TL;DR:
- The SCA regulates virtual asset activities on the UAE mainland, excluding free zones like DIFC and ADGM.
- Licensing is mandatory for specific VASP activities, with strict capital and ongoing compliance requirements.
- UAE's layered regulatory system includes federal and emirate-level authorities, influencing licensing strategies.
The UAE is often portrayed as a permissive environment for digital assets, but that perception is misleading. Most virtual asset businesses operating on the UAE mainland are subject to federal oversight, and the Securities and Commodities Authority (SCA) sits at the centre of that regulatory structure. Understanding precisely what the SCA regulates, which activities require its approval, and how it interacts with other UAE regulators is not optional for any serious VASP. This guide maps the SCA's authority, licensing requirements, capital obligations, and its relationship with VARA, DIFC, and ADGM so you can plan your market entry or expansion with clarity.
Key Takeaways
| Point | Details |
|---|---|
| SCA is the main UAE crypto regulator | The SCA oversees nearly all mainland UAE virtual asset licensing and compliance outside financial free zones. |
| Licensing is role- and zone-specific | SCA licensing requirements depend on your activity and whether you operate in mainland, Dubai, or within a free zone. |
| Capital and compliance duties are stringent | Be prepared for significant paid-up capital outlays and strict, ongoing regulatory obligations. |
| Multi-regulator strategies improve success | Effective UAE crypto businesses seek experts who grasp SCA, VARA, DIFC, and ADGM frameworks. |
What is the SCA? Scope and authority in the UAE crypto sector
The Securities and Commodities Authority (SCA) is the principal federal body responsible for regulating capital markets and, since the UAE's landmark virtual assets legislation, digital asset activities across the UAE mainland. Its statutory remit covers all emirates outside the two major financial free zones, making it the default regulator for the vast majority of the UAE's geographic territory.
As confirmed by Gulf News, the SCA is the federal regulator for virtual assets and VASPs in the UAE mainland, explicitly excluding financial free zones such as the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). This distinction is fundamental. If your business is incorporated and operates on the mainland, the SCA is your primary regulatory counterpart, regardless of which emirate you are based in.
The SCA's authority is not exercised in isolation. It operates within a broader federal framework and actively coordinates with other regulators to ensure consistent standards across the UAE. Key points about its scope include:
- UAE mainland jurisdiction: The SCA's remit covers all VASP activities conducted or offered from the UAE mainland.
- Exclusion of financial free zones: DIFC and ADGM maintain independent regulatory frameworks under their own financial services authorities and fall outside SCA's direct oversight.
- Coordination with VARA: For Dubai specifically, the SCA has established a formal partnership with the Virtual Assets Regulatory Authority (VARA), which operates as the emirate-level regulator.
- FATF/AML alignment: The SCA's regulatory standards are calibrated to meet Financial Action Task Force (FATF) recommendations and UAE Federal AML Law requirements.
"The SCA and VARA partnership reflects the UAE's commitment to a coherent, internationally aligned virtual assets regulatory environment, ensuring that oversight is consistent whether a firm operates in Dubai or across the broader mainland."
This architecture means that the UAE does not have a single, monolithic crypto regulator. Instead, it operates a layered system where federal authority (SCA) coexists with emirate-level and free zone frameworks. Knowing which layer applies to your business model is the first step in any licensing strategy.
SCA licensing: Who requires it and key regulated activities
Understanding the SCA's scope sets the stage for precisely determining which business models require its licensing. The SCA's 2025 guidelines make clear that SCA licensing is mandatory for a defined set of VASP activities, and operating without approval carries significant legal and financial risk.
The following activities require an SCA licence under the current framework:
- Virtual asset platform operation — running an exchange or trading platform for VAs.
- VA brokerage — intermediating VA transactions between buyers and sellers; see specific broker requirements for detail.
- Safe custody of virtual assets — holding or controlling VAs on behalf of clients; custody standards are stringent.
- Portfolio management — managing VA portfolios on a discretionary or advisory basis.
- Financial consulting — providing investment advice related to virtual assets.
- Exchange and transfer services — facilitating the conversion or transfer of VAs.
