Web3 regulation examples: Guidance for startups and VASPs

TL;DR:

Navigating web3 regulation requires matching business activities with appropriate jurisdictional frameworks.

UAE's CMA and Dubai VARA have distinct activity-based licensing models with strict token restrictions.

International regimes like EU MiCA and UK FCA shape global compliance strategies beyond local laws.

Navigating web3 regulatory compliance is one of the most demanding challenges facing crypto startups and established virtual asset service providers (VASPs) today. Regulations are fragmenting at pace: different jurisdictions impose distinct definitions, licensing thresholds, capital requirements, and token restrictions, all of which are subject to revision with little notice. Choosing the wrong framework, or misreading its scope, creates material legal and financial exposure. This article provides a structured, practical comparison of the UAE's leading regulatory models alongside key international frameworks, so you can make informed decisions about your compliance strategy and licensing roadmap.

Key Takeaways

Point	Details
Licensing is activity-specific	Web3 regulations define permitted activities in detail, not by asset alone.
Prohibitions matter	Privacy and algorithmic tokens are broadly excluded by leading UAE regimes.
Rulebooks guide compliance	VASPs must navigate multiple, sometimes overlapping, rulebooks for each activity.
International alignment	Comparing UAE and global frameworks reveals gaps and best practices to inform compliance strategy.

How to evaluate web3 regulatory frameworks

Before comparing specific regimes, you need a consistent set of criteria for assessing them. Regulatory frameworks are not interchangeable, and applying the wrong model to your business structure wastes resources and creates regulatory risk.

Start by mapping your regulated activities. Web3 activities typically fall into several categories for licensing purposes:

Exchange and brokerage services: Buying, selling, or facilitating trades in virtual assets
Custody services: Safeguarding client virtual assets or private keys
Issuance activities: Minting, offering, or distributing tokens to investors or users
Portfolio management and investment advice: Managing client holdings or advising on virtual asset investments
Transfer and settlement services: Facilitating payments or cross-border transfers using virtual assets
Lending and borrowing: Offering credit facilities or yield products secured by virtual assets

Each of these activities triggers different licensing requirements depending on jurisdiction. The type of asset also matters significantly. A utility token may face fewer restrictions than a stablecoin or a security token, and certain asset classes such as privacy tokens or algorithmic stablecoins are outright prohibited in several regimes.

The second dimension is geography. Where your users are located often determines which regulations apply, irrespective of where you are incorporated. A Dubai-licensed exchange serving European retail clients may still need to assess its obligations under the EU's Markets in Crypto-Assets Regulation (MiCA).

Regulatory models can be broadly divided into principle-based frameworks, which set general standards and expect firms to interpret them, and rules-based frameworks, which prescribe specific conduct, capital ratios, and process requirements. Most mature web3 regimes now combine elements of both. Understanding which approach governs your target jurisdiction helps calibrate your compliance infrastructure.

You can explore the UAE web3 legal advantages to see why many VASPs prioritise UAE licensing before expanding internationally.

Pro Tip: Start by identifying which regulated activities your business actually performs, then check local authority requirements first. Build outward from there to map overlapping obligations in secondary markets. Attempting to design a global compliance framework without anchoring it in a specific jurisdiction's requirements typically results in a structure that satisfies none of them fully.

UAE CMA (SCA) VASP framework: Comprehensive regime and prohibited tokens

The UAE Capital Markets Authority, formerly operating as the Securities and Commodities Authority (SCA), introduced in 2026 a comprehensive VASP licensing regime with eight distinct regulated activities, consolidating what had previously been a more fragmented approach to virtual asset oversight at the federal level.

The eight licensed activities under the CMA VASP framework are:

Dealing as principal: Trading virtual assets on your own account
Dealing as agent: Executing trades on behalf of clients
Custody of virtual assets: Holding or safeguarding client assets
Arranging custody: Connecting clients with custodial service providers
Portfolio management: Discretionary management of client virtual asset portfolios
Investment advice: Providing personalised recommendations on virtual assets
Operating a virtual asset market: Running a trading platform or exchange
Arranging deals: Facilitating investment transactions without direct execution

You can review the full scope of SCA regulated activities and how they apply to specific business models.

