VARA vs ADGM vs DIFC: UAE Tokenization Licence Guide

Which UAE regime fits depends on what the token is and where the business operates. Tokenized securities, such as shares, bonds, sukuk or fund units, need a securities regime: the FSRA in Abu Dhabi Global Market (ADGM) treats them as Digital Securities, the DFSA in the Dubai International Financial Centre (DIFC) regulates them as Investment Tokens, and outside the financial free zones the federal Capital Market Authority (CMA) applies its own security token rules. VARA licenses virtual-asset activities in Dubai outside DIFC, including the issuance of asset-referenced virtual assets, so it suits real-world-asset tokens that are virtual assets rather than securities. Issuers, platforms and custodians each need the permission that matches their own activity, in the zone where they carry it on.

We checked the rules below against VARA, FSRA, DFSA and federal sources on 16 October 2026. Use this guide to prepare the conversation with counsel; it is not a conclusion about any particular structure.

VARA vs ADGM vs DIFC at a glance

Each row is explained, with its source, in the sections below.

Who regulates what in the UAE

Three regimes matter for tokenization, plus a federal layer, and each licenses activity only inside its own perimeter.

• VARA, the Dubai Virtual Assets Regulatory Authority, was set up by Dubai Law No. 4 of 2022 (issued 28 February 2022), which applies to virtual-asset services across the emirate, including its free zones, except DIFC (Article 3). VARA's Regulations (version of 19 May 2025, in force 19 June 2025) require a VARA licence for any virtual-asset activity carried out by way of business in Dubai (Regulation III.A.1).
• The FSRA regulates financial services in ADGM under the Financial Services and Markets Regulations 2015 (FSMR); section 16 bars anyone but an Authorised Person or an Exempt Person from carrying on a Regulated Activity by way of business there. English common law applies directly in ADGM under its Application of English Law Regulations 2015, and ADGM has its own courts.
• The DFSA regulates DIFC, where Article 41 of the Regulatory Law 2004 (consolidated October 2025) prohibits carrying on a Financial Service in or from DIFC except as Article 42 allows, for example under a DFSA licence covering that service. Per the DIFC Courts, DIFC has its own framework for civil and commercial matters and its own common-law courts.
• The CMA replaced the Securities and Commodities Authority (SCA) as the federal capital-market regulator on 1 January 2026, under Federal Decree-Law No. 32 of 2025 (issued 1 October 2025; Article 2), and has no powers in the financial free zones (Article 5). Its Resolution No. 15/Chairman/2025, in force since 14 August 2025, governs security tokens onshore.
• The Central Bank of the UAE (CBUAE) regulates payment tokens. Under its Payment Token Services Regulation (Circular 2/2024, in force since 31 August 2024), licensed firms may transfer only dirham payment tokens from licensed issuers, or registered foreign payment tokens used to buy virtual assets (Part 3, Article 2), which matters for any stablecoin settlement leg.

Under a September 2024 agreement between the SCA and VARA, virtual-asset firms operating in or from Dubai need a VARA licence and can be registered by default with the federal regulator to serve the wider UAE, while firms based in any other emirate need a federal licence (SCA announcement, 9 September 2024).

Securities rules or virtual-asset rules?

The token's classification decides which rules apply. In ADGM and DIFC, one regulator runs both a securities regime and a virtual-asset regime. A token with the features of a security needs an approved prospectus unless the offer is exempt (FSMR sections 58 and 61; DIFC Markets Law Articles 11 and 14), and every intermediary needs the matching permission; other crypto assets go through the FSRA's virtual-asset framework or the DFSA's Crypto Token regime.

In Dubai outside DIFC, the question is which regulator. Dubai Law No. 4 of 2022 defines a virtual asset broadly, as a digital representation of value that can be traded, transferred or used for payment or investment purposes, with no securities exclusion of its own (Article 2). The federal definitions do exclude securities: Cabinet Resolution No. 111 of 2022, which also leaves digital securities to the federal regulator's own rules (Articles 1 and 3), and Federal Decree-Law No. 33 of 2025 on the Regulation of the Capital Market (Article 1). Cabinet Resolution No. 112 of 2022 delegates the federal powers under Resolution 111 to VARA within Dubai. A tokenized share or bond offered from mainland Dubai therefore needs a securities analysis under the CMA's rules before any VARA application.

