Introduction to the legal and regulatory framework
The United Arab Emirates (UAE) comprises a federation of seven Emirates (Abu Dhabi, Ajman, Dubai, Fujairah, Ras Al Khaimah, Sharjah and Umm Al Quwain). UAE Federal Law is a civil law system that incorporates elements of Egyptian and French civil law, as well as the principles of Islamic Sharia.2 The Federal financial regulators are the UAE Central Bank and the Securities and Commodities Authority (SCA). In addition to the Federal jurisdiction, each of the Emirates is entitled to choose to maintain their own separate local courts to deal with matters that are not reserved to Federal jurisdiction in the Constitution. Abu Dhabi, Dubai and Ras Al Khaimah maintain their own independent judiciaries, which apply civil law and Sharia principles. This chapter refers to these jurisdictions collectively as ‘Onshore UAE’.
Article 121 of the UAE Constitution also permits the establishments of free zones. Federal Law No. 8 of 2004 specifically permits a subset of the free zones called ‘Financial Free Zones’. The key elements of a Financial Free Zone (set down in Article 3 of Federal Law No. 8 of 2004) are that they are exempt from all Federal civil and commercial laws, but they remain bound by Federal criminal laws, including Federal Anti-Money Laundering legislation.3 The UAE has established two Financial Free Zones: the Abu Dhabi Global Market (ADGM)4 and the Dubai Internal Financial Centre (DIFC).5
Within the ADGM, there is a separate financial regulator, the Financial Services Regulatory Authority (FSRA), and separately the ADGM Courts. The ADGM Courts, Civil Evidence, Judgments, Enforcement and Judicial Appointments Regulations 2015 make English Common Law directly applicable in the ADGM, marking a clear distinction from the civil law applicable at the Federal level and in Onshore UAE. Similarly, within the DIFC, there is also a separate financial regulator, the Dubai Financial Services Authority (DFSA), and separately the DIFC Courts. The DIFC Courts also apply a common law system (i.e., DIFC law) modelled on the English Common Law (with its court rules closely modelled on the English Civil Procedure Rules) albeit, unlike in the ADGM, English law is persuasive but not directly applicable. In both the ADGM and DIFC Courts, proceedings are conducted in English with judgments written in English. Both the ADGM and DIFC are dealt with separately in this chapter where appropriate.
In 2018, the FSRA published extensive regulations making the ADGM:
“the first jurisdiction in the world to introduce a comprehensive and bespoke regulatory framework for the regulation of spot virtual asset activities, including those undertaken by multilateral trading facilities, brokers, custodians, asset managers and other intermediaries.6“
These laws, regulations and guidance have since been regularly updated, with the latest iterations issued on 24 February 2020 (see Section II).
The period of 2020–2021 saw the onshore Federal regulators publish their first regulations affecting cryptoassets. The SCA passed Decision No. 23 of 2020 Concerning Crypto Assets Activities Regulation (the SCA Virtual Asset Regulation)7 (see Section II) and the UAE Central Bank published both its Stored Value Facilities Regulation8 and the Retail Payment Services and Card Schemes Regulation.9 These regulations cover Payment Tokens (or stablecoins)10 but expressly exclude Security and Commodity Tokens.11 In addition, following a public consultation launched in June 2021, the SCA, UAE Central Bank, DFSA and FSRA cooperated on compiling the Guidelines for Financial Institutions Adopting Enabling Technologies, which were published on 15 November 2021 (the Enabling Technologies Guidelines). The Enabling Technology Guidelines are to be followed by all financial institutions licensed and supervised by the UAE Central Bank, SCA, DFSA and FSRA, and relate to the use of Distributed Ledger Technologies (DLT) (more commonly referred to as ‘Blockchain’) (see Section II).
Also in 2021, the DFSA updated its Rulebook to include Investment Tokens, which it defined as:
“the Security or Derivative in the form of a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology; or a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology.12“
The definition of Investment Token does not cover cryptocurrencies or asset-backed tokens (such as stablecoins). However, this has not stopped players in the crypto and blockchain space from establishing themselves in the DIFC. For example, the regional headquarters for Ripple is located in the DIFC and as of 29 April 2022, Binance’s payments technology company, Bifinity, also has a presence in DIFC.
In March 2022, the Emirate of Dubai and the DIFC’s DFSA both took significant steps towards regulating virtual currency.
On 8 March 2022, the DFSA issued Consultation Paper No. 143, which sets out its proposed regulatory framework for cryptocurrencies. The consultation states that ‘the development of these proposals was prompted by the need to introduce appropriate investor protection requirements in this area, while also facilitating the development of this market in a responsible and prudent manner.’
On 9 March 2022, Dubai Law No. 4 of 2022 Concerning the Regulation of Virtual Assets (the Virtual Asset Law) established the (onshore) Dubai Virtual Asset Regulatory Authority (VARA). VARA’s remit includes:
- regulating the issuance and release of virtual assets and NFTs;
- regulating and licensing virtual assets service providers;
- protecting personal data of users and beneficiaries;
- regulating and monitoring the platforms offering cryptocurrencies and digital wallets;
- monitoring digital transactions;
- preventing the manipulation or modification of prices of virtual assets;
- operating and managing virtual assets platforms services;
- exchange services between virtual assets and currencies, whether national or foreign;
- exchange services between one or more forms of virtual assets;
- virtual asset transfer services;
- virtual asset custody and management services;
- services related to the virtual asset portfolio; and
- services related to the offering and trading of virtual tokens.
