An overview of the regulation of virtual assets in the Dubai International Financial Centre (DIFC)

Virtual asset laws and regulations in the Dubai International Financial Centre (DIFC)​

Regulation of virtual assets and offerings of virtual assets in the Dubai International Financial Centre (DIFC)

Regulation of VASPs in the Dubai International Financial Centre (DIFC)

Regulation of other crypto-related activities in the Dubai International Financial Centre (DIFC)

Other relevant regulatory information

Pending litigation and judgments related to virtual assets in the Dubai International Financial Centre (DIFC) (if any)

Government outlook on virtual assets and crypto-related activities in the Dubai International Financial Centre (DIFC)

Advantages of setting up a VASP in the Dubai International Financial Centre (DIFC)

1. Virtual asset laws and regulations in the Dubai International Financial Centre (DIFC)​

The Dubai International Financial Centre (DIFC) serves as a significant financial hub in the UAE, providing a range of financial services. Established in 2004, the DIFC operates as an autonomous jurisdiction with its legal and regulatory framework based on English common law. It is home to over 2,500 registered companies, including banks and insurance firms.

As of March 2024, the DIFC has significantly updated its regulatory framework for virtual assets with the enactment of the Digital Assets Law No. 2 of 2024. This law establishes a comprehensive legal framework for digital assets. The regulatory framework for virtual assets in the DIFC also adheres to international best practices and standards, aligning with recommendations from the Financial Action Task Force (FATF). The Dubai Financial Services Authority (DFSA) plays a crucial role in shaping this framework. This regulatory initiative offers guidelines, covering licensing and registration requirements, along with measures for investor protection and risk management.

What is considered a virtual asset in the Dubai International Financial Centre (DIFC)?

Initially, virtual assets in the DIFC were classified as “Crypto Tokens” and were regulated based on their characteristics. DIFC Law No. 4 of 2012 defined crypto tokens as “Securities” if they exhibit traits similar to traditional securities. However, individual consideration was emphasised to avoid a blanket classification.

However, under the newly enacted Digital Assets Law (DIFC Law No. 2 of 2024), the term “virtual asset” in the DIFC is defined as a “Digital Asset.” A Digital Asset is characterised as a notional quantity unit that is created through the active operation of software by a network of participants and is represented by network-instantiated data. It exists independently of any particular person or legal system and is not capable of duplication. This means that the use or consumption of the asset by one person necessarily prevents others from using or consuming it in the same way. Digital Assets are classified as intangible property and are distinct from traditional forms of property, as they are neither physical objects nor rights that must be claimed through legal action. This expansive definition allows the DIFC to properly regulate technological advances and accommodate a growing range of digital assets like cryptocurrencies and non-fungible tokens.

What are the relevant laws and regulations?

