VARA Is Not a Panacea: Dubai's Crypto Payments Still Depend on the Central Bank

Making crypto payments in Dubai may be more complicated than expected.

Written by: Shao Jiadian

Imagine a scenario: an Asian merchant sets up a sales company in Dubai and wants the payment to be received in dirhams. The local buyer has USDT, and an Asian payment institution plans to accept this currency at the checkout page, convert it to dirhams, and then transfer the payment to the merchant. If this institution only has the transfer and settlement license from the Dubai Virtual Assets Regulatory Authority (VARA), can it legally operate this business model?

Making crypto payments in Dubai may be more complicated than expected. The buyer only clicks to pay once at the checkout page, but the backend needs to collect the currency, convert it, and settle the fiat currency with the merchant. If the platform intends to complete these steps itself, a VARA license may not be sufficient. This article will follow the payment to see how far VARA's permission extends and under what circumstances it is necessary to apply for permission or registration with the Central Bank of the UAE.

01 When Is VARA Enough?

If a platform transfers BTC for investment clients or receives USDT at a product checkout page, it may involve on-chain transfers. To determine whether VARA's permission is sufficient, one must first distinguish whether the platform is transferring investment assets or processing a payment. In Dubai and the free zones under VARA's jurisdiction, if an institution only engages in investment, cryptocurrency trading, and related custody and transfer of non-payment tokens like BTC and ETH, without involving product payments, currency exchanges, remittances, or other financial services regulated by the central bank, these activities do not require additional payment licenses or registration from the central bank. Transactions, custody, and transfers each have corresponding VARA permission scopes, which must be provided by entities authorized to conduct such business.

The new Central Bank Law, effective September 16, 2025, also distinguishes between investment and payment. Article 61 includes the provision of payment services using virtual assets under the central bank's licensing and regulatory financial activities. Article 187 excludes virtual assets used for investment, currency exchange, or trading swaps from the applicability of this central bank law, with relevant activities still subject to other applicable rules. When using virtual assets for payments or converting them into currency, this article requires compliance with the regulations established by the central bank for related activities. If the platform operates exchanges for payment tokens like USDT, it must also consider the provisions of the Central Bank's Payment Token Service Regulations.

Specifically regarding the VARA transfer and settlement license held by this institution, it governs the service of transferring virtual assets between wallets, addresses, or different entities. The rules effective from June 19, 2025, require licensed institutions to comply with applicable central bank payment and remittance regulations. Cross-border transfers and settlements must be legally processed and completed in all jurisdictions involved in the transaction.

02 Can a Buyer Pay with USDT and a Merchant Receive Dirhams for This Order?

If a buyer directly sends USDT to a local sales company in Dubai to pay for ordinary goods, this route is not feasible. According to Article 2(7) of the Central Bank's Payment Token Service Regulations, local merchants wishing to receive token payments for ordinary goods or services can only accept dirham payment tokens issued by central bank-licensed issuers. Foreign currency payment tokens issued by registered issuers can only be used to purchase virtual assets or their derivatives.

Stores in Dubai have already experimented with accepting dirham payment tokens. In September 2026, Network International piloted DDSC at the Marks & Spencer store in Dubai Festival City. Buyers can use wallets that support DDSC to scan the cash register's QR code, and merchants can choose to let DDSC enter their wallets or settle in dirhams. The pilot used dirham payment tokens issued by a central bank-licensed issuer.

So what if the buyer pays with USDT, and the payment institution converts it to dirhams before giving it to the merchant? If the platform is aware that the buyer is using USDT to pay for ordinary goods when providing services regulated by the Payment Token Service Regulations, Article 2(4) does not allow licensed or registered institutions to process this transfer when providing payment token services. The merchant ultimately receiving dirhams does not change the purpose of the USDT transfer. If the buyer exchanges through compliant channels and then pays for the goods with their available fiat currency, the exchange and payment must be handled according to their respective rules. Whether these two activities are independent in practice depends on who controls the exchanged assets and when the payment is settled.

There are also products in the market that confirm payments on crypto asset platforms, with merchants settling in dirhams. In August 2026, Dubai Duty Free launched Crypto.com Pay at its offline stores and website. Eligible UAE residents can authorize payments using their Crypto.com accounts at checkout, and the duty-free shop receives dirhams. Foris DAX Middle East FZE, which provides this service, holds a VARA virtual asset service license and also has a Central Bank of the UAE's Stored Value Facility (SVF) license. Crypto.com clearly states on its UAE website that Crypto.com Pay is provided under the SVF license.

In both arrangements, merchants can receive dirhams. The DDSC pilot disclosed the tokens used by buyers. However, the announcement for the duty-free shop did not specify which currency was actually deducted for each transaction, at what step the conversion occurred, nor did it disclose the complete funding path. Other payment institutions wishing to create similar products must still consider who is handling the tokens for the buyer, who completes the payment, and what services each is authorized to provide.

If the merchant sells goods directly through an Asian company, and the payment is ultimately remitted back to Asia, the payment institution still needs to consider where it is and to whom it is providing services. Article 2(1) governs payment token services provided within the UAE and services directed at local individuals. Even if the merchant is located abroad, as long as the platform operates such services in Dubai or the free zones under VARA's jurisdiction, it must still be judged according to these rules. The scope of the UAE referred to in Article 2 does not include financial free zones like the Dubai International Financial Centre (DIFC). VARA's jurisdiction also does not cover DIFC, where financial services are subject to the regulatory regime overseen by the DFSA.

