Bots, signals and copy-trading: which licence, if any?

"It is only software." We hear this every week from founders building trading bots, signal communities, copy-trading features and DEX front ends. Sometimes it is true. Often the product does something a regulator recognises as advice, dealing, arranging or portfolio management. The UAE adds four regulators with different perimeters, so a product that is lawful in one free zone can need a licence in the next.

Four questions decide most cases

Every model in this article turns on the same four facts, so answer them for your product before reading the regulator analysis:

1. Who makes the trading decision? The user, a third-party trader the user follows, or your algorithm.
2. Who places the order? The user, or a system you operate, whether through exchange API keys or a delegated wallet.
3. Who controls the assets? If you can move or withdraw user funds, you are dealing with custody, whatever else the product does.
4. How do you get paid? A flat software fee points one way. Per-trade fees, venue rebates, referral commissions and profit shares point the other.

The other variable is geography. VARA regulates virtual asset activity in and from Dubai, excluding the DIFC. The DFSA regulates the DIFC and the FSRA regulates ADGM. On 1 January 2026 the federal Capital Markets Authority (CMA) replaced the Securities and Commodities Authority. It regulates virtual asset activity in the rest of the onshore UAE and remains the securities regulator for the whole onshore UAE, Dubai included. Our CMA perimeter guide and regulator comparison set out that map.

1. Pure software sold to users who trade on their own accounts

Take a bot or trading terminal sold for a fee. The user installs it or connects it to their own exchange account, sets their own parameters and can switch it off at any time. In our view that is not a regulated activity in any of the four regimes: the vendor recommends nothing personal, places no orders, makes no investment decisions and holds no assets. It needs an ordinary trade licence covering software, which our licence finder helps you place.

The analysis changes quickly once the vendor starts doing more of the work:

• Hosted execution. If the bot runs on your servers using API keys the user has handed over, your system is placing orders in the user's account. That is either execution of the user's instructions or management of the user's assets, depending on who sets the strategy.
• Default strategies. If the product ships with your strategies and they run unless the user overrides them, the decision has moved from the user to you.
• Withdrawal permissions. API keys that allow withdrawals, or wallets you can sign from, raise custody questions. Accept trade-only permissions and say so in your terms.
• Profit shares. A fee calculated on the user's trading profit looks like a management fee.
• Performance marketing. Promoting returns to the public brings in the marketing rules, even where the product itself is unregulated.

One rule applies to software as such. VARA's Virtual Assets and Related Activities Regulations treat it as Market Manipulation to distribute or make available any software or algorithm designed to carry out manipulative trading (Regulation VIII.H.1(j)). Volume bots sold to token projects are the obvious target.

2. Signal groups and paid Telegram or Discord channels

Take a paid channel that tells subscribers to buy a token at a stated price, with a stop loss and a target. In Dubai the starting point is VARA's definition of Advisory Services in Schedule 1 to the VARA Regulations. It turns on a personal recommendation, meaning one that takes into account the particular client's knowledge and experience, investment objectives and financial circumstances. A broadcast that every subscriber receives in identical form is not personalised. The better view is that a pure signal channel is not providing Advisory Services.

That does not settle the matter, because three other sets of rules reach the same channel:

• VARA's Marketing Regulations apply to all marketing of virtual assets or VA activities in or targeting the UAE, by anyone, licensed or not. Promoting an exchange through referral links counts as marketing a VA activity. Under Marketing Regulation I.B.3, that may only be done by a VARA-licensed VASP, or on its behalf and with its approval. Marketing of a virtual asset must not include a call to buy (I.C.3.a). Key opinion leaders cannot use the journalistic or educational exemptions (I.D.4).
• VARA's market offences include voicing an opinion on a virtual asset through the media after taking a position in it, then profiting from the effect on the price without properly disclosing the conflict (Regulation VIII.H.1(h)). Channel operators who trade ahead of their own calls fall squarely within this.
• The federal finfluencer regime. The SCA introduced a licence for financial content creators in 2025. The CMA now administers it and publishes a list of authorised finfluencers. A UAE-based channel publishing buy and sell recommendations is the kind of activity the regime was designed for, and Providing Investment Advice is separately one of the CMA's eight virtual asset activities. Which applies turns on what the channel publishes, to whom, and who pays it.

