The crypto Travel Rule is in force across the United Arab Emirates (UAE), applying to virtual asset transfers of any amount under Cabinet Resolution No. (134) of 2025, which entered into force on December 14, 2025.

The UAE applies a single federal Travel Rule regime for virtual assets, set out in Cabinet Resolution No. (134) of 2025 (the AML Regulations), which implements Federal Decree-Law No. (10) of 2025 on anti-money laundering [1], and detailed in The United Arab Emirates' Virtual Assets Travel Rule (the UAE Travel Rule), a decision of the National Anti-Money Laundering and Combatting Financing of Terrorism and Financing of Illegal Organisations Committee (NAMLCFTC). [2][3] The federal regime is a minimum standard: each supervisory authority (CBUAE, CMA, VARA, ADGM FSRA or DFSA) publishes it to the firms it supervises and may supplement it with its own rules. [1][4] As a result, the requirements that apply to a VASP depend on which authority supervises it, not on the Emirate (for example, Dubai or Abu Dhabi) where it or its customer is located.

This page describes the federal regime and, for each requirement, how the guidance of each supervisory authority supplements it.

‍

Timeline

‍

Context

1. Is cryptocurrency legal in the UAE?

Yes. UAE law regulates virtual assets rather than prohibiting them, but restricts their use as a means of payment. Under the CBUAE's Payment Token Services Regulation (Circular No. 2/2024, effective August 31, 2024), a merchant or other person in the UAE selling goods or services may only accept a virtual asset as payment if it is a Dirham Payment Token issued by a licensed issuer, or a registered foreign payment token used to buy virtual assets (Article 2(7)). [11] This restriction does not apply in the Financial Free Zones (Article 2(13)). [11]

Virtual asset activities, including exchange, transfer and safekeeping of virtual assets, are recognised under the AML Regulations (Article 4) and may be carried out in or from the UAE by persons that are licensed, registered or listed by the competent supervisory authority (Article 36(1)). [1]

2. Are there AML crypto regulations in the UAE?

Yes. Federal Decree-Law No. (10) of 2025 and the AML Regulations bring Virtual Asset Service Providers (VASPs) within the federal AML/CFT framework. The AML Regulations define VASPs as persons who, as a commercial activity, conduct one or more of the virtual asset activities listed in Article 4 for another person (Article 1), and apply the wire transfer obligations of Articles 26 to 33 to VASPs, with virtual-asset-specific requirements, in Article 36(2). [1]

Each supervisory authority also applies its own AML rulebook to the VASPs it supervises — for example, VARA's Compliance and Risk Management Rulebook (Part III) [5] and the ADGM FSRA's Anti-Money Laundering and Sanctions Rulebook (AML Rulebook), which refers to the federal AML Law and AML Regulations. [6]

3. Is the Crypto Travel Rule mandated in the UAE?

Yes. VASPs must transmit originator and beneficiary information with virtual asset transfers under Article 36(2)(a) of the AML Regulations [1] and under the UAE Travel Rule, a separate NAMLCFTC document that details the Article 36 obligations. [3] It prohibits a VASP from executing a virtual asset transfer unless it collects, verifies and provides the required information immediately and securely (UAE Travel Rule, Article 1(2)). [2]

The UAE Travel Rule applies to all VASPs within the territorial scope of UAE federal and Emirate laws, including all Free Zones and Financial Free Zones (UAE Travel Rule, Application). [2] It has been published by each supervisory authority to the firms it supervises:

• CBUAE — in the CBUAE Rulebook. [2]
• CMA — as CMA Notice No. 1-2026. [7]
• ADGM FSRA — through Notice No. FSRA/FCCP/25/2026, which requires all financial institutions and VASPs in ADGM to comply with the UAE Travel Rule. [3]
• VARA — through its circular of February 24, 2026 to all VASPs in the Emirate of Dubai. [4]

4. Who regulates cryptocurrency in the UAE?

The UAE has several supervisory authorities for virtual assets:

• Central Bank of the UAE (CBUAE): It supervises banks, payment service providers and other licensed financial institutions across the UAE, including payment token (stablecoin) issuers and service providers. [11]
• Capital Market Authority (CMA): It supervises securities, commodities and virtual asset activities in mainland UAE outside the Emirate of Dubai. It was formerly the Securities and Commodities Authority (SCA), renamed by Federal Decree-Law No. (32) of 2025, in force since January 1, 2026. [8]
• Virtual Assets Regulatory Authority (VARA): It supervises virtual asset service providers in the Emirate of Dubai, including its free zones but excluding the Dubai International Financial Centre (DIFC). It was established by Dubai Law No. (4) of 2022. [9]
• Financial Services Regulatory Authority (FSRA) of the Abu Dhabi Global Market (ADGM): It supervises all financial services firms, including VASPs, in the ADGM financial free zone. [6]
• Dubai Financial Services Authority (DFSA): It is the independent regulator of financial services conducted in or from the DIFC, a financial free zone in Dubai. [14]

