Unlicensed crypto companies in the UAE – time to embrace regulations

On November 6, the UAE National Anti-Money Laundering and Combating Financing of Terrorism and Financing of Illegal Organisations Committee (NAMLCFTC), in collaboration with other UAE authorities such as the Central Bank of UAE, issued guidance on combating unlicensed virtual assets service providers (VASPs). NAMLCFTC is primarily responsible for issuing AML/ CFT regulations in the UAE.

The guidance emphasises that unlicensed VASPs operating in the UAE will face civil and criminal penalties which will also extend to the owners and senior managers of such companies.

Other professional service providers and financial entities [such as banks, financial service providers, and designated non-financial businesses or professions (DNFBPs)] that knowingly deal with unlicensed VASPs and have weak AML/CFT controls will also face enforcement actions. This guidance was soon followed by a statement from the Dubai Virtual Assets Regulatory Authority (VARA), which set a deadline of November 17 for legacy VASPs operating in Dubai to complete their application process. VASPs that fail to do so will face enforcement actions from VARA. Over 1000 legacy VASPs have already filed their applications to register with VARA.

Time is running out for unlicensed VASPs

Overall, the regulators are signalling a strong commitment to tackle unlicensed VASPs. For example, VARA has already taken multiple actions (such as public warnings, monetary penalties, and enforcement notices) against certain companies operating here without a license.

UAE offers licensing options for many types of crypto businesses including OTC platforms, crypto exchanges, types of broker-dealers, custodians, advisory firms, and asset managers. Token issuance and proprietary trading also fall within the regulatory ambit, even though specific licenses may not be required for such activities.

How can licensed VASPs benefit?

Licensed VASPs that operate in a regulatory-compliant manner stand to benefit from many advantages, such as regulatory certainty, access to world-class ecosystem, and access to business from institutional players who prefer to deal with licensed VASPs. Going forward, even from an operational perspective, licensed VASPs will have an edge, whether in terms of access to bank accounts or other service providers. For instance, lately there has been a spike in instances where VASPs have been asked to withdraw their mobile applications on the Play Store in the absence of a valid license. On the other hand, unlicensed VASPs may be considered a ‘risky business’ and denied access to bank accounts and other regular financial services.

Considering both the regulatory and market developments, now more than ever, it is essential for VASPs to prioritise obtaining the right licences for their business.

Preparing for licencing and AML compliance

To prepare for licencing, VASPs must implement robust internal systems and controls in relation to many operational aspects such as investor protection, market abuse, cyber security, and risk management, to name a few. For example, as part of our legal advisory to VASPs, we help them develop overall readiness to pursue the license, starting from defining the business model to developing all the required guardrails and processes to ensure compliance.

As regards AML/ CFT compliance by VASPs, this remains a primary focus area for all concerned regulators in the UAE. Both the federal authorities and the free zones have issued detailed framework for ensuring AML/CFT compliance and non-compliance will attract civil and criminal penalties. Therefore, VASPs must ensure that they have robust policies, systems and controls to ensure compliance with AML/CFT laws. UAE’s ecosystem already comprises established AML/ Know Your Client (KYC) technology providers whose services the VASPs can avail to meet the regulatory requirements.

UAE as a preferred jurisdiction for VASPs

Overall, for VASPs, UAE’s nuanced and bespoke framework offers both regulatory and operational clarity. For example, VARA’s regulatory framework discusses in detail the specific requirements in relation to keys and wallet management, corporate governance, cyber security and information security. For crypto exchanges, VARA’s laws also provide clarity on margin trading. Knowing the specific measures that a VASP can take to comply with the regulatory requirements can be a major relief, particularly in a global environment where VASPs are being shunned.

UAE’s futuristic approach towards the regulation of VASPs has catapulted the region into a global hub for the sector. UAE is now home to leading global players, such as top crypto exchanges as well as traditional financial companies foraying into virtual assets products and services. Licensed VASPs stand to benefit immensely from this ecosystem.

KARM Legal Consultants is a UAE-based law firm that advises companies in the tech sector including VASPs, fintech and emerging technologies domain.

Praveena Pechetti is Senior Associate and Bryce Mendonca is Associate at KARM Legal Consultants.

• Business