Under Article 15(a), the effect of the Virtual Assets Law is to prohibit, in lieu of a licence issued by VARA, any activity in respect of virtual currencies (among other operations) that falls under Article 16. The ‘activities requiring permits’ listed at Article 16 include:
- provision of virtual asset platform operation and management services;
- provision of services for the exchange between virtual assets and national or foreign currencies;
- provision of services for the exchange between one or more forms of virtual assets;
- provision of virtual asset transfer services;
- provision of virtual asset safekeeping, management, or control services;
- provision of services related to virtual asset wallets; and
- provision of services related to offering, and trading in, virtual tokens.
VARA’s jurisdiction does not extend to the DIFC and only covers activities in respect of virtual currencies that are carried out in onshore Dubai (but outside of the DIFC). At present, no passporting regime exists between Onshore UAE and the DIFC, meaning that companies must choose in which jurisdiction to become licensed. Companies who wish to operate in both Onshore UAE and the DIFC need to be licensed in both jurisdictions.
In December 2021, the DIFC Courts announced the launch of the Digital Economy Court (DEC), which is a specialised court for the resolution of disputes arising out of the digital economy. On 21 March 2022, the DIFC Courts published its public consultation on the proposed Rule Amendment No.1 of 2022, which will incorporate a new section, Part 58, into the DIFC Court Rules (i.e., the civil procedure rules governing the conduct of proceedings before the DIFC Courts). These rules will be specific to disputes before the DEC. Part 58.7 sets out that a DEC claim can involve digital assets, including the digital environment, platform or system in which a digital asset exists or may exist (Part 58.7(1)), or claims relating to blockchains (Part 58.7(1)). Part 58.5(3) defines ‘a digital asset’ as cryptoassets, digital tokens, smart contracts or other digital or coded representation of an asset or transaction.13 The consultation closed on 20 April 2022 and, at the time of writing, the DIFC Courts have made no further announcements concerning the outcome of the consultation. However, it is understood that the DIFC hopes that the DEC will prove to be a key attraction for virtual asset businesses looking to establish themselves in the region, particularly since the jurisdiction of the DIFC Courts has extended beyond the DIFC, allowing commercial parties in any geographic location to ‘opt-in’ to the jurisdiction of the DIFC Courts.
Questions remain as to how the overlapping jurisdictions of the UAE Central Bank, SCA and VARA over virtual currencies will be reconciled in practice, the extent to which VARA will issue regulations and make decisions that are specific to virtual currencies within its jurisdiction or that have wider, national effect, and whether general securities, investment and banking laws, for instance, will be issued with specific applicability to virtual currencies.
Securities and investment lawsi Onshore UAE
A notable development in 2020–2021 was the issue of the SCA Virtual Asset Regulation,14 which regulates the ‘Offering, issuing, listing and trading of Crypto Assets in the State and related Financial Activities’ (Article 2(1)) by creating a licensing regime, issuing directives and facilitating (and responding to) inquiries relating to the licensing regime (Article 2(2)). The scope of the regulation is set out in Articles 3 to 5. ‘General Obligations in respect of Crypto Assets’ are set out in Chapter 2, including the Offering of Crypto Assets (Article 6) and the Offering of Security Tokens (Article 7) in the State, and Crypto Assets listing on a Crypto Asset Exchange (Article 8).
In the Emirate of Dubai, Article 6(1) of the Virtual Assets Law empowers VARA to, among other duties, ‘develop the general policy and the strategic plans related to regulating Virtual Asset services in the Emirate’. Amendments to Dubai laws relating to securities and investment that are specific to the creation, trade and storage of virtual currencies will be forthcoming.
In Cabinet Resolution No. 36 of 2022 issued on 11 April 2022,15 the UAE Federal Cabinet issued its resolution ‘Concerning Regulated Activity of the Crowdfunding Platform Operator’ (the Crowdfunding Regulations). Pertinent to securities and investment law, the Crowdfunding Regulations prohibit joint stock companies, investment funds, entities that operate activities within the securities, insurance or banking sectors, companies that intend to use crowdfunding to grant loans or invest in other companies or companies that have a paid-up capital of more than 6 million dirhams from applying for crowdfunding, thereby limiting the use of crowdfunding in a virtual currency context by the finance industry (Article 3). Although there is no specific prohibition on the use of virtual currencies in crowdfunding, certain provisions of the Crowdfunding Regulations create barriers to that activity, such as the limits on investments in crowdfunding prescribed in dirhams in Article 6(5).
Following a public consultation launched in June 2021, the UAE SCA, Central Bank, DFSA and FSRA have cooperated on the Enabling Technologies Guidelines.16 An ‘enabling technology’ is any technology encompassing an application programming interface (API), cloud computing, biometrics, big data analytics, artificial intelligence or a distributed ledger technology (DLT, as above). Specifically, blockchain is classified ‘as a type of DLT which stores and transmits data in packages called “blocks” that are connected to each other in a digital “chain”.’ Section 2 of the Enabling Technologies Guidelines contains key principles for all enabling technologies and for each of the specific enabling technologies defined in Section 1. Specific guidance (notably on Distributed Ledger Technology as defined in the Enabling Technology Guidelines at Section 1) is covered below (see Section V).
