Regulating crypto has never been more important in this highly dynamic, emerging industry
2022 has been a very eventful year for the cryptocurrency industry. It had its share of global headlines: from the collapse of Sam Bankman-Fried’s FTX, an insider trading scandal at Coinbase, and a prolonged downturn in cryptocurrency prices. Nevertheless, digital currencies continue to gain increasing acceptance, with the benefits of cryptocurrencies and its underlying blockchain technology remain compelling for end users and investors globally. These trends highlight the critical role of regulation to safeguard customer assets, protect investors and significantly limit instances of fraud.
The UAE is at the forefront of crypto regulations having established the legal framework across jurisdictions within the country
The UAE has had recent major developments in establishing the regulatory framework for virtual assets. At the national level, the UAE government issued Cabinet Resolution No. (111) of 2022 Concerning the Regulation of Virtual Assets and their Service Providers, effective from January 2023,
to regulate the virtual asset sector by mandating the licensing of specific virtual asset activities by the Securities & Commodities Authority (SCA) of the UAE or the local licensing authorities of specific Emirates. The said cabinet resolution does not apply to virtual assets activities regulated in a Financial Free Zone.
It is worth noting that regulatory oversight is mandated under different authorities whether companies are onshore or offshore, i.e. located in one of the UAE’s free zones. In the case of virtual asset service providers, the most popular free zones are the DIFC, the ADGM and the DMCC.
For on-shore companies, players in the UAE financial and capital markets are primarily governed by the Central Bank of the UAE (CBUAE) and the Securities and Commodities Authority (SCA). UAE Onshore Companies are governed by SCA’s Decision No. 23 of 2020 concerning Crypto Assets Activities Regulation (CAAR).
CAAR also lays down AML/CFT requirements. CAAR provisions require reporting entities to:
- Set up a solid AML/CFT compliance framework.
- Define policies and procedures for KYC and AML monitoring.
- Ensure that the deposits and withdrawals are made only from and to a designated bank account of the entity, and the bank account must be maintained with an authorized financial institution. The SCA must have explicitly approved it if it’s a foreign financial institution.
- Ensure that the crypto assets are traceable.
For onshore companies in Dubai, the Virtual Asset Regulatory Authority (VARA) was established under Virtual Asset Law No. 4 of 2022. VARA was mandated to oversee the VASPs operating from the Emirate of Dubai (except for the units registered in the Dubai International Financial Centre).
On 7th February 2023, VARA recently released a detailed VASP Compliance and Risk Management Rulebook. Salient principal AML compliance aspects of the Rulebook are as follows:
- Appointment of Money Laundering Reporting Officer with minimum 2 years of experience – essential as such officer will have to foster the AML/CFT and sanctions culture in the business.
- Conducting AML Business Risk Assessment – evaluating risks of products, services, transactions, customers, and locations of businesses.
a. It is a process of identifying threats to entities from financial frauds such as money laundering, terrorism financing, bribery, and corruption.
- Designing and implementing the AML/CFT policies & procedures in line with the VARA Rulebook and related regulations.
- Client Due Diligence – includes screening of clients (KYC), UBOs, virtual asset transactions, and virtual asset wallet addresses.
- Transaction monitoring and STR – to FIU and VARA.
- Compliance with FATF Travel rule – recommends VASPs, including exchanges, banks, OTC desks, hosted wallets, and other financial institutions, to share certain Personally Identifying Information (PII) about the recipient and sender for cryptocurrency transactions over USD/EUR 1,000 globally.
- Maintaining AML records for a minimum of 8 years.
In free-zones where there is 100% foreign ownership, the following authorities have established the following legal and regulatory frameworks and regulations:
- DIFC / DFSA
- ADGM / FSRA
- DMCC
The DFSA is a supervisory authority for the companies housed in DIFC. The DFSA has came out on the 8th of March 2022 a Consultation Paper No. 143 for regulating crypto tokens. In October 2022, a Feedback Statement on this Consultation Paper was released which covers the AML/CFT regime (e.g., travel rule, account monitoring requirements, risk assessment, enhanced customer due diligence, and training).
The Financial Services Regulatory Authority (FSRA) is a supervisory authority for the companies housed in Abu Dhabi Global Market (ADGM). The FSRA came out with a regulatory framework in 2015 concerning the crypto asset businesses.
In September 2022, FSRA issued a document laying down the guiding principles around its approach to Virtual Asset Regulation and Supervision for virtual assets companies operating or planning to set up VA units in ADGM.
These guiding principles suggest the high-level approach that FSRA would adopt to regulate the operation of the virtual asset in ADGM, focusing on maintaining the stability of the ADGM’s ecosystem, the risk associated with VA, protection of the customers using VAs and the ease of entry to new VA players in ADGM.
The Dubai Multi Commodities Centre (DMCC) opened a crypto centre, and it houses VASPs offering, issuing, listing, and trading crypto assets and it also welcomes companies developing blockchain technology platforms.
The laws and regulations established in the UAE address the major players in the crypto industry and their underlying products/assets.
