An extract from The Virtual Currency Regulation Review, 3rd Edition

Introduction to the legal and regulatory framework

The United Arab Emirates (UAE) has a developing legal system that has rapidly modernised in recent years. The overall legal system is a civil law system influenced by shariah (Islamic law), of which the major legal codes include the Civil Transactions Law, the Commercial Transactions Law, the Penal Code and the Commercial Companies Code. In addition to UAE federal law, each of the seven emirates of the UAE (Dubai, Abu Dhabi, Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah and Fujairah) have their own laws and regulations in areas where there is no federal law. In the field of financial and capital markets, the UAE Central Bank and the Securities and Commodities Authority (SCA)2 are, however, the federal regulators.

Each emirate also has its own free zones, which have limited independence from the emirate and federal law that applies to foreign investment restrictions and customs. There are, however, two financial free zones established pursuant to the UAE Constitution and federal law that are entirely separate jurisdictions in the sense that they have a regime of civil and commercial laws separate from the remainder of the UAE. The two free zones are the Dubai International Financial Centre (DIFC), where the regulator is the Dubai Financial Services Authority (DFSA), and the Abu Dhabi Global Market (ADGM), where the regulator is the Financial Services Regulatory Authority (FSRA). The DIFC applies a common law system modelled on English common law, while the ADGM applies English common law itself. UAE federal criminal laws do, however, apply in the DIFC and the ADGM (e.g., the federal anti-money laundering laws). Where necessary, the onshore UAE, the DIFC and the ADGM are dealt with separately in this chapter.

Although the UAE presents blockchain and distributed ledger technology (DLT) as a government priority and has initiated various blockchain-related ventures, the regulation of virtual currencies in the onshore UAE and the DIFC remains limited. Although coins and tokens are not prohibited, the SCA and the DFSA have issued circulars to caution investors on virtual currencies, without, however, taking a firm regulatory position. Both the onshore UAE and the DIFC had adopted a wait-and-see approach; however, on 15 October 2019, the SCA issued a long-awaited draft regulation on virtual assets (the SCA Draft Virtual Asset Regulation) with a request for public commentary.3 At the time of writing, no regulation has come into force.

By contrast, the ADGM issued extensive regulation in 2018, which is regularly updated to keep abreast of global developments in blockchain regulation. The ADGM has consequently attracted significant interest by international industry players, particularly by those operating central virtual currency exchanges.4 The ADGM has also been proactive in the wider fintech regulatory space, having issued guidance on application programming interfaces5 and digital investment management ('robo-advisory') activities.6

Securities and investment laws

i Onshore UAE

In the onshore UAE, the UAE Central Bank and the SCA share responsibility for the regulatory oversight of the UAE's financial and capital markets. This includes the non-financial free zones, such as the Dubai Multi Commodities Centre (DMCC) and the Dubai Silicon Oasis (DSO).

Although the SCA announced on 9 September 2018 that it would issue regulation to govern initial coin offerings (ICOs) and determine the status of coins and tokens in mainland UAE, the SCA Draft Virtual Asset Regulation was not published until October 2019 and at the time of writing, no regulation has thus far been issued.7 This may be considered surprising given the enthusiasm professed for DLT and blockchain in the jurisdiction and the large-scale overhaul of the UAE's banking laws and its Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) Framework in 2018 and 2019, which does not consider explicitly the status of virtual assets in the jurisdiction.

The SCA Draft Virtual Asset Regulation is drafted to be all-encompassing. It is to apply to anyone offering, promoting or issuing cryptoassets in or from the UAE or to persons in the UAE, as well as anyone offering crypto custody services, or operating a crypto exchange or a crypto fundraising platform and any other financial activity relating to cryptoassets.8 However, crucially, it specifically excludes the financial free zones from its scope, thus leaving the regulatory freedom of the DIFC and ADGM unfettered.9 The Regulation distinguishes between commodity tokens and security tokens, and regulates both, though the regulatory requirements are higher for security tokens. It subjects any security token offering or trading to the UAE securities laws and suggests that the SCA would issue guidance as to how to assess whether a virtual coin or token qualifies as a security token.10

However, even without the SCA Draft Virtual Asset Regulation entering into force, depending on the technology underlying or rights attaching to a coin or token, UAE securities, investment or financial laws may apply to a specific coin and token. Persons or entities issuing or dealing in or with coins or tokens, especially if the latter exhibit characteristics of securities, should exercise caution. In a circular in 2018, the SCA requested all issuers, intermediaries facilitating initial coin offerings and trading platforms to ensure that they comply with all applicable laws.11

