenges when a VASP must reconcile it with VARA's layered structure. The VARA transfer and settlement guidance is a practical illustration of how activity-specific obligations layer onto the cross-cutting baseline.

One area where VARA's framework is notably sophisticated is its treatment of outsourcing. The VARA Company Rulebook explicitly recognises that outsourcing arrangements must be calibrated to risk, and that VASPs cannot transfer regulatory responsibility to a third party simply by contracting out a compliance function. This has direct implications for VASPs using third-party AML screening vendors, cloud-based KYC platforms, or outsourced compliance officers.

For a more detailed profile of VARA's regulatory remit and supervisory approach, the VARA regulator profile provides a structured overview of its powers and expectations.

The FATF Travel Rule and the global 'Sunrise Issue'

The FATF Travel Rule requires VASPs to collect, verify, and transmit originator and beneficiary information alongside virtual asset transfers above a defined threshold (USD/EUR 1,000 in most jurisdictions). It is the single most operationally demanding standard in global VASP compliance, and its implementation is deeply uneven.

The "Sunrise Issue" is the term used to describe the compliance gap that arises when one VASP is subject to Travel Rule obligations but its counterparty VASP in another jurisdiction is not yet legally required to comply. When a UAE-licenced VASP sends a transaction to a VASP in a jurisdiction that has not yet enacted Travel Rule legislation, the UAE VASP cannot obtain the required beneficiary data from the counterparty. This is not a failure of internal controls; it is a structural gap in the global regulatory architecture.

The practical impact on UAE VASPs is significant. If you process outbound transfers to counterparties in jurisdictions with partial or no Travel Rule implementation, you face a binary choice: apply enhanced due diligence (EDD) to compensate for the missing data, or restrict the transaction type altogether. Neither option is cost-free.

Pro Tip: Maintain a live counterparty VASP registry that records each counterparty's Travel Rule status, jurisdiction, and last verification date. This enables your compliance team to apply the correct risk treatment automatically rather than making ad hoc decisions at the point of transaction.

The FATF Best Practices on Travel Rule Supervision set out supervisory expectations for how VASPs should manage Sunrise Issue scenarios, including the use of risk-based approaches and enhanced counterparty due diligence. Similarly, Travel Rule due diligence mechanics in multi-jurisdiction flows typically require counterparty VASP verification and escalated controls when the counterparty is not yet Travel Rule obligated.

The VARA rules for asset transfers set out how Dubai-licenced VASPs are expected to handle transfer compliance specifically, and these rules must be read alongside the global Travel Rule landscape rather than in isolation. For a broader view of how to reconcile these frameworks, navigating global crypto frameworks provides practical orientation across multiple regulatory regimes.

Building an effective multi-jurisdiction compliance programme

After reviewing the practical pitfalls, the question becomes how top-performing VASPs build resilient, adaptive compliance across borders. The answer lies in architecture, not just policy.

The most effective approach is a single control catalogue with jurisdiction-specific obligation mapping. Rather than maintaining separate compliance manuals for each jurisdiction, a VASP builds one master set of controls and then maps each control to the specific obligations it satisfies in each jurisdiction. This reduces duplication, makes gap analysis faster, and ensures that when a new jurisdiction is added, the team only needs to identify which existing controls apply and which new ones are required.

VARA's own rulebook structure makes the case for this approach explicitly. The VARA Company Rulebook distinguishes between cross-cutting obligations (which apply to all licenced VASPs regardless of activity) and activity-specific obligations (which apply only to VASPs holding specific permissions). This layered architecture is directly analogous to a controls-to-obligations model.

The steps to implement a robust multi-jurisdiction compliance programme are as follows:

1. Define your regulatory perimeter. Identify every jurisdiction in which you hold a licence, solicit clients, or process transactions. Include jurisdictions where your counterparty VASPs are located.
2. Map your activity set to each jurisdiction's regulated activities list. Not every service you offer will be regulated in every jurisdiction. Document which activities trigger obligations in which markets.
3. Build your cross-cutting control catalogue. Start with the controls that satisfy the broadest set of obligations: AML/CFT programme, KYC procedures, transaction monitoring, sanctions screening, and governance framework.
4. Layer activity-specific controls. For each licenced activity, add the controls required by each jurisdiction's activity-specific rules.
5. Conduct a gap analysis against each jurisdiction's rulebook. Identify where your existing controls do not fully satisfy a specific obligation and document the remediation plan.
6. Establish a regulatory change monitoring process. Assign responsibility for tracking regulatory updates in each jurisdiction and triggering a re-mapping exercise when material changes occur.
7. Test and audit the programme annually. Internal audit should assess both the design and operating effectiveness of each control, with findings reported to the board.

