Issuing a token from the UAE: the regulatory path

The UAE has become one of the most credible jurisdictions for token issuance, but credibility comes with regulatory structure. If you are a founder planning to issue a token from the UAE, the first question is not "which blockchain?" but "which regulator?" The answer depends entirely on how your token is classified: payment, security or utility. Get the classification wrong and you risk launching under the wrong regime, facing enforcement action, or discovering mid-raise that your offering needs a licence you never applied for.

This guide walks through the regulatory path step by step, from classification through to entity structuring, disclosure obligations and tax treatment. The goal is practical clarity for founders who want to do this properly, not a sales pitch dressed up as compliance advice.

Classify first: payment, security or utility token

Every token issuance in the UAE begins with a classification exercise, and this is not something you can self-assess with confidence. The classification determines which regulator has jurisdiction, which licence you need and what investor protections apply.

The broad categories are straightforward in theory. A payment token functions as a medium of exchange or store of value: think stablecoins or currency-pegged instruments. A security token represents ownership, profit-sharing rights or debt obligations, making it functionally equivalent to a traditional financial instrument. A utility token grants access to a product or service, with no expectation of financial return tied to the efforts of others.

In practice, the lines blur. A token that starts as utility can drift into security territory if holders reasonably expect profits from the issuer's efforts. A governance token with revenue-sharing mechanics may look like equity to a regulator, regardless of what your whitepaper calls it. Qualified legal counsel must assess the classification before you file anything. Cosmos works with licensed legal partners to coordinate this assessment as part of the structuring process, but the legal opinion itself comes from a regulated adviser.

Who regulates what in the UAE

The UAE does not have a single virtual-asset regulator. Instead, jurisdiction depends on both the token classification and the geographic zone in which you operate.

• The Central Bank of the UAE (CBUAE) regulates payment tokens and anything that functions as a stored value or payment instrument. If your token is pegged to a fiat currency or designed for transactional use, expect CBUAE oversight.
• The Securities and Commodities Authority (SCA) regulates security tokens issued from the UAE mainland. If your token has characteristics of a share, bond or investment fund unit, the SCA's framework applies.
• ADGM and DIFC, the two major financial free zones in Abu Dhabi and Dubai respectively, each have their own financial services regulators (FSRA and DFSA). Security tokens issued from within these zones fall under their jurisdiction rather than the SCA's.
• VARA (the Virtual Assets Regulatory Authority) in Dubai regulates virtual-asset activities that do not fall under the CBUAE or securities regulators. This includes utility tokens and broader virtual-asset issuance activities conducted in or from Dubai.

The key takeaway: you cannot pick your regulator like you pick a free zone for a trading licence. The nature of your token dictates the authority, and operating under the wrong one is a compliance failure from day one.

VARA's issuance category and the RWA pathway

VARA operates a category-based licensing system, and one of those categories covers virtual-asset issuance. If your token is classified as a virtual asset (rather than a payment token or security), and you are issuing from Dubai, the VARA issuance licence is likely your route.

The application process requires detailed documentation: a comprehensive whitepaper, proof of technical architecture, AML/KYC frameworks, governance structures and evidence of operational readiness. VARA expects substance, not just paperwork. You need local management, a compliance officer and demonstrable operational capacity within Dubai.

For founders exploring real-world-asset tokenisation, VARA's framework provides a clear pathway. RWA projects, where tokens represent fractional ownership or rights over physical assets like property, commodities or receivables, sit at the intersection of virtual-asset regulation and traditional finance. The VARA issuance category accommodates these structures, though the specific requirements depend on the underlying asset and the rights the token confers.

Real-world-asset tokenisation: the fastest-growing route

RWA tokenisation in the UAE has moved from concept to active deal flow. Property fractions, commodity-backed instruments and trade-finance receivables are all being tokenised under regulated frameworks. The appeal is obvious: fractional ownership lowers minimum investment thresholds, blockchain settlement reduces intermediary costs, and programmable compliance (embedded KYC and transfer restrictions in smart contracts) satisfies regulators more efficiently than manual processes.

The UAE's position is particularly strong here because of its physical proximity to real assets. Dubai real estate, Gulf commodity flows and regional trade corridors provide genuine underlying value for tokenised instruments. This is not speculative DeFi: it is traditional asset management with a more efficient distribution layer.

A security token offering in the UAE tied to real-world assets requires careful structuring. The token's legal wrapper must clearly define what rights holders receive: is it beneficial ownership, a profit-sharing entitlement, or a debt instrument? Each structure triggers different regulatory and tax treatment. Cosmos regularly helps founders map out these structural decisions, coordinating with licensed legal and regulatory partners to ensure the entity, the token design and the compliance framework align before any application is filed.

The issuing entity: structure, jurisdiction and foundation options

Most token projects in the UAE do not operate through a single entity. A common pattern involves two or more legal structures working together.