After its initial flurry of activity in 2018, which saw the ADGM become the first jurisdiction globally to produce a regulatory framework for cryptoassets, followed by extensive updates to its framework in 2020, the past 12 months have been comparatively quiet. The current framework comprises:
- the Financial Services and Markets Regulations (FSMR);
- Guidance on Regulation of Digital Securities Activities in ADGM;
- Guidance on Regulation of Digital Security Offerings and Virtual Assets under the FSMR; and
- Guidance on Regulation of Virtual Asset Activities in ADGM.
The table below provides a helpful summary of the position as set out on page 7 of the Guidance on Regulation of Digital Securities Activities in the ADGM:17
Currently, the core laws regulating licensed business in the DIFC and administered by the DFSA are as follows:
- the Regulatory Law 2004, as amended;
- the Law Regulating Islamic Financial Business 2004;
- the Investment Trust Law 2006;
- the Collective Investment Law 2010; and
- the Markets Law 2012.
- Under the Regulatory Law 2004, the DFSA has also issued its Rulebook, which contains further subsidiary legislation.
The DFSA has adopted a two-phase approach to its Digital Assets Regime. For several years the DFSA had maintained a wait-and-see approach to the question of whether it should regulate cryptoassets. However, in March 2021, the DIFC launched a consultation on its proposed framework for security tokens (Consultation Paper No. 138 – Regulation of Security Tokens).18 This Consultation ended in the second quarter of 2021 and, in October 2021, the DFSA announced the introduction of its regulatory framework for investment tokens (referred to in Section I above), marking the first phase of its Digital Assets Regime.19
As part of the second phase of its Digital Assets Regime, in March 2022, the DFSA launched Consultation Paper No. 143 on the Regulation of Crypto Tokens, which sets out its proposed framework for crypto tokens.
Consultation Paper No. 143 proposes the following broad definition of a crypto token:
“A Crypto Token is a Token that is used, or is intended to be used, as a medium of exchange or for payment or investment purposes but excludes and Investment Token, or any other type of Investment, or an Excluded Token. A Crypto Token includes a right or interest in the relevant Crypto Token.20“
Notably, utility tokens (i.e., tokens that have a specific use case within a closed ecosystem), NFTs and Central Bank Digital Currencies are expressly designated as excluded tokens.21 Furthermore, it is also proposed that entities intending to offer financial services in relation to crypto tokens must establish in the DIFC as a body corporate and be incorporated under DIFC law.22
The DFSA’s proposals also aim to allow for the following services to be provided in relation to crypto tokens:
- dealing in investments as principal;
- dealing in investments as agent;
- arranging deals in investments;
- managing assets;
- advising on financial products;
- operating an exchange;
- providing custody;
- arranging custody;
- operating a clearing house; and
- operating an alternative trading system.23
The consultation remained open until 6 May 2022 and, at the time of writing, the DFSA has made no further announcements concerning the outcome of the consultation.
Banking and money transmission
i Onshore UAE
The key onshore virtual currency-specific legislation is the UAE Central Bank’s 2020 Stored Value Facilities Regulation (the SVF Regulation), which regulates the storage of non-cash mediums of exchange that can be purchased, transferred and exchanged for goods and services.24 The SVF Regulation expressly includes virtual currencies as virtual assets that customers can purchase, transfer and exchange.
The main change in regulation since 2021 has been in the Emirate of Dubai with the introduction of the Virtual Assets Law. Article 6 of the Virtual Assets Law empowers VARA in numerous ways to regulate, supervise and oversee virtual asset services within the Emirate. Article 6(4) obliges VARA to ‘regulate, and establish rules and controls to govern, the conduct of [regulated activities under the Virtual Assets Law] in the Emirate, including the activities related to Virtual Asset management, clearing, settlement and safekeeping services’. While pertinent to the regulation of exchanges (see Section V below), these activities also fall within traditional banking and money transmission operations and may be expected to lead, in due course, to further virtual currency-related regulations being issued in onshore Dubai.
Investment tokens do not fit easily with the rules and regulations that govern traditional fiat currency banking and money transmission services. However, the DFSA Rulebook regulates the custody of investment tokens by Digital Wallet Service Providers.25 For example, under conduct of business model (COB) 14.3.3 of the DFSA Rulebook, a digital wallet service provider must ensure:
- any DLT application used in providing custody of the investment tokens must be resilient, reliable and compatible with any relevant facility on which the investment tokens are traded or cleared;
- it is able to clearly identify and segregate investment tokens belonging to different clients; and
- it has in place appropriate procedures to enable it to confirm client instructions and transactions, maintain appropriate records and data relating to those instructions and transactions and to conduct a reconciliation of those transactions at appropriate intervals.26
Furthermore, the digital wallet service provider must ensure that the technology used and its associated procedures have adequate security measures (including cyber security) to enable the safe storage and transmission of data relating to the investment tokens.
In Consultation Paper No. 143, the DFSA has proposed that the same requirements will be imposed on digital wallet service providers, insofar as crypto tokens are concerned, as those imposed regarding investment tokens.
