In the Emirate of Dubai, virtual asset service providers are licensed and supervised by the Virtual Assets Regulatory Authority, VARA, under its rulebooks and the UAE’s federal AML law. The rules are close to Europe’s in spirit and differ in the detail, from a travel rule threshold of AED 3,500 to AML records kept for at least eight years.
above which originator and beneficiary data must travel with a transfer
minimum retention for AML/CFT records, against five in the EU
the date the new UAE AML law took effect, naming VASPs directly
the deadline to comply with VARA’s updated rulebooks
VARA’s rulebooks cover the whole firm. These are the parts a compliance team runs every day.
Each virtual asset activity, from exchange to custody to transfer and settlement, needs its own VARA licence, alongside rulebooks every VASP follows on governance, compliance, technology and market conduct.
Rules and reviews are set per activity, so each licence has its own controls.
Before a transfer above AED 3,500, the VASP holds the originator’s name, wallet or account and address, and the beneficiary’s name and wallet or account, and makes them available to VARA on request.
Values are converted at a live rate, and the threshold is applied per jurisdiction.
Before transacting with another VASP, the firm completes risk-based due diligence on it. It need not repeat this for every transfer unless the risk changes.
Counterparty status is known per VASP and checked again when it changes.
AML/CFT records, and records of sanctions freezing actions, are kept for at least eight years, three years longer than the EU requires.
Retention is set per jurisdiction, so Dubai records are kept for eight years and EU records follow EU rules.
A match against UN or UAE lists means freezing without delay and reporting to the authorities.
Customers and counterparties are rescreened on every list update, and freezes are kept with their reasons.
Suspicious transactions and activity are reported to the UAE Financial Intelligence Unit through goAML, without tipping off the customer.
Reports are drafted from the case and exported in goAML format.
Dubai moved early and keeps tightening. The federal law now names virtual assets directly.
The intent is the same. The numbers are not, and a programme that serves both has to know which applies to each customer and each transfer.
| Requirement | European Union | Emirate of Dubai |
|---|---|---|
| Who supervises | The national regulator that granted the MiCA authorisation, with AMLA supervising the largest cross-border firms directly from 2028 | VARA, across the Emirate of Dubai except the DIFC, which has its own regulator |
| Licence | One CASP authorisation, passported to every member state | A VARA licence for each virtual asset activity |
| Travel Rule threshold | None between CASPs, so it applies from the first euro | AED 3,500, converted at a live rate |
| Self-hosted wallets | Ownership or control assessed above €1,000 | Risk-based policy, with added checks on identity and source of funds |
| AML record retention | 5 years after the relationship ends | 8 years at least, for AML/CFT records and sanctions freezes |
| Suspicion reports | To the national FIU, often through goAML | To the UAE FIU, through goAML |
| Privacy coins | No anonymous accounts or anonymity-enhancing coins at CASPs from July 2027 | Activities involving anonymity-enhanced crypto are prohibited |
Firms licensed in Europe and in Dubai should not have to run two compliance teams.
AED 3,500 or the first euro, eight years or five, applied by where the customer and the licence sit.
Investigations, evidence and decisions live in the same record, whichever regulator reads it.
Reports go to the right FIU in the right format, signed by the right person.
Every regime writes to the same controls and the same record, so meeting one helps you evidence the others.
Authorisation, governance and ongoing obligations, evidenced from day one.
Read moreOne EU rulebook for due diligence and monitoring, applied the same way every time.
Read moreOriginator and beneficiary data travels with every transfer and is checked before funds move.
Read moreOperational resilience, with the logs, controls and third-party records auditors ask for.
Read moreWe will show one programme applying VARA and EU rules side by side, on your own flows.
A summary to help you find your way, not legal advice. The official texts are the reference, and your own counsel should confirm how they apply to you.