A licensed digital-asset firm operating from Abu Dhabi Global Market (ADGM) – the international financial centre on Al Maryah Island governed by English common law – cannot treat its regulatory authorisation as a one-time event. The Financial Services Regulatory Authority (FSRA), ADGM's prudential and conduct regulator, requires annual licence renewal and reserves the right to impose conditions, restrict scope or mandate structural changes at any point in the licence lifecycle. Miss a renewal deadline, fail to disclose a material change or expand into a new activity without a formal variation, and the firm risks suspension, public censure or – in serious cases – revocation. The sections below set out every step of the renewal and variation process, the cross-border implications for an international digital-asset business, and the structural questions that separate firms that renew smoothly from those that do not.
The Regulated Basis: What the FSRA Controls
Under the FSRA framework, every entity conducting regulated activities for virtual assets in ADGM must hold a current authorisation. That authorisation is activity-specific, not asset-class-specific. A firm authorised to operate a trading platform for virtual assets is not thereby authorised to provide custody, to manage a fund or to arrange deals on behalf of third parties. Each activity is a discrete regulated function. This architecture has a direct consequence: growth into an adjacent service line – staking-as-a-service, lending, yield products – is not a commercial decision alone. It is a regulatory variation decision first.
The FSRA applies a "recognised virtual assets" concept: only virtual assets that the FSRA has formally recognised sit inside the regulated perimeter without further classification work. An operator introducing a new token pair or a new product type must first assess whether the asset or product triggers a new or amended authorisation. In our practice, firms underestimate this step consistently. The question is never "can we list this token commercially?" – it is "does listing this token change our regulatory activity profile?"
Cross-border operators face an additional layer. A firm licensed in ADGM but whose users or counterparties are in the EU, Singapore or the UK may find that its ADGM authorisation does not satisfy the host-jurisdiction regulatory expectations of those markets. MiCA (the EU's Markets in Crypto-Assets Regulation), the Monetary Authority of Singapore's Payment Services Act and the FCA's registration requirements each apply independently. The ADGM licence is a necessary condition for operating from the centre; it is not a global passport.
For a scoped assessment of your current authorisation and whether an upcoming product change triggers a variation obligation, contact OBOLUS at info@oboluslaw.com. The earlier we map your activity profile, the more options remain open.
Annual Renewal: The Process Step by Step
ADGM licence renewal is not an administrative formality – it is a substantive regulatory review that the FSRA uses to reassess the firm's continued fitness for authorisation. The renewal cycle runs annually, aligned to the anniversary of the original authorisation date. The FSRA issues a renewal notice ahead of that date, but waiting for the notice is not a sound practice. Firms we advise begin the renewal preparation several weeks in advance.
The renewal submission typically requires the firm to confirm that its regulatory capital remains compliant, that its AML/CFT systems and controls are current, that its governance arrangements have not changed in any material and undisclosed respect, and that its audited financial statements are available or in preparation. Where any of those elements have shifted – a new senior manager, a change in ownership, a revision to the business plan – the renewal process intersects with a notification or variation obligation. Treating renewal as separate from notification is a common structural error.
The FSRA also expects that the firm's compliance function has conducted an internal review of its policies and procedures in the preceding year, with a record of findings and remediation. In our experience, firms that arrive at renewal without this internal audit trail face a slower process and, in some cases, additional conditions attached to the renewed licence. Preparation is the differentiator.
Timing matters operationally. A renewal application submitted late, or one that the FSRA must return for missing information, can leave the firm in a position where its authorisation is technically under review rather than current. That status can trigger banking and payment-rail questions, because correspondent banks and payment institutions routinely conduct periodic reviews of their clients' licences. Operating in a renewal-pending status is a risk firms should price into their compliance calendars.
What Triggers a Licence Variation?
A licence variation is required whenever a firm seeks to add a regulated activity, remove one, expand the scope of an existing activity or make a material change to the conditions under which it was originally authorised. In the context of a digital-asset business, the variation triggers are frequent and sometimes non-obvious.