How each regime classifies tokens

VARA: three issuance categories

VARA's Virtual Asset Issuance Rulebook (19 May 2025, in force 19 June 2025) sorts issuance into three groups (Rule I.C.1):

• Category 1: fiat-referenced virtual assets (FRVAs), asset-referenced virtual assets (ARVAs) and others VARA designates. The issuer needs a VARA licence (Rule I.D.1) and VARA's approval before issuing each ARVA (Annex 2).
• Category 2: any other virtual asset that is not exempt. No licence is needed, but placement and distribution must go through a Licensed Distributor, a VASP licensed for Broker-Dealer Services that takes responsibility for checking the issuer's compliance (Rules I.E.1 to I.E.3).
• Exempt VAs, such as non-transferable or redeemable closed-loop assets: no requirements before issuance, though the issuer stays under VARA's supervision (Rule I.F).

An ARVA represents, or purports to represent, ownership of real-world assets, an entitlement to income, or value backed by them (Schedule 2). That is why Category 1 is VARA's route for real-world-asset tokens that are not securities.

ADGM: Digital Securities and Accepted Virtual Assets

The FSRA's Digital Securities guidance (24 February 2020) treats digital assets with the features of a Security, including tokenized offerings of Securities, as Digital Securities, which the FSRA deems Securities under FSMR section 58(2)(b). Its Virtual Asset guidance (10 June 2025) treats other virtual assets as commodities, not Specified Investments.

Firms may use only Accepted Virtual Assets in regulated activity. Since June 2025 a firm assesses each asset against the criteria in COBS Rule 17.2.2 and notifies the FSRA at least five business days before using it; absent a written direction under FSMR section 5B, it may then treat the asset as accepted, for itself only (COBS Rules 17.2.4 and 17.2.5). FSMR section 5A(4) bans regulated activity in ADGM involving algorithmic stablecoins and privacy tokens, and issuing a fiat-referenced token is a separate Regulated Activity (FSMR Schedule 1, paragraph 53B).

DIFC: Investment Tokens and Crypto Tokens

The DFSA has regulated Investment Tokens since 25 October 2021. Its General Module (GEN App 2, Rule A2.1.1) defines them as cryptographically secured digital representations of rights and obligations substantially similar to those of a Security or a Derivative: Security Tokens resemble shares, debentures, units and other securities, and Derivative Tokens resemble options or futures. An Investment Token is an Investment (COB Rule 14.3.2, Guidance).

Crypto Tokens, regulated since 1 November 2022, are used or intended to be used for exchange, payment or investment; Fiat Crypto Tokens reference a single fiat currency; and NFTs, utility tokens and government or central-bank digital currencies are Excluded Tokens (GEN App 2, section A2.5). Since 12 January 2026 the DFSA no longer keeps a list of Recognised Crypto Tokens. Firms assess each crypto token against GEN Rule 3A.2.1 on a reasoned, documented basis and keep that assessment under review, while a Fiat Crypto Token can be used only once the DFSA is satisfied that it is suitable (DFSA crypto page). The change followed Consultation Paper No. 168 of 1 October 2025.

Licence routes for issuers, platforms and custodians

Issuers

• ADGM: an Offer of Securities, including Digital Securities, needs an Approved Prospectus unless it is an exempt offer under the FSRA's Markets Rules (FSMR section 61). Our ADGM tokenization structures guide covers how offer routes, investor access and permissions fit together.
• DIFC: Markets Law Article 14 (version in force since 31 December 2025) requires an Approved Prospectus for an Offer of Securities to the Public in DIFC, and for Security Tokens admitted to trading on an Alternative Trading System, unless the offer is an Exempt Offer.
• VARA: a Category 1 issuer needs a VARA licence; a Category 2 issuer needs none but must distribute through a Licensed Distributor (VA Issuance Rulebook, Rules I.D and I.E).
• Onshore: security tokens offered outside the financial free zones follow the CMA's 2025 security token resolution.

