Overview
The Dubai International Financial Centre is a financial free zone with its own civil and commercial legislation, its own courts, and its own regulator, the DFSA. It sits inside Dubai geographically and outside VARA's perimeter legally.
What it regulates
Crypto Tokens. A regime introduced in 2022, operating through a list of Recognised Crypto Tokens that licensed firms may deal in, with published criteria for recognition, including specific criteria for fiat-referenced tokens.
Investment Tokens. A regime introduced in 2021 for securities and derivatives issued or held in tokenised form. If the underlying is a security, tokenising it does not change its character — the Investment Token regime is how that is handled rather than avoided.
Funds. Including funds with exposure to crypto tokens, subject to the applicable restrictions.
Digital assets as property. DIFC legislation recognises digital assets as a form of property. This is the jurisdiction's most underrated feature: it gives custody, security and insolvency questions a determinate answer under a modern statute rather than by analogy.
Who needs a licence
Any firm carrying on a financial service in or from the DIFC. Scope is drawn by the licence, and the DFSA supervises against it.
Requirements
Category-based capital. Authorised individuals for the senior functions, including a Senior Executive Officer, Compliance Officer and MLRO, with UAE residence where required. Systems and controls proportionate to the activity. Client asset rules where client assets are held — which for a custodian is the core of the file. Substance in the DIFC.
Positioning
The DIFC is the natural home for tokenised securities, fund structures and wealth management with digital-asset exposure. Where the business is an institutional spot exchange or a custodian with a foundation above it, ADGM is usually the closer fit. Where the market is Dubai retail, VARA is.
How we help
We advise on whether an instrument is a crypto token or an investment token before the product is built, prepare DFSA authorisation applications, structure custody arrangements against the client asset rules and the DIFC property regime, and handle DIFC incorporation and data protection registration.
- 01
Structuring
Activity mapping, regulator selection, group and holding structure.
Not yet verified
- 02
Entity incorporation
Trade name, initial approval, lease, corporate documents.
Not yet verified
- 03
Regulatory initial approval
Permission to incorporate and build. Not permission to operate.
Not yet verified
- 04
Policies and technology build
Rulebook-mapped policies, custody and key management, technology audits.
Not yet verified
- 05
MLRO appointment and goAML registration
Entity and officer registration, sanctions screening, reporting workflow.
Not yet verified
- 06
Bank or EMI onboarding
Frequently the longest single dependency, and outside the regulator control.
Not yet verified
- 07
Full licence
Operational permission granted.
Not yet verified
- 08
Ongoing supervision
Reporting, audits, filings, variation of permission.
Not yet verified
Fees
These are the charges a licensee actually meets. Amounts are left blank until each one has been checked against the authority published schedule — an unverified figure is worse than none.
DFSA authorisation application
One-off
Not yet verified
Annual supervision fee
Annual
Not yet verified
DIFC company registration
One-off
Not yet verified
DIFC commercial licence
Annual
Not yet verified
Data protection notification
Annual
Not yet verified
DIFC office
Annual
Not yet verified
Capital to be held, not a fee
Base capital requirement
Not a fee. Category-dependent.
Variable
Not yet verified
Documents
Indicative categories. The exact bundle is activity-specific and the regulator may ask for more.
- Passport copy, valid at least six months
- Passport photograph, white background
- Proof of residential address, dated within three months
- Curriculum vitae
- Bank or professional reference letter
- Police clearance or good conduct certificate — Attestation chain required
- Source of wealth and source of funds evidence
- UAE entry stamp or visa page
- Certificate of incorporation — Attestation chain required
- Memorandum and articles of association — Attestation chain required
- Certificate of incumbency or good standing — Attestation chain required
- Board resolution approving the UAE entity — Attestation chain required
- Register of members and directors
- Ultimate beneficial owner declaration
- Group structure chart to natural persons
- Audited financial statements, most recent two years
- Power of attorney for the UAE representative — Attestation chain required
- Business plan with three-year financial projections
- AML/CFT policy and procedures manual
- Enterprise-wide money laundering risk assessment
- MLRO appointment letter and fit-and-proper file
- Compliance monitoring programme
- Targeted financial sanctions screening procedure
- Governance map and senior management functions
- Outsourcing register and material outsourcing agreements
- Complaints handling and consumer protection policy
- Technology architecture and infrastructure description
- Custody and key management model
- Hot, warm and cold wallet policy
- Penetration test and vulnerability assessment report
- Business continuity and disaster recovery plan
- Cyber incident response plan
- Transaction monitoring and blockchain analytics arrangements
Interaction with other regulators
Common questions
The DIFC is in Dubai. Why is VARA not the regulator?
Because Dubai Law No. 4 of 2022 carves the DIFC out of VARA's perimeter. The DIFC is a financial free zone with its own civil and commercial law, its own courts and its own regulator. A DIFC address puts a firm in front of the DFSA.
What is a Recognised Crypto Token?
The DFSA maintains a list of crypto tokens that licensed firms may deal in, and applies published criteria to additions. A token that is not recognised is not available to DFSA-licensed firms, which constrains listings and product design.
What does it mean that digital assets are property in the DIFC?
It answers questions that otherwise have no clean answer — who owns an asset held by a custodian, what happens on insolvency, whether it can be secured or assigned. For custody and financing structures this is the point of the jurisdiction.
Sources
- DFSA Crypto Token regime — Introduced 2022; Recognised Crypto Tokens list
- DFSA Investment Token regime — Introduced 2021
- DIFC Digital Assets Law and related amendments recognising digital assets as property — Law number and year to be confirmed