• An operating company, typically a Dubai mainland or free-zone entity, handles day-to-day business, employs staff and holds the relevant licence (such as a VARA issuance licence).
• A foundation or association, often established in RAK DAO, acts as the decentralised governance layer, holding treasury tokens and managing protocol-level decisions. RAK DAO has become a popular choice because it offers a legal wrapper specifically designed for decentralised projects, with flexible governance provisions.
• In some cases, a third entity in another jurisdiction (such as the Cayman Islands or BVI) may hold intellectual property or serve as the fundraising vehicle, depending on where investors are located.

The choice of structure has direct consequences for corporate tax, transfer pricing and regulatory exposure. A poorly structured multi-entity arrangement invites scrutiny from the Federal Tax Authority (FTA) and potentially from overseas tax authorities if founders retain ties to jurisdictions like the UK. Intercompany agreements must reflect genuine economic substance: real services, arm's-length pricing and documented decision-making. Generic templates are a red flag in any audit.

Marketing, disclosure and investor restrictions

Issuing a token is only half the compliance picture. How you market it, to whom, and what you disclose all carry regulatory weight.

VARA requires a published whitepaper that meets specific content standards, covering the project's purpose, token mechanics, risk factors, use of proceeds and team backgrounds. This is not a marketing brochure: it is a regulated disclosure document, and material omissions or misleading statements create liability.

Investor restrictions vary by token type and jurisdiction. Security tokens typically carry the heaviest restrictions, with limits on who can participate (qualified investors, professional clients) and how the offering can be promoted. Utility tokens under VARA have fewer investor-qualification hurdles but still require clear, non-misleading communication.

Cross-border marketing adds complexity. If your token is available to investors in the EU, UK, US or other regulated markets, you must comply with those jurisdictions' rules as well. A token issued from Dubai but actively marketed to UK retail investors, for example, may trigger FCA requirements regardless of your UAE licence. Founders often underestimate this extraterritorial risk.

Tax and accounting for issuers and token holders

The UAE's 9% corporate tax regime applies to token-issuing entities unless they qualify for a free-zone exemption. Qualifying free-zone persons pay 0% on qualifying income, but the conditions are strict: you need adequate substance, compliance with transfer-pricing rules and income that genuinely qualifies under the relevant Cabinet Decision.

Token proceeds raise specific accounting questions. Are funds received in a token sale revenue, deferred revenue or equity? The answer depends on the rights attached to the token and the applicable accounting standard (IFRS is the default in the UAE). A utility token granting future access to a platform may need to be recognised as deferred revenue, released over the service period. A security token representing equity interests has entirely different treatment.

For token holders, the UAE currently imposes no personal income tax on individuals, which is one reason the jurisdiction attracts crypto founders. However, founders who remain tax-resident elsewhere (particularly in the UK under the Statutory Residence Test) cannot assume UAE residency eliminates their home-country obligations. HMRC, for instance, looks at where decisions are made, where key meetings occur and where the founder spends their time. Cosmos helps founders model these scenarios accurately, working alongside tax advisers in both jurisdictions to ensure the structure withstands scrutiny. For a deeper look at crypto-specific tax treatment, see our dedicated guide to cryptocurrency taxation in the UAE.

Frequently asked questions

How long does a VARA issuance licence take?

Timelines depend on the completeness of your application and the complexity of your token structure. Expect several months from initial engagement to licence approval. Projects with clear classification, strong compliance frameworks and genuine operational substance in Dubai tend to move faster.

Can I issue a security token from a free zone?

Yes, but the free zone matters. ADGM and DIFC have their own securities regulators and frameworks for digital securities. Issuing a security token from a non-financial free zone without the correct licence is not compliant.

Do I need a foundation for my token project?

Not every project requires one, but foundations (particularly through RAK DAO) are useful for decentralised governance, treasury management and separating protocol-level activity from the regulated operating entity. The decision should be driven by your project's governance model, not by fashion.

Is RWA tokenisation treated differently from other token issuance?

The regulatory path is broadly the same: classify the token, identify the regulator and apply for the correct licence. However, RWA projects often face additional due diligence on the underlying asset, including valuations, custody arrangements and legal title verification.

The UAE offers one of the most developed regulatory frameworks for token issuance globally, but "developed" means structured, not simple. Every decision, from classification to entity design to marketing strategy, carries regulatory and tax consequences that compound if you get them wrong early.

Cosmos helps founders plan these structures from the outset, coordinating legal classification, entity formation, tax modelling and compliance workflows with licensed partners who handle the regulated elements. If you are considering issuing a token from the UAE, or exploring RWA tokenisation, start with a structuring conversation before you start writing smart contracts. For a broader comparison of UAE jurisdictions and how they fit different business models, see our guide to company formation across the Emirates.

This article is for informational purposes only and does not constitute legal, tax or regulatory advice. Token classification and regulatory requirements must be assessed on a case-by-case basis by qualified, licensed professionals.