Emirate vs federal: CBUAE, VARA, ADGM and DIFC compared

The UAE has more digital-asset regulators than any comparable market. And that's a feature, not a bug, once you understand the map. The Central Bank (CBUAE) governs stablecoins federally. VARA governs virtual-asset activity in Dubai. The two financial free zones - ADGM and DIFC - run their own complete regimes under the FSRA and DFSA. And the federal Securities and Commodities Authority (SCA) covers virtual-asset service providers on the mainland outside Dubai. Which door you knock on is determined by three questions: what activity you perform, where your customers are, and where your entity is incorporated. This is the decision framework.

The five doors

Question one: what do you actually do?

Activity determines regulator more than geography does, because one activity is carved out of every other regime. Fiat-referenced payment tokens - stablecoins - belong to the CBUAE federally, regardless of which emirate you sit in (the financial free zones excepted). A Dubai exchange with a VARA licence that wants to offer AED↔stablecoin conversion is performing a payment token service; that activity answers to the central bank, not to VARA. This is the single most common licensing misunderstanding in the market, and it cuts both ways: a CBUAE payment-token licence doesn't authorize you to run a crypto exchange, either.

Everything that isn't a payment token service - trading venues, brokerage, custody of non-stablecoin virtual assets, advisory - follows geography: VARA in Dubai, SCA on the rest of the mainland, FSRA or DFSA inside their zones.

Question two: where are your customers?

The free zones are complete jurisdictions, but they are perimeters. An ADGM or DIFC licence authorizes activity in and from the zone - it is not a passport to solicit the UAE mainland retail market. Conversely, the PTSR's reach is expansive by design: it captures services performed in the UAE or directed at persons in the UAE, which is why offshore models aimed at UAE customers stopped being viable when the transition period ended. If your customers are UAE businesses at large, you need the licence that covers where they are - not just where you are.

Question three: where are you incorporated?

Here the doors genuinely exclude each other. A PTSR licence requires incorporation in the UAE outside the financial free zones - a DIFC or ADGM entity cannot hold one. That single rule shapes real corporate structures: firms wanting both a financial free-zone base (for funds, holdcos, or institutional clients) and payment-token permissions (for settlement operations) end up with more than one entity, by design rather than by accident. It is the structural reason serious stablecoin businesses in the UAE are rarely one-entity companies.

How the choices play out

• A stablecoin issuer goes to the CBUAE - there is no other door for issuing a dirham token.

• A crypto exchange in Dubai goes to VARA - and adds CBUAE authorization the moment its product touches payment token conversion or custody for UAE customers.

• An institutional platform serving funds and banks often starts in ADGM or DIFC, where the frameworks are oldest and the institutional ecosystem is densest - accepting the perimeter constraint.

• A settlement infrastructure company - moving between fiat and stablecoins for clients - lives with the CBUAE by the nature of the activity, often alongside a free-zone entity for everything else. That combination is the licence architecture we described in our PTSR explainer, and the path we know from the inside.

Why the layered map is a strength

It's fashionable to complain about UAE regulatory complexity. The complaint misses what the layers buy. Specialization: a dedicated stablecoin regulator (the central bank - where money should be regulated), a dedicated virtual-asset authority, and two common-law financial centers with global-standard rulebooks. Competition: the zones iterate faster because founders can choose between them. And completeness: between the five doors, essentially every digital-asset business model has a lawful home - which is precisely why the licensing map filled with real issuers and venues while larger markets were still drafting. The full regulatory stack is covered in our UAE guide; the point of this piece is simpler: pick your door by activity first, customers second, incorporation third - and expect the answer, for anything ambitious, to be "more than one."

Frequently asked questions

Do I need a VARA licence or a CBUAE licence?
It depends on activity: virtual-asset services in Dubai (exchange, brokerage, custody) → VARA; payment token services (stablecoin issuance, conversion, custody & transfer) → CBUAE. Many stablecoin-touching businesses need both.

Can an ADGM or DIFC company get a PTSR licence?
No. PTSR applicants must be incorporated in the UAE outside the financial free zones. ADGM and DIFC entities operate under the FSRA and DFSA regimes instead.

Does a Dubai (VARA) licence cover the whole UAE?
No. VARA covers Dubai (excluding the DIFC). Mainland activity outside Dubai falls to the SCA federally; stablecoin services fall to the CBUAE everywhere outside the financial free zones.

Is a DIFC licence valid outside the DIFC?
It authorizes activity in and from the DIFC. It is not a passport to the UAE mainland market.

Which UAE regulator handles stablecoins?
The CBUAE, under the Payment Token Services Regulation - with the FSRA and DFSA recognizing specific fiat-referenced tokens for use within ADGM and the DIFC respectively.

Sources

• CBUAE Rulebook, Payment Token Services Regulation (Circular No. 2/2024) · CMS analysis of the PTSR

• VARA rulebooks (Dubai Law No. 4 of 2022)

• FSRA (ADGM) fiat-referenced token framework · DFSA (DIFC) crypto token regime and recognized tokens

• SCA reconstituted as the Capital Market Authority (Federal Decree-Laws 32 and 33 of 2025, effective 1 Jan 2026) · Charles Russell Speechlys, in-depth UAE virtual currency regulation