The DIFC is less forgiving. The DFSA defines Advising on Financial Products to include any statement or opinion intended to influence a person to select a particular financial product, and crypto tokens count as financial products for this purpose (GEN Rule 2.11.1). There is an exclusion for newspapers and broadcast services, but it does not help a service whose principal purpose is giving that kind of advice (GEN Rule 2.11.2). In ADGM, the FSRA allows Advising on Investments or Credit to be carried on in relation to virtual assets, so a signal service run from ADGM should expect the same analysis.

3. Copy-trading and social trading

"Copy-trading" describes several different products:

• Social feeds and leaderboards let users see other traders' positions and decide for themselves. These are closest to information. The marketing rules apply, provided the rankings are the same for every user and not tailored to the individual.
• Copy with confirmation means each replicated trade waits for the follower to approve it, so every decision stays with the follower. The lead trader's activity is only a signal, and the platform executes the follower's own order.
• Automatic replication is different in kind. The follower allocates funds, and the platform's system then opens, adjusts and closes positions in the follower's account as the lead trader does, without consent for each trade.

Our analysis of automatic replication under VARA's rules is that it involves VA Management and Investment Services. Schedule 1 defines this as acting on behalf of another person as agent or fiduciary, or otherwise taking responsibility for the management, administration or disposition of that person's virtual assets. The follower has handed over the decision, and the platform's system disposes of the follower's assets. Nobody gives the follower a personal recommendation, so it is not Advisory Services, and that absence strengthens the management analysis. The lack of per-trade consent is an indicator, not the statutory test.

VARA licenses activities cumulatively. An exchange that adds automatic copy-trading therefore needs an additional activity, not a different licence. VARA's paid-up capital for VA Management and Investment Services is the higher of AED 500,000 or 25% of fixed annual overheads. That falls to the higher of AED 280,000 or 15% where a VARA-licensed custodian is used (Company Rulebook VI.B.1).

Two variations sit closer to execution: the follower authorises each replicated trade, or copies an open position as one confirmed transaction and then manages it personally. Neither holds where authorisation is given in advance or in bulk, or where positions close automatically when the lead trader closes. Limits set by the follower define a mandate; they do not remove the platform's discretion.

The other regimes reach a similar result. Portfolio Management is one of the CMA's eight activities. In the DIFC, Managing Assets means managing another person's assets, including crypto tokens, on a discretionary basis (GEN Rule 2.10.1), and in ADGM the FSRA allows Managing Assets in relation to virtual assets. Under the CMA framework, Article 14(2) of the General Module carves a platform that only receives and passes on orders out of Dealing as Agent; that model is more naturally analysed as Arranging Investment Deals. Lead traders paid a share of followers' profits raise questions of their own, particularly where they are in the UAE.

4. Automated strategies that trade for users

Here the product is the strategy: an AI that selects assets, sets grid or leverage parameters and opens, closes and rotates positions, or a vault that a manager trades. If the user sets a mandate (asset universe, amount, leverage cap) and the system takes every decision within it, that is discretionary management in all four regimes. If users' funds are pooled and traded as one book, the analysis moves to collective investment funds, a separate regime in every UAE jurisdiction. If the user cannot withdraw without your system's cooperation, custody is in play too.

5. Front ends on DEXs and perpetuals venues

A front end on a decentralised venue is usually non-custodial. The user connects their own wallet and signs their own orders. On Hyperliquid, builder codes let a front end earn a fee on orders it routes. The user approves a maximum fee with their own signature, and the protocol caps it at 0.1% on perpetuals and 1% on spot. No custody and no discretion is a good start, but a business paid for each order it transmits looks like an arranger. The DFSA's guidance describes an arranger as one that may receive and transmit client orders without power to bind the client (GEN Rule 2.9 guidance). VARA's Broker-Dealer Services include arranging orders for the purchase and sale of virtual assets. Arranging Deals in Investments is a VA regulated activity in ADGM, and Arranging Investment Deals is one of the CMA's eight activities.