1. DIFC Law No.1 of 2004: It is a law enacted by the Ruler of Dubai for the jurisdiction of the Dubai International Financial Centre. The law has several parts, including general provisions, the structure of the DFSA and its powers, rules, financial market tribunal, proceedings, and enforcement. The Law has provisions for resolvability, which refers to the ability of an authorised firm to be resolved by an orderly resolution. The DFSA has the authority to write down or convert any instrument or liability and to appoint a temporary administrator in the event of resolution. In the context of virtual assets, the Regulatory Law 2004 enables the DFSA to regulate these assets and to ensure they comply with the law’s provisions.
2. Federal Law No. 8 of 2004: This law serves as the foundation for establishing a Financial Free Zone in any Emirate through a Federal Decree. It plays a pivotal role in granting exemptions to Financial Free Zones and Financial Activities from all Federal civil and commercial laws. While emphasising the application of Federal criminal laws, including Anti-Money Laundering regulations, within the Financial Free Zones, the law also imposes specific restrictions. Notably, it prohibits DIFC authorised firms from engaging in deposit-taking within the State’s markets and using the UAE Dirham.
3. Federal Decree No. 35 of 2004: This decree marks the establishment of the DIFC as a Financial Free Zone in Dubai, known as the DIFC Law. Accompanied by Cabinet Resolutions, the decree defines the geographic boundaries of the DIFC and permits centre bodies and authorised firms to operate outside the DIFC during its initial construction phase. It forms a crucial part of the legal framework shaping the structure and operations of the DIFC.
4. Dubai Law No. 5 of 2021: Recognising the establishment of the DIFC, Dubai Law No. 5 of 2021 reinforces the financial and administrative independence of the DIFC. It lays the groundwork for DIFC centre bodies, including the DIFC Authority, DFSA, and DRA.
5. Cabinet Resolution No. 28 of 2007: Implementing Federal Law No. 8 of 2004 on Financial Free Zones, Cabinet Resolution No. 28 of 2007 offers detailed provisions concerning the Financial Free Zones Law. It serves as a complementary piece, providing clarity and specific guidelines related to the application and enforcement of the aforementioned federal law. The resolution contributes to the comprehensive regulatory framework governing Financial Free Zones.
6. Consultation Paper No. 143: Issued by DFSA DIFC’s invites public input on potential regulations for entities involved in financial services related to Crypto Tokens. The paper focuses solely on Crypto Tokens and proposes changes to existing laws, including the Regulatory Law, Markets Law, and other relevant modules.Notable proposals in the paper include the prohibition of Privacy Tokens and Devices, as well as Algorithmic Tokens. It describes requirements in areas like acceptable Crypto Tokens, establishing a Crypto Asset Fund, managing crypto assets in funds, market supervision, and procedures for addressing complaints and seeking redress.
7. DIFC Law No. 1 of 2012 (Markets Law): Oversees securities and crypto tokens. It specifically addresses the application of the law to crypto tokens. The law applies to the offering of securities or crypto tokens and mandates issuers to provide comprehensive information in a prospectus for informed assessments by investors.
   1. The law prohibits any misleading statements or omissions related to investments or crypto tokens, regardless of the location. It also regulates the issuance and offering of securities by investment companies.
   2. It focuses on preventing market abuse and prohibiting fraud and market manipulation by prohibiting individuals from engaging in activities that create a false impression about the supply, demand, or price of investments or crypto tokens. It also bans the use of non-public information that could impact transaction terms for investments or crypto tokens.
8. The DFSA Rulebook’s General Module (GEN): It is a regulatory guide for authorised financial entities in the Dubai International Financial Centre, offering detailed definitions and rules. It directly applies to specific virtual currency services like investment dealing, custody, and trading facilities. It explains criteria for financial promotions related to virtual currencies, emphasising accurate representation. The Rulebook also prohibits privacy coins and algorithmic tokens in the DIFC due to transparency, market manipulation, and investor protection concerns.
9. Glossary Module (GLO): The GLO module defines a crypto token as a secure digital representation of value, rights, or obligations, traded electronically through technologies like distributed ledgers. A crypto business covers various financial services related to these tokens, such as buying and selling, managing assets, and operating trading platforms.
   1. The Rulebook provides clear guidance on running crowdfunding platforms for investments, loans, and property. It explains the rules to follow and the requirements for obtaining a license.
   2. Security tokens, as per the Rulebook, are like specific securities or instruments, with similar rights and obligations. It mentions that these tokens might have restrictions affecting how often or how much they can be traded.
10. The Digital Assets Law (DIFC Law No. 2 of 2024): The Digital Assets Law enacted by the DIFC on March 8, 2024, establishes a comprehensive framework for the regulation of digital assets. This law clearly defines what constitutes a digital asset, describing it as a virtual unit created by software and network data that cannot be copied and exists independently of any person or legal system. The law aims to eliminate uncertainties surrounding the legal status of digital assets, providing clarity on how they can be controlled, transferred, and managed.In addition to defining digital assets, the law amends existing DIFC legislation, including the Contracts Law and the Law of Obligations, to incorporate specific provisions related to digital assets. This ensures that these assets are recognised within the legal system, allowing them to be treated similarly to traditional forms of property.

Who do such laws and regulations apply to?