Capital requirements under the CMA framework are risk-stratified. Custodial VASPs, given the elevated risk profile of holding client assets, face materially higher minimum capital thresholds than non-custodial service providers such as advisers or arrangers. This reflects the regulator's recognition that asset safety is the most consequential operational risk in virtual asset markets.

The CMA framework also imposes clear token prohibitions. Privacy tokens, which obscure transaction details, and algorithmic stablecoins, which maintain their peg through automated supply mechanisms rather than reserve assets, are outright prohibited. Utility tokens and non-fungible tokens (NFTs) are subject to restrictions rather than outright bans, with specific conditions governing how they may be offered or traded.

The CMA's rulebooks are structured across three principal areas: general regulatory obligations, business conduct requirements, and capital adequacy standards. This layered structure means a firm seeking full exchange and custody licensing must comply with all three layers simultaneously.

Regulated activity	Capital basis	Token restrictions	Rulebook layer
Dealing as principal	Moderate minimum capital	No privacy/algorithmic tokens	General + Business conduct
Custody of virtual assets	Higher minimum capital	Strict asset eligibility rules	All three layers
Portfolio management	Moderate minimum capital	Eligible assets only	General + Business conduct
Operating a virtual asset market	Higher minimum capital	No prohibited token classes	All three layers
Investment advice	Lower minimum capital	Eligible assets only	General + Business conduct

Firms pursuing VASP licensing in the UAE under the CMA framework should begin their pre-application assessment early, as capital structuring and corporate governance documentation require significant preparation time.

Dubai VARA: Activity-based licensing and rulebook compliance

Dubai's Virtual Assets Regulatory Authority (VARA) operates a distinct regulatory model from the CMA, with its own statutory remit covering the Emirate of Dubai, excluding the Dubai International Financial Centre (DIFC). VARA regulates VASPs through activity-based licensing for eight virtual asset activities: Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, Management and Investment Services, Transfer and Settlement Services, and VA Issuance Services.

Consultant reviewing VARA license portal Dubai

Whilst the eight activities broadly mirror the CMA's framework, there are meaningful structural differences in scope and terminology. VARA's Exchange Services category, for instance, encompasses operating a platform where VA trades occur, while Broker-Dealer covers the intermediary role more explicitly. VA Issuance is a distinct licensed activity under VARA, which is significant for token issuers who might not require exchange or custody permissions but still need authorisation.

VARA's regulatory architecture is built around four core rulebooks:

Company Rulebook: Governance, fitness and propriety, senior management accountability
Compliance and Risk Management Rulebook: AML/CFT (Anti-Money Laundering and Counter-Financing of Terrorism) controls, risk frameworks, internal audit
Technology and Information Rulebook: Cybersecurity standards, infrastructure requirements, data governance
Market Conduct Rulebook: Disclosure, fair dealing, market integrity obligations

Every licensed VASP must comply with the umbrella rulebooks in full. In addition, activity-specific rulebooks apply on top of the general requirements, so an exchange operator must comply with both the Company Rulebook and the VA Exchange Activity Rulebook.

VARA prohibits algorithmic stablecoins and privacy tokens, consistent with the CMA's approach. This creates regulatory alignment on the most sensitive asset classes across both UAE frameworks.

VARA also operates a Sponsored VASP model. Under this arrangement, a foreign or unlicensed entity may operate under the licence and oversight of an approved sponsor. The scope of services is more limited than a full licence, and the sponsor bears regulatory accountability. This model is particularly relevant for foreign firms testing the Dubai market before committing to a full licensing application.

