Virtual Assets and Financial Crimes: An Understanding of the Legal Landscape in the UAE

In the recent years, the United Arab Emirates (UAE) has witnessed a number of key developments in the area of Virtual Assets (VA) and blockchain technology. These developments include the adoption of new laws, regulations and policies to regulate VA market and foster the increasing interest in the UAE developing crypto hubs. VA is not an “emerging” concept in the global economy anymore, and it is here to stay. Virtual assets have many benefits: they are used for trading, payments and they offer a great alternative to those without access to regular financial means. Given the VA inherent decentralized nature, they can serve as a fertile ground for criminal activities, if left without proper regulations and supervision.

The Financial Action Task Force (FATF), to which the UAE is a member through the Gulf Cooperation Council (“GCC”), defines a virtual asset as “a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes.” This broad definition includes cryptocurrencies (Bitcoin, Ether, Dodge, Litecoin… etc.), Stablecoins (depending on its exact nature), tokens and Non-fungible Tokens (“NFTs”) when used as a mode of payment or investment. It is also critical to note that digital representations of Central Bank digital currencies (“fiat currency”), shares, securities, NFTs when used as collectibles, PayPal or any such financial asset are not considered VA. These are merely digital assets: a larger umbrella that encompasses VA and non-VA.

Blockchain technology, on the other hand, offers the technical solutions that enable VA (and other digital assets) to operate. A blockchain is designed for the secure recording of information on a peer-to-peer network. It is a shared and decentralized public ledger, duplicated across multiple computers, in which data of any kind can be added but existing data cannot be altered. These data become permanently embedded in a digital code, and therefore, becomes permanent and verifiable.

UAE Regulations of VA and AML/CFT Compliance

A good place to navigate the UAE VA landscape is the Emirates Blockchain Strategy 2021 announced in 2018. The strategy, then, aimed to transform 50% of government transactions into the blockchain platform by 2021, saving AED 11 billion in transactions, 398 million annually printed documents and 77 million annual work hours.

The Central Bank of the UAE (CBUAE) and the Securities and Commodities Authority (SCA) are the main two federal authorities, which regulate financial and capital markets (“Onshore”). The two free zones, Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) have their own financial regulators (“Offshore”). The regulator of DIFC is the Dubai Financial Services Authority (DFSA), whereas the regulator of ADGM is the Financial Services Regulatory Authority (FSRA).

ONSHORE – UAE MAINLAND

A. CBUAE

Central Bank Circular No. 6/2020 on Stored Value Facilities (SVF) Regulation regulates SVF in onshore UAE. SVF is defined as non-cash facility used for the payment of a sum of money, including values, reward points, crypto-assets or virtual assets in exchange for the same or as a means for payment for goods and services. The SVF requires that holders of SVF licences (“Licensees”) set up a proper system to mitigate potential money laundering and terrorist financing risks. It also requires that Licensees comply with existing obligations and regulatory requirements for Anti-Money Laundering and Combating the Financing of Terrorism and financing of illegal organizations (“AML/CFT”).

In a subsequent publication on 06 December 2020, the CBUAE, clarified that it was not accepting (or acknowledging) crypto-assets or virtual assets as a legal tender in the UAE, reiterating that the only legal tender in the UAE is the UAE dirham.

On 06 June 2021, CBUAE issued Circular No. 15/2021 on the Retail Payment Services and Card Schemes (RPSCS) Regulation defining the regulatory treatment of crypto-assets. While this circular does not apply to, inter alia, transactions involving commodity or security tokens or transactions involving virtual asset transactions, it applies to issuing, buying, selling and facilitating the exchange of a Payment Token (“Payment Token Services”). A Payment Token is defined as a “type of Crypto-Asset that is backed by one or more Fiat Currencies, can be digitally traded and functions as (i) a medium of exchange; and/or (ii) a unit of account; and/or (iii) a store of value, but does not have legal tender status in any jurisdiction.”

The RPSC obliges those licenced to provide retail payment services (“Payment Service Providers”) to comply with the relevant UAE AML laws and regulations. It also considers Payment Token Services to carry high AML/CFT risk due to their speed, anonymity and cross-border nature, and calls upon Payment Service Providers of Payment Token Services to undertake risk assessment and appropriate measures to manage and mitigate such risks, according to the FATF for a Risk-based Approach to Virtual Assets and Virtual Assets Service Providers.

B. SCA

SCA Decision No. 23/Chairman of 2020 concerning Crypto Assets Activities Regulation (CAAR)¹, aims at regulating the offering, issuing, listing and trading of “Crypto Assets” and other related financial activities in the UAE. By and large, CAAR applies to anyone who issues, offers or promote crypto assets across the UAE and regulates the licensing of crypto markets, crowd funding platforms and all activities related to crypto assets. CAAR also provides AML/CFT requirements for reporting entities, including to put a system of compliance in place, KYC policies and procedures, AML monitoring mechanism, ensure that transactions are made on designated bank accounts by licenced institutions, and to ensure the traceability of crypto assets.