Under the new Digital Assets Law (DIFC Law No. 2 of 2024), the regulations apply to all entities and individuals engaging in activities involving Digital Assets within or originating from the DIFC. This includes businesses offering financial services related to Digital Assets, such as exchanges, asset managers, brokers, and custodians. These entities are required to obtain the appropriate authorisation or license from the DFSA to operate legally within the jurisdiction.

The law extends to Authorised Persons, individuals or entities seeking authorisation, issuers or developers of digital assets, and any other entity involved in activities associated with digital assets.

Who are the relevant regulatory authorities in relation to virtual assets in the Dubai International Financial Centre (DIFC)?

The Dubai Financial Services Authority (DFSA) is the primary regulatory body overseeing the virtual assets space in the DIFC. The DFSA’s framework includes:

• Licensing requirements for firms wishing to provide services related to digital assets, which include trading, custody, and advisory services.
• Regulations addressing various risks such as anti-money laundering, consumer protection, and financial crime.

What are the penalties for breaches of virtual asset laws and regulations in the Dubai International Financial Centre (DIFC)?

Under the Digital Assets Law and the Crypto Token Regime implemented by the DFSA in the DIFC, various penalties are established for non-compliance including fines, sanctions, and potential license revocation:

1. Under Digital Assets Law enacted on March 8, 2024, the financial penalties can be imposed based on the severity of the violation, starting from AED 20,000 and potentially escalating to AED 500,000 for repeat offenses. In addition to monetary fines, the DIFC has the authority to suspend or revoke licenses of individuals or entities that fail to comply with the regulations governing virtual assets. This includes both the suspension of specific permits related to virtual asset activities and, in coordination with relevant authorities, the potential cancellation of commercial licenses.The DIFC regulatory body is also vested with judicial powers, allowing it to conduct investigations and enforce compliance effectively. This authority enables the regulatory body to access records and documents pertinent to virtual asset operations to ensure adherence to the legal framework. Moreover, in cases of serious misconduct, public censure may be imposed as an additional deterrent, serving to discourage future violations and uphold the integrity of the financial system within the DIFC.
2. Sanctions may also be applied, depending on the nature and gravity of the infringement. These can encompass restrictions on the types of financial services a firm can provide, termination of client business relationships, and potential damage to the firm’s reputation.
3. License revocation is a severe consequence for persistent violations of the Crypto Token Regime. This penalty may result in the termination of business operations within the Dubai International Financial Centre, restricting the entity’s ability to conduct financial services activities in the future and adversely impacting its reputation.
4. Penalties encompass both monetary fines and potential revocation of licenses, with the DFSA having the authority to initiate criminal investigations and impose sanctions for non-compliance. These measures are designed to ensure that individuals and firms operating in the crypto-assets sector adhere to transparent and trustworthy practices.
5. Also, the DFSA does not recognise crypto-tokens prohibited in the DIFC. Engaging in activities related to these tokens, such as trading and custody, may lead to consequences such as fines, imprisonment, and limitations on business activities.
6. Furthermore, DIFC Law No. 1 of 2012 (Markets Law) discusses civil compensation that a person may need to pay for contravening the law’s provisions, including those related to the offer of securities or crypto tokens. The law grants the DFSA the authority to issue a stop order if it deems that an offer of securities or crypto tokens breaches the law or its associated rules.
7. Another part of The Markets law, focusing on proceedings, allows the court, at the DFSA’s request, to issue orders concerning a person, irrespective of whether a violation has occurred. Such measures can be taken if it is deemed in the interest of the DIFC.
8. Compliance with Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) obligations are integral in the crypto-asset industry in the DIFC. Authorised firms and individuals involved in crypto-asset activities must adhere to DFSA-issued guidelines for AML/CFT compliance. Non-compliance with these guidelines may result in penalties and restrictions on business activities.

2. Regulation of virtual assets and offerings of virtual assets in the Dubai International Financial Centre (DIFC)

Are virtual assets classified as ‘investments’ or other regulated financial instruments in the Dubai International Financial Centre (DIFC)?

