UAE Introduces Tough New Rules for Virtual Asset Service Providers

The United Arab Emirates (UAE) has introduced a new regulatory framework for virtual assets, replacing its previous framework entirely. This move is significant, as it signals that the UAE is no longer just 'crypto-friendly' but is instead building one of the most structured and credible regulatory environments in the world.

According to the new rules, virtual asset service providers (VASPs) will need to increase their minimum investment capital, with different requirements depending on their activities. For example, those dealing in virtual assets as principle must have at least AED 4 million, while those providing custody services must have at least AED 1 million.

The new framework also includes stricter compliance obligations, such as client classification, change of control notifications, and cybersecurity risk management frameworks. VASPs will need to put in place suitable governance policies and manuals to comply with the changes, including reviewing their platform architecture, cyber controls, data governance, and critical supplier contracts.

The UAE Capital Markets Authority has set hard deadlines for compliance, with full license holders required to meet the new requirements by February 13th, 2027. Preliminary approval holders have six months from the date of preliminary approval to comply, or a possible six-month extension at the discretion of the CMA.