Operating a digital-asset business in Abu Dhabi without the right regulatory authorisation is not a grey area. The Financial Services Regulatory Authority (FSRA), the independent regulator within the Abu Dhabi Global Market (ADGM), maintains a defined perimeter for virtual-asset activities – and operating outside it exposes a business to enforcement, banking disconnection and reputational damage that can be difficult to reverse. For founders and general counsel weighing entry into the Gulf, the first question is always the same: which licence, under which regime, and what does the process actually require?
ADGM's FSRA operates one of the most developed virtual-asset regulatory regimes in the region. It is a common-law jurisdiction with its own courts, a clear regulatory framework for crypto-asset businesses, and a concept of "recognised virtual assets" that determines which instruments may be dealt in. Authorisation under the FSRA framework is not a box-ticking exercise. It is a structured review of the applicant's governance, financial resources, AML/CFT programme and technology controls. This page sets out the regime, the process, the cross-border considerations and the decision points an inbound operator must navigate.
What Is the ADGM Regulatory Regime for Virtual Assets?
ADGM's FSRA authorises virtual-asset businesses as regulated activities within its financial-services framework, applying a substance-based test to determine whether an activity requires a licence. The FSRA maintains a list of recognised virtual assets – instruments that may lawfully be dealt in under a regulated-activities permission. Bitcoin and Ether have been explicitly recognised; the status of other tokens is assessed against published criteria that examine the token's rights, governance and liquidity profile.
The regime covers a range of activities: operating a virtual-asset exchange, providing custody, dealing as principal or agent, arranging virtual-asset transactions, and managing virtual-asset funds. Each activity is a discrete regulated activity. A business that operates an exchange and holds client assets will typically need permissions for both activities – and the capital and operational requirements attach to each permission separately.
ADGM sits within Abu Dhabi but is distinct from the mainland UAE regulatory environment overseen by the Virtual Assets Regulatory Authority (VARA). VARA's jurisdiction covers mainland Dubai. ADGM is an international financial centre governed by federal UAE law as modified by ADGM's own legislative framework, with the FSRA as the sectoral regulator. Operators entering Abu Dhabi's financial centre therefore engage with the FSRA – not VARA – and the two regimes, while thematically similar, have different application processes, rulebooks and expectations.
Who Needs FSRA Authorisation in ADGM?
Any person carrying on a regulated virtual-asset activity in or from ADGM must be authorised by the FSRA, absent a specific exemption. The territorial nexus is construed broadly: a business that books trades, holds client assets or operates technology infrastructure within ADGM will generally be within the perimeter, even if its broader group operates elsewhere.
In our practice, the most common applicants are exchange operators seeking a credible Gulf hub, custody providers serving institutional clients in the region, and fund managers whose mandates include digital-asset exposure. We also regularly advise holding companies restructuring a multi-entity group to place the regulated function within ADGM while leaving unregulated activities in a parallel entity.
The FSRA also supervises financial-promotion rules for virtual assets. A business marketing virtual-asset products into ADGM without authorisation – even from outside the centre – may trigger the financial-promotion perimeter. Operators we advise routinely underestimate the reach of the promotion rules when planning soft-launch communications before their licence is in place.
The FSRA's substance requirements mean that shell structures do not work. A regulated entity in ADGM must have a genuinely staffed presence: senior management resident in or accessible to the jurisdiction, a compliance function, and operational systems that can be examined by the regulator.
What Does the FSRA Application Process Involve?
The FSRA authorisation process follows a phased structure that begins well before a formal application is submitted. The regulator expects pre-application engagement – a preliminary meeting at which the applicant's business model, target activities and proposed regulatory perimeter are discussed. This is not optional courtesy. In our experience, applicants who skip this step frequently submit incomplete applications that are returned or that generate extensive information requests.
The formal application requires a business plan of genuine depth: the proposed activities, the client base, the token universe, the risk model and the revenue structure. The FSRA scrutinises the governance framework closely – board composition, the fitness-and-propriety of senior approved persons, the segregation of responsibilities between the compliance, risk and business lines, and the escalation structures.
The AML/CFT programme is examined in detail. The FSRA applies the FATF Recommendations, including Recommendation 15 on virtual assets and the Travel Rule – the requirement to pass originator and beneficiary data with each qualifying transfer. Applicants must demonstrate not only that a Travel Rule solution is in place but that it is operationally integrated with the exchange or custody platform, not bolted on after the fact.
Technology and cybersecurity documentation is a substantive part of the review. The FSRA expects evidence of penetration testing, key-management procedures, custody segregation where custody is a regulated activity, and business-continuity planning. Weak technology documentation is one of the most common causes of application delay we have seen.