Under the new Digital Assets Law (DIFC Law No. 2 of 2024), Digital Assets in the DIFC are classified and regulated based on their unique characteristics. The law defines a Digital Asset as a notional quantity unit that exists independently of any person or legal system and is not capable of duplication. This framework distinguishes between different types of Digital Assets, such as securities, utility tokens, and non-fungible tokens, each of which may fall under distinct regulatory regimes depending on their attributes and intended use.

Digital Assets that exhibit traits similar to traditional financial instruments, such as representing ownership rights or providing a return on investment, may be classified as securities. This classification aligns with the broader principles of securities regulation, ensuring that Digital Assets with investment-like characteristics are subject to stringent regulatory oversight. The DIFC does not apply a blanket classification to all Digital Assets; instead, it assesses each asset based on its specific features and use cases to determine the appropriate regulatory treatment.

The DFSA oversees the recognition and regulation of various Digital Assets, including widely recognised cryptocurrencies such as Bitcoin, Ethereum, Litecoin, and XRP. However, the DFSA imposes restrictions on certain types of Digital Assets, such as privacy tokens and algorithmic tokens, due to concerns over transparency and investor protection. Central bank digital currencies (CBDCs) are also excluded from the definition of Digital Assets under the DIFC’s regulatory framework, as they are governed by separate legal provisions.

Are stablecoins and NFTs regulated in the Dubai International Financial Centre (DIFC)?

In the DIFC, both stablecoins and non-fungible tokens (NFTs) are subject to regulation under the newly enacted Digital Assets Law and the Crypto Token regime established by the DFSA.

Regulation of Stablecoins

Stablecoins, defined as fiat-backed crypto tokens, are recognised under the DFSA’s regulatory framework. The DFSA has established specific recognition criteria for stablecoins, allowing them to be classified and regulated as part of the broader category of crypto tokens. This includes compliance with financial crime regulations and transaction monitoring to ensure transparency and investor protection.

Regulation of NFTs

NFTs are also encompassed within the regulatory framework of the DIFC. The Digital Assets Law provides a comprehensive approach to digital assets, including NFTs, which are treated as unique digital representations of ownership or rights. The law addresses how these assets can be controlled, transferred, and dealt with legally. Additionally, NFTs may fall under different regulatory regimes depending on their characteristics and intended use, such as whether they represent an investment or a utility.

Are decentralised finance (DeFi) activities (e.g. lending virtual assets) regulated in the Dubai International Financial Centre (DIFC)?

Decentralised finance (DeFi) activities, including lending virtual assets, are regulated in the DIFC under the Digital Assets Law (DIFC Law No. 2 of 2024) and the Crypto Token regime established by the DFSA.

DeFi activities fall under the general regulatory framework outlined in the DIFC Regulatory Law, specifically within the DFSA Rulebook’s general (GEN) module. This framework mandates that individuals and entities must comply with regulatory provisions when engaging in DeFi activities related to crypto tokens. Individuals are prohibited from engaging in any DeFi activity involving crypto tokens unless those tokens are recognised by the DFSA. The DFSA considers various factors for recognition, including the nature of the hosting platform and the level of investor protection provided.

Activities related to algorithmic tokens are explicitly prohibited due to concerns regarding transparency and investor protection. Also, anyone operating a crypto business in or from within the DIFC, including those involved in DeFi activities such as lending virtual assets, is required to obtain a license from the DFSA. This ensures compliance with regulatory standards and protects consumers. Moreover, DeFi projects may be registered under an Innovation License, but if they involve regulated activities like peer-to-peer lending, additional authorisations from the DFSA will be necessary.

Are there any restrictions on issuing or publicly offering virtual assets in the Dubai International Financial Centre (DIFC)?

The restrictions and requirements on the issuance or publicly offering of virtual assets in DIFC are described in the Digital Assets Law (DIFC Law No. 2 of 2024) and General Module (GEN) of the DFSA Rulebook. The Rulebook specifies requirements that apply to financial services and other activities relating to crypto tokens.

It prescribes that a person must not engage in any of the following activities in or from the DIFC in relation to a crypto token unless it is a recognised crypto token:

1. carry on a financial service relating to the crypto token;
2. operate a crypto exchange;
3. operate a crypto custodian;
4. offer to the public a crypto token.

