VARA Isn’t a Silver Bullet: Dubai’s Crypto Payments Still Depend on the Central Bank
Author: Shao Jiadian, Manqun Blockchain Legal Services
Imagine a scenario: An Asian merchant has set up a sales company in mainland Dubai and hopes to receive payments in dirhams. The local buyer holds USDT, and an Asian payment institution plans to receive this crypto on the checkout page, convert it to dirhams, and then remit the payment to the merchant. If this institution only holds a Transfer and Settlement license from the Dubai Virtual Assets Regulatory Authority (VARA), can it legally operate this business model?
Implementing crypto payments in Dubai may be more complex than anticipated. While the buyer only clicks pay once on the checkout page, the backend must accept the crypto, convert it, and settle fiat currency with the merchant. If the platform intends to handle these steps itself, a single VARA license may not suffice. This article follows the trail of this payment to examine how far VARA licensing extends, and under what circumstances a license or registration from the UAE Central Bank would also be required.
When Is a VARA License Enough?
Transferring BTC on behalf of investment clients and accepting USDT at a product checkout page may both involve on-chain transfers. To determine whether a VARA license is sufficient, it is first necessary to distinguish whether the platform is transferring investment assets or processing a commercial payment.
In mainland Dubai and the free zones under VARA's jurisdiction, if an entity only engages in the investment, trading, and related custody and transfer of non-payment tokens such as BTC and ETH, without involving product payments, crypto-to-fiat conversions, remittances, or other financial services regulated by the central bank, these activities themselves do not require separate central bank payment licenses or registrations.
Trading, custody, and transfer each have their corresponding VARA licensing scopes, and must be provided by entities authorized to conduct those specific activities.
The new Central Bank Law effective September 16, 2025, also distinguishes between investment and payments. Article 61 lists the provision of payment services using virtual assets as financial activities subject to central bank licensing and regulation. Article 187 excludes virtual assets used for investment, peer-to-peer conversion, or transactional swaps from the scope of this Central Bank Law, meaning related businesses remain governed by other applicable rules.
This article stipulates that when paying with virtual assets or converting them into currency, the rules issued by the central bank regarding the relevant activities shall apply. If the platform operates the conversion of payment tokens like USDT, it must also comply with the provisions of the Central Bank's Payment Token Services Regulations.
Specifically, the VARA Transfer and Settlement license held by this institution covers the service of transferring virtual assets between wallets, addresses, or different entities. VARA rules effective since June 19, 2025, require licensed entities to also comply with applicable central bank payment and remittance regulations. Cross-border transfers and settlements must be able to be legally executed and completed across all jurisdictions involved in the transaction.
Figure: Comparison of Business Boundaries Between the VARA and UAE Central Bank Regulatory Frameworks
Can This Order Proceed If the Buyer Pays in USDT and the Merchant Receives Dirhams?
If the buyer sends USDT directly to the mainland Dubai sales company to pay for standard goods, this route is not viable. According to Article 2(7) of the Central Bank's Payment Token Services Regulations, local merchants wishing to collect payments for ordinary goods or services using tokens can only accept dirham payment tokens issued by a central bank-licensed issuer. Foreign-currency payment tokens issued by registered entities can, under this provision, only be used to purchase virtual assets or their derivatives.
Dubai stores have already tested accepting dirham payment tokens. In September 2026, Network International piloted DDSC at the Marks & Spencer store at Dubai Festival City. Buyers scan the cash register QR code with a wallet that supports DDSC, and merchants can choose to have DDSC credited to their wallet or settle in dirhams.
The pilot utilized a dirham payment token issued by a central bank-licensed issuer.
What if the buyer pays in USDT, which the payment institution converts to dirhams before passing to the merchant? If the platform, while providing services regulated under the Payment Token Services Regulations, knows that the buyer is using USDT to pay for ordinary goods, Article 2(4) prohibits licensed or registered entities from processing this transfer while providing payment token services. The fact that the merchant ultimately receives dirhams does not change the intended use of this USDT transfer.
If the buyer separately exchanges via compliant channels and then uses their own disposable fiat currency to pay for the goods, the exchange and payment must be processed according to their respective rules. Whether these two activities are independent in practice depends on who controls the proceeds of the exchange and when the payment for the goods is cleared.
There are also products on the market where payments are confirmed on a crypto asset platform and merchants settle in dirhams. In August 2026, Dubai Duty Free launched Crypto.com Pay across its physical stores and official website. Eligible UAE residents can authorize checkout using their Crypto.com account, and the duty-free store receives dirhams.
Foris DAX Middle East FZE, which provides this service, holds a VARA Virtual Asset Service license and a Stored Value Facility (SVF) license from the UAE Central Bank. Crypto.com explicitly states on its UAE website that Crypto.com Pay is provided under an SVF license.
In both arrangements, merchants receive dirhams. The DDSC pilot disclosed the token used by buyers. The duty-free store's launch announcement did not specify which coin was actually deducted per transaction, at what stage conversion occurs, nor did it publicly disclose the complete fund flow. Other payment institutions looking to develop similar products will still need to examine who processes the tokens on behalf of the buyer, who completes the payment, and what services each party is authorized to provide.
If the merchant sells goods directly through an Asian company and the payment is ultimately remitted to Asia, the payment institution must still assess where it is located and to whom it provides services. Article 2(1) of the Regulations covers both payment token services provided within the UAE and those provided to local persons. Even if the merchant is based overseas, as long as the platform operates such services in mainland Dubai or a VARA-regulated free zone, it must be evaluated under these rules.
