Plans for new national laws for security and commodity tokens and those VASPs administering services in use of them were published last week by the UAE’s securities and commodities regulator. The SCA’s Directive marks an important update for the SCA’s Virtual Asset Regulatory Framework. This post provides background to the SCA’s Directive and updated Virtual Asset Framework and summarises the scope of the SCA’s revised remit and plans for cooperation with parallel regulator, VARA. Spoiler alert: this post is dense on regionally focused regulatory insights! New market entrants, innovators in tokenised RWAs and financial instruments and most importantly, exchange platforms looking to list tokenised anything should read. 

Background:

The SCA delegated the administration of VASP licensure and issuance of most virtual assets (VAs) to the now well-known regulator, Dubai’s Virtual Asset Regulatory Authority (VARA) back in 2022. VARA’s efforts to license and regulate the operation of exchanges, together with the promotion and marketing, issuance, distribution, advice, brokerage, custody and lending and borrowing of VAs has been underway since then, with 25 licensed operators to date. Those operators include the exchange majors, Binance, Crypto.com, OXK and ByBit, together with local outfits Hex, Fuze, Fasset and Toko, and more operators undertaking the path to licensure. Although new, as are most global VA and VASP regulators, it is maturing into a respected regulator attracting best in class projects to the region. While VARA and the SCA share territory for the regulation of most VAs and VASPs operating from within Dubai and the UAE respectively, the DIFC and ADGM operate separate legal frameworks for VASPs, VAs and tokenised securities, and offer alternative legal frameworks for those VASPs and issuers with a more international focus. The ADGM in particular is popular with globally oriented and institutionally-focused VASPs and is home to Binance’s custody operations, VA exchanges M2, Midchains, Matrix and Kraken, Finstreet, a world-first digital securities trading platform, Crypto.com’s brokerage operations through its purchase of Orion Principals last month, and asset manager Brevan Howard. The DIFC, although less prolific, is home to crypto-philic bank Standard Chartered and several hedge funds with VA interests including Millenium Management. 

(If you want more detail you can watch our explainer video)

The 2025 Crypto Zeitgeist 

As with all things in crypto, the world moves at pace, but crypto moves faster. Alongside the emergence of competing regulatory frameworks and offshore financial free zones (Bahrain, Saudi Arabia, Qatar), Exchanges’ profit centres and therefore interests in licensure now turn on derivatives and leverage trading, requiring all VASP regulators to address market needs while balancing market and consumer risk in an increasingly complex and competitive environment. The proliferation of and interest in tokenised real world assets, not least real estate, tokenised securities and commodities, although of little interest to the Exchange majors, introduces another vector of complexity, competition and risk to the mix. This all occurs against the backdrop of a new bull market embracing ever rapidly cycling investment metas, geopolitical forces orienting crypto business toward the United States for the first time, and unprecedented retail and institutional interest. All of this is to say that in 2025 our region’s crypto asset regulators have their work cut out for them if they are to retain licensing revenue and relevancy, protect against risk, meanwhile innovating to accommodate new products, business models and market entrants. This is a herculean task to say the least. 

Recent Developments

The SCA’s efforts to distill a legal framework for tokenised securities and commodities is one of several important recent developments that solve for the 2025 crypto zeitgeist. Prior to the Directive being issued last week, the SCA completed two important milestones toward the end of 2024, it published an important update to its Virtual Asset Framework, Guidelines: Regulation of Virtual Assets and Virtual Assets Services Providers (Guidance) and in September it announced a cooperation agreement with VARA to address parallel regulatory efforts for VASP businesses and inter-agency cooperation. 

