The sector in brief
A virtual asset service provider, or VASP, is a business that exchanges, transfers, holds, brokers or operates a platform for virtual assets on behalf of customers. That covers exchanges, brokers, custodians and other platforms. The UAE treats these businesses as part of its financial AML framework, and they are expected to meet standards close to those of other financial firms.
Several authorities are involved, because the UAE has more than one regulatory system. On this site, virtual asset businesses appear under the Central Bank, the DFSA in the Dubai International Financial Centre, the FSRA in Abu Dhabi Global Market and the Capital Markets Authority. Which one applies depends on where the firm is licensed and on what it does. There is also a separate Dubai authority for virtual assets outside the DIFC, which is not covered on this site, so check your own licence.
The technology brings real strengths for investigators, because many blockchains are public. It also brings real weaknesses: value can move across the world in minutes, wallets do not reveal their owners and a number of tools exist to obscure the trail. The best firms combine the discipline of a bank with a deep understanding of the technology.
Where the risk sits
Wallets and unknown owners
An address does not say who controls it. Transfers to and from unhosted wallets, where the user holds the keys, need extra care because the firm cannot see the person behind them.
Speed and borders
Assets can leave a platform and cross several jurisdictions in minutes. Controls that act only after the fact will miss the moment of risk.
Mixers, privacy tools and chain-hopping
Services that blend funds from many sources, and moving value between different assets and networks, are used to break the link between the origin and the destination.
Fraud, scams and ransomware proceeds
Proceeds of crimes such as investment scams and ransomware are commonly turned into virtual assets and cashed out through exchanges.
Sanctions evasion
Sanctioned parties may use virtual assets to move value. Firms must screen customers and addresses and act without delay on a confirmed match.
Customer onboarding at a distance
Customers join online, often from many countries. Identity fraud and the use of accounts by people other than the verified holder are constant concerns.
Activities covered
The same framework applies across virtual asset activities, but the point of risk differs. These are the activities this page covers and what to watch in each.
Advisory services
Advisers guide clients on strategy, structuring and investment in virtual assets. They do not hold or move the assets, but advice that shapes how a client holds or moves them can help hide who is behind a structure or where the money came from.
Main risk: Clients seeking structures that reduce visibility, or acting for undisclosed third parties.
Red flag: A client who asks how to structure holdings to stay under a reporting threshold, or will not explain the source of funds behind a mandate.
Broker-dealer services
Broker-dealers execute trades for clients or trade as principal. The speed and volume of activity put the risk at the transaction layer, so controls apply at onboarding, throughout the relationship and on each trade.
Main risk: Layering through rapid trades across assets and accounts, and weaker controls at counterparties.
Red flag: A client who switches assets often and withdraws to a new wallet each time, or trades repeatedly in small amounts with no clear purpose.
Custody services
Custodians hold keys or control accounts on behalf of clients. The key questions are who may instruct a movement and where assets may be sent, and the relationship needs periodic review as owners change.
Main risk: Instructions from someone other than the verified client, and withdrawals to wallets whose owners are unknown.
Red flag: A request to move all assets to a wallet the client has never used and cannot explain, or an unexplained change in who can give instructions.
Lending and borrowing services
Lending platforms extend credit against virtual asset collateral or lend virtual assets directly. Both the collateral and the repayments can carry criminal proceeds into the system.
Main risk: Collateral derived from crime, and repayments from unverified sources.
Red flag: Collateral arriving from a high-risk address, or a quick repayment from a new wallet with no explanation.
Management and investment services
Managers run portfolios or funds for investors. Subscriptions can bring illicit money in as investment capital, and redemptions can take cleaned proceeds out.
Main risk: Subscriptions funded with illicit assets, and redemptions paid to unverified wallets.
Red flag: A redemption soon after subscribing with no stated reason, or an unexplained change in the beneficial owner of an investor entity.
Transfer and settlement services
Transfer and settlement services move virtual assets between wallets, accounts and parties. This is the activity most directly exposed, and supervisors focus on the travel rule and on screening addresses at the point of transfer.
