Accepting Crypto Payments in the UAE: Merchant Sale or Regulated Activity?

Quick Answer

A UAE business cannot simply accept cryptocurrency for its goods or services. Article 2(7) of the Central Bank’s Payment Token Services Regulation permits a merchant onshore to accept only a Dirham Payment Token issued by a CBUAE-licensed issuer, or a Foreign Payment Token from a CBUAE-registered issuer where the payment buys a virtual asset. Bitcoin, Ether and unregistered dollar stablecoins fall outside that permission. Where a third party converts, holds, settles or promotes, a second layer of licensing applies under the Central Bank Law, the VARA framework, or the federal Capital Market Authority regime.

Key takeaways

1. Article 2(7) of the Payment Token Services Regulation (Circular No. 2/2024, effective 31 August 2024) restricts merchant acceptance of virtual assets onshore to two narrow categories of token.
2. Article 40 of that Regulation suspended Article 2 for one calendar year after commencement. That transition has expired, so the restriction now bites.
3. The restriction excludes DIFC and ADGM, but it applies in commercial free zones such as DMCC and JAFZA.
4. Article 61 of Federal Decree-Law No. 6 of 2025 makes advertising, marketing or promoting a licensable financial activity a licensed financial activity in its own right.
5. CMA Decision No. 4/R.M/2026, issued on 13 February 2026, replaced the federal VASP framework in full and set eight licensed virtual asset activities with minimum capital between AED 500,000 and AED 4,000,000.
6. In October 2025, VARA imposed fines of AED 100,000 to AED 600,000 on 19 firms for unlicensed virtual asset activity and breaches of its Marketing Regulations.

Can a UAE business accept cryptocurrency as payment for its goods or services?

Not for general goods and services. Article 2(7) of the Payment Token Services Regulation prohibits a merchant selling goods or services in the UAE in the course of business from accepting a virtual asset in payment, unless that asset is a Dirham Payment Token issued by a CBUAE-licensed issuer, or a Foreign Payment Token from a registered foreign issuer used to buy a virtual asset or a virtual asset derivative.

That is a restriction on the token, not on the merchant. A restaurant does not need a financial licence to accept a licensed dirham stablecoin. It does, however, need to check that the token it is being offered is one of the two permitted categories, and in practice that means checking the Central Bank’s public register.

The consequences are blunt. A Dirham Payment Token (a stablecoin denominated in dirhams and issued by a Licensed Payment Token Issuer) may be accepted for anything lawful. A Foreign Payment Token (a stablecoin denominated in another currency, issued by a Registered Foreign Payment Token Issuer) may be accepted only where the customer is buying a virtual asset or a derivative of one. Everything else, including Bitcoin, Ether, and any dollar stablecoin whose issuer has not registered with the Central Bank, is outside the permission.

Three dated facts show how thin the permitted universe still is. AE Coin received the first CBUAE approval to issue a dirham payment token in December 2024. RAKBANK received in-principle approval to issue a dirham-backed stablecoin on 7 January 2026. The Central Bank registered USDU, issued by Universal Digital, as a Foreign Payment Token on 29 January 2026.

What does the Payment Token Services Regulation actually prohibit?

The Regulation, issued as Circular No. 2/2024 and effective from 31 August 2024, does four things. It requires a licence or registration to perform payment token issuance, conversion, or custody and transfer. It restricts which tokens a merchant may accept. It bans algorithmic stablecoins and privacy tokens outright. It bans promotion of payment token services by anyone not licensed, registered, or appointed by a licensee.

The prohibitions sit in Article 2. Article 40 provided that Article 2 would not apply for one calendar year following commencement, and gave the Central Bank discretion to extend that transition period. The transition has run its course. Article 2 is live, which is why the position described in most pre-2025 commentary is now out of date.

Two structural points are easy to miss. First, Article 2(13) states that references to the UAE in Article 2 exclude the financial free zones. DIFC and ADGM are outside it; DMCC, JAFZA, RAKEZ and other commercial free zones are inside it. Second, Article 2(2) catches services performed on a means of payment that is not a payment token where the service is equivalent to a payment token service, and it says so expressly for firms already licensed by a virtual asset regulator. Holding a VARA licence does not carve you out of the Central Bank’s perimeter.

There is a closed-loop exemption. Article 4(1)(c) exempts payment tokens usable only for non-financial goods or services supplied by the token issuer itself. Article 4(2) allows the Central Bank to exempt an issuer whose reserve would not exceed AED 500,000 and which has no more than 100 token holders. Loyalty points and bonus schemes sit here. A retail crypto checkout does not.

