Two businesses can tokenize the same building and end up in entirely different regulatory positions. One tokenizes an asset it owns and sells interests in it. The other builds infrastructure that lets third parties tokenize and trade their own assets. The technology can be identical. The licensing pathway is not, and the distinction is settled at the design stage rather than discovered at the application stage.

Two Questions, Not One

Most tokenization licensing analysis starts by asking what you intend to do. That is the second question. The first is what the token is.

Classification comes before activity. A tokenized interest that carries rights to profits, to a share of an enterprise, or to repayment behaves as a security in most frameworks, and tokenizing it does not change that. The instrument is regulated as what it is. A token that represents no such rights may fall within a virtual asset regime instead, or outside the perimeter altogether. Each of the UAE frameworks approaches this classification slightly differently, which is why the answer is jurisdiction-specific rather than universal. Our guide to tokenized securities covers where that line falls in practice.

Activity comes second. Once you know what the instrument is, the question becomes which regulated activities you are conducting in relation to it. Dealing, arranging, managing, providing custody and operating a trading venue are separate activities with separate permissions and separate capital consequences. A firm can find itself conducting three of them without having framed its business that way.

Note that issuing is not necessarily among them. Creating and offering an instrument is often governed by an offer or prospectus regime, or an exemption from one, rather than by a licensing requirement attaching to the issuer. Whether the issuer also needs authorisation depends on what else it does.

The reason this ordering matters is that businesses tend to reason from the product backwards. They know they are building a platform, so they look for a platform license. But if the instruments on the platform are securities, the applicable framework is the securities framework, and the platform question is answered inside it rather than alongside it.

The Issuer Path: Tokenizing Your Own Asset

An issuer owns or controls an asset, creates tokens referable to it, and offers those tokens to investors. Everything in the structure points inward at a single asset or pool.

The core requirements follow from that shape.

The asset must genuinely sit in the issuing vehicle. Title has to be transferred and documented, not described. An asset that remains registered to a founder or a separate group company has not been ring-fenced, and the token represents a contractual claim against an entity that does not hold the thing the claim refers to.

The instrument must be classified before it is offered. Whether the token constitutes a security determines the offer regime, the disclosure obligations, and whether a prospectus or equivalent document is required or an exemption is available. This is distinct from whether the issuer needs a license.

The offer is constrained by the investor base. Offers restricted to professional or institutional participants generally carry lighter obligations than offers open to retail participants, though the exact consequences depend on the applicable regulator and offer regime.

Custody and transfer need an answer. Someone holds the assets and someone maintains the register. If the issuer performs those functions for token holders, it may have moved into a separate regulated activity.

Ongoing obligations continue after issuance. Reporting, valuation, corporate actions and redemption mechanics are live obligations for the life of the instrument, not launch tasks.

An issuer that never touches anyone else's asset and never matches anyone else's trade has a comparatively contained perimeter. Its primary regulatory exposure is the offer regime rather than authorisation, with licensing questions arising from any post-issuance functions it performs itself, such as holding assets for token holders or facilitating transfers between them.

The Operator Path: Running a Venue for Others

An operator provides infrastructure. Third parties bring their own assets, tokenize them through the platform, and in many models trade them there. The operator does not own the underlying assets and is not the issuer of the instruments.

The requirements follow from that shape and they are heavier.

Operating a venue is a distinct regulated activity. Bringing together multiple third-party buying and selling interests in a way that results in contracts is a market operation, and it requires authorisation in every UAE framework.

Which framework applies turns on what is being traded. In ADGM this sits within the multilateral trading facility regime. In Dubai, a venue trading virtual assets falls to VARA as exchange activity, while a venue trading tokenized securities or other financial instruments may instead engage a securities or market infrastructure framework. Onshore, the Capital Market Authority's Virtual Assets Framework under Decision No. 4/R.M/2026, issued in February 2026 and publicly announced on 13 April 2026, expanded federal regulated activities from three to eight and includes Operating a Multilateral Trading Facility among them. Activity conducted solely within ADGM or DIFC remains with the FSRA and the DFSA respectively. A free zone firm targeting onshore UAE clients, however, has to assess the federal perimeter separately under Federal Decree-Law No. 33 of 2025, which reaches a person targeting clients in the UAE even where the activity is conducted from a financial free zone.