Pro Tip: Use a compliance management platform that supports obligation tagging at the control level. This allows you to run instant gap reports when a new jurisdiction is added or an existing rulebook is updated, rather than conducting manual cross-referencing exercises.

Regulatory compliance for platform operators in the UAE provides further detail on the specific obligations that apply to exchange and platform operators under UAE law. For a broader licensing orientation, Web3 legal compliance in the UAE covers the licensing pathway from pre-application to full approval.

Our take: what most VASPs get wrong about global compliance

The most persistent error we observe in practice is the assumption that a strong home-jurisdiction licence automatically confers a degree of global compliance credibility that reduces the need for jurisdiction-specific mapping. It does not.

A VARA licence is one of the most rigorous and credible VASP licences in the world. The VARA licensing framework imposes demanding governance, technology, and conduct standards that compare favourably with any equivalent regime. But a VARA licence does not satisfy MiCA's transfer of funds requirements. It does not replace a Singapore MAS licence for services directed at Singaporean users. It does not eliminate the need for FCA registration if you market to UK retail clients. Each jurisdiction's regulator applies its own nexus test, and a UAE licence is not a passport.

The second error is treating compliance mapping as a one-time exercise. Regulatory frameworks for virtual assets are changing faster than in almost any other sector. VARA issued significant rulebook updates in 2024 and 2025. MiCA's full application brought new obligations for EU-facing VASPs. The FCA's crypto financial promotions regime introduced new marketing restrictions. Each of these changes requires a re-mapping exercise against your control catalogue, not simply a policy update.

The third, and perhaps most underestimated, error is failing to invest in the technology and legal infrastructure needed to keep obligations visible. VASPs that manage their compliance obligations in spreadsheets or static policy documents consistently fail to detect gaps before regulators do. The VASPs that sustain regulatory approval across multiple jurisdictions are those that treat compliance architecture as a live, managed system rather than a filing exercise.

Expert legal support for seamless multi-jurisdiction compliance

Multi-jurisdiction VASP compliance is a specialist discipline. The frameworks are dense, the interactions between them are non-obvious, and the cost of getting it wrong includes licence suspension, regulatory fines, and reputational damage that is very difficult to recover from.

CRYPTOVERSE Legal Consultancy provides end-to-end legal support for VASPs navigating the UAE's regulatory landscape and expanding into global markets. Our team advises on VARA regulations and licensing, designs controls-to-obligations compliance architectures, drafts AML/CFT policies aligned with FATF standards and UAE Federal AML Law, and engages directly with regulators on behalf of clients. We also provide cross-border legal support across more than 30 jurisdictions, including MiCA, MAS, FCA, and FINTRAC frameworks. Whether you are building your first compliance programme or stress-testing an existing one, our digital asset legal consultancy team is equipped to help you stay ahead of the rules.

Frequently asked questions

What is the 'Sunrise Issue' in global crypto regulation?

The Sunrise Issue refers to the compliance gap created when some countries implement the FATF Travel Rule at different times, leaving VASPs unable to obtain required transfer data from counterparties in non-compliant jurisdictions. It is a structural problem, not an operational one, and requires risk-based mitigations rather than simple policy fixes.

How does the Dubai VARA rulebook ecosystem affect a VASP's compliance?

Every VASP licenced by VARA must comply with cross-cutting rulebooks covering compliance and risk management, technology and information, and market conduct, plus any activity-specific rulebooks relevant to its permitted services. This layered structure means compliance obligations multiply with each additional licenced activity.

What is the top practical risk for VASPs with cross-border clients?

When a client's jurisdiction has not implemented the Travel Rule, VASPs must apply enhanced due diligence or restrict the transaction type to manage the compliance gap. Failing to do so exposes the VASP to regulatory censure in its home jurisdiction even if the counterparty jurisdiction imposes no equivalent obligation.

Can VASPs outsource compliance functions under VARA?

Yes, but the VARA Company Rulebook requires that outsourcing arrangements are calibrated to the level of risk involved, and VASPs remain fully responsible for compliance outcomes regardless of which functions are contracted to third parties.

Recommended

• Cross-border crypto compliance: Essential rules explained
• Crypto Regulations in UAE - VARA, DFSA, FSRA, SCA & CBUAE Explained
• Step-by-step guide to crypto regulatory compliance in the UAE
• Corporate structuring for UAE crypto firms: key strategies