The laws and regulations established in the UAE and their respective regulatory bodies cover the following players in the industry:
- Exchanges
- Virtual Asset Platform operation and management services,
- Exchange services between one or more forms of virtual assets,
- Virtual Asset transfer services,
- Brokerage services in virtual assets trading operations,
- Virtual Asset custody, management, and control services, and
- Financial services related to offering and/or selling by the issuer to the Virtual assets or participating in providing those services.
The UAE, per Cabinet Resolution 111 of 2022, defines “virtual assets” as:
“A digital representation of the value that can be traded or transferred digitally, can be used for investment purposes, and does not include digital representations of paper currencies, securities or other funds.”
The most common example of VA is virtual currencies such as Bitcoin, Ether, Dogecoin, and Stablecoins.
The laws and regulations established in the UAE focus strongly on AML and CFT and compliance with these regulations
The basic reform in this AML/CFT regime in the UAE really has accelerated after the Financial Action Task Force (FATF) issued in the 2018 Mutual Evaluation Report which finds that the UAE needed a significant enhancement to its AML/CFT laws and framework for combatting financial crimes.
Since the report was issued, the UAE was strongly committed in introducing raft measures to enhance its financial crime credentials and this includes the introduction of the new AML law and various other more practical measures that includes establishment of its own national financial action task force and specialized anti-money laundering court in Dubai.
- Cabinet Resolution No. (111) of 2022 Concerning the Regulation of Virtual Assets and their Service Providers.
- The Federal Decree-Law No. (20) of 2018 On Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organizations.
- Federal Decree-Law No. (26) of 2021 amending certain provisions of Law No. 20 for 2018 On Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organizations. Earlier, the original Decree Law provided that only Financial Institutions and the specified DNFBPs (Designated Non-Financial Businesses and Professions) would be subject to AML/CFT regulations. With amendments coming in, the AML/CFT rules and regulations also apply to Virtual Asset Service Providers.
- Cabinet Decision No. (10) of 2019 concerning the implementing regulation of Decree-Law No. (20) of 2018, as amended by Cabinet Resolution No. (24) of 2022. By amending the Cabinet Decision, the AML/CFT provisions are also made applicable to the Virtual Asset Service Providers.
- Cabinet Decision No. (74) of 2020 Regarding Terrorism Lists Regulation and Implementation of United Nations Security Council (UNSC) Resolutions on the Suppression and Combating of Terrorism, Terrorist Financing, Countering the Proliferation of Weapons of Mass Destruction and its Financing and Relevant Resolution.
- VASP Compliance & Risk Management Rulebook issued by Virtual Asset Regulatory Authority of Dubai (VARA).
As entities being subject to AML/CFT regulations in UAE, VASP would be required to adhere to the following requirements to identify ML/FT risk and mitigate the same:
- Appoint the Compliance Officer to manage the AML/CFT program in the company.
- Maintenance of AML/CFT policy designed considering the applicable regulations, money laundering and terrorism financing risk the VASPs are exposed to, VA-related red-flag indicators, etc.
- Conducting business risk assessment from ML/FT risk perspective (using a risk-based approach) and identifying the risk the VASP is exposed to and the controls in place to mitigate it.
- Customer screening, risk categorization, and performance of adequate due diligence (generally enhanced, owing to the inherent nature of the VA).
- Screening of Virtual Asset transactions and the Virtual Asset wallet address.
- Reporting suspicious transactions and activities to the authorities.
- Imparting adequate training to the employees and senior management.
- Periodic audit of the AML/CFT framework adopted for the company by an independent team.
- Annual risk assessment reporting.
Combined with its advanced broader financial ecosystem, business environment and first-class infrastructure, the UAE offers an attractive proposition for cryptocurrency companies and players from all over the world to come here and operate in the country
By now everyone knows that the UAE has shifted its weekend from Friday/Saturday to the global norm of Saturday/Sunday and this has reinforced the UAE’s position as a global financial hub. With the business environment, safety and first-class infrastructure and connectivity, we expect more cryptocurrency companies and players to come and operate in the city. The regulatory landscape is established and the conditions for success are in place to make the UAE a leader in the crypto and blockchain industries not just regionally but globally as well.
As a result of the UAE’s forward thinking in the crypto industry, it has managed to attract major names such as Binance to base itself in Abu Dhabi. Many other cryptocurrency companies have made the UAE their home with many others planning to move here, such as Bybit, crypto.com, Deribit. (source: https://www.zawya.com/en/economy/gcc/dubai-ranked-2nd-most-crypto-ready-city-in-the-world-cdlojhsk). These regulations have led to Dubai to be recognized as the 2nd most crypto ready city in the world after London, based on a study by Recap, highlighting its push to become the leading centre for cryptocurrency and blockchain technology in the Middle East and the multiple new laws for crypto exchanges to operate in the city.
For further information on this, please get in touch with the authors of this article, Vida Grace Serrano who can be contacted on [email protected] or Suneer Kumar who can be contacted on [email protected]