Securities and related investments are primarily governed by Federal Law No. 4 of 2000 Concerning the Emirates Securities and Commodities Authority and Market (the Securities Law),12 and regulations issued thereunder and relating thereto.13 The Securities Law established the SCA as a second federal regulator and includes basic rules on the offering of securities.14 Under the Securities Law, any securities or commodities market or exchange must be in the corporate form of a local public institution or public corporation and must be licensed by the SCA.15 This requirement was relaxed in 2014, permitting the listing of securities in private joint-stock companies on regulated exchanges.16 The licensing requirement also applies to brokers. The Securities Law and (most) regulations issued thereunder define securities as 'shares, bonds and notes . . . and any other domestic or non-domestic financial instruments accepted by the Authority'.17 In theory, this definition leaves room for the SCA to subsume coins or tokens within its own definition. The Law defines commodities as '[a]gricultural produce and natural resources extracted from under the ground and the seas after being processed and prepared for commercial use', which would not appear to cover virtual currencies. However, later regulation defines commodities to include 'and any other commodities traded in contracts'.18 Even without the SCA Draft Virtual Asset Regulation entering into force, most virtual coins and tokens may be characterised as commodities, where they do not exhibit characteristics of securities.

Highly relevant to trading platforms of virtual coins and tokens, the activity of market-making of securities requires a licence from the SCA. Market-making is defined as 'the activity which mainly depends on providing continuous prices for the purchase and sale of certain securities to increase the liquidity of such securities'.19 Where coins or tokens are considered securities, the provision to ensure liquidity of the token, for example through trading bots, may therefore potentially amount to a regulated activity in the onshore UAE.

ii DIFC

The DFSA, the DIFC's competent regulator, stated in September 2017 that it does not regulate digital coins or tokens and considers them to be high-risk.20 It then stated that it does not license any firms in the DIFC to carry out activities related to virtual currency investments. In October 2019, the DFSA sent an alert about 'MeleCoin' falsely being licensed in the DIFC.21 In its alert, the DFSA again referred to its September 2017 warning.22 In June 2020, as part as their Future Finance initiative, the DFSA cooperated with Deloitte Middle East to publish a paper on digital asset custody.23 The document includes a classification of coins and tokens adopted by the UK's Financial Conduct Authority. The publication may indicate that the DFSA is set to clarify the regulatory status of coin- and token-related transactions within the DIFC.

The core laws regulating licensable businesses in the DIFC and administered by the DFSA are:

  1. the Regulatory Law 2004;
  2. the Markets Law 2012;
  3. the Law Regulating Islamic Financial Business 2004;
  4. the Collective Investment Law 2010; and
  5. the Investment Trust Law 2006.24

The DFSA has issued a rulebook (the DFSA Rulebook) that contains subsidiary legislation made under the Regulatory Law 2004 by the board of directors of the DFSA.25

The DIFC prohibits people from performing financial services, including dealing in and advising on investments such as securities and derivatives, unless authorised to do so.26 An activity constitutes a financial service under the Regulatory Law 2004, subject to various exemptions, if it amounts to:

  1. accepting deposits;
  2. providing credit;
  3. providing money services;
  4. dealing in investments as principal;
  5. dealing in investments as an agent;
  6. arranging deals in investments;
  7. managing assets;
  8. advising on financial products;
  9. managing a collective investment fund;
  10. providing custody;
  11. arranging custody;
  12. effecting contracts of insurance;
  13. carrying out contracts of insurance;
  14. operating an exchange;
  15. operating a clearing house;
  16. insurance intermediation;
  17. insurance management;
  18. managing a profit-sharing investment account;
  19. operating an alternative trading system;
  20. providing trust services;
  21. providing fund administration;
  22. acting as the trustee of a fund;
  23. operating a representative office;
  24. operating a credit rating agency;
  25. arranging credit and advising on credit; and
  26. operating a crowdfunding platform.27

The DIFC also prohibits financial promotions, which covers any communication 'which invites or induces a Person to (a) enter into, or offer to enter into, an agreement in relation to the provision of a financial service; or (b) exercise any rights conferred by a financial product or acquire, dispose of, underwrite or convert a financial product'.28

While there is extensive room for virtual currency transactions to fall within financial services or promotions, the statement of the DIFC indicates that at this point in time it does not consider the issuance of or dealing in digital coins and tokens to fall within its extensive regulatory framework.

iii ADGM

The competent regulator in the ADGM is the FSRA. In summer 2018, the FSRA issued a far-reaching framework regulating the operation of what it then called 'cryptoasset' businesses by amendment of the Financial Services and Markets Regulations (FSMR)29 and the provision of detailed guidance notes.30 The framework is regularly updated to keep abreast of global crypto-related developments; it was last amended in February 2020,31 along with corresponding guidance documentation.32 One notable change is renaming 'cryptoassets' to 'virtual assets' in line with the Financial Action Task Force (FATF) nomenclature.