Also, an issuer seeking recognition for a crypto token must submit an application for recognition to the DFSA. The application must include a comprehensive proposal clearly identifying how the crypto token complies with the criteria for recognition which requires that the issuer seeking recognition must disclose relevant and accurate information to the DFSA, including the white paper describing the crypto token, any technical specifications, any legal opinions, any contracts and agreements relating to the crypto token, and any other information relevant to the determination that the crypto token meets the recognition criteria.

It should be noted that the Recognition of a crypto token under the Rulebook does not relieve an authorised person or any other person from their responsibility to carry out proper due diligence on a crypto asset before providing a Financial Service or carrying out any other activity relating to the crypto token.

Additionally, it set out stricter requirements and restrictions on Issuing or Publicly Offering of Virtual Assets in DIFC in Digital Assets law,2024. Under the Act, an issuer or promoter who wishes to issue or publicly offer any virtual asset within or from the DIFC would require to fulfil certain requirements as set out below:

1. The issuer must be incorporated as a limited liability company under DIFC companies’ law.
2. The virtual asset’s publicly offering must comply with the Chapter 2.0 of the Rules in the Offered Securities and Debentures Module (OSD).
3. The issuer must provide detailed information about the virtual asset, its technology, its characteristics, and the risks associated with it in the offer document.
4. The issuer must provide a clear description of the product, its features, and how it can be used.
5. The issuer must provide a clear explanation of the rights and obligations of the investor.
6. The issuer must ensure that the virtual asset is suitable for the type of investor it is being offered to, and that the investor has the necessary knowledge and experience to understand the product’s risks and characteristics.
7. The issuer must disclose the risks associated with the product and any conflicts of interest that may exist.
8. The issuer must establish proper governance and control procedures to ensure the protection of investor’s rights and interests.
9. The issuer must provide proper record keeping to enable the DFSA to supervise the issuer’s operations.
10. The issuer must establish procedures and controls for the safekeeping of any virtual assets, including holding such assets in an appropriate custodian, and ensuring that they are properly accounted for.
11. The issuer must ensure that it is compliant with all relevant laws and regulations, including anti-money laundering and counter-terrorist financing regulations.
12. The issuer must submit regular reports to the DFSA on the virtual asset’s performance and any changes to its features.

Are there any exemptions to the restrictions on issuing or publicly offering of virtual assets in the Dubai International Financial Centre (DIFC)?

There are exemptions to the restrictions on issuing or publicly offering virtual assets in DIFC. Specifically, the Digital Assets Law (DIFC Law No. 2 of 2024) and DIFC Rulebook’s General Module (GEN) provides exemptions. The rulebook provides exemptions for virtual assets that are considered Security Tokens. This exemption is granted if the following conditions are met:

1. The virtual asset must be issued by an Authorised Firm or an entity operating under a financial services regulatory framework that is equivalent to that of the DFSA;
2. the virtual asset must be offered to (a) Professional Clients (as defined in the DFSA Conduct of Business Module), (b) clients who are knowledgeable in investing in virtual assets, or (c) clients who can invest a minimum of USD 100,000 in the virtual asset;
3. the virtual asset is listed on an exchange recognised by the DFSA, or is traded via a Multilateral Trading Facility or Organised Trading Facility; and
4. the virtual asset is registered with the DFSA.

Additionally, General Module (GEN) provides an exemption for virtual assets that are utility tokens. This exemption is granted if the following conditions are met:

1. The virtual asset must be used to access or purchase goods or services, or to otherwise provide a benefit to its holders;
2. the virtual asset must be available for use at the time of issuance;
3. the proceeds from the sale of the virtual asset must be used to develop the network or platform that facilitates its utility, and
4. The issuer of the virtual asset must disclose clearly that the virtual asset is a utility token and not a security token.

It is important to note that the DFSA may require additional conditions to be met in order to grant an exemption for virtual assets. the DFSA may impose further conditions or restrictions regarding virtual assets, including minimum disclosure requirements, sale limitations, and liquidity requirements.