Criterion	UAE CMA (SCA)	Dubai VARA
Regulatory scope	Federal (mainland UAE)	Emirate of Dubai (excl. DIFC)
Number of licensed activities	Eight	Eight
Privacy tokens	Prohibited	Prohibited
Algorithmic stablecoins	Prohibited	Prohibited
Sponsored/lighter model	Not available	Sponsored VASP model
Rulebook structure	Three layers	Four core rulebooks plus activity rulebooks
Capital basis	Risk-stratified by activity	Risk-stratified per Company Rulebook Part VI

You can read more about Dubai virtual asset operators and the practical implications of VARA's licensing pathway, and separately review VARA supervision and enforcement practices to understand how the regulator exercises its powers.

Global examples: EU, UK, and Asia approaches to web3 regulation

UAE-based VASPs increasingly serve clients across Europe, Asia, and beyond. Understanding how leading international frameworks operate is therefore not optional. It directly affects your ability to market services, onboard users, and maintain correspondent relationships.

European Union: MiCA

The Markets in Crypto-Assets Regulation provides a unified licensing framework across all 27 EU member states. Crypto-asset service providers (CASPs) authorised under MiCA benefit from passporting rights, meaning a single authorisation in one member state permits service provision across the bloc. MiCA distinguishes between three categories of crypto-assets: asset-referenced tokens, e-money tokens, and other crypto-assets. Each faces different issuer and service provider obligations. You can review the detailed EU crypto regulation framework to assess its scope for your business.

United Kingdom: FCA authorisation

The UK Financial Conduct Authority (FCA) requires registration for cryptoasset businesses under the Money Laundering Regulations, and authorisation under the Financial Services and Markets Act for specified investment activities involving qualifying cryptoassets. The FCA's AML/CFT focus is rigorous, and its rejection rate for registration applications has historically been significant, signalling the regulator's stringent fitness expectations. The UK's regime does not yet offer passporting to EU markets following Brexit.

Singapore: MAS licensing

The Monetary Authority of Singapore (MAS) licenses digital payment token (DPT) service providers under the Payment Services Act. Singapore's framework is particularly relevant for VASPs with Asian client bases or operational presence there. The MAS approach combines robust AML/CFT requirements with a clear licensing pathway, making it a preferred jurisdiction for many Asia-Pacific-focused crypto businesses.

Malaysia

Malaysia's Securities Commission licences digital asset exchanges and initial exchange offering (IEO) operators. Its framework is less mature than Singapore's but is developing rapidly, with clear registration obligations for firms serving Malaysian users.

"Jurisdictional alignment is not simply a compliance exercise. It is a commercial decision that determines which markets you can access, which institutional partners will engage with you, and how your business will be perceived by regulators in the years to come."

For firms with complex multi-jurisdictional filing requirements, specialist support for global regulatory submissions can streamline the process significantly.

Matching regulatory examples to business needs: Situational scenarios

Comparing frameworks is useful. Applying them to your specific situation is where real decisions get made. The following scenarios illustrate how to match your business model to the most appropriate framework.

UAE-based crypto exchange targeting retail users: Apply for VARA licensing under Exchange Services if operating in Dubai, or CMA licensing for a federal presence. Both require full rulebook compliance, AML/CFT controls, and eligibility restrictions on listed tokens. The choice between them often turns on your corporate structure and target client geography within the UAE.
Cross-border token issuer targeting European and UAE markets: You will likely need both VARA's VA Issuance licence and MiCA authorisation as a CASP or issuer. These frameworks have overlapping but not identical disclosure and reserve requirements, so legal structure and issuer entity placement are critical. MiCA compliance documentation must be prepared in the relevant EU language alongside English.
Custody specialist serving institutional clients across UAE and UK: You will need to address custody compliance in the UAE under either CMA or VARA rules, and consider FCA registration or authorisation for UK-facing services. Capital adequacy requirements in both jurisdictions are elevated for custody activities, reflecting the risk-based capital approach applied to client asset holders.
DeFi protocol seeking regulatory clarity: This remains one of the most complex scenarios. Most protocols will not fit neatly into existing licensing categories. However, if the protocol's front-end or governance structure is operated by an identifiable legal entity, that entity may still trigger licensing obligations under VARA, CMA, or MiCA depending on the activities it facilitates.
Foreign startup entering Dubai via Sponsored VASP model: VARA's activity-based licensing framework allows limited operations under a sponsor. This suits firms that want to establish a track record in Dubai before committing to the full licence application process.

