Securing Digital Finance: An Overview of the UAE’s Payment Token Services Regulation

Key takeaways:

• The CBUAE has issued new regulations prohibiting services with respect to stablecoins, including their issuance, custody, transfer, or conversion, without a licence or registration from the CBUAE.
• The Regulation provides a framework for licensing or registration for the issuance, custody and transfer, and conversion of stablecoins.
• All entities incorporated within or catering to the UAE are prohibited from conducting any service related to any virtual asset that may be designated as a means of payment by the CBUAE without a licence or registration from the CBUAE. However, entities in the ADGM and DIFC that do not cater to the rest of mainland UAE and deal in non-AED-based payment tokens are exempt from the licensing and registration requirements.
• Licences issued to virtual asset service providers are likely to become obsolete when conducting business in the local UAE market.
• The Regulations provide a one-year transition period, which the CBUAE can extend at its discretion.
• Fiat-referenced Virtual Asset Issuance Rules published by VARA are now in flux. VARA-regulated entities may have to obtain dual licensing/registration from the CBUAE and VARA for using or providing services involving stablecoins pegged to foreign currencies unless further clarification is issued by the regulators.

I. Background

In recent years, digital assets and cryptocurrencies have significantly transformed the global financial landscape. Among these innovations, Payment Tokens or stablecoins have emerged as important elements of the digital economy.

The Central Bank of the United Arab Emirates (“CBUAE”) has published a new regulation, “Payment Token Service Regulation”^[1] (the “Regulation”), laying down the rules and conditions established for granting a licence or registration for the provision of Payment Token Services and related matters.

II. Understanding the Terms

Payment Token[2] means a virtual asset which maintains a stable value by referencing the value of (a) the same fiat currency in which the Payment Token is denominated in; or (b) another Payment Token, also denominated in the same fiat currency. The CBUAE has also been given the power to designate any token as a Payment Token.

Payment Tokens are classified into the following two categories:

• A Dirham Payment Token is a Payment Token whose value is denominated in Dirham (AED) or issued by a Dirham Payment Token Issuer.[3]
• Foreign Payment Token is a Payment Token whose value is denominated in a foreign currency, not AED.[4]

Further, the three categories under Payment Token Services are recognised as:[5]

• Payment Token Issuance[6] refers to the first occasion a Payment Token, including tokens generated by the issuer for distribution to the public, is sold or transferred.
• Conversion of Payment Tokens[7] refers to the exchange of Payment Tokens for other tokens, fiat currencies, or other assets, including the conversion to different types of Payment Tokens or to traditional currencies.
• Custody and Transfer of Payment Tokens[8] involves the safekeeping and movement of Payment Tokens on behalf of customers, ensuring secure storage and transfer between parties as needed.

The transition period of one year[9]

Notably, the restriction on activities and promotions mentioned above is subject to a one-year transition period from the Regulation’s commencement date. Therefore, the penalties and sanctions for violation of the Regulation will only be attracted after one year.

III. Categorisation of the Licence and Registration

Any person[10] intending to provide Payment Token Services in the UAE must apply for one or more of the following categories of licences[11]:

• Dirham Payment Token Issuer
• Payment Token Custodian and Transferor
• Payment Token Conversion

Entities incorporated in the ADGM or DIFC have been provided with the option of obtaining the following registrations for conducting services outside the UAE:

• Foreign Payment Token Issuer:[12] If an issuer incorporated in ADGM and DIFC is performing Payment Token Issuance for a Foreign Payment Token, they may apply for registration as a Foreign Payment Token Issuer.
• Foreign Payment Token Custodian and Transfer: Virtual Assets Exchange Platform Operators, Banks, and Exchange Houses may apply for a Non-Objection Registration to perform Payment Token Conversion or Custody and Transfer.[13]

For the purposes of ease and convenience, the licensing and registration regime under the Regulations has been explained through the flowchart below:

     IV. The Prohibitions

• Prohibition 1: All services related to Payment Tokens

The Regulation prohibits all entities from performing Payment Token Issuance, Custody and Transfer, and Conversion (terms explained in Section 3 of this article) without a licence or registration from the CBUAE to provide such services.[14]

• Prohibition 2: Services related to all virtual assets used as ‘means of payment’

The Regulation also prohibits all entities from performing any service in the UAE related to all virtual assets similar to Payment Tokens, i.e., virtual assets that can be used as a store of value, medium of exchange and unit of account.[15] This prohibition has been included to apply to all entities to whom a Virtual Asset activities licence has been granted by the Securities and Commodities Authority (“SCA”) or the Virtual Assets Regulatory Authority (“VARA”) in Dubai. The CBUAE also has the power to designate any virtual asset as a ‘means of payment’, which would extend the prohibition to that virtual asset expressly.