According to the Consultation Paper, however, investment tokens would not be the subject of any money transmission. The DFSA’s Money Service regime was established in January 2020 to allow various previously prohibited activities to be carried out in or from the DIFC. However, the DFSA does not intend to include crypto tokens within this regime, although they note that digital currencies that are legal tender could form part of it.27 The DFSA also does not intend to allow money services firms to provide services relating to both fiat currency and crypto tokens, although this may change in the future.
The DFSA is, however, proposing to allow money service providers to use blockchain (and associated native tokens required to operate on the blockchain) for the limited purpose of back-office operations without exposing the client to the token.28
This would only be allowed if:
- they are only used for the purposes of money transmission or executing payment transactions;
- the originator and beneficiary of such transactions continue to operate in fiat currency; and
- there is no exposure for the client to the crypto tokens used in the process.
The UAE’s anti-money laundering (AML) and countering the financing of terrorism (CTF) laws are covered under an extensive suite of federal statutes and the federal penal code. This is in addition to specific legislation and implementing regulations in force throughout the UAE (including in the financial and commercial free zones) covering these crimes.
The UAE Central Bank is the key authority on AML in the state, with assistance from the different authorities across the UAE when it comes to supervision, enforcement and industry related policies. These include the Dubai Multi Commodities Centre (a commercial free zone) (DMCC), the DFSA and the FSRA.29
In February 2021, the UAE Cabinet approved the establishment of an executive office to oversee the implementation of the UAE’s National AML/CFT Strategy and National Action Plan (NAP) as part of a broader approach to strengthening the UAE’s domestic approach to these issues. The executive office will act as a focal point for AML/CTF within the jurisdiction, with a broad mandate to assist the various AML/CTF entities and develop a sustainable AML/CTF structure in the country.
The principal legislation in this area has undergone substantial amendment and modernisation in the past 12 months. Federal Decree-Law No. 20 of 2018 on Facing Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations was amended by Federal Decree-Law No. 26/2021 (the AML Law), and its implementing regulation, Cabinet Decision No. 10 of 2019 on the Implementing Regulation of Federal Decree-Law No. 20 of 2018 on the Criminalisation of Money Laundering and Combating the Financing of Terrorism and the Financing of Unlawful Organisations was amended by Cabinet Decision No. 24/2022 (the AML Implementing Regulation).
Money laundering is defined in Article 2 of the AML Law as requiring a person to have knowledge that funds were derived from a predicated offence, and that they willfully commit any of the following:
- the transfer, movement or transaction of the proceeds with the intention of concealing or disguising the illegal source of the funds;
- concealing the true nature, source, location, movement or ownership or rights of the funds;
- acquiring, possessing or using the funds; or
- assisting the perpetrator of the predicate offence to escape punishment.
In the context of virtual assets, Article 1 of the AML Law defines ‘funds’ as including assets, ‘whatever their form . . . including . . . electronic, digital or crypto . . . and instruments in any form, including electronic or digital, that evidence ownership of those assets or the shares or rights related thereto . . .’ This broad definition of funds means that money laundering in the UAE incorporates acts involving cryptoassets, including virtual or cryptocurrencies.30 However, the definition of ‘virtual assets’ in the AML Implementing Regulation excludes ‘digital representations of fiat currencies, securities and other financial assets’.31
Penalties for money laundering range from a monetary fine of between 100,000 dirhams and 5 million dirhams to imprisonment for up to 10 years.32 In addition, confiscation will apply to the funds the subject of the crime or owned by the perpetrator.33
The AML Law applies broadly to local authorities that are entrusted under legislation with the control of financial institutions, designated non-financial businesses and professions, virtual asset service providers (VASP) and non-profit organisations.34
The recent changes to the AML Law incorporate recent recommendations from the Financial Action Task Force (FATF) that VASPs be registered as a VASP if there is a commercial nexus between the legal entity releasing the software protocol and the decentralised finance (DeFi) solutions provider.35 The penalty for operating an unregistered or unlicensed VASP attracts a prison sentence or a fine, or both.
Those subject to the AML Law are subject to AML Suspicious Transaction reporting obligations if they suspect a transaction or funds fully or partially constitute the proceeds of any felony or misdemeanor.36 There is a penalty of imprisonment or a fine, or both, to anyone who intentionally or negligently violates these obligations.
Of further note is Chapter 4 of Federal Law No. 7 of 2014 on Combatting Terrorism Offences, which deals with offences related to terrorist financing. In addition, the UAE recently implemented legislation introducing a requirement for a beneficial ownership register in the UAE mainland (including the ADGM and the DIFC) with a view to harmonising minimum disclosure requirements for corporate entities in the UAE mainland.37 Under the UBO Regulations, companies had 60 days from the date the Regulation came into effect to submit details of their ultimate beneficial owners to the register. Information contained in the register is not, however, publicly available.
On 7 June 2021, the UAE Central Bank issued new guidance and assistance to supervised financial institutions to help them fulfil their statutory obligations when implementing AML and CFT laws, including filing suspicious activity reports (SARs) and suspicious activity transactions (SATs) to the Central Bank’s Financial Intelligence Unit.38
The DFSA Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (Annex I) contained rules in its appendix. These rules were amended by DIFC Law No. 1/2004 (the Regulatory Law) on 26 February 2020, which came into force on 1 April 2020 and assists entities falling under its remit with minimum requirements for due diligence and required procedures when conducting KYC.
