VASP licensing in Abu Dhabi Global Market (ADGM) – the jurisdiction for digital-asset businesses that need a credible common-law home inside the Gulf – requires authorisation from the Financial Services Regulatory Authority (FSRA), the independent regulator operating within the ADGM financial free zone. The FSRA applies a principles-based regime that covers trading, custody, advice and management of virtual assets, and that regime sits entirely outside the UAE mainland licensing infrastructure overseen by VARA in Dubai. For an inbound operator, the choice between ADGM and the Dubai mainland is not merely administrative: it determines the legal system, the type of authorisation, the banking access, and the cross-border enforceability of your contracts.
This page sets out who the ADGM virtual-asset regime catches, how the authorisation process works in practice, how the ADGM interacts with the wider licensing and tax picture for a business with users across multiple jurisdictions, and where the common mistakes arise. One anonymized matter illustrates the kind of structuring problem we see at the intake stage.
What is the regulatory basis for virtual-asset business in ADGM?
The FSRA authorises virtual-asset businesses under its Financial Services and Markets Regulations and the dedicated virtual-asset framework it has developed since 2018 – one of the earliest purpose-built regimes for digital assets in the Gulf. The FSRA maintains a list of "recognised" virtual assets that are eligible to be held, traded and serviced under the regime; an operator seeking authorisation for a product or token must confirm its asset falls within that list or apply for recognition. The regime is activity-based: you need authorisation for each regulated activity you intend to carry on, including operating a trading platform, providing custody, advising on virtual assets, and managing a virtual-asset fund or portfolio.
The ADGM is a common-law enclave on Al Maryah Island in Abu Dhabi. Its courts apply English common law, and its legal infrastructure – including the ADGM Courts – is structurally distinct from Abu Dhabi civil courts and from the DIFC Courts in Dubai. That matters to operators for two reasons. First, English common-law precedent travels: a freezing order out of the ADGM Courts is recognisable in England, Singapore and other common-law forums. Second, institutional investors in the US, Europe and Asia are familiar with the common-law framework and generally prefer it for contractual counterparty risk.
The FSRA is independent of the Abu Dhabi Global Market Registration Authority (ADGM RA), which handles corporate formation, and of the UAE Central Bank and Securities and Commodities Authority, which regulate activity on the mainland. An ADGM financial-services authorisation does not permit the holder to service clients from the UAE mainland unless a separate mainland arrangement exists. Regulators in the leading hubs increasingly expect operators to map this perimeter precisely before onboarding, and the FSRA is no exception.
To discuss your ADGM licensing position before committing to a structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis significantly. Map your options.
Who needs FSRA authorisation for virtual-asset activity?
Any person carrying on a regulated virtual-asset activity in or from ADGM requires FSRA authorisation – and "from ADGM" captures entities incorporated in the free zone that service clients internationally, not only those serving customers physically present in Abu Dhabi. The FSRA's regulated activities for virtual assets include operating a multilateral trading facility or exchange, providing custody or safeguarding of virtual assets on behalf of clients, managing or advising on a virtual-asset portfolio or fund, and arranging deals in virtual assets. Operating without authorisation is a criminal offence under the ADGM regulatory framework, and the FSRA has powers to issue public censures, impose financial penalties and restrict or revoke permissions.
In our practice, we see three categories of inbound business most frequently. The first is a crypto exchange or trading platform relocating from a European or Asian jurisdiction seeking a Gulf hub with strong institutional credibility. The second is a custodian or prime broker wanting to service family offices, sovereign-adjacent capital and institutional funds in the Middle East without operating through a mainland UAE entity. The third is a Web3 fund or investment manager raising capital in the Gulf and needing a regulated wrapper that institutional limited partners will accept. Each profile faces a different regulatory entry point and a different capital expectation under the FSRA regime.
How does the ADGM FSRA authorisation process work?
The FSRA authorisation process for a virtual-asset firm follows a structured engagement model, beginning with a pre-application meeting that the FSRA actively encourages. This early-engagement step is not ceremonial. The FSRA uses it to signal whether the proposed business model fits within its recognised-asset list, to flag capital adequacy expectations, and to identify whether any novel elements require a regulatory sandbox approach before a full authorisation is pursued.
