1. What is the current legal landscape for your practice area in your jurisdiction?

The United Arab Emirates supports blockchain adoption through regulated market access, dedicated financial services frameworks and legal structures for digital assets. For businesses, the central question is which regime covers their product, customers and operating model. Incorporation alone does not authorise a company to provide virtual asset services, and the UAE does not have a single licence covering every activity and location.

A choice of regulatory regimes

At the federal level, the Capital Market Authority (CMA), formerly the Securities and Commodities Authority, supervises virtual asset activities within its remit outside the financial free zones. Its 2026 framework covers eight activities, including dealing, custody, arranging, advice, portfolio management and operating a multilateral trading facility. Separate requirements address conduct, prudential resources and financial crime controls.

In Dubai, including its non-financial free zones, the Virtual Assets Regulatory Authority (VARA) regulates virtual asset activities under Dubai Law No. 4 of 2022, the 2023 Regulations and associated rulebooks. Its remit excludes the Dubai International Financial Centre (DIFC). Coordination arrangements allow VARA licensees to register with the federal regulator to serve the wider UAE, subject to the applicable scope. This does not create automatic access to the financial free zones or permission to undertake Central Bank-regulated activities.

Abu Dhabi Global Market (ADGM) and DIFC have separate financial services regimes, supervised by the Financial Services Regulatory Authority (FSRA) and the Dubai Financial Services Authority (DFSA), respectively. Both accommodate digital asset businesses within frameworks addressing authorisation, custody, governance and investor protection. ADGM also has a dedicated framework for regulated activities involving accepted fiat-referenced tokens.

The asset and its use determine the rules

Tokenised shares, bonds and fund units remain subject to the relevant financial instrument rules. A token described as a utility token or NFT requires analysis of its actual rights and functions. Likewise, describing a service as decentralised does not resolve whether its operators conduct regulated activities.

Payment tokens require separate consideration under the Central Bank of the UAE’s 2024 Payment Token Services Regulation. Within that regime, foreign payment tokens are not generally available for ordinary merchant payments: their permitted use as a means of payment is restricted to purchases of virtual assets or their derivatives, subject to registration requirements.

2. What three essential pieces of advice would you give to clients involved in your practice area matters?

First, choose the right jurisdiction for your project, not the popular one

The UAE offers several routes for digital asset businesses, and the choice should extend beyond virtual asset licensing. Corporate law, fundraising plans, target markets and operating costs can be equally important.

For a business focused primarily on serving UAE customers, the federal or Dubai VARA framework may be a suitable starting point. Where the founders also anticipate external investment, more complex shareholder arrangements or an international group structure, ADGM and DIFC deserve particular consideration. Their common law frameworks provide familiar tools for structuring ownership, governance and investor rights. ADGM applies English common law directly, while DIFC has its own laws based on common law principles.

These advantages must be weighed against establishment and ongoing costs, which can be higher in ADGM and DIFC depending on the structure and activities. The investment vehicle and regulated operating business may also have different requirements and need not necessarily be established in the same jurisdiction. The objective is to choose a structure that supports the business commercially and legally, with a clear allocation of functions between entities.

Second, test whether the proposed model can operate commercially

In the UAE, regulatory authorisation and access to banking and other essential services are separate processes. A licence does not guarantee a bank account, payment services or acceptance by a particular custodian. Businesses should engage with essential counterparties early and prepare a consistent explanation of their ownership structure, source of funds, customer base and expected transaction flows. The willingness of those counterparties to support the proposed structure can also influence where the business should incorporate and which regulatory regime it should choose.

This is particularly important for businesses combining digital assets and fiat payments. The proposed payment arrangements must be checked separately against the applicable Central Bank requirements; a virtual asset licence should not be assumed to cover every payment function.

Financial planning should cover the ongoing cost of personnel, local presence, compliance, technology controls, audits and reporting under the chosen regime. These costs should be compared before committing to a jurisdiction, alongside the tax treatment of the intended activities. Incorporation in a UAE free zone does not automatically mean that all income qualifies for a zero corporate tax rate. For an early-stage project, launching with a narrower range of services may be more sustainable than seeking authorisation for every planned activity immediately.

Third, prepare the structure for investment and expansion from the outset

A UAE company may form part of a wider business involving overseas developers, international investors and customers in several markets. Founders should establish which entity owns the software, contracts with customers, holds regulatory permissions and receives revenue. Those arrangements should be reflected in development agreements, intellectual property assignments and contracts between group companies.

Where external investment is planned, the structure should accommodate how investors will enter the business, participate in key decisions and eventually exit. The choice of entity and jurisdiction affects the ability to issue different classes of shares, agree investor protections and implement future funding rounds. Addressing these points early can reduce the need to restructure the business when an investor is ready to proceed.

International expansion should be assessed separately for each target market. Where the proposed activity is regulated, entering a new market will generally require local authorisation unless an exemption or another recognised route applies. A UAE licence does not provide permission to operate worldwide. Before offering services or launching marketing campaigns overseas, businesses should establish which local licensing and promotion rules apply and whether a local entity or presence is required.

