Operating a digital-asset business without the right authorisation in a tier-one regulatory hub is not a calculated risk – it is an operational liability. Enforcement action, frozen banking rails and reputational damage are the practical consequences operators face when they miscalculate the reach of a regime. Abu Dhabi Global Market (ADGM), governed by the Financial Services Regulatory Authority (FSRA), has built one of the most deliberate and institutionally credible virtual-asset regimes in the world. For businesses targeting institutional capital, sovereign wealth counterparties, or a Middle East and Central Asia distribution footprint, the ADGM framework is a primary licensing consideration.
This page sets out the FSRA's virtual-asset regime in full: the regulated perimeter, the licence categories and substance expectations, the application process, the AML and Travel Rule posture, the tax environment, and the cross-border interactions that determine whether an ADGM authorisation fits your structure. It also explains who the right candidates are – and who should look elsewhere.
What does the ADGM regulatory perimeter actually cover?
The FSRA regulates virtual-asset activities conducted from, or into, the Abu Dhabi Global Market – an international financial centre on Al Maryah Island operating under its own common-law legal system, independent of the UAE federal financial-services framework. That jurisdictional distinction matters. ADGM is not subject to the UAE's SCA licensing regime, and it operates separately from Dubai's VARA (Virtual Assets Regulatory Authority) regime on the mainland. An entity authorised by the FSRA is authorised to operate within the ADGM perimeter; it is not automatically authorised to market or distribute to UAE mainland retail clients.
The FSRA's virtual-asset framework centres on the concept of a recognised virtual asset – a virtual asset that the FSRA has formally designated as falling within its regulated perimeter. Not every token or digital asset qualifies automatically. The FSRA evaluates whether an asset meets the definition, and only activities involving recognised virtual assets attract the regulated-activity obligations. Instruments that constitute conventional financial products under ADGM law – for example, a token structured as a security or a derivative – are regulated as those conventional instruments, not as virtual assets.
Regulated virtual-asset activities under the FSRA framework include: operating a virtual-asset exchange, providing custody of virtual assets, managing a virtual-asset fund or discretionary portfolio, and dealing or arranging deals in virtual assets as principal or agent. Each activity has its own authorisation requirement. A business conducting more than one activity typically requires a combined authorisation covering each regulated head.
The process above describes the standard scope. Your entity structure, the assets you handle, and the client categories you intend to serve all change the analysis. For a scoped assessment of where your activities fall within the FSRA perimeter, contact OBOLUS at info@oboluslaw.com.
What FSRA licence categories are available for virtual-asset businesses?
The FSRA issues Financial Services Permissions (FSPs) covering specific regulated activities, and a virtual-asset business typically applies for one or more FSPs tailored to its operational model. The principal categories relevant to digital-asset operators are: dealing in investments as principal, dealing in investments as agent, arranging deals in investments, managing assets, providing custody, and operating a multilateral trading facility or exchange. When these activities involve recognised virtual assets, the virtual-asset-specific rules and guidance overlay the general FSRA framework.
The FSRA also maintains a RegLab (regulatory laboratory) pathway. This is a time-limited, restricted-conditions authorisation designed for businesses that cannot yet meet full authorisation standards but have a credible product and a defined path to full compliance. RegLab is not a shortcut. It is an acceleration mechanism for genuinely novel models, and the FSRA exercises meaningful selectivity over which applicants are admitted.
For virtual-asset investment funds, the ADGM structure interacts with the FSRA's fund management regime. A fund investing in virtual assets may be structured as a Qualified Investor Fund or Professional Investor Fund under ADGM law, with the fund manager holding the relevant FSP. The combination of a common-law fund structure, institutional-grade governance, and FSRA oversight is a material differentiator for family offices and institutional investors allocating to digital assets in the region.
What substance and capital does the FSRA expect?
The FSRA applies genuine substance requirements – not a box-ticking exercise. An applicant that proposes to locate its registered office in ADGM while running its actual operations from another jurisdiction will not satisfy the FSRA's expectations. Senior management with relevant expertise must be present and accessible. The Board must include individuals with the competence to provide effective oversight of the licensed activities. Key functions – risk, compliance, and the senior executive officer – require FSRA pre-approval.
On capital: the FSRA sets minimum own-funds requirements that vary by regulated activity and by the risk profile of the business model. Because specific capital thresholds are subject to periodic review and differ across activity categories, they are not stated here as fixed figures – current requirements should be verified against the FSRA's published rules before any application is prepared. What the framework makes clear is that a custody business, an exchange, and an asset manager each face different capital expectations, and that the FSRA assesses adequacy against the actual risk exposure of the applicant, not merely against the published floor.
Governance and technology controls are equally weighted. The FSRA expects applicants to demonstrate robust cybersecurity architecture, key-management procedures for any custody function, and clear conflicts-of-interest management. Exchanges must address market-integrity rules, including surveillance and order-handling obligations. These are not aspirational – they are pre-authorisation conditions, documented in the application and tested during the vetting process.
