MENA Tokenization Regulations: UAE, Saudi Arabia, Bahrain Complete Guide

Tokenization in MENA runs through five main regimes: Dubai's Virtual Assets Regulatory Authority (VARA) for virtual assets, the FSRA in ADGM and the DFSA in DIFC for financial-centre activity including tokenized securities, the Capital Market Authority (CMA) and Saudi Central Bank in Saudi Arabia, and the Central Bank of Bahrain (CBB). None of them offers a generic "tokenization licence". What you need depends on whether the token is a security or a virtual asset, who performs each regulated activity, and where the investors are.

This guide summarises each regime as of 14 October 2026 and points to our detailed country guides. Regulatory content changes quickly in the Gulf, so confirm every point against the current rulebook with qualified counsel before acting.

UAE: Federal Layer + Free Zones + Dubai (VARA)

The UAE has a multi-layered regulatory structure:

• Federal layer: the Capital Market Authority (CMA) regulates securities and capital-market activity outside the financial free zones. It is the former Securities and Commodities Authority (SCA), reconstituted under Federal Decree-Law No. 32 of 2025 with effect from 1 January 2026. The Central Bank of the UAE (CBUAE) regulates payment tokens.
• ADGM (Abu Dhabi): regulated by the FSRA under its own common-law framework
• DIFC (Dubai): regulated by the DFSA under its own legal framework
• Dubai outside DIFC: VARA for virtual assets and virtual-asset activities

Each regime has its own licensing, rules and enforcement. A licence in one does not authorise activity in another.

VARA (Dubai Virtual Assets Regulatory Authority)

Established: 2022, under Dubai Law No. 4 of 2022 Jurisdiction: Emirate of Dubai, including its free zones, excluding DIFC Scope: virtual assets and virtual-asset activities. VARA is not a securities regulator. A token that is a security is analysed under securities law: the federal CMA onshore, or the DFSA in DIFC.

VARA issued Version 2.0 of its rulebooks on 19 May 2025. Under the Virtual Asset Issuance Rulebook, issuance falls into three groups:

• Category 1 covers fiat-referenced virtual assets (FRVAs) and asset-referenced virtual assets (ARVAs). Issuing them requires a VARA licence.
• Category 2 covers other virtual assets. No VARA licence is needed, but all placement and distribution must go through a licensed distributor.
• Exempt VAs, such as non-transferable tokens, have no pre-issuance requirements.

Licence categories (VARA FAQ):

1. Advisory Services
2. Broker-Dealer Services
3. Custody Services
4. Exchange Services
5. Lending and Borrowing Services
6. VA Management and Investment Services
7. VA Transfer and Settlement Services
8. VA Issuance (Category 1)

Each activity is licensed separately. A VASP must appoint two Responsible Individuals, each a full-time employee who is UAE-resident or a UAE passport holder and approved by VARA. Firms must hold reserve assets equal to 100% of liabilities owed to clients (Company Rulebook, Rule VI.E.1). Anonymity-enhanced cryptocurrencies are prohibited.

Timeline: VARA does not publish a standard processing time. Applicants move from an Initial Disclosure Questionnaire to an Approval to Incorporate, and then to the full licence application.

Regulator fees (Schedule 2 of VARA's Virtual Assets and Related Activities Regulations, checked 14 October 2026):

• Licence application fee: AED 40,000 for Advisory and for Transfer and Settlement; AED 100,000 for the other activities, including Category 1 VA Issuance
• Annual supervision fee: AED 80,000 or AED 200,000 on the same split
• Fees apply per licensed activity

Capital and personnel detail is in our VARA licence requirements guide.

ADGM (Abu Dhabi Global Market)

Regulator: Financial Services Regulatory Authority (FSRA) Jurisdiction: Abu Dhabi financial free zone Best for: institutional offerings, fund tokenization, tokenized securities

The FSRA treats a token with the features of a security as a Digital Security under the Financial Services and Markets Regulations (FSMR). Virtual assets that are not securities sit under the FSRA's separate virtual-asset framework.

Key points:

• Token acceptance by self-assessment. On 10 June 2025 the FSRA moved from approving each Accepted Virtual Asset to a notification model: the firm assesses the asset against FSRA criteria, notifies the FSRA, and the FSRA can object. The same amendments expressly prohibit privacy tokens and algorithmic stablecoins.
• RegLab. The FSRA's FinTech Regulatory Laboratory grants a restricted Financial Services Permission valid for up to two years.
• Common law. ADGM applies English common law and has its own courts.
• Offers. Exempt-offer routes are set out in the FSRA Markets Rules. Confirm the current conditions with counsel; our ADGM tokenization structures guide explains how offers, investor access and permissions fit together.

Timeline and fees: the FSRA does not publish a guaranteed processing time. Application and supervision fees are set in the FSRA FEES Rulebook, which was amended for virtual-asset activities in June 2025. Check the current version rather than relying on older figures.