Platforms

• ADGM: a Private Financing Platform is limited to primary markets; secondary trading of the securities offered on it requires the separate Regulated Activity of Operating a Multilateral Trading Facility (FSRA guidance on PFPs and MTFs, version of 23 September 2026, paragraphs 2.4 and 4.2). An MTF may also be the primary venue for exempt-offer Digital Securities traded only by non-retail clients (Digital Securities guidance, paragraph 46); an organised trading facility cannot trade virtual assets (FSMR Schedule 1, paragraph 54).
• DIFC: a trading venue carries on Operating an Alternative Trading System, either a multilateral or an organised trading facility, and only the multilateral form may trade crypto tokens (GEN Rule 2.22.1). Exchanges are Authorised Market Institutions; Operating an Exchange covers Investments only, so an exchange trading crypto tokens needs a multilateral trading facility and an endorsement on its licence (GEN Rule 2.17.1, Guidance).
• VARA: matching orders or keeping an order book is Exchange Services, and arranging, dealing or placement is Broker-Dealer Services; each is a separate licence (VARA Regulations, Schedule 1).
• Onshore: the CMA's Resolution No. 04/Chairman/2026 on virtual-asset service providers and alternative trading system operators, in force since 28 February 2026, covers alternative trading systems for tokenized securities.

Custodians

• VARA: Custody Services is a separate licence. The Custody Services Rulebook (19 May 2025) requires a separate wallet for each client (Rule III.B.3), bans rehypothecation even with client consent (Rule III.B.2), and requires the custodian to be a separate legal entity from group members providing other virtual-asset services, except transfer and settlement (Rules III.B.5 and III.B.6). Client assets stay outside the firm's estate if it becomes insolvent (Compliance and Risk Management Rulebook, Rule V.B.2).
• ADGM: safeguarding Financial Instruments, Virtual Assets or Fiat-Referenced Tokens for others is Providing Custody (FSMR Schedule 1, paragraph 43). Virtual-asset custodians follow the COBS client-asset rules (Rule 17.8.1), hold client assets separately from their own (Rule 15.3.2) and need key-management procedures (Rule 17.5.1). For Digital Securities, only a firm permitted to provide custody may act as a central securities depository (Digital Securities guidance, paragraph 61).
• DIFC: Providing Custody of Investment Tokens or Crypto Tokens requires a licence (COB Rule 14.3.2, Guidance; GEN Rule 2.13.1). The custodian must segregate each client's tokens and keep cryptographic keys secure (COB Rule 14.3.3), and crypto-token wallet providers follow the same rules (COB Rule 15.4.2).

Whichever regime applies, the legal register, the wallet holding the tokens and the bank account receiving cash often sit with different parties. Our registry-of-record guide covers how to keep them reconciled.

Innovation and sandbox routes

• ADGM RegLab: the FSRA grants a Financial Services Permission for Developing Financial Technology Services within the RegLab, with client and exposure limits. Under its RegLab Guidance (2016), the permission is valid for up to two years and can be extended only in exceptional circumstances; at the end, the firm moves to full authorisation or carries out its exit strategy.
• DFSA Innovation Testing Licence (ITL): launched in 2017, the ITL is a restricted licence for testing innovative financial products, services and business models in or from DIFC without the full requirements that apply to authorised firms. At the end, the firm applies to remove the restrictions or to withdraw the licence (DFSA ITL explainer, May 2025).
• DFSA Tokenisation Regulatory Sandbox: expressions of interest ran from 17 March to 24 April 2025, and the DFSA received 96, from firms in the UAE, UK, EU, Canada, Singapore and Hong Kong. Some firms were invited into live testing under the ITL; others were treated as suitable for full authorisation under existing rules (DFSA, 12 May and 16 June 2025). The sandbox page now says applications are closed, and crypto tokens and fiat crypto tokens are outside its scope.
• VARA: we found no sandbox or test licence in VARA's rulebooks or on its licence pages (checked 16 October 2026), so a new entrant's route is the full licence.

A sandbox permission is a supervised test with limits, not a cheaper licence, and neither the FSRA nor the DFSA guarantees admission or later authorisation.

VARA in brief

VARA licenses eight activities separately: advisory, broker-dealer, custody, exchange, lending and borrowing, VA management and investment, VA transfer and settlement, and Category 1 VA issuance (VARA Regulations, Schedule 1). Each licence carries its own paid-up capital under Part VI of the Company Rulebook and its own application and supervision fees under Schedule 2 of the Regulations. New applicants file an Initial Disclosure Questionnaire through Dubai Economy and Tourism or the relevant free zone, receive an Approval to Incorporate, and then apply for the VASP licence, which may carry operating conditions (VARA licence applications page). Our VARA licence requirements guide sets out the capital, fee and personnel rules in detail.