How does the ADGM crypto licence application process work, and how long does it take?
The FSRA application process follows a structured pre-application and formal submission pathway. The FSRA actively encourages pre-application engagement: a preliminary meeting allows both parties to assess fit before significant preparation cost is incurred. For businesses with complex or novel structures, this stage is not optional – it is where the FSRA signals whether a model is within scope and what additional work will be required.
Following pre-application engagement, the formal submission involves a detailed application package: a completed regulatory business plan, draft financial projections, governance documentation, personnel disclosure forms for controlled-function holders, legal entity documentation, AML/CFT policy manuals and risk assessments, and – where relevant – custody and cybersecurity frameworks. Each controlled-function holder undergoes individual vetting by the FSRA. The depth of the FSRA's review is greater than the average seen in lighter-touch offshore regimes.
In our practice, well-prepared ADGM applications for straightforward activity profiles have moved from formal submission to grant of in-principle approval in a matter of weeks. Applications involving multiple regulated activities, novel structures, or complex cross-border arrangements take longer – sometimes several months. Timelines also reflect FSRA workload at any given period. The single most reliable accelerant is a complete, consistent submission on the first pass. Incomplete applications or late disclosure of material facts reliably extend the process.
The FSRA grants an in-principle approval before final authorisation. Between in-principle approval and the grant of the FSP, the applicant must satisfy outstanding pre-authorisation conditions – often including proof of office premises, confirmation of minimum capital, and completion of technology readiness checks. Only after those conditions are met is the FSP granted and the entity operationally licensed.
What AML and Travel Rule obligations apply under the FSRA?
The FSRA's AML/CFT framework aligns with FATF Recommendation 15 and the broader FATF standards for virtual asset service providers (VASPs). ADGM-licensed virtual-asset businesses are required to implement full customer due diligence and enhanced due diligence where higher-risk indicators are present, maintain transaction monitoring, and conduct ongoing screening against sanctions lists. The UAE's broader AML legislative framework applies within ADGM, supplemented by the FSRA's own conduct rules.
The Travel Rule – the obligation to pass originator and beneficiary identification data with virtual-asset transfers above the applicable threshold – is an active compliance requirement for ADGM licensees. The FSRA has engaged with the practical challenges of Travel Rule implementation, including counterparty identification where the receiving institution is unhosted or operates in a non-compliant jurisdiction. Operators must have documented policies for handling sunrise-period counterparties and unhosted wallets. Regulators in the leading hubs, including the FSRA, increasingly expect these policies to be operational at authorisation, not deferred to a post-licence implementation phase.
Sanctions compliance is particularly acute in the Gulf context. ADGM-licensed businesses must screen against UAE, UN, US (OFAC), EU and UK sanctions lists as a minimum, and must maintain documented escalation procedures for hits. The cross-border dimension – where a UAE entity deals with counterparties subject to US sanctions regimes – is one of the most practically complex areas we see in ADGM-focused mandates.
How does the ADGM tax and banking environment interact with a virtual-asset licence?
The UAE does not impose a personal income tax or a capital gains tax on individuals, which has historically made Abu Dhabi and Dubai attractive domicile options for digital-asset entrepreneurs and family offices. UAE corporate tax was introduced with effect from the financial year beginning on or after 1 June 2023, applying at a standard rate on taxable income above the threshold for small businesses – though the specific application to different entity types and free-zone vehicles should be verified against current legislation and any ADGM-specific guidance before reliance.
ADGM itself operates as an independent financial free zone. The interaction between ADGM entity structures, UAE federal corporate tax, and the free-zone tax regime requires careful analysis by tax counsel – particularly for businesses with operating substance split across ADGM, mainland UAE, and offshore holding structures. We work alongside tax specialists on the structuring layer whenever an ADGM licensing engagement involves a complex group.
Banking access is a recurrent operational challenge for ADGM virtual-asset licensees. UAE banks have, at varying times, applied conservative policies toward crypto-related businesses even where those businesses hold FSRA authorisation. The FSRA authorisation materially improves a business's position in banking conversations, but it does not guarantee account access. Operators should anticipate a banking assessment process that runs in parallel with – not after – the licensing engagement, and should plan for the possibility that primary banking relationships are held outside the UAE, with UAE accounts used for specific local operational purposes.
If your structure includes a cross-border banking layer or a multi-entity holding arrangement, the licence, banking and tax analysis must be built together. To map the full stack before you commit, write to info@oboluslaw.com or message us at t.me/oboluslaw.
ADGM versus VARA: how do operators decide?
The choice between ADGM and Dubai's VARA is one of the most frequent strategic questions we address for businesses entering the UAE market. Both are credible, internationally recognised regimes. They are not interchangeable – the right choice depends on the operator's client profile, product type, and operational footprint.