3. What are the greatest threats and opportunities in your practice area law in the next 12 months?

Tokenisation, stablecoins and the Digital Dirham are likely to create significant opportunities as the UAE develops the infrastructure for issuing, holding and transferring digital assets. Over the next 12 months, the commercial challenge will be to turn these developments into services that attract users, operate reliably and meet the requirements of the relevant regulators.

Tokenisation

Tokenisation creates opportunities across real estate, shares, bonds, sukuk and investment funds. Beyond fractional ownership, its potential benefits include more efficient issuance, automated distributions, faster settlement and the use of tokenised investments as collateral. These applications create demand for regulated issuers, trading platforms, custodians and technology providers.

Real estate remains a prominent UAE example. In February 2026, the Dubai Land Department announced the second phase of its tokenisation project, introducing resale of approximately 7.8 million property tokens within a controlled pilot framework. This is an important step towards testing secondary-market liquidity, rather than establishing an unrestricted market for tokenised property.

Dubai also has a broader tokenisation framework under VARA’s Virtual Asset Issuance Rulebook. Its asset-referenced virtual asset regime covers tokens linked to underlying assets or income, potentially including real estate, commodities and financial instruments. Issuance falls within Category 1 and requires a VARA licence and prior approval of the relevant white paper. The requirements depend on the structure, including whether the token grants ownership, redemption rights or exposure to an asset’s value. The treatment of the underlying asset must also be assessed; a token referencing shares does not necessarily give its holder direct shareholder rights.

Tokenised shares and other securities are also developing within the financial free zones. The DFSA’s Tokenisation Regulatory Sandbox covers equities, bonds, sukuk and fund units, together with related trading, custody and settlement services. In ADGM, the FSRA’s public list of deemed securities includes several equity-linked tokens classified as structured products, illustrating the distinction between owning a share and holding a token that provides exposure to it.

Institutional participation is giving these developments practical commercial relevance. In April 2026, BlackRock, Standard Chartered and OKX announced a framework enabling eligible clients to use BlackRock’s tokenised BUIDL fund as collateral for trading on OKX Middle East, with an option for custody at Standard Chartered. This demonstrates how tokenised investments can be integrated into institutional trading and collateral management. Such developments suggest opportunities over the next year in fund distribution, custody, settlement and financing, alongside token issuance itself.

Stablecoins and payments

The UAE’s stablecoin market is progressing towards practical payment applications. The Central Bank’s public register lists several licensed dirham payment token issuers. In September 2026, Network International announced a DDSC payment pilot at selected Marks & Spencer and LuLu locations, using existing point-of-sale devices and allowing merchant settlement in either DDSC or UAE dirhams. This provides a concrete example of stablecoin integration into established retail infrastructure.

Industry cooperation is also developing. In July 2026, the Middle East Stablecoin Association (MESA) announced its incorporation in DIFC as a non-profit organisation. Its work focuses on regulatory dialogue, education and best practices, bringing together participants across the stablecoin ecosystem. Such initiatives could help businesses develop partnerships and address shared challenges around interoperability, compliance and practical adoption.

The opportunity extends beyond issuing tokens to wallets, merchant acceptance, conversion, custody and corporate settlement services. Businesses that can integrate these functions with existing banking and payment systems may benefit as adoption develops.

The Digital Dirham

The Digital Dirham is a separate development: it is central bank money rather than a privately issued stablecoin. The Central Bank has tested retail and cross-border applications, and the Ministry of Finance announced the first government financial transaction using Digital Dirham in November 2025 as part of the pilot programme. These milestones demonstrate practical implementation, while remaining distinct from general public availability.

Its planned applications include programmable payments, tourist wallets and settlement for fractional ownership of assets. As implementation progresses, these could create opportunities for banks, payment providers and technology businesses developing customer interfaces and integrating digital currency into commercial transactions.

Key risks

The main threats over the next 12 months are regulatory rather than technological. Federal Decree-Law No. 6 of 2025 on the Central Bank extends licensing requirements to businesses that provide or facilitate licensed financial activities through technology, expressly including decentralised finance platforms and related infrastructure. With the transitional period for existing businesses having ended in September 2026, projects that describe themselves as technology providers should reassess whether their payment, exchange, lending or custody functions require Central Bank authorisation in addition to, or instead of, a virtual asset licence.

Enforcement is also becoming more visible. VARA has publicly penalised firms for operating without a licence and for marketing breaches, and regulators increasingly expect financial crime controls to operate effectively in practice rather than exist only on paper. Unlicensed activity, non-compliant promotions and weak AML/CFT frameworks are likely to remain the principal sources of regulatory exposure. Businesses that cannot demonstrate robust controls may also lose the support of banks and other counterparties, regardless of their licence status.

4. How do you ensure high client satisfaction levels are maintained by your practice?

At White Stone, we combine a detailed understanding of digital asset regulation with close attention to the client’s commercial objectives. We take time to understand how the business operates, which markets it intends to serve and what the founders and investors want to achieve. This allows us to assess legal requirements in the context of the client’s product, resources and plans for growth.