Client assets create custody obligations. An operator holding assets or keys on behalf of participants is providing custody, with segregation, reconciliation and key management requirements attached, and insurance requirements or expectations depending on the applicable regime.

Admission standards become the operator's responsibility. A venue decides what may be listed, and that decision is a regulatory function. Operators are expected to have documented criteria and to apply them.

Market conduct obligations attach to the venue. Surveillance, fair and orderly trading, disclosure and handling of disorderly conditions are obligations of the operator regardless of who issued the instruments.

Capital requirements are materially higher. Venue operation carries among the heaviest prudential treatment in this space in both Abu Dhabi and Dubai.

An operator's perimeter is wide by design, because the regulatory concern is systemic rather than transactional. The framework is protecting the participants on the venue, not the operator's own investors.

The Two Models Side by Side

Where the Two Paths Collide

The models are clean in the abstract and blur in practice, usually in one of three ways.

The issuer that builds a secondary market. A project tokenizes its own asset, then adds a facility for holders to trade with each other. That facility is a venue, and the firm has added the operator perimeter to the issuer one.

The operator that seeds the platform. A platform launches with its own asset to demonstrate the product. It is now both issuer and operator, and the conflicts between those roles need managing as well as licensing.

The platform that provides custody by default. Holding keys on behalf of users is custody whether or not the business describes itself as a custodian.

None of these is a reason not to build the business. They are reasons to know which perimeter you are in before you build, because retrofitting a permission is slower and more expensive than applying for the right one at the outset. Our RWA tokenization legal strategy work starts with classification and perimeter mapping, and a token legal opinion settles the classification question in a form counterparties will accept. To discuss which path your model sits on, get in touch.

Frequently Asked Questions

Do I need a license to tokenize my own real estate?

It depends on what the token is and who you offer it to. Tokenizing an asset you own is not automatically a regulated activity, and issuing is not necessarily a licensed activity in itself. Offering interests usually engages an offer regime, and where the instrument constitutes a security the securities framework applies. A license becomes the question where the issuer also performs a regulated function such as custody or matching trades.

What is the difference between a token issuer and a platform operator?

An issuer creates tokens referable to an asset it owns or controls and offers them to investors. An operator provides infrastructure on which third parties tokenize and trade their own assets. The issuer's regulatory perimeter is narrow and centred on issuance. The operator's is wide and centred on venue operation, custody and market conduct.

Can one entity be both issuer and operator?

Yes, but it needs the permissions for both and it needs to manage the conflict between them. A venue that lists its own instruments is in a different position from one that does not, and regulators expect that conflict to be identified and addressed rather than left implicit.

Which carries the broader regulatory perimeter, issuing or operating?

Operating, typically. Venue operation carries capital requirements, market conduct obligations, admission standards and surveillance duties that do not apply to a pure issuer, and it is among the most closely supervised permissions in the UAE frameworks. That is a statement about breadth rather than an absolute hierarchy: a complex public securities issuance can be extremely demanding in its own right.

Does holding user keys make me a custodian?

Generally yes. Holding assets or private keys on behalf of others is custody in substance regardless of how the service is described commercially, and it brings segregation, reconciliation and key management obligations with it. Insurance is treated as a requirement in some regimes and as a recommendation in others, so it needs checking against the applicable framework rather than assumed.

This article provides general information about UAE regulatory frameworks and is not legal advice. Requirements differ between ADGM, DIFC and VARA and change over time. Verify against current regulator source material and speak with qualified counsel about your specific circumstances.