03 If the Platform Collects and Converts Currency Itself, What Should It Apply to the Central Bank For?

If the platform intends to collect or convert currency itself, it must first confirm whether the currency it handles falls under the central bank's definition of payment tokens. The Payment Token Service Regulations will be implemented starting August 31, 2024. These tokens mainly refer to virtual assets that are priced in fiat currency and claim to maintain their value by referencing that fiat currency or payment tokens of the same currency, such as USDT and USDC, which are under discussion. Even if the platform has not yet integrated merchant orders, as long as the services it provides fall within the scope of the regulations and there are no applicable exclusions or exemptions, it must have the corresponding qualifications from the central bank.

First, consider how the platform collects currency. If the platform acts as a business to hold payment tokens or uses private keys for holding, storing, and transferring such tokens, or receives, holds, and transfers payment tokens on behalf of clients, it involves the custody and transfer of payment tokens. To operate this business, it generally needs to obtain the central bank's payment token custody and transfer license (Payment Token Custodian and Transferor). If the institution has already obtained virtual asset custody qualifications granted by the Capital Markets Authority (CMA, formerly SCA) or relevant local licensing authorities, it can apply for a no-objection registration for foreign currency payment token custody and transfer under Article 8(3). Simply having a VARA transfer and settlement license cannot be used as custody qualifications. If it meets the registration conditions, it must also wait for central bank approval.

Next, consider who is converting the currency. If the platform engages in the paid buying and selling of payment token spot markets as a business, or allows both parties to publish and accept sale offers, it falls under the definition of exchange in the regulations. To conduct this business, it must obtain the central bank's payment token conversion license (Payment Token Conversion) or obtain a no-objection registration through applicable channels. The registration channels under Article 8(1) are aimed at operators of virtual asset trading platforms that meet the definition of the regulations. The central bank will verify the platform's operational qualifications and regulatory affiliation, and only after approval can it conduct exchanges within the registration scope. A VARA transfer and settlement license alone cannot be used to apply for this registration.

The exclusions in the Payment Token Service Regulations target specific activities. If a business is already licensed under retail payment or stored value facility rules, or should be licensed under these rules, the corresponding rules apply. Article 39 of the regulations has further linking provisions, stating that after the transition period expires, licenses under the old rules will no longer cover related crypto asset businesses. When a product involves custody, exchange, and transfer simultaneously, it is necessary to check the applicable rules and authorized scopes item by item. To apply for the aforementioned two central bank licenses, the entity must be a company established in the UAE, excluding financial free zones (Article 6). If it intends to allow the same company to operate other businesses, it must also verify the restrictions on the scope of operations in Article 17 of the regulations.

04 How Does the Payment Enter the Merchant's Account?

The payment ultimately credited in dirhams also depends on who handles the fiat currency collection and settlement. If the payment institution itself provides the merchant with fiat currency collection, payment aggregation, payment accounts, or fund transfer services, it must have the central bank's permission or other statutory authorization for that business; VARA's permission does not cover these services. If the payment is also to be sent back to Asia, the corresponding cross-border fund transfer must also be within the authorized scope of the actual service provider.

Merchants can directly contract with banks or payment institutions that have the corresponding qualifications, allowing them to handle funds and be responsible for settlement. If the Asian payment institution only conducts its authorized business and does not actually provide or facilitate the regulated service, it does not need to obtain the same qualifications for the services directly provided by its partner. Currency exchange, custody, and transfer can also be provided directly by qualified institutions. If the currency exchange itself is part of VARA's transfer and settlement service, it must also use institutions that have obtained VARA's exchange service license. If choosing institutions outside the Emirate of Dubai, VARA's approval is required. The institution handling the transfer and settlement must still be responsible for completing the service for the client.

If the merchant's payment contract is signed by the Asian payment institution, and it collects and transfers the payment, handling refunds as well, with the bank only opening an account for it and executing transfers, the collection service is still performed by the Asian payment institution itself, which needs to have the corresponding qualifications. When discussing the division of labor, one can review the actual process: who the merchant contracts with, who can access wallets and accounts, who receives payment instructions, and who to contact if the money does not arrive.

Another division of labor is to only provide interfaces or wallet software, with assets controlled by clients or licensed institutions. Technical teams that meet the corresponding exclusion conditions may not need to obtain additional licenses for the supported payment services. Even if the team does not handle funds, when actually providing regulated services such as payment initiation, it must also be judged according to the corresponding rules. Those operating, providing, or facilitating regulated financial services directly or indirectly through smart contracts are also subject to Article 62 of the new Central Bank Law.

What Should the Dubai Company Do First?

If the Asian payment institution at the beginning changes the checkout page to allow buyers to pay for goods directly with fiat currency, the first batch of merchants can sign contracts with qualified partners, allowing them to collect and settle payments directly, while the Dubai company is responsible for product integration. Once the business stabilizes, the institution can consider whether to handle settlements itself. If the plan is for the Dubai company to collect payments and be responsible for transfers and refunds, it must confirm and obtain the necessary qualifications before switching, while also adjusting merchant contracts and funding processes.