· Jurisdiction Briefing

Virtual assets: who licenses what, and where you can check

When a bank or payment firm is asked to bank a virtual asset service provider, the first question is simple: is this firm licensed, and by whom? We checked that question against the regulators' own documents. Some answers come with a public register. One…

Illustration for “Virtual assets: who licenses what, and where you can check”

When a bank or payment firm is asked to bank a virtual asset service provider, the first question is simple: is this firm licensed, and by whom? We checked that question against the regulators’ own documents. Some answers come with a public register. One points to a framework that is not yet in force. For two positions we could not find an official document to rely on, and we say so rather than guess.

What the regulators’ documents say

Mauritius. The Virtual Asset and Initial Token Offering Services Act 2021 regulates the business activities of virtual asset service providers, and the FIU lists entities licensed or registered under that Act among the financial institutions regulated by the Financial Services Commission (FSC).

DIFC. The DFSA regulates crypto token activity in the centre. Since 12 January 2026 firms decide for themselves, on a reasoned and documented basis, whether a crypto token is suitable, and the DFSA no longer publishes a list of Recognised Crypto Tokens. Fiat crypto tokens are the exception: for those, the DFSA itself must be satisfied that the token is suitable. Firms must disclose to clients a current list of the tokens they have assessed as suitable.

ADGM. The FSRA‘s AML Rulebook says any entity acting as a virtual asset service provider in ADGM is expected to be an Authorised Person or Recognised Body, and that none should act as one without the appropriate Financial Services Permission or Recognition Order.

Dubai, outside the DIFC. VARA, established following Law No. 4 of 2022, regulates virtual assets across the emirate, including its free zones, but excluding the DIFC.

UAE federal layer. Cabinet Resolution No. 134 of 2025 requires anyone conducting virtual asset service provider activity from within the State to be licensed, registered or listed by the competent supervisory authority (Art. 36). The federal Capital Market Authority’s own virtual asset rules could not be confirmed from a source on our trusted list for this briefing, so they are not summarised here.

Qatar. In the QFC, the QFCRA has confirmed that the virtual assets covered by its 26 December 2019 alert are “Excluded Tokens” under the QFC Digital Assets Regulations 2024, and that the restrictions in that alert still apply to them. Excluded Tokens include cryptocurrencies, stablecoins and CBDCs. The regulations themselves open the way to tokenising assets such as shares, bonds, sukuk, commodities and real estate. The onshore position under the Qatar Central Bank could not be confirmed from an official document for this briefing.

Saudi Arabia. We could not confirm the Kingdom’s position on licensing crypto exchanges from a SAMA or Capital Market Authority document for this briefing, so we do not state one.

Morocco. No crypto-asset framework is in force yet. Bank Al-Maghrib’s website describes the use of virtual currencies as an unregulated activity, with the Ministry of Economy and Finance, Bank Al-Maghrib and the AMMC drawing the public’s attention to its risks. In December 2025 the AMMC described its training work as preparing for the entry into force of a future legislative framework for crypto-assets. As reported by Morocco World News, Draft Bill No. 42.25, published in November 2025, would introduce a licensing regime with prior regulatory approval; Bank Al-Maghrib’s 22nd annual banking supervision report confirmed work was continuing but gave no firmer date for the bill to reach parliament.

Who licenses what

JurisdictionPosition confirmed for this briefingLicensing or supervising bodyWhere to check
MauritiusRegulated under the VAITOS Act 2021FSCFSC register (its page could not be opened for this briefing)
DIFCRegulated; firm-led token assessmentDFSADFSA public register
ADGMFSRA permission expectedFSRAFSRA Public Register
Dubai, outside the DIFCLicensedVARAVARA public register
Qatar (QFC)Crypto and stablecoins are Excluded TokensQFCRA—
Qatar (onshore)Not confirmed——
Saudi ArabiaNot confirmed——
MoroccoNo framework in force; draft law reported——

The Travel Rule, where it is written down

Three texts spell it out. Mauritius’s Travel Rules 2022 (Government Notice No. 226 of 2022), made by the FSC, apply to financial institutions when they send or receive virtual asset transfers on behalf of a customer, not only to VASPs. The FSRA’s AML Rulebook has a dedicated section on transfers of virtual assets and fiat-referenced tokens and the travel rule (section 10.3). Federally, Cabinet Resolution No. 134 of 2025 requires an originating VASP to obtain originator and beneficiary information and transmit it to the beneficiary VASP or financial institution, and applies those requirements to financial institutions that send or receive virtual asset transfers on behalf of a customer. For the other regimes we did not check the regulator’s text; check directly rather than assume.

The failure mode

The common mistake is treating “licensed in the UAE” as one fact. It is several facts from several registers: VARA’s remit stops at the DIFC, where the DFSA regulates, and the FSRA expects VASPs in ADGM to hold its permission. A VARA licence therefore says nothing about DIFC activity, or the reverse.

VARA’s register also separates full licences from in-principle approvals, which are not the same permission: VARA says IPA holders may not start operations or service clients until they hold a full VASP licence. When we saved the register’s licensed view on 14 September 2026 it showed 56 results, each with a CMA registration number alongside the VARA licence.

Three things worth doing this week

  1. Save the register entry, not the website badge. For every VASP customer or counterparty, keep the regulator’s register page, including status and whether it is a full licence or an in-principle approval.
  2. Match the licence to where the activity happens. A Dubai mainland or free zone, DIFC or ADGM permission is a different permission. Check the one that matches the entity you are dealing with.
  3. Where the position is unconfirmed or not yet in force, ask for the document. For a counterparty claiming a Saudi, onshore Qatari or Moroccan crypto licence, ask for the regulator’s own licence document and verify it with that regulator before you rely on it.

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu