The sector in brief
A payment token is a digital token designed to hold a stable value and to be used to pay for things, rather than to be held as an investment. Businesses that issue, convert, hold or transfer these tokens for customers in the UAE need to be authorised by the Central Bank, and they have AML duties like other regulated financial firms.
Tokens combine features of cash and of electronic money. They can move between people in seconds and across borders, and the ledger is often public. That makes some investigation easier, because transactions can be traced, but it also means that value can be moved before anyone at the issuer has had a chance to react.
Supervisors expect a firm that handles payment tokens to bring the discipline of a bank to a new technology: proper customer checks, sanctions screening that covers wallet addresses, and monitoring that uses both the firm's own records and what the blockchain shows.
Where the risk sits
Anonymity and wallet ownership
A wallet address does not by itself say who owns it. The firm has to link addresses to verified customers and treat unhosted or unknown wallets with care.
Speed and cross-border movement
Tokens can pass through many wallets and across borders very quickly, which makes it harder to stop funds once a problem is spotted.
Mixing and obfuscation
Tools designed to hide the trail of funds, and chains of transfers between many wallets, can be used to layer criminal proceeds.
Sanctions exposure
Wallets linked to sanctioned people or places can interact with the network. Screening must cover addresses as well as names.
Redemption and conversion points
Where tokens are turned back into money, the firm is at a gateway. This is where checks on the source of the tokens and the identity of the customer matter most.
Who supervises you
Payment token services licensed in the UAE under the Central Bank's regime are supervised by the CBUAE. Other token and crypto activity may fall under a different regulator depending on the product and where the business is based, so read the virtual asset service provider page if your activity goes beyond payment tokens.
The supervisor decides the detailed rules for your licence category, so always read its current guidance alongside this page.
What supervisors expect
- A named Compliance Officer or MLRO with understanding of the technology, and board oversight of the AML programme.
- A risk assessment that considers the token, the networks used, the customers, the countries and the way tokens are issued and redeemed.
- Customer due diligence before onboarding, with beneficial owner checks for business customers, and enhanced checks for higher-risk customers.
- Screening of customers and wallet addresses against sanctions lists, and a process to act without delay on a confirmed match.
- Monitoring that combines internal records with blockchain analytics, and investigation of alerts with recorded outcomes.
- Information on the parties to a transfer collected and passed on, in line with the rules that apply to your activity.
- Reporting through goAML, training, record keeping and independent testing of both technology and process.
Red flags to watch
- Tokens received from addresses linked to mixers, darknet markets or sanctioned parties.
- A customer who wants to move tokens through several wallets before redeeming.
- Many small transfers that add up to a large amount, or the reverse.
- Customers who refuse to confirm ownership of a wallet they want to use.
- Redemptions to bank accounts in the name of other people.
- Sudden activity on a long-dormant account.
A worked example
A fast redemption after a chain of transfers
A customer receives a large amount of tokens from an address the firm's analytics tool flags as having received funds from a high-risk service. Within an hour the customer asks to redeem the whole balance to a bank account in someone else's name. A strong programme stops the redemption, asks the customer to explain the origin of the tokens and the ownership of the receiving account, and records the response. If the explanation is not persuasive, the Compliance Officer considers a report and whether to freeze or return the funds in line with the rules.
How Adventant helps
Questions answered
Is a payment token the same as a cryptocurrency?
Not necessarily. A payment token is intended to maintain a stable value and to be used for payments, while many cryptocurrencies are held or traded as investments. The regulatory treatment can differ, so check how your activity is classified.
Does the public ledger make AML easier?
In some ways, because transactions can be traced. But a wallet address is not an identity, and criminals can move tokens through many addresses. You still need customer due diligence and monitoring.
Do we need to screen wallet addresses?
Supervisors expect screening to cover the risks that the technology brings, which in practice includes addresses linked to sanctioned or high-risk parties. Many firms use blockchain analytics tools to support this.
What about transfers to private wallets?
They are higher risk because ownership is harder to confirm. Firms usually require proof of control of the wallet and apply extra checks. Your supervisor's rules set the minimum.
Who supervises other crypto businesses?
It depends on the activity and where the firm is licensed. See the page on virtual asset service providers for how this is divided between the regulators on this site.