The Payment Token Services Regulation (PTSR), explained

The Payment Token Services Regulation (PTSR) is the Central Bank of the UAE's framework for stablecoins, issued as Circular No. 2/2024 in mid-2024, fully in force since its transition period ended in mid-2025. It defines fiat-pegged tokens as "payment tokens," establishes three licensed service categories (issuance, conversion, and custody & transfer) plus a registration regime for foreign tokens, and sets the rules that determine what every stablecoin business touching the UAE can and cannot do. This is the full guide what the PTSR covers, who needs which licence, and what the requirements mean in practice.

What is a "payment token"?

The PTSR defines a payment token as a virtual asset designed to maintain a stable value by referencing the fiat currency it is denominated in (or another payment token in that same currency). In plain terms: a stablecoin. Algorithmic tokens and privacy tokens are excluded from the regime entirely and they cannot be licensed in the UAE.

The regulation then splits the universe in two, and everything downstream follows from this split:

• Dirham payment tokens - AED-denominated, issuable only under full CBUAE licence, and the only virtual assets generally permitted for paying for goods and services in the UAE.

• Foreign payment tokens - denominated in any other currency, admitted via a lighter registration of the issuer, and restricted largely to licensed trading venues and virtual-asset purchases rather than domestic commerce.

Which activities require a licence?

Article 2 is blunt: no person may perform a payment token service in the UAE, or direct one at persons in the UAE, without CBUAE authorization. The services come in three licensed categories, plus registration:

Three eligibility rules shape who can even apply. Applicants must be incorporated in the UAE. commercial free zones qualify, but the financial free zones (DIFC and ADGM) are excluded, since they run their own regimes. Marketing and promotion of payment tokens is itself restricted without authorization. And a de-minimis exemption exists for very small issuers (reserves up to AED 500,000 and no more than a hundred holders) - a sandbox-by-another-name for pilots, not a loophole for scale.

What are the core requirements?

Across the categories, the PTSR imposes the obligations you would expect of a payments regulator, plus several with sharper edges:

Full reserve backing and safekeeping. Dirham tokens must be backed 1:1, with strict rules on how the reserve is held, managed, and segregated. Custody & transfer providers face parallel safeguarding duties for customer tokens.

No interest to holders. An issuer may not pay customers interest - or any benefit tied to how long a token is held. This single rule quietly shapes the entire UAE stablecoin product landscape: yield-bearing stablecoin products, as marketed elsewhere, do not fit inside a UAE payment token.

Issuance perimeter. A licensed issuer may only issue dirham tokens to UAE residents - though once issued, the PTSR does not territorially restrict where tokens may be used or transferred. Local issuance, global circulation.

The full supervisory stack. Regulatory capital, fit-and-proper assessment of controllers and senior management, white paper disclosure, redemption rights, AML/CFT compliance, consumer protection, data protection, and liability rules for unauthorized transfers.

Who needs what? The operator's view

Mapping the categories onto real business models is where most confusion lives, and where getting it wrong is expensive:

• A fintech or PSP embedding stablecoin payouts or collections for clients is likely performing conversion (fiat↔token) and, if it holds client balances, custody & transfer.

• A CASP or exchange offering AED pairs to UAE customers needs conversion authorization for that activity - a VARA licence covers virtual-asset activity in Dubai, but fiat-referenced payment tokens answer to the CBUAE.

• A bank launching its own AED token needs the issuance licence - the path AE Coin and Zand took and others are following.

• A merchant accepting licensed dirham stablecoins needs no licence to accept them - the perimeter sits on the service providers, not the payer or payee.

The categories also stack: a full settlement operation - money in, conversion, custody, money out - typically implicates conversion and custody & transfer together. That combination is precisely the shape of the licence architecture required to run the settlement layer we described in our manifesto, and it is the framework Thiqwave builds against.

Why the PTSR matters beyond the UAE

Most jurisdictions regulate stablecoin issuance and stop. The PTSR regulates the full service chain: issuance, conversion, custody, transfer, even marketing, which makes it one of the few frameworks in the world under which a complete, regulated stablecoin settlement stack can exist inside one perimeter. Combined with the dirham/foreign token split (covered in our UAE regulation guide), it explains why the UAE has become the natural home for regulated non-USD settlement - the thesis behind the dollar detour.

Frequently asked questions

What does PTSR stand for?
Payment Token Services Regulation - Central Bank of the UAE Circular No. 2/2024, the UAE's framework for stablecoins ("payment tokens").

When did the PTSR take effect?
It was issued in mid-2024 with a one-year transitional period that ended in mid-2025. It is now fully in force.

What are the PTSR licence categories?
Three licensed services - Payment Token Issuance, Payment Token Conversion, and Payment Token Custody & Transfer - plus a registration regime for foreign (non-AED) payment token issuers.

Do crypto exchanges need a PTSR authorization?
If they offer payment-token services to UAE customers, such as converting stablecoins to fiat - yes, that activity sits with the CBUAE, separate from any VARA or free-zone virtual-asset licence.

Does the PTSR allow yield on stablecoins?
No. Issuers may not pay interest or any time-based benefit to token holders - one of the regime's most consequential product rules.

Can DIFC or ADGM companies get a PTSR licence?
No - applicants must be incorporated in the UAE outside the financial free zones. DIFC and ADGM operate their own digital-asset regimes.

Sources

• CBUAE Rulebook, Payment Token Services Regulation (Circular No. 2/2024) — primary text

• CMS, "The new CBUAE Payment Token Services Regulation: 10 things you need to know"

• Norton Rose Fulbright, Regulation Tomorrow · Pinsent Masons, end of transition period