The UAE territory referred to in Article 2 of the Regulations does not include financial free zones such as the Dubai International Financial Centre (DIFC). VARA's jurisdiction also excludes DIFC, where the operation of financial services is governed by the local regulatory framework administered by the DFSA.
If the Platform Accepts and Converts Tokens Itself, What Must It Apply for from the Central Bank?
If the platform intends to accept or convert tokens itself, it must first confirm whether the tokens in question qualify as payment tokens under the central bank's definition. The Payment Token Services Regulations came into effect on August 31, 2024. These tokens primarily refer to virtual assets denominated in fiat currency and claiming to maintain their value by referencing that fiat currency or another payment token of the same currency; USD stablecoins like USDT and USDC fall squarely within this scope.
Even if the platform has not yet integrated with merchant orders, if the services it provides fall within the scope of the Regulations and no applicable exclusions or exemptions exist, it must obtain the corresponding central bank authorization.
First, consider how the platform accepts tokens. If the platform professionally safeguards payment tokens on behalf of clients or private keys used to hold, deposit, and transfer such tokens, or receives, holds, and transfers payment tokens on behalf of clients, it involves payment token custody and transfer. Operating this business independently requires, in principle, a Central Bank Payment Token Custodian and Transferor (Payment Token Custodian and Transferor) license.
If an institution has already obtained virtual asset custody authorization from the Capital Markets Authority (CMA, formerly SCA) or the relevant local licensing authority, it may apply for a No Objection Registration for foreign-currency payment token custody and transfer under Article 8(3). A standalone VARA Transfer and Settlement license cannot be used as proof of custody qualification. Even if registration conditions are met, central bank approval is still required.
Next, consider who handles the conversion. If the platform commercially buys and sells spot payment tokens, or allows counterparties to post and accept selling offers, it constitutes conversion as defined in the Regulations. Operating this business independently requires a Central Bank Payment Token Conversion (Payment Token Conversion) license, or obtaining a No Objection Registration through the applicable channel.
The registration channel under Article 8(1) targets operators of virtual asset trading platforms that meet the definitions in the Regulations. The central bank will verify their platform operational qualifications and regulatory jurisdiction; only after approval can they conduct conversions within the scope of the registration. Holding only a VARA Transfer and Settlement license does not entitle an entity to apply for this registration.
The exclusions under the Payment Token Services Regulations target specific activities. If a business is already licensed, or should inherently be licensed, under retail payment or stored value facility rules, the corresponding rules apply. Article 39 of the Regulations contains further transitional provisions: upon expiration of the transition period, licenses issued under old rules will no longer cover related virtual asset businesses. When a product simultaneously involves storing value, conversion, and transfer, the applicable rules and authorized scopes must be checked item by item.
To apply for the aforementioned two central bank licenses, the applicant must be a company established in the UAE, excluding financial free zones (Article 6). If planning to allow the same company to concurrently operate other businesses, restrictions on business scope under Article 17 of the Regulations must also be verified.
How Are Payments Deposited Into the Merchant's Account?
Whether payments are ultimately credited in dirhams depends on who handles fiat collection and settlement. If the payment institution itself provides fiat acquiring, payment aggregation, payment accounts, or funds transfer services to merchants, it must hold a central bank license or other statutory authorization for that activity, as VARA licenses do not cover these services. If the payment is also to be remitted to Asia, the corresponding cross-border fund transfer must also fall within the authorized scope of the actual service provider.
Merchants can directly contract with qualified banks or payment institutions, allowing them to handle funds and manage settlement. If the Asian payment institution only conducts its authorized activities and does not actually provide or facilitate the regulated service, it is not required to obtain the same qualification for services directly provided by partners. Token conversion, custody, and transfer can also be directly provided by institutions holding the corresponding qualifications.
If token conversion is intrinsically part of the VARA Transfer and Settlement service, it must still utilize institutions licensed for VARA Exchange Services. Institutions selected outside the Emirate of Dubai require VARA approval. The institution handling the transfer and settlement remains responsible to the client for executing the service.
If the Asian payment institution signs the merchant's collection contract, aggregates and forwards the payment, and handles refunds, while the bank merely opens an account for it and executes the transfer, the collection service is still being performed by the Asian payment institution itself, which therefore requires the appropriate qualification. When discussing division of labor, review the actual workflow: Who does the merchant sign with? Who controls the wallets and accounts? Who receives payment instructions? Who handles the inquiry if funds fail to arrive?
An alternative division of labor involves providing only APIs or wallet software, with assets controlled by the client or a licensed institution. Technical teams meeting applicable exclusion criteria are exempt from obtaining separate licenses for the supported payment services. Even if the team does not handle funds, it must still be assessed under relevant rules when actually providing regulated services such as payment initiation. The newly enacted Central Bank Law Article 62 similarly applies to the direct or indirect operation, provision, or facilitation of regulated financial services through smart contracts.
What Should the Dubai Company Prioritize?
If the initial Asian payment institution modifies the checkout page to allow buyers to pay directly with fiat currency, early merchants can contract with qualified partners, who will handle collection and settlement directly, leaving the Dubai company to manage product integration initially. Once operations stabilize, the institution can reassess whether to handle settlement internally.
If the plan is for the Dubai company to aggregate payments and handle forwarding and refunds, it must verify and obtain the required qualifications before switching over, while simultaneously adjusting merchant contracts and fund workflows.