Pursuant to the 2020 changes, the FSMR divides virtual coins and tokens into digital assets regulated by the FSRA on one hand, which includes virtual assets (such as non-fiat virtual currencies including Bitcoin, Ether), digital securities, fiat tokens (fully backed by fiat), and derivatives and funds (i.e., derivatives over any digital assets and collective investment funds investing in digital assets), and other digital tokens (e.g., utility tokens) on the other hand.33 Only the latter remain unregulated.

The FSMR defines a 'virtual asset' as a means of digital representation of value that can be digitally traded and functions as a medium of exchange, a unit of account or a store of value, or all three, but does not have legal tender status in any jurisdiction.34 From a regulatory policy perspective, the FSRA treats virtual assets as commodities and therefore not as specified investments under the FSMR. Derivatives of virtual assets are treated as commodity derivatives, and therefore as specified investments under the FSMR.35 Even though not all virtual assets are specified investments, any market operator, intermediary or custodian dealing in virtual assets is required to be approved by the FSRA as a financial service permission holder in relation to the applicable regulated activity.36

Where the FSRA classifies digital assets as digital securities or derivatives or collective investment funds of virtual assets, dealing in them and their issuance must fully comply with the provisions applying to securities, derivatives and funds as set forth in the FSMR and ancillary rules issued by the FSRA.37 To clarify its treatment of digital securities, the FSRA issued new guidance on the regulation of digital securities activities in February 2020.38 The guidance defines 'digital securities' as digital assets with the economic and legal features and characteristics of securities.39 The guidance seeks to clarify digital securities-related financial services activities within the ADGM, in both a primary and secondary market context, as well as tokenised security offerings.40

Where fiat tokens are involved, activities must be licensed and regulated as providing money services under the FSMR.41

Banking and money transmission

The Central Bank is the UAE's banking, credit and monetary regulator, and:

  1. provides general regulation of banking-related matters;
  2. oversees the issuance of currency;
  3. supervises banking and other licensable financial activities;
  4. advises the government on financial issues;
  5. maintains foreign exchange reserves; and
  6. acts as a bank for the government and other banks in the UAE.

In September 2018, the UAE government overhauled its financial service and banking laws through the issuance of Federal Law No. 14 of 2018 concerning the Central Bank and Organisation of Financial Institutions and Activities (the Financial Services Law).42 The Financial Services Law replaced Federal Law No. 10 of 1980 concerning the Central Bank, the Monetary System and the Organisation of Banking as the main legal framework for banking in the UAE.43 The law regulates financial services within and from the UAE as well as the proceedings of the Central Bank. Despite its recent issuance, the Financial Services Law does not refer to virtual coins or tokens.

In January 2017, the Central Bank issued the regulatory framework for stored values and electronic payment systems (the Stored Value Regulation) to regulate different types of electronic payments and stored value.44 The Stored Value Regulation applies in the UAE but does not apply in the DIFC and the ADGM. The Regulation defines virtual currencies as 'any type of digital unit used as a medium of exchange, a unit of account, or a form of stored value'.45 The definition goes on to stipulate that virtual currencies are not covered by the Stored Value Regulation, but confusingly also suggests that their usage (and any transactions with them) is prohibited.46 In February 2017, the Central Bank Governor reportedly clarified that it is not prohibiting virtual currency transactions, and that they do not fall under the Stored Value Regulations.47 In November 2019, the UAE Central Bank announced that it was setting up a FinTech Office to compete with the sandboxes and initiatives in the DIFC and the ADGM. The office is also set to examine cryptocurrencies.48 Despite the SCA Draft Virtual Asset Regulation published in October 2019, the Central Bank governor is reported to have noted then that 'cryptocurrency is a big issue now and there's a lot of debate . . . we at the central bank are not supportive of cryptocurrencies'.49

In the past, local banks in the UAE have adopted inconsistent and changeable restrictions on remitting funds to or receiving funds from cryptocurrency exchanges or other businesses in the ecosystem, typically without prior notice. The basis for such restrictions is typically the know your customer (KYC) and anti-money laundering (AML) obligations applicable to banks (as further considered in Section IV). In May 2018, BitOasis, a virtual currency exchange serving UAE customers, suspended fiat-to-crypto transactions on its trading platform because of issues with its bank.50 In June 2018, the company was able reinstate that feature.51 As is the case elsewhere in the world, UAE banks have hesitated to open bank accounts for cryptocurrency blockchain businesses. This position has improved significantly, however, as UAE banks are studying blockchain solutions and integrating them into their own business with great vigour, or are at least considering doing so.52