When does a crypto payment arrangement become a regulated activity?

A crypto payment model becomes regulated when someone other than the buyer and the seller performs a financial function. The trigger is not the presence of a virtual asset. It is the presence of conversion, custody, transfer, settlement, brokerage, issuance, or paid intermediation between the two ends of the transaction.

Common triggers include the following:

1. A payment processor receives crypto from customers and settles the merchant in dirhams.
2. A UAE platform routes customers to a crypto provider and earns commission or a revenue share.
3. A group company collects stablecoins from customers and remits dirhams to the UAE seller.
4. A checkout page lets customers buy, sell, convert or transfer virtual assets.
5. A platform creates wallets for customers, or controls the private keys (the secret codes that give control over the crypto).
6. A merchant uses pooled or omnibus wallets (single wallets holding several people’s assets together) before settlement.
7. A third party guarantees settlement, quotes rates, keeps a spread, or handles refunds in crypto.

Fee arrangements matter more than most founders expect. Article 61 of Federal Decree-Law No. 6 of 2025 lists advertising, marketing or promoting a licensable financial activity as a licensed financial activity in its own right. Article 62 then extends the Central Bank’s jurisdiction to any person carrying on, offering, issuing or facilitating such an activity, "regardless of the medium, technology, or form employed". Building on a blockchain does not place a financial function outside the perimeter, and neither does calling the arrangement a technical integration.

Which regulator applies to your crypto payment model?

Four regimes can apply to a single arrangement, and they apply cumulatively rather than in the alternative. The Central Bank governs the money leg. VARA governs virtual asset activity carried on in or from Dubai outside the DIFC. The CMA sets a federal baseline for virtual asset activities onshore. The AML statute applies to all of them.

Two boundaries are worth stating plainly. Where a virtual asset is used as a means of payment, or exchanged for currency, the Central Bank Law engages. Where a virtual asset is bought for investment, or swapped for another virtual asset, it does not, and the analysis moves to VARA or the CMA. The CMA has made the same functional point about technology, noting that "not everything that uses DLT will automatically fall under the VA regime". Classification follows the legal nature of the instrument.

Does putting the crypto function offshore solve the problem?

Rarely, and less than it used to. Article 62 of Federal Decree-Law No. 6 of 2025 captures facilitation of a licensed financial activity through any medium or technology, which reaches platforms, protocols and infrastructure providers that enable payments for UAE customers. Federal Decree-Law No. 33 of 2025, in force since 1 January 2026, extends the CMA’s reach to cross-border activity with a sufficient UAE nexus, including activity directed at UAE markets or investors.

So the analysis can still be triggered where the service is directed at UAE customers, marketed from the UAE, embedded in a UAE website or app, supported by UAE staff, or tied to the UAE merchant’s sale. Incorporation elsewhere changes the identity of the licensee, not the existence of the activity.

VARA has published enforcement notices against firms conducting or promoting virtual asset activity accessible in or from Dubai without approval. Its October 2025 action fined 19 firms between AED 100,000 and AED 600,000 each and issued cease-and-desist orders, warning that dealing with unlicensed operators carries "significant financial, legal, and reputational risk". The Central Bank’s own sanctions are heavier: unlicensed financial activity is a criminal offence under Federal Decree-Law No. 6 of 2025, the maximum administrative fine for a licensed financial institution is AED 1 billion, and there is a minimum fine of AED 1 million for promoting a financial activity without authorisation.

For a group structure, ask where customers are targeted, who controls the relationship, who receives fees, who holds the assets, who settles the merchant, and whether the UAE entity does anything beyond selling its own goods.

When does a token cross into capital markets territory?

A token crosses into CMA territory when the arrangement connects to investment returns, fractional ownership, derivatives, structured products, fundraising or issuer activity. Paying a merchant in a stablecoin is a payments question. Offering a token that promises yield, profit-sharing or exposure to an underlying asset is a capital markets question, whatever the token is called.

CMA Decision No. 4/R.M/2026, issued on 13 February 2026, replaced the previous federal VASP framework in full rather than amending it. It applies across mainland UAE and commercial free zones, and expressly excludes DIFC and ADGM. Existing licensees have until 13 February 2027 to comply with the Business Regulation Module and the Alternative Trading System Module. Privacy tokens and algorithmic tokens are prohibited outright, with no licensing pathway around the ban.