5. Which Travel Rule requirements apply to my VASP in Dubai, Abu Dhabi or elsewhere in the UAE?

All UAE VASPs must meet the federal regime. Which supplementary rules apply depends on the authority that licenses or registers the VASP (AML Regulations, Article 36(1)) [1], not on the Emirate where the VASP or its customer is located. For example, a VASP serving customers in Dubai can be supervised by the CBUAE rather than VARA, and would then follow the CBUAE's requirements. The AML Regulations allow the VASP supervisory authority to issue decisions, circulars and procedures on the scope, limits and form of virtual asset transfers and on verification obligations (Article 35(1)). [1]

‍

FATF Travel Rule requirements in the UAE

1. Are there licensing or registration requirements for VASPs in the UAE?

Yes. Any person conducting virtual asset activities, offering virtual asset products or services, or carrying out virtual asset transactions from within the UAE must be licensed, registered or listed, as applicable, by the competent supervisory authority (AML Regulations, Article 36(1)). [1]

Which authority licenses a VASP determines its supplementary rules; see questions 4 and 5.

2. When does the Crypto Travel Rule go into effect in the UAE?

The current federal crypto Travel Rule regime has been in effect in the UAE since December 14, 2025, the date Cabinet Resolution No. (134) of 2025 entered into force. [1] VARA has confirmed that the UAE Travel Rule applies in accordance with the commencement provisions of Cabinet Resolution No. (134) of 2025 and that VASPs are expected to be fully compliant from the applicable effective date (VARA Circular, section 5). [4]

The Travel Rule already applied to UAE VASPs before that date, under the regimes that previously governed them:

• Dubai (VARA): since February 7, 2023, when VARA issued the Virtual Assets and Related Activities Regulations 2023 and its Compliance and Risk Management Rulebook, which set out the Travel Rule requirements for Dubai VASPs. [12]
• Abu Dhabi (ADGM FSRA): under section 10.3 of the FSRA's AML Rulebook, including the version of December 21, 2023 (AML VER09.211223). [13]

‍

Complying with the FATF Crypto Travel Rule in the UAE

1. What is the minimum threshold for the Crypto Travel Rule in the UAE?

There is no minimum threshold for transmitting Travel Rule information in the UAE. Required originator and beneficiary information must accompany transfers below AED 3,500, but without the need to verify it unless there is suspicion of a crime (UAE Travel Rule, Article 1(11)). [2]

The AED 3,500 threshold determines when information must be verified: for virtual asset transfers with a daily aggregated amount of AED 3,500 or more, the beneficiary's VASP must verify the identity of the beneficiary if it has not previously done so (UAE Travel Rule, Article 1(10)). [2] For wire transfers in general, the AML Regulations also require the accuracy of originator information to be verified for international transfers equal to or exceeding AED 3,500 (Article 28(1) and (3)). [1]

How supervisory authorities supplement this:

• VARA: The VARA Rulebook requires VASPs to obtain and hold accurate originator and beneficiary information before initiating, or making available, transfers exceeding AED 3,500 (Part III.G, Rules 2 and 3), and to monitor for transactions that seek to circumvent this threshold (Rule 9). [5] VARA's 2026 Circular confirms that, below the AED 3,500 daily aggregated threshold, the required information must still accompany the transfer (section 2(e)). [4]
• DFSA: The DFSA applies a USD 1,000 threshold above which a wider set of originator information must be transmitted (DFSA AML Module, Rules 9.3.4 and 9.3.5). [10]

2. What personally identifiable information (PII) is required to be shared for the Crypto Travel Rule in the UAE?

Under the federal regime, the originator's VASP must collect, verify and transmit the following information immediately and securely before executing a virtual asset transfer:

Source: AML Regulations, Article 36(2)(a). [1]

The AML Regulations set the minimum: the originator's name, account number or virtual asset wallet address, and residential or business address, and the beneficiary's name and account number or virtual asset wallet address (Article 36(2)(a)). [1]

The information must have been verified by the originator's VASP (UAE Travel Rule, Article 1(5)), and, where transfers are batched, must accompany each individual transfer in the batch (Article 1(3)). [2] VASPs must keep all collected originator and beneficiary information in line with the record-keeping provisions of the AML Regulations (Article 1(16)). [2]

How supervisory authorities supplement this:

These are each authority's own requirements. In our interpretation, all VASPs must also meet the federal minimum in the first table, which makes the originator's address mandatory in every case. Sources: CBUAE Rulebook, UAE Travel Rule, Article 1(2) [2]; CMA Notice No. 1-2026, Article 1(2) [7]; ADGM AML Rulebook, Rule 10.3.2(k) [6]; VARA Rulebook, Part III.G, Rules 4 and 5. [5]

In our interpretation, the originator identifiers in Article 1(2)(c) of the UAE Travel Rule are alternatives (OR), consistent with the general wire transfer rule in the AML Regulations, which joins the same identifiers with "or" (Article 28(1)(c)). [1]

