SCA and VARA Create a Unified UAE VASP Register
The UAE has taken a concrete step toward closing the regulatory gaps in its virtual asset sector. The Securities and Commodities Authority (SCA) and the Dubai Virtual Assets Regulatory Authority (VARA) have agreed to share licensing data and operate a single, unified register of all regulated virtual asset service providers (VASPs) active in the country. For accounting firms, auditors, and CFOs with UAE-facing digital asset exposure, this shift changes the counterparty due diligence calculus overnight.
What the SCA and VARA Have Actually Agreed
The SCA confirmed it has already received licensing requests and inquiries from companies intending to offer virtual asset services following the issuance of the relevant regulations. The authority's board of directors, chaired by Muhammad Ali Al-Shorafa, has issued decisions requiring all companies that provide virtual asset services and are based in the UAE to obtain an SCA licence. The only carve-out is for firms operating inside a recognised financial free zone, such as the Abu Dhabi Global Market or the Dubai International Financial Centre, which carry their own regulatory frameworks.
How the two regulators divide the landscape
The jurisdictional split is straightforward on paper. Any company providing virtual asset services from mainland UAE must be licenced by the SCA. Any company operating in Dubai specifically must obtain its licence from VARA. VARA then informs the SCA of every licence it grants, and the SCA consolidates all of that data into one national register. The result is a single source of truth covering the entire country.
Cabinet Resolution No. 111 of 2022, which governs the regulation of virtual assets and their service providers, is the legal foundation for the SCA's authority to issue these regulatory decisions and to licence service providers across the mainland. That resolution is what empowers the SCA to act now, rather than wait for further legislative changes.
The Enforcement Timeline and Penalty Structure
The SCA has not set a distant deadline. The authority called on all companies currently providing virtual asset services without the required approval to submit a licensing request immediately. It described the enforcement phase as beginning "in the next stage," signalling that the window for voluntary compliance is short.
Penalties firms and their clients should understand
The SCA set out three escalating enforcement tools for unlicensed operators:
- A formal warning
- A fine of up to AED 10 million
- Referral to the Public Prosecution
These are not alternative tracks: the SCA stated that one or more measures may be applied simultaneously. That last point matters. Referral to the Public Prosecution means potential criminal exposure, not just an administrative fine. For any firm that has a VASP as an audit client, a treasury counterparty, or a platform through which it settles digital asset transactions, that criminal risk sits in the supply chain.
The authority also addressed investors directly, urging them to deal only with firms that hold the necessary licences and approvals before transacting. That investor-facing language signals that the regulator intends to make the unified register publicly accessible, so that any market participant can verify status before engaging a VASP.
Why a Unified Register Changes Counterparty Due Diligence
Until this announcement, the UAE's virtual asset regulatory architecture was fragmented in practice. VARA licenced firms operating in Dubai, the SCA oversaw mainland entities, and the free zone regulators handled their own perimeters. A compliance professional trying to verify a counterparty's standing had to check multiple sources and could not be certain that any single list was complete or current.
The compliance gap the register is designed to close
A unified register eliminates that ambiguity. Once operational, the register will reflect every licenced VASP in the UAE, regardless of whether the licence was issued by VARA or the SCA. For a compliance team running crypto compliance reporting, this is significant: a single authoritative check replaces a multi-step verification process.
For firms that use crypto accounting software to track digital asset transactions, the register also provides a formal mechanism for classifying counterparty regulatory status. Transactions with an unlicenced entity are a different risk category from those with a registered VASP, and that distinction has accounting, tax, and AML implications that need to be reflected in the ledger and the client file.
Linking to the VASP onboarding framework
The mechanics of verifying VASP status at onboarding, and maintaining that verification on an ongoing basis, are covered in depth in our piece on building a VASP due diligence onboarding framework. The SCA's unified register will need to be embedded into that process as a standard check for any UAE-connected relationship.
Accounting and Tax Implications for UAE-Connected Practices
The regulatory announcement carries consequences that extend well beyond the compliance team. Accounting firms and CFOs managing UAE-based or UAE-facing digital asset positions should work through the following angles.
Audit and financial reporting considerations
An audit client that operates as a VASP without a valid SCA or VARA licence is, by definition, operating illegally under UAE law. That status triggers a going concern assessment. The fine ceiling of AED 10 million and the possibility of criminal referral are material contingent liabilities that must be considered under IAS 37 (or the equivalent standard). Auditors of any UAE VASP client should confirm licence status as part of the engagement acceptance and continuance process, not as an optional step.
For entities that hold virtual assets on their balance sheet and transact through UAE-based exchanges or custodians, the exchange's regulatory standing now affects the reliability of the price data and the custody arrangements underpinning those asset valuations. An unlicenced custodian is a counterparty risk that the financial statements should reflect.