The overall timeline from formal submission to authorisation varies by the complexity of the application and the regulator's current caseload. It is typically measured in a matter of months rather than weeks. Simple single-activity applications with a well-prepared submission package move faster than multi-activity applications or those involving novel business models that require bespoke policy engagement.
Important note on the H1 of this page: the H1 references "VARA licence application in Abu Dhabi Global Market (ADGM)." Technically, VARA is the Dubai regulator; the ADGM regulator is the FSRA. In practice, operators and their advisers frequently use "VARA" as shorthand for UAE virtual-asset authorisation broadly. This page addresses ADGM / FSRA authorisation specifically. Operators planning mainland Dubai operations should review the VARA regime separately.
For a scoped assessment of your ADGM application strategy, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your entity structure, target activities and user geography change the analysis significantly.
What Are the Capital and Financial Requirements?
The FSRA applies minimum capital requirements that vary by the regulated activity or combination of activities for which authorisation is sought. The specific thresholds are set out in the FSRA's rulebooks and are subject to revision; operators should consult current FSRA publications or take legal advice rather than rely on any figure stated here, because the applicable number depends on the precise activity permission being sought.
Beyond minimum capital, the FSRA expects ongoing financial-resource adequacy – a buffer above the regulatory minimum, monitored and reported on a continuing basis. Applicants must demonstrate at the application stage that projected capital levels will remain compliant through the early operational period, not just at the point of authorisation.
The FSRA also imposes client-money and client-asset safeguarding requirements where a licensee holds client funds or tokens. Segregation from the licensee's own assets, reconciliation procedures and the choice of custodian or banking arrangement are all examined. For exchange operators accepting fiat deposits, the banking relationship and the structure of client-money accounts are a material part of the application review.
How Do Tax and Banking Interact With an ADGM Licence?
ADGM sits within the UAE, a jurisdiction that introduced corporate tax in recent years, with specific rules for financial-services entities and free-zone businesses that affect how a regulated entity in ADGM is taxed. The interaction between the UAE's corporate-tax regime and the ADGM entity is a structuring question that must be resolved at the incorporation stage, not after authorisation. An entity that operates across the ADGM perimeter into onshore UAE activities may lose the free-zone tax position; the boundaries of permissible "qualifying activity" under the corporate-tax rules are relevant and evolving.
VAT applies in the UAE at the federal level, and the treatment of virtual-asset transactions under UAE VAT is a live question in cross-border structures. Operators with token-issuance, staking or DeFi activity layered onto an ADGM exchange licence face additional classification complexity.
Banking is the practical bottleneck. UAE banks apply rigorous KYC to virtual-asset businesses, and ADGM licensees are not exempt. In our cross-border practice, we have seen well-structured applications with strong FSRA documentation delayed for months by banking onboarding. The banking relationship should be developed in parallel with the FSRA application, not after it. Operators who treat banking as a post-licence task routinely face a gap between authorisation and commercial operation.
The cross-border dimension does not end at the UAE border. A business operating an ADGM-licensed exchange with users in the EU will encounter MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities) on the marketing and product side, and FATF Travel Rule obligations on the transfer side. ADGM authorisation does not passport into the EU; a separate regulatory position – whether a CASP authorisation in an EU member state or a structured service model – is needed for EU-facing activity.
A Representative Engagement
In a recent licensing matter, a multi-activity digital-asset group approached us after an initial pre-application meeting with the FSRA had not proceeded as expected. The business had prepared its application documents independently, with strong commercial content but an underdeveloped AML/CFT programme and no Travel Rule solution documented. We rebuilt the compliance architecture, sourced and integrated a Travel Rule solution, restructured the governance section to reflect the FSRA's approved-persons expectations, and coordinated the banking engagement in parallel. The application was resubmitted and proceeded through the FSRA review without an information-request delay on the AML/CFT component. The group launched operations from ADGM within the same calendar year.
Which Operator Profile Should Choose ADGM?
ADGM is not the right choice for every operator. A decision matrix helps clarify fit.
An institutional exchange or custody provider targeting Gulf Cooperation Council institutional clients and sovereign wealth funds is a strong candidate. ADGM's common-law framework, its DIFC Courts relationship, and its recognition by counterparties as a credible financial centre make it the natural home for a Gulf-facing institutional business. The timeline and capital cost are justified by the client base and the regulatory recognition.