As described further in Section VIII below, a new specialist Anti-Money Laundering Court has been established within the onshore Dubai Courts.
Regulation of exchanges
i Onshore UAE
The SCA Virtual Asset Regulation is still the main, UAE-wide onshore regulation that governs and controls the operation of virtual currency exchanges. The requirements for obtaining and continuing a licence for the operation of a virtual currency exchange and the listing and trading of virtual currencies are set out at Articles 8, 16, 17 and 21 therein.
In the Emirate of Dubai, the Virtual Asset Law obliges VARA to ‘develop the general policy and the strategy places related to . . . dealing and trading in Virtual Assets in the Emirate’ (Article 6(1)), including ‘classify, and determine the types of, Virtual Assets and Virtual Tokens; and prescribe the standards and rules for trading in the same’ (Article 6(5)). Although no VARA regulations relating to the regulation of exchanges have yet been made, it is likely to be only a matter of time before such regulations are introduced.
The Enabling Technologies Guidelines contain guidelines for all financial institutions licensed by the SCA, Central Bank, DFSA or FSRA. Sections 2.31 to 2.36 of the Guidelines contain specific principles for the operation of a DLT, including technologies that use blockchains like virtual currency exchanges, covering their governance, auditability, design, anonymity and pseudonymity, management and monitoring and business continuity. The specific (and detailed) guidelines for a DLT are at Sections 3.115 to 3.156 of the Guidelines.
The DMCC is one of the non-financial free zones in Dubai and has been at the forefront of developing an infrastructure for the growth of a prosperous and sophisticated environment for the cryptoasset industry. In 2017, the DMCC recognised proprietary trading in cryptoassets as a licenced activity. The launch in May 2021 of the DMCC Crypto Centre,39 in partnership with the Swiss-Government backed CV Labs, has provided a platform for a huge increase in blockchain and decentralised finance projects and related businesses in Dubai.40 The success of this venture is due in large part to the Memorandum of Understanding signed between the DMCC and the SCA in March 2021, establishing a regulatory framework for businesses offering, issuing, listing and trading cryptoassets in the freezone, including cryptoasset trading platforms. The DMCC offers bespoke licences for crypto-related business41 for which the SCA will be responsible for issuing approvals and regulating the crypto activities in line with the SCA Virtual Asset Regulation.
Currently, the DMCC is also working on establishing the first precious metals refinery and storage facility in the GCC to be completely enabled by blockchain. The facility will cater for gold, silver and other precious metals, to be tokenised to back a set of stable coins.42
Paragraph 54(1), Chapter 9, Schedule 1 of the FSMR provides that the operation of a Multilateral Trading Facility (MTF) on which Virtual Assets are traded is a Regulated Activity.43 Regulated Activities can only be carried out by Authorised Persons. Authorised Persons operating an MTF may also provide Custody Services.
Paragraphs 125–134 of the Guidance on the Regulation of Virtual Asset Activities set out the requirements for those operating an MTF and Virtual Assets. Paragraph 129 makes it clear that an MTF includes trades not only made from fiat currency (or other value) to accepted virtual assets and vice versa but also from one accepted virtual asset to another.
Accepted virtual asset in this context is specific to each authorised person, creating bespoke licences for each authorised person and MTF trading virtual assets. For that reason, the FRSA does not maintain a public list of accepted virtual assets.44
A key point to note is the attitude that the FRSA has taken to the location of MTFs operating in the ADGM. Paragraphs 128–129 of the Guidance on Virtual Asset Activities make it clear that the FRSA will have extensive regulatory oversight for both start-ups and established exchanges. The FRSA recognises that, in this respect, its level of oversight may differ from other regulators globally.
In practical terms, for a start-up MTF, its entire order book and the functionality of its matching engine will be subject to FSRA oversight. For existing operational virtual asset exchanges that already have their order book or matching engine outside the ADGM prior to making an application, a determination of which parts (if not all) of its order book (and how its matching engine) will come under FSRA regulatory oversight needs to be made by the applicant, to allow it to apply to become authorised as an MTF. In situations where an entity establishes an authorised person that routes orders to a virtual asset exchange outside the ADGM (even as part of a group that may be operating globally) instead of having orders matched within an MTF’s order book within the ADGM, that entity cannot obtain an MTF Exchange licence within the ADGM and can only be licensed as an intermediary-type authorised person within the ADGM.45
The principal Rules for authorised persons conducting a regulated activity in relation to virtual assets in the ADGM are set out in Chapter 17 of the FSRA Conduct of Business Rulebook (FSRA-COBS). These are also supplemented by the Market Infrastructure Rules (MIR). Chapter 8 of FSRA-COBS incorporates rules from various other FSRA Rulebooks that must be complied with, including certain sections of MIR.
FSRA-COBS Rule 8.2.1 sets out various rules in MIR that MTFs (using virtual assets) are required to comply with to the satisfaction of the FSRA, with the applicable rules covering:
- operational systems and controls;46
- transaction recording;47
- membership criteria and access;48
- access requirements;
- contents of the rulebook (including KYC and AML procedures);
- financial crime and market abuse;
- rules and consultation;
- fair and orderly trading;
- public disclosure; and
- settlement and clearing.