Tax and substance considerations
The UAE introduced corporate tax at a nine percent rate for financial years starting on or after 1 June 2023. Virtual asset businesses operating on the mainland are subject to that tax unless they qualify for a specific exemption. An unlicenced VASP operating in the UAE may also be at risk of losing any free zone benefits it believed it held, since those benefits typically require compliance with all applicable regulations. A tax adviser reviewing a client's UAE substance and benefit positions should treat the licensing requirement as a threshold condition, not an administrative footnote.
AML and transaction monitoring
The FATF Travel Rule and the UAE's own AML framework require financial institutions to conduct enhanced due diligence when transacting with VASPs. The SCA's move to publish a unified register gives compliance teams a clear, regulator-backed reference point for determining whether a counterparty VASP is covered by the Travel Rule obligations and whether it has passed the minimum regulatory bar. Transactions routed through unregistered entities carry a higher suspicious transaction reporting risk and may need to be treated as higher-risk under the firm's AML policy.
The parallels with what is happening in Europe are instructive. Our analysis of EU VASPs after MiCA shows how licensing gaps create residual AML exposure even in markets that believe they are well-regulated. The UAE's unified register is a direct response to the same concern in a different geography.
Practical Steps for Accounting Firms and CFOs
The SCA's call for immediate action is not ambiguous. Here is a prioritised checklist for firms with UAE digital asset exposure.
Immediate actions, in order of urgency
- Map all UAE VASP relationships. List every exchange, custodian, broker, and payment processor in the UAE that the firm or any of its clients uses. Include entities that may have a Dubai address but operate on the mainland, since jurisdiction determines which regulator applies.
- Verify current licence status. Check each entity against VARA's published register and the SCA's equivalent list. Document the check and date-stamp it. Repeat this process each time a new UAE VASP relationship is onboarded.
- Assess audit client exposure. For VASP audit clients, confirm they have filed for or already hold the applicable licence. Update the risk assessment and, if necessary, the engagement letter to reflect the regulatory timeline.
- Update AML policies. Insert the unified register check as a mandatory step in the VASP onboarding and periodic review workflow. Flag any counterparty that cannot demonstrate SCA or VARA authorisation as high-risk pending resolution.
- Review contingent liability disclosures. For clients who may not yet be licenced, quantify the potential fine exposure and assess whether a provision or disclosure under IAS 37 is required in the next reporting period.
- Integrate into digital asset accounting software workflows. If the firm uses digital asset accounting software or crypto bookkeeping software to record virtual asset transactions, tag each counterparty with its regulatory status so that reporting can filter by licenced versus unlicenced exposure. This supports both internal risk management and regulator-ready audit trails.
The Broader UAE Virtual Asset Strategy
The SCA framed this initiative explicitly within the UAE's broader ambition to position its financial markets among the best globally. The virtual asset sector is described as one of the pillars of sustainable growth in the SCA's own strategy, which means the regulator is not treating VASP licensing as a one-time cleanup exercise. The unified register is a foundation for ongoing market oversight, not a temporary measure.
That strategic framing matters for firms advising clients on UAE market entry or expansion. Regulatory compliance is not a cost of doing business in the UAE virtual asset sector; it is a prerequisite for doing business at all. The SCA's enforcement language, combined with the criminal referral option, signals that the era of operating in a grey zone while awaiting regulatory clarity is over in this jurisdiction.
Source: VARA Dubai
Frequently Asked Questions
Which companies must register with the SCA?
All companies providing virtual asset services that are based in mainland UAE must obtain an SCA licence. Companies licensed inside a recognised financial free zone are exempt from this requirement but remain subject to their own free zone regulator.
Do Dubai-based VASPs need both a VARA licence and an SCA licence?
No. Companies operating in Dubai must obtain a licence from VARA only. VARA then notifies the SCA, and the SCA incorporates that data into the unified national register. There is no double-registration requirement for Dubai-based entities.
What are the penalties for operating without a licence?
The SCA can issue a formal warning, impose a fine of up to AED 10 million, or refer the matter to the Public Prosecution for criminal proceedings. The authority stated that more than one of these measures may be applied at the same time.
How should auditors treat an unlicenced VASP audit client?
An unlicenced status constitutes an ongoing regulatory breach that is material to the going concern assessment. Auditors should also consider whether the potential fine and criminal referral represent contingent liabilities requiring disclosure or provision under IAS 37. Licence status should be confirmed at engagement acceptance and reviewed at each subsequent stage of the audit.
How does the unified register affect AML transaction monitoring?
The register provides a regulator-backed reference point for verifying whether a VASP counterparty meets the minimum regulatory standard. Transactions with an unlicenced entity carry heightened suspicious transaction reporting risk and should be treated as high-risk under any AML policy aligned with FATF standards and UAE AML law.