After the pre-application engagement, the formal application involves the submission of a detailed business plan, a financial soundness assessment, fit-and-proper evaluations of controllers and senior managers, a governance and compliance framework covering AML, the Travel Rule (the obligation to pass originator and beneficiary identification data alongside virtual-asset transfers), and operational-risk management. The FSRA also requires technology risk and cybersecurity documentation at a level that reflects the operational complexity of a digital-asset platform. Operators we advise routinely underestimate the depth of the technology-risk workstream: the FSRA's expectations here are closer to those of MAS in Singapore than to the lighter documentation demands of some smaller registries.
The FSRA issues an In-Principle Approval (IPA) once it is satisfied with the application in substance, after which the applicant must satisfy the remaining pre-commencement conditions – typically completing the physical establishment in ADGM, funding the required capital, and demonstrating the readiness of systems and controls. Final authorisation follows. The total elapsed time from formal application submission to final authorisation varies by complexity; the FSRA does not publish a fixed statutory clock, and in our experience the timeline depends heavily on the quality of the initial application package and the pace at which the applicant responds to FSRA queries.
A corporate entity must be registered with the ADGM RA concurrently with or prior to the FSRA application. The ADGM RA handles commercial registration, annual filings and the physical-presence requirement. The requirement for genuine local substance – an office, resident management, and ADGM-resident Approved Persons in key functions – is enforced. Nominee arrangements that create the appearance of local management without substance do not satisfy the FSRA, and we have seen applications stall at the IPA stage because of this.
What are the AML and Travel Rule obligations under the ADGM framework?
The FSRA's AML regime aligns with the FATF Recommendations, including Recommendation 15 covering virtual assets, and requires authorised firms to implement risk-based customer due diligence, transaction monitoring, suspicious-activity reporting and sanctions screening. For firms handling virtual-asset transfers, the Travel Rule obligation requires the collection, verification and transmission of originator and beneficiary information for transfers above applicable thresholds. The specific threshold that triggers the Travel Rule obligation in ADGM is set by the FSRA's AML rules and must be confirmed against the current regulatory text: we write this qualitatively because the figure is subject to update and falls outside the fixed facts in our registry.
In practice, Travel Rule compliance requires either an integrated messaging solution or a third-party Travel Rule protocol vendor, plus a policy for handling transfers involving counterparty VASPs that are not yet Travel-Rule-compliant. The FSRA expects documented procedures for these "sunrise problem" scenarios – situations where a sending or receiving VASP cannot yet exchange the required data. Operators entering the ADGM market without a tested Travel Rule solution at application stage face a pre-commencement condition that delays go-live. We map the Travel Rule stack – vendor selection, policy design and FSRA documentation requirements – as part of the authorisation workstream for every client we advise in this jurisdiction.
How does ADGM interact with the cross-border tax and banking picture?
An ADGM-licensed virtual-asset firm operates in a jurisdiction where the UAE imposes no personal income tax and corporate tax applies only above certain profit thresholds under the Federal Corporate Tax law enacted in 2023 – a structurally attractive position for firms with significant trading or management revenue. However, the tax analysis for an inbound operator is almost never limited to the UAE rate. Controllers and beneficial owners who are tax-resident in the UK, EU, US or Australia remain subject to their home jurisdiction's controlled-foreign-company rules, transfer-pricing obligations and treaty positions, and the ADGM structure must be examined against those frameworks before a group commits to the jurisdiction.
Banking remains the most operationally fraught element of any Gulf digital-asset licensing project. UAE banks have materially improved their appetite for licensed virtual-asset businesses since the major regulatory frameworks were formalised, but correspondent-banking access for fiat settlement – particularly USD and EUR – remains selective. Operators we advise routinely need to sequence the banking application in parallel with the FSRA authorisation, because an ADGM authorisation does not guarantee a banking relationship; it improves the creditworthiness of the application in the eyes of a UAE bank's compliance team, but does not compel any bank to open an account. Failure to resolve banking before go-live is one of the most common reasons a licensed firm cannot actually commence operations on schedule.
For cross-border operators, the relationship between ADGM authorisation and the licensing regimes of the jurisdictions where users are located is a second critical variable. An ADGM firm servicing retail clients in the EU does not substitute its ADGM licence for a MiCA CASP (Crypto-Asset Service Provider) authorisation under ESMA's oversight. Servicing professional or institutional clients cross-border from ADGM may be possible under reverse-solicitation or equivalent provisions in some jurisdictions, but those provisions are narrow and the burden of proof is on the operator. We assess the user-base geography at the outset, because a firm that builds its product on an ADGM-only licensing assumption and then discovers it needs an additional EU or UK authorisation is facing a significant delay and cost overrun.
