Are virtual asset service providers (VASPs) regulated under UAE AML law?

UAE
, ,
1

Yes. Federal Decree-Law No. 10 of 2025 brings virtual asset service providers (VASPs) firmly within the core of the UAE’s AML/CFT/CPF framework. VASPs are named throughout the law alongside financial institutions and designated non-financial businesses and professions, and they are subject to the same preventive obligations: risk assessment, customer due diligence, ongoing monitoring, targeted financial sanctions, record keeping and suspicious transaction reporting.

Crucially, no natural or legal person may carry on virtual asset service provider activities without obtaining the required licence, registration or enrolment from the competent authority or supervisory authority. This closes the door on unlicensed operation. VASPs are supervised, can be inspected, and face the full range of administrative penalties for breaches. In addition to the core obligations, VASPs are expected to apply requirements tailored to their sector, such as originator and beneficiary information rules for transfers. Firms in the virtual asset space should ensure they hold the correct authorisation, maintain a documented risk-based programme, and implement sanctions screening and travel-rule style controls appropriate to digital asset flows.

Legal Reference (UAE):

For more details, consult the full text of Federal Decree-Law No. 10 of 2025 or seek guidance from your AML compliance officer.

AML Obligations of VASPs under VARA Regulations

3

Yes. Virtual asset service providers are named throughout the 2025 law alongside financial institutions and DNFBPs, and carry the same core preventive obligations: risk assessment, customer due diligence and ongoing monitoring, the prohibition on anonymous accounts, internal policies approved by senior management, immediate implementation of targeted financial sanctions instructions, and record retention.

A VASP is any natural or legal person who, as a commercial activity, conducts one or more virtual asset activities on behalf of another person. The Executive Regulations list those activities: exchange between virtual assets and fiat currencies, exchange between types of virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets or instruments enabling control over them, and financial services related to an issuer’s offer or sale of virtual assets. A licence, registration or enrolment is required before operating, and the occasional transaction threshold for VASP customer due diligence is AED 3,500.

Legal Reference (UAE):

· Federal Decree-Law No. 10 of 2025, Article 1: definitions of Virtual Assets and Virtual Asset Service Provider; Article 19(1): the core obligations; Article 20: the licensing requirement.

· Cabinet Resolution No. 134 of 2025, Article 4: the list of virtual asset activities; Article 7(3): the AED 3,500 occasional transaction threshold; Articles 35 and 36: VASP supervision and obligations.

Where the position is finely balanced, document your reasoning and raise it with your compliance officer.

AML consulting services