In a statement issued on 08 March 2022, the SCA envisages to issue a regulatory and supervisory framework related to VA issued for investment purposes soon. SCA also confirmed that it is the sole authority in the UAE, except for financial free zones, responsible for licensing, supervising and overseeing the VA activities and services issued for investment purposes (not virtual assets issued for payment purposes). SCA also ensures the Licensees’ compliance with the recommendations and requirements of the FATF and the Federal Decree No. 20 of 2018 on Anti-Money Laundering and Countering the Financing of Terrorism and Illegal Organizations and its amendments and implementing regulations (“AML Law”).

In December 2022, the UAE Government issued Cabinet Resolution No.111 of 2022, effective from 14 January 2023, to regulate VA and Service Providers. The resolution aims to safeguard consumers, fortify the UAE regulatory framework, manage virtual asset activities and related service providers, and guarantee that virtual asset service providers (VASPs) are covered by the UAE AML legislation. The is implemented throughout the UAE, except for the financial free zones, and applies to VA operations requiring licensing, including crypto exchange or brokerage, as well as holding and controlling crypto tokens. The SCA is designated as the administering authority, with the power to monitor and ensure compliance, and protect consumers. VASPs are granted a period of three months to comply from the date of entry into force, and the SCA is expected to publish additional regulations in conjunction with local licensing authorities to provide further clarification on unspecified aspects.

By extending the scope of the VA Resolution to encompass companies in free zones, those overseen by the Virtual Asset Regulatory Authority (VARA) in Dubai are now subject to its provisions.

C. LAW 4/2022 REGULATING VIRTUAL ASSETS IN THE EMIRATE OF DUBAI

On 28 February 2022, Law No. 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai (“Dubai VA Law”) was issued and entered into force. The Law applies to all VA service provided in Dubai, including Special Development Zones and free zones but excluding the DIFC. The Dubai VA Law does two things: it creates a legal framework for regulating the VA industry and establishes the Dubai Virtual Assets Regulatory Authority (VARA) to oversee it. The law adopts the FATF definition of VA, save for minor linguistic modifications, and elaborates on the examples of digital representations. One example is virtual tokens, a digital representation of a set of rights that can be digitally offered and traded through virtual platforms. Other examples are yet to be determined by VARA. According to the law, VARA is the competent entity in Dubai which will be in charge of regulating, supervising, and overseeing VA services. VARA is also set to coordinate with the CBUAE and SCA to organize and set the rules and controls for conducting VA related activities.

OFFSHORE

A. DIFC – DFSA

On 25 October 2021, the DFSA issued a regulatory framework for Investment Tokens, based on Consultation Paper 138, which has come into force on 1 November 2022. Tokens covered by this regulatory framework are those that confer rights and obligations similar to those conferred by a share, debenture, or future contracts or similar in nature to those conferred by investments. On 12 November 2021, the DFSA issued an announcement confirming that the DFSA “does not regulate any other types of cryptocurrencies, crypto assets, virtual assets, or digital assets and that no firms are licensed or supervised by DFSA to provide financial services relating to Crypto Assets in or from the DIFC.” On 8 March 2022, the DFSA released Consultation Paper No. 143, seeking public comments on a proposed regulatory framework for persons wishing to provide Crypto Token activities in DIFC.

B. ADGM – FSRA

ADGM has a more sophisticated system regulating VA. In 2015, the FSRA issued the Financial Services and Markets Regulations 2015 (FSMR) regulating VA. In 2018, FSRA introduced a regulatory framework for operating Crypto Assets business by introducing three appendixes to the FSMR, namely, Conduct of Business Rules, Market Infra Structure Rules, and a Glossary. In 2019, the FSRA introduced further enhancements to the guidance on regulation of crypto assets activities. These enhancements covered the acceptance of Stablecoins backed by fiat currency, clarity on crypto asset custody activities, and updates on AML regulations. In 2020, the FSRA introduced a regulatory framework changing, inter alia, the terminology of “Crypto Assets” to VA, to align with FATF terminology.

On 21 March 2022, the ADGM issued Consultation Paper No. 1 of 2022, seeking proposals to enhance capital markets and VA in ADGM. Very recently, in September 2022, issued the Guiding Principles for the Financial Services Regulatory Authority’s Approach to Virtual Asset Regulation and Supervision. These principles (1) introduces a transparent risk-based regulatory framework; (2) set high standards for authorization; (3) aims to prevent money laundry and other financial crimes; (4) confirms a risk-sensitive supervision; (5) ensures commitment to enforce regulatory breaches; (6) and emphasizes international cooperation.

FINANCIAL CRIMES

Most, if not all of the regulations listed above emphasize compliance with the AML/CFT laws and regulations. Although there are plethora of laws and regulations on VA onshore and offshore, the UAE federal criminal laws, including the AML Law, apply to all Emirates as well as to the DIFC and ADGM. The AML Law specifically addresses money laundering in relation to VA and digital currency. A great emphasis is also put on adhering to FATF’s International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation.

If you are operating or engaging in VA activities and would like to ensure adherence to licensing requirements or mitigate risks related to AML/CFT, please feel free to reach out to us.

1. CAAR defines Crypto Asset as a “record within an electronic network or distribution database functioning as a medium for exchange, storage of value, unit of account, representation of ownership, economic rights, or right of access or utility of any kind, when capable of being transferred electronically from one holder to another through the operation of computer software or an algorithm governing its use.”