If you have already committed to an ADGM structure and need a second read on the banking and cross-border licensing gaps, write to info@oboluslaw.com. If a prior application stalled or a banking relationship did not materialise, a structured review can surface the reason and the route forward. Map your options.
How does ADGM compare with VARA for an inbound digital-asset operator?
ADGM and VARA represent the UAE's two principal virtual-asset licensing tracks, and the choice between them is one of the most common strategic questions we address for businesses entering the Gulf. They are not interchangeable: they serve different client profiles, carry different regulatory philosophies, and produce different outcomes for banking, institutional fundraising and cross-border contract enforceability.
VARA, the Virtual Assets Regulatory Authority established by Dubai, regulates virtual-asset activity on the Dubai mainland and in designated free zones, but explicitly excludes the DIFC. VARA issues activity-based licences across categories including advisory, broker-dealer, custody, exchange, lending, management and transfer/settlement, and its rulebooks set detailed operational requirements for each. The VARA regime is younger than the ADGM framework and has attracted a broader range of consumer-facing businesses, partly because Dubai's commercial ecosystem and population density make it a natural retail-adjacent market. However, VARA entities are incorporated under UAE mainland or designated-freezone law, not under common-law statutes, and the legal infrastructure for dispute resolution and insolvency differs materially from ADGM's common-law courts.
For a firm whose primary counterparties are institutional – sovereign wealth funds, family offices, regulated banks and asset managers – the ADGM's common-law framework and its FSRA regulator carry greater institutional credibility in the markets where those counterparties conduct legal due diligence. For a firm whose primary market is consumer or SME trading in the GCC, the Dubai/VARA positioning may better align with the commercial geography. Many operators ultimately need a presence in both, with the ADGM entity holding the institutional and custody layer and a VARA-licensed entity servicing the retail-adjacent or transfer/settlement activity. That two-entity structure has its own cost and governance implications, and we model it explicitly for clients before they commit.
A structuring decision in practice
In a recent licensing engagement, a custodian established in a European jurisdiction sought to establish an ADGM entity to service Gulf-based institutional clients. The initial instruction was to apply for FSRA authorisation for custody only. In reviewing the business model, we identified that the firm's proposed activity – accepting assets from clients, executing periodic rebalancing instructions and settling to third-party venues – constituted portfolio management under the FSRA's activity definitions, not custody alone. A custody-only authorisation would have left the firm carrying on an unauthorised regulated activity from day one. We restructured the application scope to capture both regulated activities, revised the governance and compliance documentation accordingly, and engaged the FSRA in a pre-application meeting to confirm the approach. The IPA issued within the timeframe the client had originally budgeted for a simpler application, because the expanded application was complete and consistent from submission.
Which operator profile should choose ADGM?
The decision to pursue ADGM FSRA authorisation rather than another Gulf or international hub depends on three axes: the nature of the regulated activity, the counterparty profile, and the long-term capital and banking strategy.
Profile A – Institutional custodian or prime broker. A firm holding digital assets on behalf of regulated funds, family offices or banks, with a user base that requires a common-law contractual framework and comfort with English-law insolvency protections. ADGM is the natural home. The FSRA's custody regime is well-developed; the ADGM Courts provide a familiar forum for secured-creditor and insolvency proceedings; and the common-law foundation supports cross-jurisdictional recognition of ADGM judgments. Timeline to authorisation is a function of application quality rather than a fixed statutory period.
Profile B – Virtual-asset fund or investment manager. A fund raising from Gulf-based limited partners who need a regulated General Partner or investment manager entity that their own legal and compliance teams can sign off. The ADGM's investment-management authorisation track, combined with the ADGM RA fund-registration regime, produces a structure that is recognisable to institutional LPs from the US, Europe and Asia. The key risk in this profile is ensuring the fund's underlying assets are on the FSRA's recognised-asset list and that the capital and disclosure obligations of the management entity are correctly scoped from the outset.