A retail-focused trading app with a global user base and low operating margins is less well suited. The FSRA expects a substantive local presence and a well-resourced compliance function. The cost and governance overhead is proportionate to an institutional or semi-institutional business model, not a lean consumer app.
A token issuer seeking to issue an asset-referenced or utility token in the Gulf is a more nuanced case. The FSRA's recognised-virtual-assets framework governs which tokens may be dealt in under an ADGM licence. An issuer whose token does not meet the recognition criteria will face restrictions on secondary-market activity within ADGM, regardless of whether the issuance itself is licensed elsewhere. We advise clients in this position to engage the FSRA early on the recognition question before committing capital to an ADGM structure.
A business sitting between ADGM and a European licensing hub – for example, an exchange that wants an EU CASP for EU users and an ADGM licence for Gulf institutional clients – faces a group-structure question. Which entity holds which activity? Where does the technology sit? How are intercompany arrangements documented so that each regulator is satisfied with its entity's substance? These questions are answered at the design stage, not after both applications are filed.
If a prior application stalled or you are weighing ADGM against another hub, reach OBOLUS at info@oboluslaw.com. A second read can surface the structural issue and the route forward.
What Are the Most Common Application Mistakes?
In our experience reviewing applications that have stalled or been returned, the same mistakes recur. Knowing them in advance is the most direct way to save time and cost.
The first is an underdeveloped AML/CFT programme. A policy document that lists obligations is not the same as a programme that can be examined. The FSRA expects procedures, systems, a named MLRO with genuine authority, and evidence that the Travel Rule solution is operational or contractually committed.
The second is governance thin on paper. A board of two founders with no independent oversight, no audit function and no documented conflict-of-interest procedures will not pass the fit-and-proper review. The FSRA expects governance proportionate to the activity, not to the size of the founding team.
The third is an afterthought on banking. Applicants who do not have a realistic banking plan – including a named bank that has indicated a willingness to onboard a regulated virtual-asset business – face a credibility gap in the application. The FSRA is aware that UAE banking is difficult for virtual-asset businesses, and it expects applicants to have engaged the problem seriously.
A common assumption is that a single offshore registration – a BVI VASP registration, a Cayman VASP licence, or a legacy EU VASP registration from before MiCA – is sufficient to serve clients globally, including in ADGM. It is not. Each jurisdiction applies its own perimeter rules. An ADGM-facing business that relies on an offshore registration without FSRA authorisation risks enforcement by the FSRA and the loss of any banking relationship it has built in the UAE. The offshore registration may be useful for certain holding-company or group-structuring purposes, but it does not substitute for regulated-activity authorisation in ADGM.
Related at OBOLUS
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full-spectrum licensing service across 70+ jurisdictions, from application strategy to post-authorisation compliance.
- EMI Licence for Crypto Firms in Guernsey – how an e-money institution licence in Guernsey fits a cross-border digital-asset payment stack.
- Oracle and Data-Feed Liability from a Cross-Border Perspective – legal exposure at the technology layer for exchanges and DeFi operators relying on external data feeds.
FAQ
How long does a crypto licence take to obtain?
The timeline depends on the jurisdiction, the complexity of the activity and the quality of the application. In ADGM, a well-prepared single-activity application typically proceeds over a period of several months from formal submission to authorisation. Multi-activity applications, novel business models or submissions with material gaps in AML/CFT or governance documentation take longer. Pre-application engagement with the FSRA, and thorough preparation before submission, are the most reliable ways to reduce timeline risk.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right choice depends on the target client base, the regulated activities, the entity's capital position, the banking environment and the operator's appetite for ongoing compliance cost. ADGM suits institutional-facing Gulf businesses with the governance and capital to meet FSRA expectations. EU-facing operators need a MiCA CASP authorisation. A business serving both markets typically requires two regulated entities with a documented group structure. We map the full licence stack before any application is filed.
Do I need a separate custody licence?
In ADGM, custody of virtual assets is a discrete regulated activity. A business that operates an exchange and also holds client tokens in omnibus or segregated accounts will generally need an express custody permission in addition to its exchange or dealing permission. The FSRA's safeguarding and segregation requirements attach to the custody permission separately. Operators who hold client assets without a custody permission are operating outside their authorisation, which creates enforcement exposure and complicates banking relationships.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including ADGM, VARA, MiCA and the major Asia-Pacific hubs – on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the entirety of our practice. We map the licence, banking and tax stack across operating, custody and payment layers before you commit, and we act only for businesses, not retail. To discuss your ADGM application or a cross-border licensing strategy, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in ADGM, VARA and Asia-Pacific virtual-asset regulatory authorisations for exchange and custody operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.