DIFC (Dubai International Financial Centre)

Regulator: Dubai Financial Services Authority (DFSA) Jurisdiction: Dubai financial free zone Best for: established financial firms adding tokenization, institutional clients

Regulatory timeline:

• 2021: Investment Token regime introduced (security tokens treated as investments under existing DFSA rules)
• 2022: Crypto Token regime for non-security tokens
• March 2025: Tokenisation Regulatory Sandbox opened for expressions of interest. The DFSA received 96.
• 1 October 2025: Consultation Paper No. 168 on enhancing the crypto token regime
• 12 January 2026: updated Crypto Token rules in force. The DFSA no longer maintains a list of recognised crypto tokens. Firms now assess and document each token's suitability, while fiat crypto tokens remain subject to DFSA assessment.

Framework highlights:

• Investment Tokens: tokenized securities are regulated as investments under the existing DFSA rules
• Crypto Tokens: a separate regime for non-security crypto tokens
• Innovation Testing Licence: the DFSA's restricted licence for live testing, which also hosts the tokenisation sandbox cohort

UAE Stablecoin Rules

The CBUAE's Payment Token Services Regulation (Circular 2/2024, issued June 2024) restricts the use of payment tokens for payments in the UAE. Dirham payment tokens from CBUAE-licensed issuers are the main permitted route, and foreign payment tokens require a CBUAE-registered issuer. Check the regulation before designing any stablecoin settlement leg.

Saudi Arabia: Sandbox and Sector Pilots

Status: no standalone virtual-asset or tokenization licence. Tokens with security features fall under the Capital Market Law. Regulators: Capital Market Authority (CMA); Saudi Central Bank (SAMA), the former Saudi Arabian Monetary Authority, renamed under the Saudi Central Bank Law (Royal Decree M/36, November 2020) and still abbreviated SAMA; Real Estate General Authority (REGA) for real estate

Current Regulatory State

The practical routes are an experimental permit, a partnership with a CMA-licensed capital market institution, or an offshore structure distributed into the Kingdom through licensed persons. Full detail is in our Saudi Arabia tokenization CMA guide.

GCC Fund Passporting

GCC fund passporting is a product-registration route for investment funds, not a licence passport for firms (status checked 14 October 2026):

• Framework. The GCC Committee of Heads of Financial Market Authorities approved the fund passporting regulations in November 2024. A passported fund is entered on the registers of both the home and host regulators.
• Bahrain. The CBB has applied the regime since 1 January 2025 (CBB Rulebook Volume 7, CIU-6). Operators of other GCC funds need home-regulator approval and a designated placement agent to market in Bahrain.
• Saudi Arabia. The CMA Board adopted its Cross-Border Passporting Guide for Investment Funds by Resolution 1-46-2025 dated 23 April 2025, published on 3 June 2025. A GCC fund is offered in the Kingdom through a CMA-licensed capital market institution acting as agent. The agent files a notification, pays the passporting fee and keeps a local unitholder register. Units of a passported private fund may be placed only with qualified and institutional investors.
• Other states. We have not confirmed implementing rules for Kuwait, Oman, Qatar or the UAE from primary sources. Check with each regulator.

The passport does not cover token offerings outside a fund wrapper. A VARA, ADGM, DIFC or CBB licence does not by itself authorise soliciting Saudi investors.

Bahrain: Central Bank Framework

Regulator: Central Bank of Bahrain (CBB) Best for: GCC-focused structures, fund products using GCC passporting, security token offerings through licensed investment firms

Bahrain introduced a crypto-asset licensing module in 2019. Security tokens are generally analysed as investment business under Volume 4 of the CBB Rulebook rather than under the crypto-asset module; our Bahrain tokenized securities guide covers that route.

CBB Crypto-Asset Module (CRA, Volume 6)

The CRA module licenses crypto-asset services in four categories (CBB Rulebook, CRA-1.1, as amended April 2023):

Stablecoins. On 4 July 2025 the CBB issued its Stablecoin Issuance and Offering (SIO) Module. Licensed issuers may issue single-currency stablecoins backed by Bahraini dinar, US dollars or another fiat currency the CBB accepts, with full 1:1 backing in that currency.

Fees and capital depend on the licence category and are set in the relevant CBB Rulebook volume; see the Bahrain guide for the investment-firm figures.

Comparison: Which MENA Regime Covers What?

Practical Structuring in MENA

Option 1: ADGM Fund + Tokenized Units

International/GCC Investors
         ↓
    ADGM Fund Vehicle
    (FSRA-licensed manager)
         ↓
   Tokenized Fund Units
         ↓
    Underlying Assets

Best for: institutional capital, fund managers targeting Gulf and international investors

Option 2: VARA Dubai + RWA Tokenization

Eligible Investors
         ↓
   VARA-Licensed VASP
         ↓
  Category 1 ARVA Issuance
  (VARA licence)
         ↓
   Real Estate/Commodities

Best for: Dubai-based real assets where the token is a virtual asset rather than a security. If the token has the features of a security, this route does not apply.