Pro Tip: Prepare for multi-jurisdiction licensing from day one, even if you are initially targeting a single market. Regulatory requirements evolve, and retrofitting a compliance framework to accommodate additional jurisdictions is far more expensive than building multi-jurisdiction capacity into your structure at the outset.

What most VASPs overlook about choosing a regulatory home

The conventional approach to selecting a regulatory jurisdiction focuses almost entirely on two variables: speed to licence and upfront cost. Both are reasonable considerations. Neither is sufficient.

We have observed a consistent pattern among firms that treat licensing as a box-ticking exercise. They optimise for the easiest approval, then discover that institutional counterparties, banking partners, and sophisticated investors apply their own scrutiny to the jurisdiction choice. A licence from a regulator with a weak enforcement track record or limited international recognition can actually impede commercial relationships rather than enable them.

Regulatory reputation is a commercial asset. The UAE's investment in building credible regulatory infrastructure through VARA and the CMA has had a direct impact on the willingness of global financial institutions to engage with Dubai-licensed VASPs. That credibility does not come from having the fastest or cheapest licence. It comes from demonstrable compliance standards.

The other overlooked dimension is regulatory change. Web3 regulation is not stable. Firms that build compliance frameworks anchored to a single moment in time will face expensive restructuring as rules evolve. The better approach is to design governance structures, policies, and operational controls that are inherently adaptable, with clear ownership of the regulatory monitoring function internally.

Multi-layered compliance planning, encompassing legal structure, AML/CFT frameworks, technology controls, and board-level accountability, is what separates businesses that scale sustainably from those that encounter regulatory friction at every growth stage. Exploring global licensing lessons from firms that have navigated multiple jurisdictions reveals that the upfront investment in rigorous compliance design consistently delivers better commercial outcomes than the shortcut approach.

Expert support for navigating web3 regulation

The regulatory landscape covered in this article spans multiple jurisdictions, overlapping rulebooks, and fast-moving policy changes. Keeping pace with it whilst building a business is a genuine operational challenge.

CRYPTOVERSE Legal Consultancy provides specialist legal support to VASPs and crypto startups navigating this environment. Our team advises on VARA regulations and licensing, SCA licensing in the UAE, and major international frameworks including MiCA, FCA, and MAS. We support clients from pre-application assessment through to full licence approval, designing AML/CFT policies, governance frameworks, and capital structuring that meet regulator expectations. If you need a structured regulatory roadmap tailored to your business model and target jurisdictions, explore our digital asset legal consultancy services to understand how we can support your next stage of growth.

Frequently asked questions

What are the main licensing activities under the UAE web3 regime?

There are eight regulated activities: dealing as principal, dealing as agent, custody, arranging custody, portfolio management, investment advice, operating a virtual asset market, and arranging deals in virtual assets.

Are privacy tokens permitted in the UAE or Dubai?

No. Both the CMA and VARA frameworks explicitly prohibit privacy tokens and algorithmic stablecoins, and VARA's rulebook reinforces this prohibition across all licensed activity categories.

How are capital adequacy rules applied to VASPs in the UAE?

Capital requirements are risk-based and tiered, with custodial service providers subject to higher minimum capital obligations. VARA sets out detailed capital ratios in Part VI of its Company Rulebook.

Can foreign-based crypto firms operate under the sponsored VASP model in Dubai?

Yes, but the Sponsored VASP model limits the scope of permitted services and places regulatory accountability on the sponsor, making it more suitable as a market-entry step than a long-term operating structure.

What is the main difference between UAE and major global web3 regulations?

The UAE frameworks apply activity-based licensing with explicit token prohibitions, whereas global regimes such as MiCA and the UK FCA tend to focus on asset classification and harmonised standards across a broader range of financial instruments.