Common variation triggers include: introducing a new virtual-asset product that changes the economic or risk profile of the firm's activity; onboarding a new category of client (for example, moving from professional investors to retail clients); launching a custody offering where the firm previously only operated as a trading platform; or establishing a new legal entity that interacts with the licensed business. A change in key personnel – a new Chief Executive, a new Compliance Officer, a new Money Laundering Reporting Officer – also requires FSRA notification, and depending on the circumstances, may require FSRA approval before the change takes effect.
In a recent matter, a virtual-asset trading platform sought to add a lending product in the wake of positive market conditions. The team had treated the product as a commercial extension of existing services. On review, the product required a distinct regulated activity authorisation under the FSRA regime, and the firm's proposed risk framework for the lending book did not satisfy FSRA's conduct expectations. We restructured the product timeline, submitted the variation application with a revised risk and capital analysis, and the firm received its expanded authorisation before the product launch window closed. The lesson – commercial and regulatory timelines must run in parallel, not in sequence.
How Does Renewal Interact with Tax and Banking?
The renewal of an ADGM virtual-asset authorisation sits at the intersection of several operational dependencies that go beyond the FSRA itself. For a business with substance in ADGM and users or counterparties in other jurisdictions, the annual renewal window is also the natural moment to review the broader licence and compliance stack.
On the banking side, the UAE's financial institutions – and the correspondent banks that underwrite their USD clearing – apply their own periodic reviews of their digital-asset clients' regulatory status. An ADGM authorisation that is current, conditions-compliant and accompanied by a clean AML posture is a banking prerequisite, not a banking guarantee. We have seen firms lose access to payment rails during a prolonged FSRA inquiry, not because the licence was revoked, but because the bank's compliance team treated the inquiry as a material adverse development. Managing regulator and bank communications in parallel is part of the renewal discipline.
On the tax side, ADGM firms benefit from the UAE's zero corporate-tax environment for qualifying income from international operations, but the substance requirements that underpin that position must be maintained year-round. A licence renewal that reveals a hollowed-out ADGM operation – a shell entity with no genuine management and control in the centre – creates not just a regulatory risk but a substance and tax-residency risk for the wider group. The FSRA's governance expectations, including the requirement for a resident senior manager, align closely with the substance conditions that underpin a defensible UAE tax position.
For operators with entities in multiple jurisdictions – an ADGM operating entity, a BVI or Cayman holding structure, an EU-passported vehicle under MiCA – the renewal of one licence is an occasion to audit the whole structure. Allied counsel in the relevant jurisdictions can confirm whether the licence status in each hub remains fit for purpose.
If a prior application stalled or a variation was returned by the FSRA, a structured second review can identify the gap and the route forward. Write to info@oboluslaw.com for an assessment.
Which Operator Profile Needs What?
Not every ADGM-licensed digital-asset business faces the same renewal complexity. The following profiles describe the most common situations we encounter, and the relevant action in each case.
Profile A – the established trading platform renewing with no material changes. This operator has stable governance, a current AML audit, compliant capital and no new products. The renewal is principally a documentation and submission exercise. The key risk is complacency: assuming last year's submission package meets this year's regulatory expectations, when in fact the FSRA has updated its guidance or issued a thematic review with new expectations. Even a "clean" renewal benefits from a regulatory gap review before submission.
Profile B – the growing exchange adding custody or lending. This operator has an upcoming product or service expansion that almost certainly constitutes a regulated-activity change. The renewal and the variation must be coordinated. Submitting the renewal before the variation is resolved can create a timing mismatch, particularly if the FSRA asks questions about the firm's forward business plan during the renewal review. In our practice, we run these as a single coordinated submission where the FSRA permits.
Profile C – the inbound operator establishing in ADGM for the first time. This operator does not face a renewal in the first year, but should model the renewal process from day one. The systems, policies and governance structures put in place at authorisation are the same ones that must satisfy the FSRA annually. Building for renewal compliance from the start avoids costly remediation later.
Profile D – the group with multi-hub presence. This operator holds or is seeking licences in ADGM and one or more other jurisdictions – the EU under MiCA, Singapore under the Payment Services Act, or the UK under the FCA's registration regime. Each renewal cycle in each hub must be managed independently, but the governance, capital and AML documentation is often shared across entities. A failure to maintain the ADGM licence in good standing can have knock-on effects on group-wide regulatory credibility in other forums.