1. The Guidance 

Toward the end of 2024 the SCA released its legal framework for VAs Guidelines, a much anticipated 67-page guidance updating its regulatory framework for Virtual Assets. From a legislation interpretation perspective, the Guidance together with Cabinet Resolution No. 111 of 2022, SCA Decision 13/RM of 2021 (known as the SCA Rulebook), and SCA Decision No. 26 (Chairman) of 2023 comprises the SCA’s “Virtual Asset Framework” (SCA Framework). The SCA Framework provides the legal architecture for the licensing and regulation of specified VASP activities (page 9 of the Guidance) and the issuance of the following licenses:

• Virtual asset platform operators

• Safe custody of virtual assets 

• Financial consulting in virtual assets

• Managing portfolio of virtual assets

• Virtual Asset Broker 

• Virtual Asset Dealer 

Notably, the SCA regime does not, at least presently, include provisions for the issuance of specific VAs (more on this below).  

Scope

Central to interpreting the SCA Framework is determining what types of VAs and VASP activity it addresses and what other legal frameworks it overlaps with. The SCA Framework applies to all VAs and VASPs operating within the UAE, excluding entities in the financial free zones of the DIFC and ADGM, which as we set out above, have their own legal frameworks for VAs, VASPs, and tokenised securities and other financial instruments. The SCA’s Virtual Asset Framework applies to VAs for investment purposes, which may be distinguished from VAs used for payment purposes (i.e. loyalty programs and stored value facilities), which remain the responsibility of the UAE Central Bank (unless exclusively approved by the Central Bank for investment purposes on a virtual assets platform). The Guidance contains the following express exclusions from the SCA Framework, i.e. those areas that the SCA Framework does not regulate: 

• digital securities and digital commodity derivatives contracts

• service tokens and NFTs that don't represent VAs for investment purposes 

• developing, deploying or using software to mine, create or extract virtual assets

• loyalty programs

• virtual assets for payment purposes; and

• virtual assets evaluated by the SCA.

The first exclusion “digital securities and digital commodity derivatives contracts” very clearly exempts these products from the SCA Framework. The Directive that was published last week either overturns this exclusion, or suggests that the SCA is underway developing a separate legal framework for regulating tokenised securities and commodities that will not be brought into and under the umbrella of the SCA Framework. It is unclear as to which is the case at this early stage.  

2. The Cooperation Agreement 

Around the same time VARA and the SCA announced a cooperation agreement to improve the attractiveness of the region to VASP businesses. Under the cooperation agreement VASPs operating in/from Dubai, or wishing to service the emirate of Dubai are required to obtain a license from VARA, and can be registered by default with the SCA to service the wider UAE. For those VASPs that wish to operate out of any other Emirates, they must be licensed by the SCA to do so. The agreement covers the mechanism for mutual supervision of VASPs, penalty and fine imposition, the exchange of information and statistics, as well as cooperation in employee training and qualification. 

3. The Directive 

The SCA published the Directive on tokenised securities and commodities last week, interestingly, without the online fanfare that preceded its previous updates. However, the Directive contains some important modifications to the SCA Framework. 

Scope 

The Directive defines Security Tokens and Commodity Tokens as  “digital assets created using Distributed Ledger Technology to represent financial rights or tangible assets” and “a type of digital asset that are based on the value of physical commodities such as gold, oil, metals, or agricultural products” respectively. Examples of Security Tokens include “Equity Tokens”, representing ownership rights in specific companies and “Bond Tokens” representing tradable debt interests. Examples of Commodity Tokens include Gold Tokens that represent a specific quantity of stored gold and Oil Tokens that ostensibly represent stored oil, fractional ownership of reserves, or rights to future oil deliveries, as these tie the token to a specific, asset-backed resource.

Content

The Directive mandates that the SCA will regulate token offering, issuance, promotion and registration of token contracts, and all trade and settlement through SCA-licensed securities and commodities markets, Multilateral Trading Facilities (MTFs) and Organised Trading Facilities (OTFs). However Bonds and Sukuk tokens (an Islamic financial instrument similar to bonds, structured to comply with Shariah law) may be traded OTC (Article 11) and there is provision for private pledges of tokens so long as the pledge is recorded on the token’s distributed ledger (Article 7(2)). Interestingly, the Directive addresses precedence of interests, and token based interests do NOT take precedence over paper-based rights where there are conflicting claims (Article 6(3)). 