- VA dealership — buying and selling VAs as principal.
| Activity | SCA-regulated | VARA-regulated | Both |
|---|---|---|---|
| Platform operation | Yes (mainland) | Yes (Dubai) | If operating across both |
| Brokerage | Yes (mainland) | Yes (Dubai) | If operating across both |
| Safe custody | Yes (mainland) | Yes (Dubai) | If operating across both |
| Portfolio management | Yes (mainland) | Yes (Dubai) | If operating across both |
| Financial consulting | Yes (mainland) | Yes (Dubai) | If operating across both |
| VA dealership | Yes (mainland) | Yes (Dubai) | If operating across both |
The mandatory licensing steps under the SCA framework follow a structured sequence:
- Confirm that your activity falls within the SCA's regulated categories.
- Incorporate a UAE mainland legal entity with the appropriate corporate structure.
- Prepare and submit the full licensing application, including business plan, compliance policies, and governance documentation.
- Demonstrate minimum capital adequacy (see next section).
- Pass the SCA's fit-and-proper assessment for key personnel.
- Receive conditional approval and satisfy any remaining conditions before full licence issuance.
Pro Tip: Do not assume that a UAE free zone licence or a foreign regulatory approval substitutes for SCA approval on the mainland. Each jurisdiction requires its own authorisation, and conflating them is one of the most common and costly errors we see.
Capital requirements and ongoing compliance for SCA-licensed VASPs
Once SCA licensing needs are clear, financial readiness and ongoing obligations become the next biggest concern. The SCA's 2025 guidelines set out specific minimum paid-up capital requirements for each licensed activity, and these figures are non-negotiable at the application stage.
| Licensed activity | Minimum paid-up capital (AED) |
|---|---|
| Platform operator (standalone) | 1,000,000 |
| Platform operator (combined activities) | 5,000,000 |
| VA brokerage | 2,000,000 |
| Portfolio management | 3,000,000 |
| Safe custody | 4,000,000 |
| Financial consulting | 500,000 |
| VA dealership | 30,000,000 |
As the SCA's 2025 guidelines confirm, firms must also maintain operating capital sufficient to cover at least six months of projected operational expenses. This is a separate requirement from paid-up capital and is assessed independently.
Ongoing compliance obligations for SCA-licensed VASPs include:
- AML/KYC programmes: Firms must implement robust anti-money laundering and know-your-customer procedures aligned with FATF standards and UAE Federal AML Law.
- Periodic reporting: Regular financial and operational reports must be submitted to the SCA on the timelines it specifies.
- External audits: Annual audited financial statements are required, conducted by an SCA-approved auditor.
- Incident notification: Material changes to business structure, ownership, or operations must be notified to the SCA promptly.
- Technology and cybersecurity standards: Platform operators and custodians face additional requirements around system resilience and data protection.
- Governance frameworks: Boards and senior management must meet fit-and-proper standards on an ongoing basis, not just at the point of licensing.
For platform compliance guidance and practical licensing tips relevant to 2026, detailed resources are available. The SCA's framework for navigating its regulatory requirements is also worth reviewing before you begin your application.
Pro Tip: Underestimating operational expenditure is a frequent pitfall. Many applicants focus on meeting the minimum paid-up capital figure but fail to account for the six-month OPEX cushion. Build a realistic financial model before submitting your application to avoid delays or rejection.
SCA, VARA, DIFC and ADGM: How UAE's crypto regulators fit together
Equipped with compliance foundations, understanding the regulatory patchwork is vital for multi-jurisdictional operations. The UAE's crypto regulatory landscape is deliberately tiered, and each layer has distinct authority, geographic scope, and licensing consequences.
Here is how the key regulators divide responsibility:
- SCA (federal, mainland): Governs all VASP activities across UAE mainland emirates, excluding financial free zones. Firms in Abu Dhabi, Sharjah, Ras Al Khaimah, Fujairah, Ajman, and Umm Al Quwain that are not within a designated free zone fall under direct SCA oversight.
- VARA (Dubai, emirate-level): Regulates virtual asset activities within the Emirate of Dubai, outside DIFC. As confirmed by Gulf News, VARA holds a delegation from the SCA for Dubai, meaning a VARA licence effectively satisfies SCA requirements for UAE-wide operations from Dubai.
- DFSA (DIFC): The Dubai Financial Services Authority regulates financial services, including certain virtual asset activities, within the DIFC free zone. It operates independently of both the SCA and VARA.