AML Obligations and the Travel Rule in ADGM
Every ADGM-licensed virtual-asset business is subject to the FSRA's AML/CFT rules, which are aligned to the FATF Recommendations – including Recommendation 15, which applies the FATF standards to virtual-asset service providers, and the Travel Rule (the obligation to pass originator and beneficiary data with each qualifying transfer). These obligations do not pause during renewal. The FSRA expects firms to maintain a continuous, auditable AML programme, not to rebuild one at renewal time.
The Travel Rule is particularly demanding for a multi-hub operator. Where a transfer originates in ADGM and the beneficiary VASP (virtual asset service provider) is in a jurisdiction with a different threshold or a different technical standard, the firm must manage both sides of the data exchange. Technical solutions – standardised messaging protocols between compliant VASPs – are now widely available, but their implementation requires legal input on which jurisdiction's standard applies to which transfer leg. ADGM firms serving counterparties in the EU will encounter MiCA's own data-transfer expectations alongside the FSRA's, and the two regimes must be satisfied concurrently.
FSRA thematic reviews of AML systems have become more detailed in recent cycles. Firms that rely on generic AML policies not tailored to the specific risks of virtual-asset activity – smart-contract interactions, DeFi protocol exposure, cross-chain transfers – are increasingly likely to receive questions or remediation requests. The renewal moment is the right time to stress-test the AML framework against the firm's current product and counterparty profile.
A Common Assumption Worth Examining
A widespread view among operators expanding from offshore holding structures is that a single well-regarded licence – whether in ADGM, a major EU state or Singapore – is sufficient to serve a global user base. That assumption does not survive regulatory scrutiny in most of the major hubs.
ADGM authorisation grants the right to conduct regulated activities from within the ADGM perimeter. It does not, by itself, authorize the firm to solicit or serve clients in jurisdictions that have their own virtual-asset or payment-services licensing regimes. The EU's MiCA passporting mechanism works within the EU/EEA on the basis of a MiCA CASP authorisation from an EU national competent authority – not on the basis of an ADGM licence. Singapore's MAS requires its own DPT service authorisation for persons conducting regulated payment activities in or from Singapore. And the FCA's regime applies to any person conducting crypto-asset business in the UK, regardless of where that person is licensed elsewhere.
This is not a counsel-of-perfection argument. Many businesses begin with a single primary licence and expand their regulatory coverage deliberately, in line with user growth and market entry strategy. What matters is that the decision is made deliberately – with a mapped view of where the exposure lies and when a local authorisation becomes necessary. We map the licence stack across operating, custody and payment layers before clients commit capital to a market-entry structure.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – how we scope and manage multi-jurisdiction licensing across 70+ hubs
- ADGM vs. Switzerland: where to license a crypto business – a structured comparison of two leading offshore-friendly common-law regimes
- Security token offering structuring in UAE (VARA Dubai) – structuring STOs under the VARA regime for the Dubai mainland
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and licence category. In ADGM, the FSRA review period for a new virtual-asset authorisation is typically a matter of weeks to several months, depending on application completeness, the complexity of the proposed activities and whether the FSRA raises questions requiring additional information. Firms with well-prepared governance, capital and AML documentation consistently experience faster outcomes. Qualitative planning should assume several months from submission to authorisation.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are, where your banking relationships are available, what activities you conduct and what your group tax structure looks like. ADGM is well-suited to institutional-facing businesses, funds and operators seeking a common-law environment with Gulf connectivity. EU authorisation under MiCA is necessary for meaningful EU market access. Singapore suits Asia-Pacific expansion. We map these variables before a client commits to a primary hub.
Do I need a separate custody licence?
In most leading regimes – including ADGM under the FSRA framework, the EU under MiCA and Singapore under the Payment Services Act – custody of virtual assets is a distinct regulated activity that requires separate authorisation or an explicit extension of an existing licence. A trading-platform authorisation does not automatically confer custody permissions. Operators who hold client assets without the appropriate custody authorisation are exposed to enforcement risk in each jurisdiction where they operate.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – reducing the risk of enforcement, frozen rails and lost banking relationships. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in FSRA authorisation, multi-hub licence strategy and cross-border regulatory structuring for virtual-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.