The Directive specifies minimum substantive, operational, technical and security requirements for smart contracts (Articles 4, 9 and 10), provides instruction as to the alignment of the new laws with existing Bankruptcy and financial consolidation (netting) legal frameworks (Article 6), proposes undefined trade suspension and powers of enquiry (Articles 13 and 15) and suggests further legislative and regulatory directives will be published with respect to token offering/issuance (Article 2). 

Our Assessment 

The SCA’s Directive squarely lands regulatory oversight for tokenised securities and commodities with the SCA, confining trade to SCA-licensed venues and issuance further to a registration process designed to maintain a degree of control over disclosure standards and technical robustness of smart contracts. This broadens the SCA Framework in a way that would easily be misread and misrepresented if you were only looking toward the Guideline as representative of the SCA’s regulatory remit over VAs and VASPs. 

As with all regulatory advancements for VAs and VASP activities, the Directive, contextualised against the SCA Framework, Guidance and Cooperation Agreement with VARAA raises a host of questions, not least around overlap with the region’s other regulators and existing legal frameworks. Our questions are: 

• VARA vs SCA: Will the SCA and VARA share oversight and regulation of tokenised securities and commodities? Will the SCA delegate powers to VARA to regulate specific tokenised virtual asset products that are also securities or commodities and that the market and licensees are demanding? Given that the SCA regulates all emirates and VARA’s remit extends to the emirate of Dubai only, is an expansion of VARA’s remit from a geography perspective anticipated? What will the SCA x VAR Co-operation agreement entail with respect to security and commodity tokens issuance specifically? 

• Double Regulation: Will VASPs that are licensed for VA activities by VARA (for example, an Exchange) also require an SCA license to the extent that the same Exchange wishes to admit to trade tokenised securities or commodities? (we expect the answer is yes). Is doubling VASPs’ regulatory burden the right approach in an increasingly competitive environment, and what efforts may be made by VARA and the SCA to simplify compliance and avoid duplication of obligations?

• Token Distinctions: Will the SCA pursue greater definitional depth for tokenised securities and commodities? What will distinguish a VA from a tokenised security or commodity and is it the expectation that VARA will exclusively regulate the former, the SCA the latter? If the arrangement is not exclusive, then will equivalency be granted between registration authorities of each? We are particularly interested in this when the structuring of, and rights attached to a particular token can lead to different results, as well as the outcome for one or more regulatory frameworks that mandate token registration when rights in those tokens are modified, say by consensus of their holders.

• Overlap and jurisdictional limits: What are the jurisdictional limits for the contemplated regime? Granted, domestic security and commodity token issuers will need to register tokens issued and traded on a SEC-licensed domestic exchange. Will foreign token issuers that wish to make their tokens available to UAE customers require registration of their asset before they are available to trade on an SCA-licenseed venue? Wont UAE customers seek the best assets available to them, and simply shop for assets on offshore exchanges? What about tokenised securities registered and issued at first instance from within the ADGM? Will the SCA grant equivalency to the registration processes for those assets and their issuers? Will ADGM-licensed exchanges for tokenised securities also require licensure with the SCA if marketing efforts are targeted toward and products offered to UAE residents? What will reverse solicitation practically look like in the context of exchanges regulated from within a financial freezone? 

Summary 

In the 2025 crypto Zeitgeist, the market and regulatory environment regulatory efforts will continue to evolve and on a significantly expedited timeframe. The SCA’s Directive, Guideline and Cooperation announcements are illustrative of this. Market interest continues to escalate for licensed perpetuals and leveraged trading services in particular, and a proliferation of tokenised securities and other financial instruments is underway. In this environment all VASP regulators are challenged to work in a way that gives our industry wings, while protecting against consumer and market risk. Central to these efforts is market access to reliable information about what licensing pathways and obligations look like.  

Regulators from VARA, ADGM and DIFC rarely engage together in audience with new market entrants, which heightens the importance of strategic knowledge workers that work closely with clients and regulators across the different legal frameworks. If you are looking for regulatory strategists and lawyers  to identify opportunities for licensed operations in the UAE, and to cut through areas of overlap and possible confusion, get in touch with us now.