Profile C – Crypto exchange seeking a Gulf institutional gateway. A trading platform that already operates under a recognised regime – MiCA in the EU, MAS in Singapore, SFC in Hong Kong – and wants to add a Gulf-facing entity for institutional flow. ADGM works well here, but the operator must map clearly which activity the ADGM entity carries on versus what the home-jurisdiction entity does. Regulators on both sides will scrutinise the substance of the local operation; a booking or passporting arrangement that lacks genuine local activity will not satisfy the FSRA.
Profile D – Consumer-facing exchange or payments firm. A business whose primary activity is retail crypto trading or fiat-to-crypto conversion for individual users in the GCC. ADGM is less commercially suited for this profile. The VARA regime in Dubai, with its closer alignment to the UAE retail market, and the mainland payment-service framework operated by the UAE Central Bank are likely more appropriate, either alone or combined with an ADGM entity for the institutional and treasury layer.
What are the most common mistakes in an ADGM FSRA application?
A common assumption is that ADGM registration with the ADGM RA – the corporate formation step – is substantively similar to FSRA financial-services authorisation, and that completing one accelerates or shortcuts the other. It does not. The two processes are sequential and governed by entirely separate rulebooks. Companies that approach the ADGM as a "quick offshore registration" and discover the FSRA authorisation requirements only at the point of product launch face delays measured in months, not days.
The second frequent mistake is underestimating the substance requirement. The FSRA requires that Approved Persons holding key functions – the Senior Executive Officer, Compliance Officer, Finance Officer and Risk Officer – demonstrate genuine connection to the ADGM entity, meaning relevant professional experience, physical presence in Abu Dhabi during supervision and examination periods, and the ability to speak substantively to the business with the FSRA. We regularly advise clients to reconsider their leadership structure for the ADGM entity before applying, because a nominee or placeholder Approved Person creates supervisory risk that the FSRA has historically acted upon.
The third mistake is treating the recognised-asset list as a formality. If a firm's primary token or asset is not on the FSRA's recognised list at the time of application, the authorisation scope is constrained. The recognition process adds time to the project plan. Operators that discover this late either delay launch or seek to operate with a narrower permission set than the business model requires.
The fourth is the banking sequencing problem described earlier: applying for FSRA authorisation without a concurrent banking strategy. ADGM authorisation is necessary but not sufficient for operational readiness. The firms that launch on schedule are those that treat banking as a parallel workstream, not a post-authorisation task.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full practice overview covering major jurisdictions and activity types
- CASP authorisation under MiCA in Germany (BaFin) – for operators building an EU-licensed entity alongside a Gulf hub
- Crypto holding structure: where the legal lines are drawn – the tax and ownership-structuring layer that sits behind any licensing decision
FAQ
How long does a crypto licence take to obtain?
In ADGM, the timeline from formal FSRA application to final authorisation varies by the complexity of the regulated activities sought, the completeness of the application package and the pace of the applicant's responses to FSRA queries. The FSRA does not publish a fixed statutory clock. An In-Principle Approval typically precedes final authorisation, and pre-commencement conditions – capital funding, physical establishment, systems readiness – must be satisfied before the licence issues. In our experience, a well-prepared application for a straightforward activity scope moves materially faster than a complex multi-activity filing with gaps.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on the regulated activities you carry on, the geography of your user base, the profile of your counterparties and capital sources, and the banking access you need. ADGM is well-suited for institutional-facing custody, fund management and exchange activity where a common-law framework and Gulf presence matter. VARA in Dubai serves a different commercial profile. MiCA provides EU passporting. MAS in Singapore anchors Asia-Pacific credibility. The optimal structure is often a multi-jurisdiction stack, and we map that stack before a client commits to any single hub.
Do I need a separate custody licence?
In ADGM, custody of virtual assets on behalf of clients is a distinct regulated activity requiring its own FSRA permission. A firm authorised for trading or advisory activity is not thereby authorised for custody. Operators that hold client keys or assets as an operational convenience – without a custody permission – are carrying on an unauthorised regulated activity. The same principle applies in Singapore under the Payment Services Act, in the EU under MiCA's custody provisions, and in most other flagship regimes. We assess the custody perimeter at the outset of every licensing engagement because the consequences of getting it wrong are material.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and when disputes arise, our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in FSRA authorisations, Gulf virtual-asset licensing and multi-jurisdiction entry strategy for digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.