There is also a requirement that the authorised person operating the MTF maintain a minimum regulatory capital in fiat equivalent to 12 months’ operational expenses.
In addition to Kraken, BitOasis, Matrix Exchange, DEX and MidChains having obtained permission from the FSRA to operate in the ADGM, in May 2022 Binance, the largest cryptocurrency exchange in terms of daily trading volume, also obtained a licence to operate in the ADGM.
NASDAQ Dubai, one of the largest stock exchanges in the Middle East, has been present in the DIFC since 2004 while the Dubai Mercantile Exchange, an energy-focused commodities exchange that is home to the world’s third crude benchmark, has been located in the DIFC since 2005. Historically, the DFSA has issued licences for and regulated the operation of an exchange, a multilateral trading facility or an alternative trading platform in the DIFC, and it has since extended these financial services to include activities related to investment tokens. This means that companies wishing to operate an alternative trading platform for investment tokens will have to comply with the same requirements that are applicable to operators of other types of exchange. In particular, admitting securities tokens to an exchange or trading platform in the DIFC will require the publication of a prospectus in compliance with the DIFC Markets Law 2012.
A technology audit requirement is also imposed on all authorised firms operating a facility for investment tokens, holding or controlling investments that include investment tokens, relying on DLT or similar technology to carry out financial services in relation to investment tokens, or managing a fund where either 10 per cent or more of the asset value of the fund comprises investment tokens; or the units are in security tokens.
The DFSA is now proposing, under Consultation Paper No. 143, to further extend the provision of these financial services to allow for the trading of crypto tokens. However, only accepted crypto tokens will be permitted to be traded, and the DFSA has set out a proposed acceptance process for firms who wish to apply for a crypto token to be deemed an accepted crypto token. Once a crypto token is deemed an accepted crypto token it will be placed on a list of accepted crypto tokens and there will be no need to make further applications to the DFSA concerning the same token.
Furthermore, the DFSA proposes to impose certain limits on the trading of crypto tokens. For example, the DFSA plans to prohibit trading through an organised trading facility due to the discretionary rules associated with this model. The DFSA is also minded to not allow the same operator to organise a trade venue for crypto tokens and investments or investment tokens from the same legal entity.49
In June 2021, the Bitcoin Fund (QBTCu.TO) listed on NASDAQ Dubai, making it the Middle East’s first indexed cryptocurrency-based fund.50 The issuer, Canadian digital asset management firm 3iQ, received approval from the DFSA to list the Bitcoin Fund under the DFSA’s then current securities framework in April 2021.
Regulation of miners
i Onshore UAE
In Dubai, the Virtual Asset Law obliges VARA to ‘regulate, supervise, and oversee the issuance, offering and relevant disclosure processes of Virtual Assets and Virtual Tokens’ (Article 6(2)) and to:
“regulate, and issue Permits to, Virtual Asset Service Providers in accordance with the requirements, procedures, and rules adopted by it; and oversee and supervise them to ensure their compliance with the provisions of this Law, the resolutions issued in pursuance hereof, and other Legislation in force in the Emirate (Article 6(3)).”
Given that, to date, the mining of virtual currencies in the UAE has not been regulated, the issuance, offering and disclosure process of virtual currency miners and, in particular, the activities involved in the creation of and then the initial currency offering (ICO) of a virtual currency are likely to be regulated in Dubai by VARA in due course. The Virtual Assets Law has apparently spurred a number of applications to VARA for relevant ‘mining’ licences. It is understood that a number of provisional approvals for limited activities have been issued, holding the position until full, formal licensing framework is effective.
The ADGM has not legislated for, nor passed any regulation that governs, the mining of cryptoassets. Paragraph 11(b)(ii) of the FRSA Guidance on the Regulation of Virtual Asset Activities in the ADGM expressly confirms that the Virtual Asset Framework is not intended to apply to ‘the development, dissemination or use of software for the purpose of creating or mining a Virtual Asset’.51
At present, there is no proposed regulation of miners insofar as crypto tokens are concerned. However, as noted in Section VII below, the DFSA has said that, at present, it does not intend to allow for the issuance of new crypto tokens, although it intends to revisit this in the future. If the DFSA were to permit the issuance of new crypto tokens in the future, it is possible that a regulatory regime applicable to miners might also be introduced.
Regulation of issuers and sponsors
The SCA Virtual Asset Regulation is still the main, UAE-wide onshore regulation that governs and controls the operation of persons offering, issuing or promoting virtual assets. The requirements for obtaining and continuing a licence for these activities are set out in various Articles in the regulations, and particularly at Article 14. These requirements are as follows:
- the issuer and sponsor must be licensed by VARA to conduct the activities carried out, that licence to include approval for operating a crypto-fundraising platform under Article 15;
- no client may be permitted to invest more than 350,000 dirhams, or its equivalent, in respect of any issuing of the material cryptoassets. VARA, under directions issued according to Article 2, may amend that amount from time to time;
- the only funds and cryptoassets that may be accepted in fundraising are those that can be subject to applicable controls for combating money laundering and terrorism financing crimes in accordance with Article 21;
- a person licensed to fundraise shall comply with the disclosure requirements set out in the Regulation in respect of the relevant cryptoasset; and
- the fundraising person may not conduct any trading or exchange of issued cryptoassets, unless approved to do so by VARA.
