Crypto Payment Processing in the UAE

Since a cooperation agreement signed on 5 September 2024, VARA-licensed firms are registered with the federal regulator by default so they can serve the rest of the UAE, but not the DIFC or ADGM. Acquirers and banks check that the licensed activity covers exactly what you do: a licence for one activity does not cover the others.

• VARA, the Virtual Assets Regulatory Authority: Dubai, including its free zones but not the DIFC. Set up under Dubai Law No. 4 of 2022, with a separate licence for each activity.
• CMA, the Capital Market Authority: the rest of the UAE outside the DIFC and ADGM. It was the Securities and Commodities Authority (SCA) until it was renamed on 1 January 2026, and its 2026 virtual asset rules replaced the SCA's 2023 regime.
• FSRA, the Financial Services Regulatory Authority: Abu Dhabi Global Market, where firms need a permission for operating a crypto asset business and may only deal in accepted crypto assets.
• DFSA, the Dubai Financial Services Authority: the DIFC, under a crypto token regime in force since 1 November 2022, with only recognised tokens allowed and privacy and algorithmic tokens banned.

VARA's Company Rulebook sets a minimum paid-up capital for each licensed activity. Where two figures are given, the lower one applies when the firm uses a VARA-licensed custodian. Each figure is a floor: the requirement is the higher of it and a share of fixed annual overheads, and every firm must also hold net liquid assets of at least 1.2 times its monthly operating expenses.

• Advisory: AED 100,000.
• Broker-dealer: AED 400,000 or 600,000.
• Custody: AED 600,000.
• Exchange: AED 800,000 or 1,500,000.
• Lending and borrowing: AED 500,000.
• Management and investment: AED 280,000 or 500,000.
• Transfer and settlement: AED 500,000. There is no separate VARA payments licence, so payment gateways generally fall under this activity.

CMA Resolution 04/Chairman of 2026 covers eight virtual asset activities across six licence types, with minimum capital from AED 500,000 to AED 4 million. Licensing runs in two stages, approval in principle and then a full licence, every virtual asset must be registered with the CMA, and privacy and algorithmic tokens are banned. Existing licensees have a year to comply.

The Central Bank's Payment Token Services Regulation (Circular 2/2024) licenses three kinds of business: dirham token issuers, token custodians and transferors, and token conversion. Dirham tokens can only be issued by UAE companies, including free zone companies but not those in the DIFC or ADGM. The rules apply to VARA and CMA licensees too.

For merchants, the key rule is what they may accept as payment. A UAE merchant can accept licensed dirham tokens. A foreign token can be accepted only if its issuer is registered with the Central Bank and only when it is used to buy virtual assets. Paying for ordinary goods and services in other crypto is not allowed, and algorithmic and privacy tokens are banned.

Law firm reporting in October 2026 lists AE Coin, Zand AED and DDSC as licensed dirham tokens and a single registered foreign token, while ADGM and the DIFC keep their own lists of accepted stablecoins. Check the Central Bank's register before you rely on any token.

Most UAE merchants that take crypto do not hold it. The customer pays through a licensed provider, and the merchant is settled in dirhams. When Dubai Duty Free started accepting crypto in August 2026, customers scanned a QR code priced in AED and paid through a provider holding a Central Bank stored value licence, while the retailer was paid in AED.

For a crypto business on the other side of the transaction, the questions are about fiat: how card and bank money comes in, where client assets are held and how fiat leaves. Some UAE banks now offer crypto trading in their own apps through VARA-licensed partners, which shows how the bank and VASP sides are starting to connect.

Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025 and gave firms until 15 September 2026 to align. Article 61 brings virtual asset payment services into Central Bank licensing, and Article 62 makes clear that the technology used does not take an activity outside it, naming decentralised finance and decentralised apps. Unlicensed activity can lead to prison and fines from AED 50,000 to AED 500 million.

Card purchases of crypto are processed under MCC 6051, which Visa places in Tier 2 of its Integrity Risk Program, and Mastercard registers cryptocurrency merchants in its specialty merchant programme. The acquirer uses your licence to complete these steps, which is why a VARA, CMA, FSRA or DFSA licence makes boarding much smoother.

The UAE was removed from the FATF grey list on 23 February 2024, after being listed in March 2022, so the jurisdiction itself is no longer the obstacle it once was.

• Your VARA, CMA, FSRA or DFSA licence and its exact scope.
• Trade licence, shareholder register and beneficial owners, plus passports and Emirates IDs.
• A flow-of-funds diagram: how card and bank money enters, where client assets are held and how fiat leaves.
• Anti-money laundering and sanctions controls, travel rule compliance and blockchain analytics.
• Which countries your clients are in. EU clients need MiCA authorisation since the transition period ended on 1 July 2026.
• A UAE bank account in the company's name for AED settlement.

• VARA Company Rulebook, version of 19 May 2025.
• Regulation Tomorrow, SCA renamed CMA (14 January 2026); Al Tamimi and Clyde & Co on CMA Resolution 04/Chairman of 2026 (April 2026).
• Central Bank of the UAE, Payment Token Services Regulation (Circular 2/2024); CMS, 10 things you need to know (8 August 2024).
• DLA Piper, digital assets and tokenisation developments (October 2026).
• Hadef & Partners on Federal Decree-Law No. 6 of 2025 (26 August 2026).
• Dubai Media Office, Dubai Duty Free and crypto payments (5 August 2026).
• Gulf Business, UAE exits FATF grey list (23 February 2024).
• ESMA, statement on the end of MiCA transitional periods, 17 April 2026.
• Visa Integrity Risk Program; Mastercard, Security Rules and Procedures, Merchant Edition.