How to choose: match the regime to the activity

• Tokenized securities for professional investors, such as private shares, bonds, sukuk or fund units: ADGM or DIFC. Both run a prospectus-or-exempt-offer regime with licensed intermediaries, so the choice usually turns on where the team, counterparties and investors are, which courts you prefer, and whether a sandbox fits the model.
• A real-world-asset token that is a virtual asset, not a security, issued from Dubai: VARA, through Category 1 ARVA issuance, with broker-dealer and custody licences, or licensed partners, around it.
• A virtual-asset exchange or broker in mainland Dubai or a Dubai free zone other than DIFC: VARA; serving clients elsewhere in the UAE relies on the default federal registration agreed in 2024.
• A securities offer to investors outside the financial free zones: the federal CMA's rules, including its 2025 security token resolution.
• A model the rulebooks do not yet fit: ADGM's RegLab or the DFSA's Innovation Testing Licence, neither of which is a shortcut to a full licence.
• Investors in both Abu Dhabi and Dubai: a separate permission from each regulator, since none of the three permissions authorises activity in the other zones.

Each route carries different entity, capital and permission consequences. Our legal setup and licensing coordination maps them with qualified UAE counsel before you commit to one, and the legal perimeter memo is a starting template for the classification question.

Costs and timelines

Regulator fees and capital depend on the permissions granted: VARA sets them per activity in Schedule 2 of its Regulations and Part VI of its Company Rulebook, the FSRA in its FEES and PRU Rulebooks, and the DFSA in its fee and prudential rules. We found no guaranteed processing time from any of the three regulators. Professional fees, staff, systems and audit usually exceed the regulator fees, and we do not publish all-in estimates; scope costs against the current rulebooks for the exact permissions you need.

FAQ

Should I choose VARA, ADGM or DIFC?

Start with the token, not the free zone. If it is a security, such as a share, bond, sukuk or fund unit, the choice is between ADGM and DIFC, or the federal CMA's rules for an onshore offer. If it is a virtual asset that is not a security, such as an asset-referenced token issued from Dubai, VARA is the route. Between ADGM and DIFC, the deciding factors are usually where the team, counterparties and investors are, the courts you prefer and whether a sandbox fits. Apply the same fact pattern to each option before deciding.

Is ADGM or DIFC better for tokenized securities?

Neither is better in the abstract. Both treat tokenized securities as securities, require a prospectus unless an exempt offer applies, and license trading venues and custodians. ADGM applies English common law directly and offers the RegLab; DIFC has its own laws and courts, the Innovation Testing Licence and a tokenisation sandbox cohort selected in 2025.

Does VARA regulate tokenized securities?

VARA's issuance rules cover virtual assets, such as fiat-referenced and asset-referenced virtual assets. Dubai's VARA law has no securities exclusion of its own, but the federal definitions exclude securities from virtual assets, and since August 2025 the CMA has had its own security token rules for onshore offers. In DIFC, tokenized securities are Investment Tokens under the DFSA.

Can one licence cover VARA, ADGM and DIFC?

No. A VARA licence covers Dubai outside DIFC, an FSRA permission covers ADGM and a DFSA licence covers DIFC, so a firm working in more than one zone needs a permission from each. The one bridge is for virtual-asset firms: under the 2024 SCA and VARA agreement, a VARA-licensed firm can be registered by default with the federal regulator to serve the rest of the UAE outside the financial free zones.

What sandbox options exist for tokenization in the UAE?

ADGM's RegLab grants a limited permission for up to two years. The DFSA's Innovation Testing Licence, running since 2017, allows restricted live testing, and its 2025 tokenisation sandbox is now closed to applications. We found no comparable VARA programme, and none of these routes guarantees a full licence.

Do I need a separate custody licence?

If you hold client assets, usually yes. VARA licenses Custody Services separately, ADGM treats safeguarding assets for others as Providing Custody, and the DFSA requires a licence for Providing Custody of Investment Tokens and Crypto Tokens. Using a licensed custodian instead is a common design, and under VARA's Company Rulebook it lowers the capital requirement for some activities.