Furthermore, there are exemptions in relation to the restrictions on offering or issuing Virtual Assets are provided in the Digital Assets Law (DIFC Law No. 2 of 2024), which states that DIFC will allow certain exempted activities which include the following:

1. Persons who provide auto-conversion service for Virtual Assets which eliminates the involvement of any fiat currency.
2. Mining pools that operate in DIFC are exempted from seeking regulatory protection for their activities.
3. Persons that provide services related to Smart Contracts or related to Operating Systems/Protocol Layers do not have to obtain regulatory approval for their functioning.
4. Persons who are involved in providing services for load balancing, security, or other similar purposes that are not conducted to provide decentralised exchange functions do not need to obtain regulatory permission.
5. Service providers that are involved in ancillary services such as systems management, data hosting, and server administration do not require regulatory permission.

It is important to note that VASPs operating in these exempted activities are still subject to AML/CFT regulations and must comply with the AML module.

3. Regulation of VASPs in the Dubai International Financial Centre (DIFC)

Are VASPs operating in the Dubai International Financial Centre (DIFC) subject to regulation?

Virtual asset providers operating in or from DIFC are regulated by the Dubai Financial Services Authority DFSA. The specific manner in which they are regulated depends on several factors including the type of VASP activity being conducted, the level of risk associated with that activity, and the nature of the business. The regulation of VASPs is detailed in the Digital Assets Law and the DIFC Rulebook’s General Module (GEN).

The DFSA has set out the regulatory requirements for VASPs to help mitigate the risks associated with virtual assets and ensure compliance with AML/CTF obligations. These requirements include:

1. The requirement to obtain DFSA authorisation or registration to operate a virtual assets business in DIFC, unless an exemption applies.
2. Individuals are prohibited from engaging in activities related to crypto tokens unless the token is recognised by the DFSA. This includes carrying on financial services related to the token, operating a crypto exchange or custodian, or offering a crypto token to the public.
3. An issuer seeking recognition for a crypto token must submit a comprehensive application to the DFSA demonstrating compliance with recognition criteria and providing relevant documents like a white paper and legal opinions.
4. The requirement to comply with AML/CTF obligations under the DIFC AML/CTF module, which includes conducting due diligence on customers, ongoing monitoring of transactions, and reporting suspicious activities to the Financial Intelligence Unit,
5. The requirement to ensure the safety, security, and custody of client assets by implementing appropriate safeguards and risk management systems,
6. The requirement to have appropriate policies and procedures in place to manage the operational risks associated with providing virtual asset services,
7. The requirement to have appropriate corporate governance arrangements in place,
8. The requirement to comply with the relevant DIFC data protection regulations,
9. The requirement to provide customers with appropriate disclosures regarding the risks and nature of virtual asset services, as well as any conflict of interests that may arise in the course of providing such services.

Are VASPs providing virtual asset services from offshore to persons in the Dubai International Financial Centre (DIFC) subject to regulation in the Dubai International Financial Centre (DIFC)?

Virtual Asset Providers providing virtual asset services from offshore to persons in DIFC are subject to regulation in DIFC. Specifically, the regulation of VASPs is detailed in the DIFC Rulebook’s General Module (GEN), which applies to all VASPs regardless of whether they provide services from within or outside the DIFC.

Therefore, if a VASP provides virtual asset services to persons in DIFC from offshore, it must still comply with the regulatory requirements explained in the GEN, which includes obtaining DFSA authorisation or registration, complying with AML/CTF obligations, ensuring the safety and security of client assets, implementing appropriate risk management systems, and providing appropriate disclosures to customers.

What are the main requirements for obtaining licensing / registration as a VASP in the Dubai International Financial Centre (DIFC)?