Main risk: Transfers between parties whose identities are unknown, and chain-hopping to break the trail.
Red flag: A transfer to an address linked to a mixer or sanctioned party, or to a wallet created shortly before the transfer.
Virtual asset issuance
Issuers create and distribute tokens to the public or to a defined group of investors. The point of sale is the main exposure, and the regulatory treatment of issuance differs between the UAE's regimes, so confirm whether a licence is needed and from whom.
Main risk: Purchases funded with criminal proceeds, and buyers whose identities were never checked.
Red flag: A large purchase immediately moved to an external wallet, or a buyer who cannot explain where the money came from.
Who supervises you
It depends on where you are licensed and what you do. Virtual asset businesses licensed by the Central Bank are supervised by the CBUAE. Crypto and token firms in the DIFC are supervised by the DFSA, and virtual asset firms in Abu Dhabi Global Market by the FSRA. Virtual asset brokers, custodians and platform operators overseen by the Capital Markets Authority are supervised by the CMA. A separate Dubai authority covers virtual assets outside the DIFC and is not described on this site. Your licence names your regulator.
The supervisor decides the detailed rules for your licence category, so always read its current guidance alongside this page.
What supervisors expect
- A Compliance Officer or MLRO who understands both the technology and the regulations, with direct access to the board.
- A business risk assessment covering the assets handled, the networks used, the customers served, the countries involved and the type of service offered.
- Customer due diligence at onboarding, including beneficial owners of business customers and enhanced checks for higher-risk customers.
- Screening of customers and of wallet addresses against sanctions lists, using blockchain analytics where appropriate.
- Collection and transmission of originator and beneficiary information for transfers, in line with the rules that apply to your licence (often called the travel rule).
- Monitoring that combines the firm's own records with on-chain data, and investigation of alerts with a recorded outcome.
- Reporting through goAML, staff training that covers new typologies, record keeping and independent testing of systems and processes.
Red flags to watch
- Funds arriving from addresses linked to mixers, darknet markets or sanctioned parties.
- A customer who deposits, trades briefly and withdraws to a new wallet with no apparent purpose.
- Use of privacy-enhanced assets or tools without a reasonable explanation.
- Transfers split into many small amounts or moved through many wallets.
- A customer who will not confirm control of the wallet they want to withdraw to.
- Several accounts that share devices, addresses or bank accounts but present as unrelated.
A worked example
A deposit from a flagged address, then a fast exit
A new customer funds an account with a large amount of tokens from an address that the firm's analytics tool marks as having received funds linked to a scam. Within an hour the customer swaps into a different asset and tries to withdraw to a new wallet. The firm's controls should pause the withdrawal, ask the customer how the assets were obtained and who controls the destination wallet, and record the answers. If the explanation is weak or the customer disappears, the Compliance Officer considers a report to the Financial Intelligence Unit and whether to freeze the funds, always in line with the rules that apply to the licence.
How Adventant helps
Questions answered
Which regulator supervises my virtual asset business?
It depends on where you are licensed and on the activity. The Central Bank, the DFSA, the FSRA and the Capital Markets Authority each supervise different groups on this site, and a separate Dubai authority exists for activity outside the DIFC. Check your licence, and if in doubt ask the issuing authority.
Does the travel rule apply to us?
Supervisors expect virtual asset businesses to collect and pass on information about the parties to transfers, in line with international standards. The exact requirement depends on your licence and the rules your regulator has issued, so check the current guidance.
Can we accept transfers from private wallets?
Many firms do, but with extra checks such as proof that the customer controls the wallet and a look at the address's history. Some choose not to accept them at all. The decision should follow from your risk assessment.
Do we need blockchain analytics?
The rules do not name a tool. But supervisors expect monitoring that is capable of dealing with the risks of the technology, and in practice most firms use blockchain analytics to do so.
What if a customer is in a country we do not serve?
Your onboarding should detect it, using location checks as well as documents. If you find that a customer in a restricted country has been onboarded, you should deal with the matter according to your policy and consider whether a report is needed.