What does the federal Capital Market Authority regulate?

Since 1 January 2026 the CMA has replaced the Securities and Commodities Authority under Federal Decree-Law No. 32 of 2025. It regulates securities and other financial activities across the UAE except the financial free zones, including security tokens under its 2025 resolution and virtual-asset firms based outside Dubai. It has no powers inside ADGM or DIFC.

Sources

• VARA: Dubai Law No. 4 of 2022 (opens in a new tab) (issued 28 February 2022; Articles 2 and 3); Virtual Assets and Related Activities Regulations 2023 (opens in a new tab) (version of 19 May 2025, in force 19 June 2025; Regulation III.A.1 and Schedule 1 (opens in a new tab)); Virtual Asset Issuance Rulebook (opens in a new tab) (Rules I.C to I.F, Schedule 2 and Annex 2); Custody Services Rulebook (opens in a new tab) (Part III); Compliance and Risk Management Rulebook (opens in a new tab) (Rule V.B.2); Company Rulebook, Part VI (opens in a new tab); Licence applications (opens in a new tab); Cabinet Resolution No. 112 of 2022 (opens in a new tab)
• ADGM FSRA: FSMR 2015, consolidated to May 2026 (opens in a new tab) (sections 5A, 16, 58 and 61; Schedule 1); Guidance on Digital Securities, 24 February 2020 (opens in a new tab); Guidance on Virtual Asset Activities, 10 June 2025 (opens in a new tab); COBS Rulebook (opens in a new tab) (Rules 15.3.2, 17.2, 17.5.1 and 17.8.1); FinTech RegLab Guidance (opens in a new tab); Guidance on Private Financing Platforms and MTFs, 23 September 2026 (opens in a new tab); English common law in ADGM (opens in a new tab); Amendments to the digital asset framework, 10 June 2025 (opens in a new tab)
• DFSA: Regulatory Law, consolidated October 2025 (opens in a new tab) (Articles 41 and 42); Markets Law Article 11 (opens in a new tab) and Article 14 (opens in a new tab); GEN module, VER72/07-26 (opens in a new tab) (Rules 2.13.1, 2.17.1, 2.22.1, 3A.2.1 and App 2); COB module, VER51/07-26 (opens in a new tab) (Rules 14.3 and 15.4); Investment Token framework, 25 October 2021 (opens in a new tab); Crypto Token regime in force, 1 November 2022 (opens in a new tab); Crypto Token regulation page (opens in a new tab) and 12 January 2026 update (opens in a new tab); Consultation Paper No. 168 (opens in a new tab); Innovation Testing Licence explainer, May 2025 (opens in a new tab); Tokenisation Regulatory Sandbox (opens in a new tab), 96 expressions of interest, 12 May 2025 (opens in a new tab) and selected firms, 16 June 2025 (opens in a new tab); DIFC Courts (opens in a new tab)
• Federal: Federal Decree-Law No. 32 of 2025 Regarding the Capital Market Authority (opens in a new tab) (issued 1 October 2025, in force 1 January 2026; Articles 2, 5 and 30); Federal Decree-Law No. 33 of 2025 on the Regulation of the Capital Market, Article 1 (opens in a new tab) and Article 2 (opens in a new tab); Cabinet Resolution No. 111 of 2022 (opens in a new tab) (issued 12 December 2022; Articles 1 and 3); CMA Resolution No. 15/Chairman/2025 on Security Tokens and Commodity Tokens Contracts (opens in a new tab) (in force 14 August 2025); CMA Resolution No. 04/Chairman/2026 on virtual-asset service providers and alternative trading system operators (opens in a new tab) (in force 28 February 2026); SCA and VARA regulatory framework, 9 September 2024 (opens in a new tab); CBUAE Payment Token Services Regulation (opens in a new tab) (Circular 2/2024, in force 31 August 2024)

---

This article is informational and does not constitute legal, tax or investment advice. Asset Haus provides tokenization infrastructure and structuring support, including for structures in ADGM and DIFC as part of work across 9+ jurisdictions; legal setup is coordinated with qualified UAE counsel, and no licensing outcome is guaranteed. See our legal setup workflow, client case studies, or start with the legal perimeter memo.