Two points of hygiene follow. Do not rely on pre-2026 references to the Securities and Commodities Authority: it was reconstituted as the CMA on 1 January 2026, and Decision No. 4/R.M/2026 abrogated SCA Decision No. 26/R.M/2023. And do not treat "utility token" as a safe harbour. Utility tokens and NFTs are restricted under the new Decision, with a narrow exception for custody or trading platform operation subject to prior CMA approval.

What AML and sanctions obligations apply to crypto payments?

They apply regardless of whether a licence is required. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025, repealing Federal Decree-Law No. 20 of 2018 and bringing virtual asset service providers squarely within the statutory perimeter. Its executive regulations, Cabinet Resolution No. 134 of 2025, took effect on 14 December 2025 and set out detailed requirements for virtual asset transfers.

One change deserves attention from anyone accepting high-value crypto payments. Article 2 of the 2025 statute lowers the mental element for money laundering: a person commits the offence where they know, or where sufficient evidence or circumstantial evidence supports knowledge, that funds derive from a predicate crime. Prosecutors no longer need to establish actual knowledge. For a developer taking AED 40 million in tokens through an intermediary, that shifts the value of a properly documented source-of-funds file from good practice to protection.

A compliant crypto payment model should address customer due diligence, wallet and sanctions screening, source of funds and wealth where relevant, virtual asset transfer information requirements, suspicious transaction reporting to the Financial Intelligence Unit, record keeping, diligence on any counterparty service provider, and controls for refunds, failed payments and chargebacks. Real estate developers, luxury dealers, brokers and payment platforms carry the sharpest exposure, because high-value goods and cross-border token flows are where these questions become commercially serious.

Frequently asked questions

Can a UAE business accept crypto payments without a licence?

Not for general goods and services onshore. Article 2(7) of the Payment Token Services Regulation permits a merchant to accept only a Dirham Payment Token issued by a CBUAE-licensed issuer, or a Foreign Payment Token from a registered foreign issuer used to buy a virtual asset. Bitcoin, Ether and unregistered dollar stablecoins are outside that permission. The merchant does not need its own licence, but the token and its issuer must be authorised.

Can a UAE merchant accept USDT or USDC?

Only in a narrow case. A Foreign Payment Token may be accepted where it is issued by a CBUAE-registered foreign issuer and used to pay for a virtual asset or a virtual asset derivative. A shop selling watches, a developer selling property or a consultancy selling services cannot rely on that route. The Central Bank registered USDU, issued by Universal Digital, as a Foreign Payment Token on 29 January 2026.

Does the merchant restriction apply in DIFC and ADGM?

No. Article 2(13) of the Payment Token Services Regulation states that references to the UAE in Article 2 exclude the financial free zones. DIFC and ADGM firms answer to the DFSA and the FSRA respectively. Commercial free zones such as DMCC and JAFZA are not financial free zones, so the restriction does apply to businesses established there.

When does a crypto checkout become a regulated activity?

When a person other than the buyer and the seller performs a financial function. Converting crypto to dirhams, holding customer assets, controlling private keys, settling the merchant, earning a spread, or promoting the service can trigger the Central Bank Law, the VARA framework, or both. The label attached to the arrangement does not decide the result.

Does using an offshore provider avoid UAE regulation?

Not reliably. Article 62 of Federal Decree-Law No. 6 of 2025 captures any person who carries on, offers, issues or facilitates a licensed financial activity, whatever the technology. Federal Decree-Law No. 33 of 2025 reaches cross-border activity with a sufficient UAE nexus, including activity directed at UAE clients. Where the customer sits and who earns the fee matter as much as the place of incorporation.

What penalties apply to unlicensed crypto payment activity in the UAE?

Under Federal Decree-Law No. 6 of 2025, carrying on a licensed financial activity without authorisation is a criminal offence carrying imprisonment and a fine, and the maximum administrative fine for a licensed financial institution is AED 1 billion. In October 2025, VARA fined 19 firms between AED 100,000 and AED 600,000 for unlicensed virtual asset activity and marketing breaches.

Can property in Dubai be bought with cryptocurrency?

Property is transferred and registered in dirhams. Where crypto is involved, a licensed intermediary converts it and settles the seller in dirhams, which means that intermediary is performing conversion, transfer, settlement or custody and needs the corresponding authorisation. The seller cannot simply take Bitcoin into its own wallet. Source of funds and sanctions checks on a high-value transfer will be significant.

Disclaimer: This article is general information about UAE law as at July 2026. It is not legal advice and does not create a lawyer-client relationship. The right answer for any arrangement depends on its exact facts, which should be reviewed with a qualified UAE legal consultant before you rely on any position.