Option 3: Multi-Jurisdiction Structure

US Investors (Reg D/S) → US Entity
                              ↘
MENA Investors → UAE Entity → Asset Holding Company
                              ↗
EU Investors (MiFID II/Prospectus) → EU Entity

Best for: larger raises with investors in several regions. Each investor market still needs its own offering analysis.

Option 4: Bahrain Fund for GCC Distribution

GCC Investors
      ↓
 Bahrain-domiciled fund
 (CBB-regulated operator)
      ↓
 GCC fund passport (fund products only)
      ↓
 Multi-Country Assets

Best for: fund-format products that will be distributed in Bahrain and, through a CMA-licensed agent, in Saudi Arabia

Compliance Essentials for MENA

KYC/AML Requirements

All MENA regimes expect robust KYC:

1. Identity verification: government ID, passport, proof of address
2. Source of funds: documented source of investment capital
3. Source of wealth: for high-value relationships
4. PEP screening: politically exposed persons
5. Sanctions screening: UN and local lists (UAE, Saudi Arabia, Bahrain), plus OFAC where relevant
6. Ongoing monitoring: transaction monitoring and periodic reviews
7. Travel Rule: originator and beneficiary data for virtual-asset transfers, under each regulator's own thresholds and rules

Shariah Compliance Considerations

For Islamic investors (significant in MENA):

Compliance is decided per structure by qualified Shariah scholars, not by the technology.

Getting Started in MENA

Step 1: Jurisdiction Selection

Step 2: Local Partnerships

• Legal counsel: securities and regulatory lawyers in each relevant jurisdiction
• Licensed partners: for any regulated activity you will not perform yourself
• Banking: account opening for token-related businesses is often the slowest workstream
• Shariah advisers: if targeting Islamic investors

Step 3: Regulatory Engagement

• Pre-application meetings: VARA, FSRA, DFSA and CBB all engage with applicants before formal filing
• Sandboxes: CMA FinTech Lab, ADGM RegLab and the DFSA Innovation Testing Licence for novel models
• Documentation: business plan, compliance framework, technology architecture

Step 4: Structure Setup

Sequence the work rather than assuming a fixed timeline. Form the entity, open bank accounts, then file and answer the regulator's questions. Regulators do not guarantee approval or processing times. Our legal setup coordination runs this sequence with qualified counsel. The legal perimeter memo is a starting template for the perimeter analysis.

Key Takeaways

1. UAE has three regimes plus a federal layer: VARA for virtual assets in Dubai, the FSRA and DFSA for their free zones, and the federal CMA (formerly the SCA) onshore.
2. VARA is not a securities route: Category 1 issuance (FRVAs and ARVAs) needs a VARA licence, but tokens that are securities sit elsewhere.
3. Token acceptance has moved to firms: ADGM since June 2025 and DIFC since January 2026 rely on documented firm assessments.
4. Saudi Arabia is permit- and partner-led: no general tokenization licence; real estate is moving fastest under REGA.
5. GCC fund passporting is for funds only: in force in Bahrain since January 2025 and adopted by the Saudi CMA in April 2025, with a CMA-licensed agent required in the Kingdom.
6. Shariah compliance matters: it is decided per structure by qualified scholars.

---

Related Reading

• GCC tokenization market: 2026 report
• Saudi Arabia tokenization: CMA rules and market entry
• Bahrain tokenized securities and GCC market access
• Dubai real estate tokenization market guide
• Client case studies
• Legal setup and licensing coordination

Sources

• UAE: Federal Decree-Law No. 32 of 2025 on the Capital Market Authority (opens in a new tab) (in force 1 January 2026)
• VARA: Virtual Asset Issuance Rulebook, 19 May 2025 (opens in a new tab); Schedule 2, Supervision and Authorisation Fees (opens in a new tab); Company Rulebook Part VI (opens in a new tab); VARA FAQ (opens in a new tab)
• ADGM: FSRA implements amendments to its digital asset regulatory framework, 10 June 2025 (opens in a new tab); FinTech RegLab Guidance (opens in a new tab)
• DFSA: Crypto Token regime (opens in a new tab); Tokenisation Regulatory Sandbox (opens in a new tab)
• CBUAE: Payment Token Services Regulation (Circular 2/2024)
• Saudi Arabia: CMA Cross-Border Passporting Guide for Investment Funds (opens in a new tab) (Board Resolution 1-46-2025, 23 April 2025); Saudi Central Bank Law (opens in a new tab)
• Bahrain: CBB Rulebook Volume 6, CRA-1.1 (opens in a new tab) and Volume 7, CIU-6 (opens in a new tab); CBB stablecoin issuance framework, July 2025 (opens in a new tab)
• GCC: GCC financial market authorities approve fund passporting framework, 20 November 2024 (opens in a new tab)

---

This article is informational and does not constitute legal, tax or investment advice. Asset Haus provides tokenization infrastructure and structuring support, including for MENA structures as part of work across 9+ jurisdictions; legal setup and licensing are coordinated with qualified counsel and licensed local partners. Start the readiness assessment to map your MENA tokenization path.