ADGM is generally the stronger fit for institutional-facing businesses: exchanges or platforms targeting professional and institutional counterparties, fund managers, custodians serving family offices or asset managers, and businesses where common-law legal infrastructure and the depth of the ADGM courts matter for counterparty confidence. The ADGM Courts operate under English common law, which provides a predictable dispute resolution environment for institutional counterparties and lenders. VARA, by contrast, operates on the Dubai mainland and governs a broader range of activity categories under its own rulebooks, including retail-facing exchange and lending operations.
A business targeting both institutional and retail segments across the UAE – or operating a broad product suite – may ultimately require both ADGM and VARA authorisation, or a group structure that holds licences in both environments. That adds cost and governance complexity but reflects the regulatory reality of a two-regime federation. In our cross-border practice, we have seen operators launch with one licence and build toward the second as their product and user base scale; the sequencing decision depends on which revenue stream is primary at launch.
The DIFC – Dubai International Financial Centre – is a third axis for some businesses. The DIFC has its own financial regulator, the DFSA, and its own courts. Certain digital-asset activities are regulated within the DIFC. For businesses with strong existing DIFC relationships or a securities-focused model, the DFSA route merits parallel assessment alongside ADGM and VARA.
Which operator profiles are best suited to ADGM authorisation?
ADGM is not the right choice for every digital-asset business, and a candid assessment of fit is the starting point for any engagement. The FSRA's substance, capital, and governance expectations position ADGM as a regime for operators who are ready to build a real regulated presence, not for businesses seeking the lightest available oversight with the most recognisable address.
The profile that consistently benefits most from ADGM authorisation is the business for which institutional credibility is a commercial necessity. A virtual-asset exchange or custodian that needs to onboard sovereign wealth funds, family offices, or international banks as clients will find that ADGM authorisation carries weight that lighter-touch offshore registrations do not. The same applies to fund managers raising capital from institutional limited partners who conduct rigorous regulatory due diligence on the manager's licence.
Businesses at an earlier stage – with a proof-of-concept product and a lean team – may find the FSRA's RegLab pathway more appropriate than full authorisation. RegLab provides a defined window to build toward full compliance under regulatory supervision, which is valuable where the product model is still being refined. The trade-off is that RegLab authorisation is time-limited and subject to conditions that restrict commercial scale.
A common assumption in the market is that a single offshore registration is sufficient to serve clients across the Middle East, Europe, and Asia simultaneously. That assumption is wrong. Regulators in each major jurisdiction assess the substance of the entity serving their market, not merely the existence of a registration in a remote offshore hub. An ADGM authorisation is a strong foundation for regional operations, but it does not substitute for the authorisation required in each jurisdiction where clients are actively solicited or services actively delivered.
In a recent licensing matter, an asset management group with a regional investor base sought to consolidate its virtual-asset fund management under a single regulated structure. We assessed the ADGM, VARA and Cayman options against the group's investor domicile mix and banking relationships, structured an ADGM FSP application for the fund management activity, and coordinated substance and governance documentation to satisfy the FSRA's pre-application expectations. The application proceeded to in-principle approval without material revision requests.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we scope and execute licence applications across 70+ jurisdictions
- VARA Licence Application in Kazakhstan (AIFC) – a parallel common-law hub option for Central Asia and MENA operators
- Correspondent Banking Access in the United Kingdom – banking strategy for cross-border digital-asset businesses
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction, activity scope, and application quality. In ADGM, a straightforward single-activity application with a complete submission can reach in-principle approval in a matter of weeks; more complex applications involving multiple regulated activities or novel structures typically take several months. Timeline is directly correlated to preparation quality: incomplete submissions reliably extend the process. Current FSRA timelines should be confirmed at pre-application engagement.
Which jurisdiction is best for licensing my crypto business?
There is no single correct answer. The right jurisdiction depends on your client profile, product type, target markets, capital position, banking strategy, and the substance you can genuinely put in place. ADGM suits institutional-facing businesses that need a common-law environment and high-credibility authorisation. Other hubs – Singapore, the Cayman Islands, Lithuania under MiCA, or VARA in Dubai – may better fit different operator profiles. A proper multi-jurisdiction analysis precedes any licensing commitment.
Do I need a separate custody licence?
In most tier-one regimes, yes – custody of virtual assets is a separately regulated activity and requires its own authorisation or a combined permission that expressly covers custody. Under the FSRA framework, providing custody of virtual assets is a regulated activity distinct from operating an exchange or managing assets. A business that holds client assets as an incidental function of another service must still satisfy custody-specific requirements. Combining custody with other regulated activities in a single authorisation is possible, but the capital and operational expectations for the custody component apply regardless of how the permission is structured.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so that the structure you build is the one your regulator, your bank and your investors expect to see. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, including the ADGM Courts and DIFC Courts. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in FSRA, VARA and Gulf-region regulatory authorisation for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.