3. Are there differences in customer PII requirements for cross-border transfers versus transfers within the UAE?

Yes. For domestic virtual asset transfers where verified originator and beneficiary information is available to the beneficiary's VASP by other means, the originator's VASP only needs to include the wallet or account number or a unique reference number, provided it allows the transfer to be traced. The full information must be provided within three (3) working days of a request from the beneficiary's VASP or a supervisory authority (UAE Travel Rule, Article 1(6)). [2] The AML Regulations set the same three-working-day rule for domestic wire transfers (Article 28(4)–(5)). [1]

How supervisory authorities supplement this:

• VARA restates the domestic transfer rule, including the three-working-day window (VARA Circular, section 2(b)). [4]

4. What are the non-custodial or self-hosted wallet requirements in the UAE?

Before sending a virtual asset transfer to, or receiving one from, a self-hosted wallet on behalf of a customer, a VASP must perform enhanced due diligence, including requesting additional identification documents and verifying the source of funds (UAE Travel Rule, Article 3(2)). [2] In addition:

• Where an originator instructs a transfer to a self-hosted wallet, the VASP must request any Article 1(2) information it does not already hold, and must decline the transfer if the information is not provided (Article 3(5)). [2]
• A VASP receiving a transfer from a self-hosted wallet must have risk-based policies on when to reject, permit, delay or return the transfer, report it to its supervisory authority, or take follow-up action (Article 3(3)). Where required information is missing, it must take reasonable steps to obtain it from the beneficiary, and consider delaying the transfer or returning it to the self-hosted wallet (Article 3(4)). [2]

How supervisory authorities supplement this:

• VARA requires VASPs to decline, delay or return a transfer involving a self-hosted wallet where required information is not provided or risks cannot be adequately mitigated (VARA Circular, section 2(g)), and to consider how they will handle risks from self-hosted wallets (VARA Rulebook, Part III.G, Rule 7(b)). [4][5]
• ADGM FSRA requires enhanced customer due diligence before sending or receiving a virtual asset transfer to or from a self-hosted wallet for a customer (AML Rulebook, Rule 8.4.1(1)(c)). [6]

5. What are the counterparty VASP due diligence requirements in the UAE?

The originator's VASP must ensure the beneficiary's VASP is appropriately regulated, in the UAE or abroad, and must not execute a transfer to one that is not (UAE Travel Rule, Article 1(4)). Where the beneficiary's VASP cannot receive the required information, the originator's VASP must use best efforts to establish an alternative communication channel and, if that fails, consider declining further transfers to it (Articles 1(7)–(8)). [2]

How supervisory authorities supplement this:

• VARA requires risk-based due diligence on a counterparty VASP before transacting with it, which need not be repeated for each transaction unless higher risk is identified (VARA Rulebook, Part III.G, Rule 6). VARA also requires VASPs to reassess the relationship where a counterparty persistently cannot receive the required information (VARA Circular, section 2(c)). [4][5]

6. What happens when Travel Rule information is missing?

The beneficiary's VASP must take reasonable measures, which may include real-time or post-event monitoring, to identify transfers lacking required information (UAE Travel Rule, Article 1(9)), and must have risk-based policies on when to reject, permit, delay or return such transfers, report them to a supervisory authority, or take follow-up action (Article 1(12)). It must request the missing information from the originator's VASP and consider delaying the transfer, or returning it if the information is not received within a reasonable time (Article 1(13)). Systemic failures by an originator's VASP must be reported to the supervisory authority (Article 1(15)). [2]

Intermediary VASPs must confirm the regulatory status of both the originator's and beneficiary's VASPs, pass on all originator and beneficiary information, keep a log of all transfers including rejected attempts, and report systemic failures to their supervisory authority (UAE Travel Rule, Article 2). [2]

How supervisory authorities supplement this:

• VARA requires systemic failures by counterparties to be documented and reported together with the remedial actions taken (VARA Circular, section 2(d)). [4]

7. Are privacy tokens permitted in the UAE?

UAE VASPs must not execute virtual asset transfers of privacy tokens (UAE Travel Rule, Article 5). [2] VARA has confirmed that this prohibition applies specifically to the execution of virtual asset transfers and does not affect other licensed activities (VARA Circular, section 2(i)). [4]

‍

Why choose Notabene for Crypto Travel Rule Compliance in the UAE?

Notabene Transact is an enterprise-grade transaction authorization platform that lets UAE VASPs verify, authorize, and policy-check every transfer before it settles. Its policy engine applies jurisdiction- and amount-based rules automatically, so each VASP can apply its own supervisor's data requirements and the AED 3,500 verification threshold. The platform also supports the counterparty regulatory-status checks and missing-information handling the UAE Travel Rule requires. With the largest network of reachable institutions spread across 100+ countries, Transact also helps UAE VASPs reach counterparties abroad, where counterparty reachability becomes a revenue issue, not just a compliance one. See which UAE VASPs are already reachable on the Notabene network.