- FSRA (ADGM): The Financial Services Regulatory Authority governs activities within Abu Dhabi Global Market. Like the DFSA, it is entirely independent of the SCA's mainland framework.
- CBUAE: The Central Bank of the UAE oversees payment-related virtual asset activities and stablecoin regulation at the federal level.
The practical consequence of this structure is significant. If you are licensed by VARA in Dubai, you can conduct regulated VASP activities across the UAE without a separate SCA application. However, if you are based in another emirate's mainland, you must engage the SCA directly. For VARA supervision and Dubai-specific compliance, the requirements differ meaningfully from mainland SCA processes.
DICF and ADGM licences, by contrast, do not carry any automatic recognition by the SCA or VARA for mainland or Dubai operations. A firm licensed in ADGM that wishes to serve clients on the UAE mainland must obtain separate SCA authorisation.
Pro Tip: If your business model spans multiple emirates or includes both free zone and mainland operations, co-ordinate legal advice across all relevant frameworks from the outset. Attempting to retrofit compliance after launch is far more costly and disruptive than building the correct structure from the start.
What most guides miss: SCA rules are a strategic business advantage
Most commentary on SCA compliance frames it as a cost centre or a bureaucratic obstacle. That framing is short-sighted. In our experience advising VASPs across the UAE and internationally, firms that pursue SCA licensing proactively, rather than reactively, consistently achieve better commercial outcomes.
An SCA licence signals to institutional counterparties, banking partners, and sophisticated investors that your firm meets federal regulatory standards. This credibility is not trivial. As the SCA has aligned its framework with FATF recommendations, SCA-licensed firms are increasingly accepted by correspondent banks and international partners who would otherwise decline to engage with unregulated entities.
The SCA's standards have also raised the quality floor across the industry. Firms that invest in genuine compliance infrastructure, rather than minimum viable documentation, find that the process builds internal discipline that pays dividends in operational resilience. Reviewing licensing strategies with this long-term perspective in mind changes how you approach the application entirely. Compliance is not the ceiling of your ambition. It is the foundation.
Get expert support: Navigate SCA crypto licensing with confidence
For readers ready to act, tailored professional guidance can streamline and de-risk the licensing process. The SCA's framework is detailed, the capital requirements are substantial, and the documentation standards are exacting. Attempting to navigate this without specialist support adds unnecessary risk to your timeline and budget.
CRYPTOVERSE Legal Consultancy works exclusively in virtual assets and digital finance regulation. Our team advises clients on SCA licensing from pre-application through to full approval, covering corporate structuring, AML/CFT policy design, governance frameworks, and ongoing compliance management. For broader digital asset legal advice across VARA, DFSA, FSRA, and international frameworks, we provide end-to-end support tailored to your business model and risk profile. Contact us to discuss your SCA licensing pathway.
Frequently asked questions
Do all UAE crypto firms need an SCA licence?
All VASP activities conducted on the UAE mainland, outside DIFC and ADGM, require SCA authorisation. Firms operating solely within Dubai under VARA, or within DIFC or ADGM, follow separate and independent frameworks.
How long does SCA licensing approval take for VASPs?
Timelines vary based on application completeness and the complexity of the business model, but SCA approval typically ranges from several weeks to several months. Thorough preparation materially reduces processing time.
What is the main difference between SCA and VARA regulation?
The SCA governs the UAE mainland, while VARA regulates Dubai outside DIFC. As confirmed, VARA holds a delegation from the SCA for Dubai operations, whereas DIFC and ADGM operate entirely independently under their own authorities.
What ongoing compliance is expected from SCA-licensed VASPs?
Licensed VASPs must maintain AML/KYC programmes, submit periodic reports, undergo annual audits, and notify the SCA of material changes. The SCA's ongoing standards are aligned with FATF recommendations and UAE Federal AML Law.
Recommended
- Crypto Regulations in UAE - VARA, DFSA, FSRA, SCA & CBUAE Explained
- UAE crypto licensing tips 2026: navigate approvals fast - Cryptoverse Legal Consultancy
- Virtual Assets in the UAE: The Role of the SCA and Key Regulated Activities - Cryptoverse Legal Consultancy
- UAE Blockchain Legal Frameworks 2026: Navigate Licensing - Cryptoverse Legal Consultancy
- Dubai Business Licensing Step by Step Guide 2026