As noted above, in Dubai the Virtual Asset Law obliges VARA to ‘regulate, supervise, and oversee the issuance, offering and relevant disclosure processes of Virtual Assets and Virtual Tokens’ (Article 6(2)). The Virtual Assets Law has apparently spurred a number of applications for relevant issuer and sponsor licences from VARA. Again, a number of provisional approvals for limited activities have been issued, holding the position until full, formal licensing framework is effective.
Financial promotions (i.e., the marketing of financial products and financial services) are generally prohibited under Article 41A of the Regulatory Law 2004, unless certain requirements relating to marketing in the GEN Module Chapter 3 (of the DFSA Rulebook) are met. As such, financial promotions can only be made or approved by authorised persons, although other persons may also make them in very limited circumstances, which are subject to additional requirements.
The general prohibition on financial promotions has been extended to persons making them in relation to investment tokens and the DFSA is now proposing, through Consultation Paper No. 143, to extend the general prohibition to include crypto tokens as well by expanding the definition of financial product to include crypto tokens. Such prohibition is intended to also apply to crypto tokens that are not accepted crypto tokens, algorithmic tokens and privacy tokens. It is the responsibility of the person proposing to carry out activities in relation to a token to determine whether such token is an investment token. Guidance has been provided by the DFSA in order to assist in the process of determination.
Issuance of tokens
Issuers of securities are required to have a prospectus that meets the DFSA’s requirements set out in the DIFC Markets Law 2012. Issuers of security tokens must also provide a prospectus, although the rules for prospectuses relating to security tokens are somewhat more onerous in their requirements, as set out in MKT A220.127.116.11
It is also important to remember that any authorised firm that wishes to provide a financial service in respect of an investment token must provide a key features document, per COB 14.4.53 Such document must include information relating to the risks associated with the investment token, the essential characteristics of the investment token, confirmation of whether the investment token is, or will be, admitted to trading, how the client may exercise any rights conferred by the investment token and any other information that is relevant to the investment token in question, which would assist the client in understanding the product and allow them to make a more informed decision about the product.
With regard to crypto tokens, the DFSA has said that initially it intends to focus on crypto tokens that have already been issued and therefore it does not intend to allow for the issuance of new crypto tokens.54 However, the DFSA has also stated that it will consider this matter again at a later stage, suggesting that the issuance of new crypto tokens may become permitted in the future.
Criminal and civil fraud and enforcement
As part of general legal reforms introduced within the UAE at the start of 2022, Federal Decree Law No. 5/2012 on Combatting Cybercrime was repealed and replaced by Federal Decree-Law No.34/2021 Concerning the Fight Against Rumours and Cybercrime (the Cybercrime Law), which came into effect on 2 January 2022. The Cybercrime Law includes a number of offences prevalent in cryptoasset fraud, from hacking and compromising information systems to the unauthorised obtaining of third-party symbols and codes of electronic information technology (passwords), to the fabrication of websites, mail and electronic accounts.55 It also criminalises acts related to unlicensed cryptocurrency trading and behavior that promote or encourage the unlicensed dealing in cryptocurrency that is not officially recognised in the UAE.56 Unsurprisingly, the full scope of federal civil and criminal penalties is applicable to all activities related to cryptoassets, and regulated persons must comply with AML/CFT laws.57
While at the forefront of regulatory development in the cryptoasset field, regulatory bodies in the UAE continue to urge caution in dealing with crypto-related financial products. The SCA has publicised warnings for investors against dealing with certain crypto or initial coin offering companies due to concerns about fraud.58 The DFSA has highlighted fraud and money laundering among key risk factors when buying cryptoassets, and advises potential investors and consumers to undertake due diligence and exercise caution before entering a transaction.59
Operators of a virtual asset business in the ADGM are subject to the full remit of financial crime offences, including making misleading statements and market abuse.60 To reduce the risk of financial crime, the FSRA regulates cryptoassets and continues to issue warnings about suspect companies.61
To help combat the rise in crypto fraud, on 22 August 2021, the Dubai Courts announced the establishment of a specialist criminal court focused on combating money laundering. The new court will sit within the Court of First Instance and Court of Appeal. Additionally, in October 2021, the Dubai Police launched a specialist Virtual Asset Crime department to investigate crypto fraud62 and announced that it will be collaborating with a cryptocurrency trading platform and other industry experts to fight crime within the space.63 In the past year, the Dubai Police have arrested 40 members of a crypto laundering scheme and successfully investigated the theft of an NFT from a Dubai resident.
Furthermore, the UAE’s civil courts may be able to assist victims of fraud. The DIFC and ADGM Courts have the full arsenal of interim measures available to common law courts, including freezing and proprietary injunctions and asset disclosure orders. These interim measures have been successfully used in other common law jurisdictions and, provided the jurisdictional requirements of the UAE’s common law courts are met, it is highly likely that similar measures could be wielded by the DIFC and ADGM under their existing laws and court rules. The UAE’s Onshore Courts may also be able to make orders in support of claims by fraud victims, notable in the form of the precautionary attachment, which is similar to a freezing order in the common law courts and can be easily notified to banks and other financial institutions under existing processes.