Perpetuals add a second layer, because they are derivatives. VARA brings virtual asset derivatives within its Exchange and Broker-Dealer activities under additional conditions, as our crypto derivatives page explains. The facts that decide whether a front end is caught are these. Is it operated from the UAE? Does it market to UAE users? Is it paid per trade? Does it add features such as copy-trading, vaults or preset leverage? A Dubai-based front end that markets an unlicensed venue to UAE users has a problem under the Marketing Regulations even if the arranging analysis comes out in its favour.

Crypto versus securities, FX and CFDs

VARA's perimeter covers virtual assets only. A signal, bot or copy-trading service in equities, FX or CFDs run from the Dubai mainland or a non-DIFC free zone is a federal CMA question. The DFSA and FSRA rulebooks apply to investments and crypto tokens alike. Where an offshore broker runs copy-trading or introducing programmes into the UAE, the onshore marketing and introducing work is usually what needs licensing: see our guide to CMA Category 5 promotion and introducing.

Structuring the product

1. Decide, feature by feature, who makes the decision, and write the product so that it matches. Most regulatory problems come from a feature that drifted.
2. Never take custody by accident. Use trade-only keys, keep users' wallets in their own control and allow no withdrawal paths through your systems.
3. If you want to stay a software vendor, charge for the software. Profit shares and per-trade fees change the characterisation.
4. Map your marketing against VARA's Marketing Regulations and the federal finfluencer regime before launch, including your affiliates and community managers.
5. If management is the business, apply for it. Under VARA that means VA Management and Investment Services, in the DIFC and ADGM it means Managing Assets, and under the CMA it means Portfolio Management. Remember that activities are cumulative.

The CMA's activities are set out in our activity-by-activity guide. Neo Legal advises exchanges, brokers and founders on whether a copy-trading, bot or derivatives product fits an existing UAE licence or needs another activity, and runs the application where one is needed.

Frequently asked questions

Do I need a licence to sell a crypto trading bot from Dubai?

Not usually, if users run the bot on their own accounts with their own parameters and you never hold their assets or place orders for them. A licence becomes necessary if your system trades for users on strategies you control, holds keys that allow withdrawals, or is paid by a share of profits. The marketing rules apply either way.

Is a paid crypto signals Telegram group regulated in the UAE?

Usually yes, in some form. Under VARA a broadcast signal is rarely a personal recommendation, so it is generally not Advisory Services. VARA's Marketing Regulations and market offence rules still apply, and the federal finfluencer licence, now administered by the CMA, is aimed at exactly this kind of content. In the DIFC a signal service is likely to be Advising on Financial Products.

Does copy-trading need a VARA licence?

Automatic copy-trading, where the platform opens and closes positions in the follower's account without consent for each trade, involves VA Management and Investment Services on our analysis. That is in addition to any Exchange or Broker-Dealer activity. Copy-trading where the follower confirms each trade sits much closer to execution.

What is the difference between advice and management for trading products?

Advice leaves the decision with the client: under VARA it is a personal recommendation that the client chooses whether to follow. Management means taking responsibility for the client's assets and deciding, within whatever mandate the client sets, what to buy, sell or close. Automation usually points to management.

Do I need a licence to run a front end for Hyperliquid or another DEX from the UAE?

It depends on the facts. A non-custodial interface where users sign their own orders is a good start. Earning a fee on every order routed, marketing to UAE users and adding copy or vault features all push the business towards arranging, and perpetuals bring in the derivatives rules. The venue itself also matters for marketing purposes.

Which regulator covers FX and CFD signals or copy-trading in Dubai?

Not VARA, whose perimeter is virtual assets only. FX, CFDs and securities run from the Dubai mainland or a non-DIFC free zone are a federal CMA matter. In the DIFC and ADGM, the DFSA and the FSRA regulate them under their own rulebooks.

This article is general information on the position at the date shown and is not legal advice. Token classification and licensing turn on the specific facts of each project; speak to us before relying on it.