Under the Digital Assets Law (DIFC Law No. 2 of 2024) and the updated regulatory framework provided by the DFSA, obtaining a license or registration as a VASP in DIFC involves several specific requirements designed to ensure compliance, risk management, and consumer protection. Under the Digital Assets Law, DIFC has established specific licensing and registration requirements for VASPs based on the nature of their business activities. There are different categories of licenses, each tailored to the type of services provided. For instance, entities engaging in high-risk activities such as operating trading platforms for Digital Assets must obtain an Alternative Trading System (ATS) license. This license requires technological infrastructure, advanced cybersecurity measures, and compliance with strict AML/CFT standards. Market makers or credit providers fall under the Category 2 license, which necessitates substantial capital reserves and comprehensive risk management systems. STP brokers dealing on a matched principal basis need a Category 3A license, while discretionary portfolio managers require a Category 3C license. These licenses come with medium-level fees and specific requirements for managing client portfolios and maintaining strong governance frameworks.

For those offering low-risk services such as advisory or arrangement activities, a Category 4 license is required, which involves lower fees and minimal capital requirements. VASPs must ensure they have a physical office in the DIFC, with core functions like compliance and risk management being managed locally. Additionally, the DFSA imposes a range of licensing fees, which include an initial registration fee that can range from AED 50,000 to AED 100,000, and annual renewal fees varying between AED 20,000 and AED 50,000, depending on the license category and scope of activities.

Application process: A VASP must submit a detailed application to the DFSA using the prescribed forms, specifically tailored for Digital Asset activities. The application must include comprehensive information about the proposed business model, governance structure, and the types of Digital Assets the entity plans to handle. This documentation must demonstrate how the VASP will comply with the requirements set out in both the Digital Assets Law and the DFSA Rulebook, including the AML/CFT module.

To be authorised as a VASP, the entity must have a physical place of business within the DIFC, with key management personnel based in the jurisdiction. The core operational functions, such as compliance, risk management, and finance, should be conducted from this location. Also, the VASP must ensure governance arrangements, with clear policies to prevent conflicts of interest in providing Digital Asset services. This includes having independent compliance and risk management functions. Additionally, the entity must demonstrate that it has sufficient financial resources to conduct the proposed Digital Asset business. This includes meeting specific capital requirements, which are calibrated based on the risk profile of the Digital Asset activities being undertaken.

Furthermore, the VASP must have adequate human resources with relevant qualifications and experience in the Digital Asset industry. This includes employing personnel who are knowledgeable in technology, financial services, and regulatory compliance. Also. the VASP must establish systems and controls that are appropriate for the scale, nature, and complexity of its Digital Asset activities. This includes advanced technological infrastructure for managing Digital Assets securely, monitoring transactions, and preventing unauthorised access.

Moreover, the applicant must submit a clear business model that outlines how Digital Assets will be generated, issued, traded, or redeemed. Additionally, the VASP must have well-documented policies and procedures in place for the management of these processes.

The new regulatory framework imposes stringent AML/CFT requirements. VASPs must implement comprehensive AML/CFT policies, including customer due diligence (CDD), transaction monitoring, and suspicious activity reporting. The DFSA requires VASPs to appoint a dedicated AML/CFT officer who is qualified and experienced in handling Digital Asset transactions.

Also, Licensed VASPs are required to comply with ongoing reporting obligations to the DFSA. This includes regular financial reporting, disclosure of any material changes in business operations, and immediate reporting of any security breaches or incidents that could impact clients or the market. Additionally, the DFSA may impose additional requirements on VASPs engaged in high-risk activities, such as operating trading platforms, custody services, or dealing with high-risk Digital Assets like algorithmic or privacy tokens. These may include enhanced due diligence, increased capital requirements, or additional regulatory oversight.

Moreover, VASPs must comply with the entire DFSA Rulebook, including the AML, Conduct of Business (COB), and Prudential – Investment, Insurance Intermediation, and Banking Business (PIB) modules, as applicable. The DFSA may also reference other regulatory instruments, such as the Markets Law and the Data Protection Law, to ensure comprehensive compliance across all aspects of Digital Asset operations.

The DFSA reserves the right to impose additional conditions or requirements on a case-by-case basis, depending on the nature and complexity of the Digital Asset activities proposed. This may include specific restrictions on certain activities, additional reporting requirements, or enhanced regulatory scrutiny.

