Definition

A Virtual Asset Service Provider (VASP) is any business that, for or on behalf of another person, exchanges virtual assets for fiat currency or for other virtual assets, transfers virtual assets, safekeeps or administers virtual assets or the instruments that control them, or provides financial services connected to an issuer's offer or sale of a virtual asset. The definition comes from the Financial Action Task Force (FATF), and it is the chassis on which every UAE virtual asset regime is built.

Where the term comes from: the FATF concept

The Financial Action Task Force added "virtual asset" and "virtual asset service provider" to its Recommendations in 2018, so that the global anti-money-laundering framework, built for banks and brokers, could reach crypto businesses. The FATF definition captures anyone conducting, as a business for or on behalf of another person, any of five activities:

  1. exchange between virtual assets and fiat currencies;
  2. exchange between one or more forms of virtual assets;
  3. transfer of virtual assets;
  4. safekeeping or administration of virtual assets, or of instruments enabling control over virtual assets; and
  5. participation in, and provision of, financial services related to an issuer's offer or sale of a virtual asset.

Two features of the definition do most of the work. It is functional: what matters is what you actually do, not what your trade licence, whitepaper or Telegram bio says. And it is client-centred: every limb requires acting for or on behalf of another person. That single phrase is why personal holdings fall outside the perimeter and why a proprietary desk that starts filling friends' orders falls inside it.

How the UAE turns the concept into licences

The UAE did not adopt the FATF list verbatim; each regulator translated it into its own schedule of regulated activities. The result is that "do I need a VASP licence?" is really two questions: are you inside the functional perimeter, and which regulator's territory are you in.

VARA: Dubai outside the DIFC

The Virtual Assets Regulatory Authority licenses VASPs across eight activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, VA Transfer and Settlement, and Virtual Asset Issuance. Each activity has its own rulebook on top of the compulsory rulebooks that bind every licensee. The perimeter test is in our VARA perimeter guide, and the practice overview is at VARA lawyer Dubai.

The CMA: federal onshore UAE

The Capital Market Authority (the reconstituted SCA, effective 1 January 2026 under Federal Decree-Laws No. 32 and 33 of 2025) issued its Virtual Assets Framework on 13 April 2026, replacing SCA Decision No. 26/RM of 2023 in full. It regulates eight activities of its own: Dealing as Principal, Dealing as Agent, Providing Custody, Arranging Custody, Arranging Investment Deals, Providing Investment Advice, Portfolio Management, and Operating an MTF, across five modules from conduct to prudential requirements. The detail is in our CMA framework analysis and on the CMA virtual asset licence page.

The financial free zones and the central bank

Inside the ADGM the FSRA authorises virtual asset activity; inside the DIFC the DFSA runs its crypto token regime; and the CBUAE regulates dirham-pegged payment tokens, as well as controlling, under Resolution No. 16 of 2026, how banks, finance companies, exchange houses and payment service providers enter CMA-regulated virtual asset activity. The four supervisors are compared side by side in our four-regulator guide.

What is not a VASP

The perimeter excludes more than founders often fear, and less than promoters often claim:

  • Personal holding and investing. Buying, holding and selling your own virtual assets, personally or through your own vehicle, involves no client and no service. In Dubai it is still not a regulatory vacuum: VARA expects proprietary traders to hold a No Objection Certificate, with mandatory registration at USD 250 million equivalent of virtual asset investment in any rolling 30-day period.
  • Pure technology development. Under FATF guidance, writing software is not a virtual asset service. Developers, non-custodial wallet providers and hardware makers who never hold or control client assets, and who do not themselves conduct a regulated activity, sit outside the definition. The moment a "tech provider" holds keys, runs the order flow or takes a cut of client trades, the analysis changes.
  • Genuinely ancillary roles. Providing office space, marketing services or general consultancy to VASPs does not make the provider one, although promotion of virtual asset products can engage separate regimes of its own.

The honest caveat: these carve-outs are narrow and factual. Most disputes are not about the law but about what the business actually does, which is why perimeter analysis is done on flows and documents, not on the pitch deck.

Why the perimeter matters

Because both UAE tracks criminalised getting it wrong. In Dubai, conducting a regulated virtual asset activity without a VARA licence is an offence under Article 17 of Dubai Law No. 4 of 2022, with penalties for entities reaching the higher of AED 50 million, 15 percent of revenue or 300 percent of gains, alongside criminal exposure and director liability: see the VARA penalties guide. Onshore, Article 71 of Federal Decree-Law No. 33 of 2025 provides fines up to AED 250 million and imprisonment of not less than one year for unlicensed financial activity, and the CMA has shown willingness to close premises and block websites: see our CMA fines analysis. For a business that concludes it is inside the perimeter, the constructive path is set out in how to set up a virtual asset company in Dubai and, for firms weighing the federal route, do I need a CMA licence.

VASPs in the UAE: frequently asked questions

What is a VASP?
A VASP, or Virtual Asset Service Provider, is any business that, for or on behalf of clients, exchanges virtual assets for fiat currency or for other virtual assets, transfers virtual assets, safekeeps or administers them, or provides financial services connected to a token issuer's offer or sale. The concept comes from the Financial Action Task Force (FATF) and is the foundation of every UAE virtual asset licensing regime.
What does VASP stand for?
VASP stands for Virtual Asset Service Provider. The term was introduced by the Financial Action Task Force in 2018 alongside its definition of virtual assets, so that crypto businesses could be brought inside the global anti-money-laundering framework. UAE regulators, including Dubai's VARA, use VASP as the formal label for licensed virtual asset firms.
What activities make a company a VASP in the UAE?
Client-facing virtual asset activity: operating an exchange, dealing or broking for clients, holding or administering client virtual assets, transferring them, managing portfolios, advising on them, lending against them, or issuing tokens. VARA lists eight regulated activities for Dubai, and the federal CMA framework lists eight for onshore UAE. The label on your trade licence does not matter; the substance of what you do for clients does.
Is holding my own crypto a VASP activity?
No. Buying, holding and selling virtual assets for yourself, whether as an individual or through your own investment vehicle, is not a virtual asset service, because there is no client. In Dubai, VARA still expects proprietary traders to hold a No Objection Certificate, and registration becomes mandatory once virtual asset investment reaches USD 250 million equivalent in any rolling 30-day period, but neither is a licence and neither permits serving clients.
Are software developers and wallet makers VASPs?
Generally not. Under FATF guidance, building technology is not itself a virtual asset service: developers of software, providers of non-custodial wallets and makers of hardware do not become VASPs merely by writing code, provided they never hold or control client assets and do not conduct the regulated activity themselves. The perimeter question is control and client relationship, not technology, and hybrid models should be assessed case by case.
What are the penalties for operating as an unlicensed VASP in the UAE?
Severe on both tracks. In Dubai, unlicensed virtual asset activity is an offence under Article 17 of Dubai Law No. 4 of 2022, with penalties for entities reaching the higher of AED 50 million, 15 percent of revenue or 300 percent of gains, plus director liability. Onshore, Article 71 of Federal Decree-Law No. 33 of 2025 provides fines up to AED 250 million and imprisonment of not less than one year for unlicensed financial activity under the CMA.

This article is general information as at September 2026 and is not legal advice. The FATF definition is summarised from the FATF Recommendations and guidance; UAE activity lists are as published by the relevant regulators at the review date.