We always present several options and explain their practical implications. Our comparisons cover regulatory permissions, corporate structure, tax considerations, establishment costs and the ongoing expense of operating the business. We identify the trade-offs and recommend a route that fits the client’s priorities, whether those are speed to market, access to investment, operational flexibility or cost.

Our analysis is not confined to the UAE. Where another jurisdiction, or a structure combining UAE and overseas entities, would better serve the client’s interests, we include it in the assessment. The aim is to find a commercially workable structure, taking account of where the business, its customers and its investors are located.

Clear communication is equally important. We agree on the scope, deliverables, timetable and fees at the outset, explain our advice in accessible language and flag changes that could affect the budget or implementation. Clients should understand the options available, the reasons behind our recommendation and the steps needed to put it into practice.

5. What technological advancements are reshaping your practice area law and how can clients benefit from them?

Tokenisation

Tokenisation allows shares, bonds, fund units and interests in other assets to be issued and transferred using blockchain infrastructure. Combined with smart contracts, it can automate distributions, apply transfer restrictions and simplify ownership records. Clients can benefit from more efficient administration and new ways to distribute investments or use assets as collateral.

The legal work must establish how the token connects to the underlying rights. For example, does transferring a token transfer ownership of a share, or does the holder acquire a contractual claim against an intermediary? How are voting rights, distributions and corporate actions handled? Resolving these questions at the design stage helps clients build products whose technical operation matches the rights promised to investors.

Compliance tools

Blockchain analytics, digital identity verification and automated transaction monitoring are changing how digital asset businesses identify and manage financial crime risks. These tools can help trace transaction histories, detect unusual activity, screen wallet exposure and exchange information required under the Travel Rule.

For clients, the benefits include faster onboarding, more targeted investigations and the ability to handle growing transaction volumes without a corresponding increase in manual work. Their effectiveness depends on how they are configured and integrated into the business. A risk score should inform an assessment rather than automatically determine its outcome. Clear escalation procedures, human review and appropriate data protection controls remain essential, particularly where providers process customer information across borders.

DeFi and interoperability

DeFi protocols and technologies connecting different blockchains are expanding the ways businesses can access liquidity, exchange assets and execute transactions. They can support services that combine several protocols or networks within a single customer interface, potentially reducing manual steps and dependence on individual platforms.

For clients, these developments offer greater flexibility in how services are delivered. A business may integrate an existing protocol for exchange or lending or allow customers to move assets between networks without leaving its interface. This can reduce the need to build every function internally and make the product accessible to users across different blockchain ecosystems.

The legal task is to establish what the business itself provides and what it obtains from other participants. The answer depends on how it selects protocols, routes transactions, charges fees and controls access to the service. The question has become more pressing since the Central Bank law of 2025 expressly extended licensing requirements to decentralised finance. Addressing these questions during development helps clients understand which activities require authorisation and explain clearly to customers how the service works, who holds their assets and where responsibility lies.

6. Describe a particularly interesting or complex matter you have advised on recently, and explain the challenges involved, your approach, and the outcome achieved for the client

A recent matter concerned the choice of jurisdiction and structure for a platform intended to combine digital asset exchange, transfers between blockchains and access to fiat services through third-party providers. The project also needed to accommodate venture investment through a simple agreement for future equity (SAFE). The matter illustrates how product design, regulation and corporate structuring need to be considered together.

The challenge

The platform brought several functions into one customer experience, but those functions could attract different regulatory treatment. The key question was how to distinguish the platform’s own services from those provided by external exchanges, payment providers and other infrastructure partners. Describing the business as a technology platform was not sufficient to resolve that question.

The jurisdictional choice also had to reflect the founders’ tax residence and the proposed investment structure. An option that appeared attractive for incorporation could be less suitable once the required permissions, ongoing obligations and future financing were considered. The analysis therefore needed to go beyond a comparison of company formation costs.

Our approach

We compared the regulatory and tax conditions in six jurisdictions, including the UAE, against the proposed business model. The review considered the exchange, cross-chain and fiat components separately, while also examining how they would operate together. This made it possible to identify where the platform’s role and its relationships with third-party providers required particular attention.

The corporate analysis considered the founders’ position and the planned use of a SAFE alongside the operational requirements. This was important because the entity receiving investment, the entity holding the technology and the entity providing services need to fit within a coherent structure. Decisions taken at incorporation can otherwise create difficulties when investors conduct due diligence or the business seeks regulatory authorisation.

The outcome

The immediate outcome was a comparative assessment to support the client’s choice of jurisdiction and the subsequent design of its business structure. It connected the regulatory implications of the product with the tax and investment considerations, giving the client a clearer basis for deciding how to proceed.

Building on that analysis, we prepared the SAFE for the client’s investment round and aligned its terms with the proposed group structure. In particular, we addressed which entity would issue equity on conversion, how the instrument would operate if the structure changed before a priced round, and how the valuation cap, discount and conversion mechanics would interact with future financing. As a result, the client was able to approach investors with documentation consistent with its regulatory and corporate plan, while preserving flexibility for subsequent rounds and the licensing process.