What are the main ongoing requirements for VASPs regulated in the Dubai International Financial Centre (DIFC)?

Virtual asset providers regulated in DIFC must comply with several ongoing requirements, as per the Digital Assets Law and the DIFC Rulebook’s General Module (GEN). The main ongoing requirements for VASPs regulated in DIFC as per the Rulebook are as follows:

1. Continuous Compliance: VASPs must continuously comply with the regulatory requirements of the GEN, including all applicable rules and standards, as well as all relevant local and international regulations.
2. Risk Management Systems: VASPs must establish and implement extensive risk management systems that are appropriate for the nature, scale, and complexity of their virtual asset services. These systems must be reviewed and tested regularly to ensure they are effective and adequate.
3. AML/CTF Obligations: VASPs must have effective anti-money laundering (AML) and counter-terrorist financing (CTF) policies, systems, and procedures in place to prevent their services from being used for money laundering or terrorist financing activities.
4. Client Asset Protection: VASPs must take appropriate steps to safeguard client assets held by the provider, and to ensure that these assets are not used for unauthorised purposes or subject to undue risk.
5. Customer Disclosures: VASPs must make appropriate disclosures to their customers regarding the nature, risks, and costs of their virtual asset services, as well as any limitations or conditions that apply to these services.
6. Reporting Obligations: VASPs must maintain appropriate records and reporting systems that enable them to report to the DFSA on a regular basis, as well as in response to any specific requests or requirements.
7. Notification Obligations: VASPs must notify the DFSA promptly of any material changes that occur in their operations or circumstances that could affect their regulatory status or compliance with the requirements of the GEN.
8. Cybersecurity Obligations: VASPs must establish and maintain extensive cybersecurity systems, policies, and procedures to protect their systems and data from unauthorised access or use, and to ensure the confidentiality, integrity, and availability of these assets.

The new Digital Assets Law (DIFC Law No. 2 of 2024) introduces several additional ongoing requirements, that are not explicitly covered in the General Module (GEN) of the DFSA Rulebook. These additional requirements include:

1. Enhanced Governance and Oversight: The law mandates the establishment of specialised governance structures specifically for managing Digital Asset risks. This includes appointing compliance and risk officers with expertise in digital assets and forming independent audit committees to oversee the compliance and integrity of Digital Asset activities.
2. Digital Asset-Specific Risk Management: Beyond the general risk management obligations in the GEN, the new law requires VASPs to implement risk management strategies that specifically address the unique risks associated with Digital Assets. This includes handling issues like market volatility, the security of digital wallets, and technological risks linked to blockchain networks.
3. Advanced AML/CFT Measures: The Digital Assets Law introduces advanced AML/CFT obligations tailored to Digital Asset activities. VASPs must use blockchain analytics tools to monitor and trace transactions, especially those involving high-risk assets like privacy tokens. Enhanced due diligence is required for customers engaging in high-risk transactions.
4. Smart Contract Compliance: VASPs involved in the creation or deployment of smart contracts must ensure that these contracts are secure and compliant with the law. This involves conducting thorough audits of the smart contract code to identify and mitigate vulnerabilities, which is not a requirement under the general GEN provisions.
5. Detailed Cybersecurity Obligations: While the GEN requires basic cybersecurity measures, the new law outlines specific requirements for securing digital wallets, private keys, and distributed ledger systems. VASPs must conduct regular cybersecurity audits, implement multi-layered security controls, and establish comprehensive data protection mechanisms to safeguard digital assets from advanced cyber threats.
6. Obligations Related to System Integrity: The law requires VASPs to maintain the integrity and reliability of their technology systems. This includes regular system testing, implementing backup and disaster recovery plans, and ensuring that their systems are capable of handling operational disruptions without compromising the security of digital assets.
7. Consumer Protection and Transparency: VASPs must provide transparent and comprehensive information to consumers about the nature of Digital Asset services, associated risks, and the legal status of Digital Assets across different jurisdictions. This level of consumer protection goes beyond the general disclosure requirements in the GEN module.

4. Regulation of other crypto-related activities in the Dubai International Financial Centre (DIFC)