“The future belongs to those who design it. Through the virtual asset law, we aspire to participate in shaping the future of this ever-evolving sector64… Dubai will provide the most advanced virtual asset ecosystem in terms of organization, governance and security.65“
Those were the words of His Highness Sheikh Mohammed bin Rashid Al Maktoum, Vice President and Prime Minister of the United Arab Emirates (UAE) and the Ruler of Dubai, announcing the approval of the Virtual Asset Law on 9 March 2022.
Looking ahead to the future of virtual currency in the UAE requires considerably less speculation than in other jurisdictions.
In the short term, the key developments are likely to be the result of the two completed consultations involving the DFSA’s regulatory framework for cryptocurrencies, and the DIFC Court’s consultation on the implementation of Part 58 of the Rules of the DIFC Court and the operation of the Digital Economy Court. That will complete the second phase of Onshore Dubai and the DIFC’s regulatory and legal framework in relation to virtual currency. Of particular interest will be the extent to which the DFSA and VARA co-operate or collaborate, or both; if they do not, there will be the real risk of conflicting and incoherent regulation that leaves gaps in the national frameworks that may be exploited by fraudsters. The DFSA could adopt regulations that are more favourable to virtual currency businesses and customers, particularly if, as we anticipate, VARA aligns itself comparatively closely with the UAE Central Bank and SCA when it comes to licensing and regulating virtual currencies.
In Abu Dhabi, the FRSA and ADGM continue to press ahead with regulatory policy development, focusing on policy considerations for DeFi in the jurisdiction. Discussion Paper No. 1 of 22 published on 13 April 2022 seeks comments on four key areas:
- the risks associated with DeFi;
- the FSRA’s view on the likely medium-term direction of DeFi (i.e., over the next five to 10 years);
- high level policy positions on how the FSRA might consider regulating DeFi; and
- a description of what a future regulatory framework for DeFi might look like.
- The consultation closes on 30 June 2022 and will shape the future direction of DeFi regulation in the region.
Longer term, both the UAE and Dubai governments’ Blockchain Strategies are well established and are kept under review. Moreover, the words of His Highness Sheikh Mohammed make clear Dubai’s aspiration and intention to be at the forefront of the developing digital economy. That aspiration is more than inspirational rhetoric. Smart Dubai’s Blockchain Strategy 2020 Achievement Report records that two pillars of the strategy are as follows:
- industry creation – creating an economic sector and effective blockchain-enabling environment, especially for entrepreneurs and start-ups; and
- international leadership – leading the theoretical and practical aspects of blockchain applications and putting Dubai on the global map for thought leadership in the field.
Dubai has also led national engagement with the ‘metaverse’, the online network of virtual worlds that allow human interaction. In March 2022, Dubai Municipality announced plans for a model of the city in a metaverse called One Human Reality. Subsequently, Dubai has announced the formation of a higher committee to prepare the Dubai Metaverse Strategy, supervise all future technological developments in the Emirate and enhance Dubai’s position as a global centre for new metaverse technology. VARA has also established a MetaHQ on the Sandbox metaverse platform.
Echoing the words of his father, His Highness Sheikh Hamdan bin Mohammed bin Rashid Al Maktoum, Crown Prince of Dubai and Chairman of Dubai Executive Council, said at the launch of VARA into the Metaverse in May 2022:
“We have exceeded the role of an early adopter to become an innovator and participant in shaping the future of this technology . . . VARA represents a serious effort to build a new, powerful economic sector that contributes to the nation’s economy and creates new investment opportunities, and this is possible through the safe and modern regulatory solutions we envision. Our presence in the Metaverse therefore marks the beginning of a new phase in the Dubai Government’s march for the future . . . By expanding VARA’s resources to a borderless audience through the Metaverse, Dubai is creating a prototype Decentralised Regulator Model, inviting international thought leaders – global authorities, governance custodians, and industry shapers – to participate, exchange knowledge, and problem-solve collectively so that we enable the dynamic virtual assets sector to build economic resilience, accelerate social inclusion, and address environmental sustainability.66“
Continuing in the same vein, the UAE Central Bank has also launched a digital currency part of its 2023–2026 roadmap.67 The UAE Central Bank is also participating in the Multiple Central Bank Digital Currency (m-CBDC) Bridge test involving China, Hong Kong and Thailand. That test is for the use of Blockchain for foreign currency payments.68 This follows on from Project Aber, a pilot project between the UAE and Saudi Arabia in 2019, which successfully concluded that Blockchain technology can facilitate cross-border transactions.69
In the meantime, businesses within the UAE are already moving forward with virtual currency. Emirates Chief Operating Officer Adel Ahmed Al-Redha told a media gathering at the Arabian Travel Market that Emirates is exploring the use of Bitcoin as a payment service,70 and in May 2022, coffee shop Bake N More became the first cafe in Dubai to accept payment in Bitcoin, Ether and Tether virtual currencies.
Given that the full weight of the UAE’s federal and local institutions seem to be targeting the development of the digital economy as a key priority, it is difficult to see anything other than the UAE continuing to innovate with the development of virtual currencies and the infrastructure that supports them, including the legal and regulatory framework that underlines consumer confidence in the sector and the region.