Introduction

In recent years, innovations in blockchain technology, decentralized finance (“Web3”), virtual assets (“VA”) and tokenization have offered significant opportunities, particularly in economies subject to inflation, currency devaluation, and uncertainty.

The United Arab Emirates (“UAE”) has positioned itself at the forefront of these developments. Through law, regulation, and new frameworks, the UAE seeks not merely to accept crypto and Web3, but to integrate them safely into its financial ecosystem. The Circular No. C 7/2023 effective from 15/4/2024, this Circular has been repealed and replaced by Circular No. 03/2025, issued on 10/7/2025 of the UAE Central Bank (“CB”)regarding Open Finance Regulation (the “Open Finance Regulation”), as well as the earlier frameworks for VA, such as Dubai’s VA Regulatory Authority (“VARA”) under Dubai VA Law No. 4 of 2022 and its implementing VA and Related Activities Regulations 2023.

One of the most important parts of the Open Finance Regulation is the rule that nothing can happen without the customer’s clear consent. Under Articles 15–17 of the Open Finance Regulation, any financial data cannot be shared and payments cannot be started unless the customer gives permission first. For example, if you want a budgeting app or a loan provider to see your bank details, you must approve it through a secure pop-up or notification. The same applies to payments: no money can be sent unless you agree to it, usually through a secure system called Application Programming Interface (“API”), combined with an extra security step like two-factor authentication. Just as important, you can cancel your consent at any time, and once you do, the sharing or payment stops immediately. This ensures that you are always in control of your data and your money, while banks and financial companies are legally required to keep records and respect your decisions. In short, the consent process is the safety lock of the open finance system, making sure innovation happens without losing privacy, security, or trust.

Legal and Regulatory Landscape in the UAE

1. VARA and VA Regulation

UnderLaw No. 4 of 2022 Regulating VA in the Emirate of Dubai, the VARA was established. Article 3 of the Law defines its scope, applying VARA in all zones across the Emirate of Dubai, including Free Zones and Special Development Zones, but excluding the Dubai International Financial Centre.

Among its objectives (Article 5) are promoting the emirate as a regional and international hub for VA, increasing awareness, protecting investors, developing necessary rules, and regulating VA Service Provider (“VASP”). VARA’s VA and Related Activities Regulations 2023set out the full VA framework in Dubai, including requirements for licensing, operation, market integrity, AML/Terrorist Financing obligations, consumer protection, and technology neutral regulation.

Also noteworthy is VARA’s Issuance Rulebook for certain asset‐referenced tokens (“ARTs”), including FIAT‐referenced VA, which clarifies prudential requirements for stablecoins and which tokens are under exclusive CB supervision vs. VARA oversight.

1. ADGM / FSRA’s Digital Asset Framework

The Abu Dhabi Global Market (“ADGM”), through its Financial Services Regulatory Authority (“FSRA”), has also refined its regulatory framework for VAs. Notably, amendments were introduced as of mid‐2025 (following consultation in 2024) dealing with how VAs are accepted as “Accepted VAs” (AVAs), updated capital requirements, fees, and the introduction of product intervention powers. Privacy coins and algorithmic stablecoins remain explicitly prohibited in ADGM.

1. Open Finance Regulation C 3/2025

The Open Finance Regulation Circular 03/2025 Issued on 10/7/2025, is the UAE’s central regulatory framework for open finance. It establishes a framework consisting of a Trust Framework, an API Hub and Common Infrastructural Services.

These components collectively enable cross‐sector sharing of user financial data and initiation of transactions, always under user consent.

(Articles 3 and  5): All banks, specialized banks, finance companies, payment service providers, stored value facility providers, insurance companies and brokers, exchange houses, loan‐based crowdfunding companies, and others designated by the CB must (subject to onboarding phases) act as “Licensees” and provide data / transaction initiation services in respect of “Accounts” and “Products” that fall within the scope of Article 5.

(Articles 15‐17): Open Finance regulation requires that Data Holders / Service Owners establish secure interfaces (usually via APIs); that Users give express consent for data sharing or service initiation; that the status of initiated transactions be reflected back to the User; secure communication is used; strong authentication is enforced.

(Articles 13, 20, 21, 24 etc.): Providers must have strong corporate governance (Article 11), risk management, cyber‐security, record keeping (Article 13), and be liable for unauthorized transactions or data breaches.

(Article 27): Violations may lead to administrative and financial sanctions. The regime mandates that the CB may impose penalties and take other enforcement action as appropriate.

Why These Regulatory Frameworks Matter

Below are the principal reasons why robust regulation such as that in UAE for VA and open finance is essential. The UAE’s example demonstrates how regulation can foster both innovation and protection.

For institutions and investors to deploy resources (capex, technical talent, market entry), clear rules are essential: what counts as a VA; who can operate; what duties and liabilities apply. UAE’s frameworks (VARA 2023 VA regulations, Open Finance Regulation) provide such clarity.

Many harms in crypto derive from opacity, speculative promotions, lack of transparency, and misleading marketing. Regulations establish requirements for disclosure, for ensuring “informed consent,” for marketing oversight (for example VARA’s Marketing Regulations), for liability in data breaches or unauthorized transactions.

Risk Management Including Financial Crime

Money laundering, terrorist financing, fraud, market abuse are real risks. Both VARA regulation and Open Finance Regulation incorporate AML/CFT requirements, monitoring, surveillance, and obligations for transparency.

Enabling Innovation

By being “technology neutral,” regulators avoid freezing out creative uses of blockchain, tokenization, DeFi. The open finance approach, with APIs, consent mechanisms, and infrastructural frameworks (API Hubs, Trust Frameworks), enables new services budgeting tools, payment initiation, tokenized assets that are efficient and user‐centric.

International & Cross‐jurisdictional Competitiveness

As jurisdictions worldwide scramble to regulate crypto/Web3, having stable legal regimes with coherent licensure, risk standards, and international alignment (e.g. with FATF, global standards) makes the UAE attractive. Examples: ADGM refining its AVA process; UAE’s CB issue of open finance; VARA’s clarity over stablecoin issuance (e.g. for FIAT‐referenced assets).

Challenges, Trade‐offs, and the Regulation vs Decentralization Debate

A recurring tension exists between decentralization (one of the philosophical underpinnings of crypto/Web3) and institutional regulation. Key trade‐offs:

• Over‐regulation may stifle innovation, raise costs, slow development.
• Under‐regulation can lead to consumer harm, loss of trust, volatility and reputational damage for the ecosystem.

The UAE’s approach thus far principled, activity‐based regulation (VARA doesn’t prescribe token types per se, but regulates by activity, risk, disclosure, etc.) seeks to balance these concerns.

Written by  Mr. Sanjeev Kandathil