• Prohibition on merchants in UAE from accepting virtual assets

Merchants and other businesses in the UAE are also restricted from accepting virtual assets as payment unless the asset is a Dirham Payment Token issued by a Licensed Payment Token Issuer or a Foreign Payment Token issued by a Registered Foreign Payment Token Issuer^[16] and is being used to purchase a virtual asset or its derivative.^[17]

• Exception: Entities incorporated and offering their service in the DIFC, ADGM and outside the UAE

The above prohibitions do not apply to entities dealing in non-AED-based Payment Tokens issued by entities incorporated in the DIFC, ADGM or outside the UAE. This exemption is subject to these issuers not catering to any individual or entity in the UAE (other than in the DIFC and ADGM). As such, if an issuer is licensed by the Financial Services Regulatory Authority and/or the Dubai Financial Services Authority and plans to offer these tokens in mainland UAE, obtaining a prior licence or registration from the CBUAE will be required.

V. Impact on the Emirate of Dubai: Uncertainty with VARA Licences

VARA, which has been considered a premier regulator for virtual assets in Dubai, will be affected by the new Regulation. As the new Regulation provides that no activities related to any virtual assets used as ‘means of payment’ or ‘Payment Token’ can be carried out in mainland UAE without a licence from the CBUAE, the validity and applicability of licences issued by VARA are now in flux.

Even though an entity licenced by VARA as a Custody Service Provider has been given the option of applying for a No-Objection Registration,[18] without such registration, VARA-regulated VASPs will not be able to provide Payment Token-related services despite holding valid licences from VARA, unless further clarification is issued by the regulators.

A previous dual-licensing instance with the SCA

Despite this uncertainty, a similar situation arose in early 2023 when the SCA issued regulations pertaining to cryptocurrency, raising questions about dual licensing between the SCA and VARA. This was quickly followed up by a Cabinet Resolution, in which the SCA officially delegated authority for licensing within the Emirate of Dubai to VARA.

We hope a similar update will be underway soon, clarifying VARA’s position vis-à-vis the CBUAE and the Regulation.

VI. Capital Requirements

A Licensed Payment Token Issuer is required to maintain specific regulatory capital to ensure their financial stability. This includes (a) an initial and ongoing capital of at least fifteen (15) million Dirhams; and (b) additional ongoing capital of at least 0.5% of the face value of their outstanding Payment Tokens in Fiat Currency.

Further, a Licensed Payment Token Service Provider involved in Payment Token Custody and Transfer or Payment Token Conversion must maintain regulatory capital based on the monthly average value of Payment Token Transfers: (a) if the monthly average value is 10 million Dirhams or above, the provider must hold at least 3 million Dirhams in regulatory capital and (b) if the monthly average value is less than 10 million Dirhams, the provider must hold at least 1.5 million Dirhams in regulatory capital.

VII. Repercussions and Conclusion

The introduction of the Regulation by the CBUAE represents a significant milestone in regulating digital financial services within the region. This Regulation’s implications are far-reaching, affecting various aspects of the virtual asset service industry.

Service providers using stablecoins, such as USDT, USDC, etc., face further challenges under the new Regulation. Even if a service provider is registered or licenced by the CBUAE, it cannot use these stablecoins unless the underlying issuers are approved by the CBUAE.

While the Regulation introduces compliance and operational challenges, it enhances the digital payment ecosystem’s security, stability, and trustworthiness. Service providers must carefully navigate these new regulatory requirements to operate within mainland UAE successfully.

For existing VARA-regulated (or soon-to-be-regulated) entities, we strongly recommend seeking advice to confirm whether or not CBUAE registration and/or licensing may be essential for your operations to continue.

***

TLP Advisors is a dynamic and forward-thinking consulting, strategy and law firm specialising in providing cutting-edge solutions to our diverse clientele. With our roots deeply embedded in financial services, gaming, web3, and emerging tech, we offer unparalleled knowledge and support tailored to these rapidly evolving sectors’ unique challenges and opportunities.

TLP Advisors has consistently been the firm of choice for L1 chains, DeFi protocols, gaming companies, fintech and payment companies, foundations, funds, and investors. We have built a reputation for excellence through frequent collaborations with regulators, funds, and technology incubators. Our deep understanding of the intricate regulatory landscapes and industry dynamics allows us to provide strategic guidance and innovative solutions that empower our clients to navigate complex challenges and seize emerging opportunities.

www.techlawpolicy.com

[1] Circular No. 02/2024, the “Payment Token Services Regulation”.

[2] Part 2, Article (1), Section 51, Payment Token Services Regulation.

[3] Part 2, Article (1), Section 24, Payment Token Services Regulation.

[4] Part 2, Article (1), Section 35, Payment Token Services Regulation.

[5] Part 2, Article (1)(59), Payment Token Services Regulation.

[6] Part 2, Article (1)(58), Payment Token Services Regulation.

[7] Part 2, Article (1)(52), Payment Token Services Regulation.

[8] Part 2, Article (1)(52), Payment Token Services Regulation.

[9] Part 10, Article (40), Payment Services Regulation.

[10] “Person” includes “both natural and juridical persons”, Part 2, Article (1), Section 61, Payment Token Services Regulation.

[11] Part 4, Article (5), Payment Services Regulation.

[12] Part 2, Article (2), Section 37, “Foreign Payment Token Issuer” means “Payment Token Issuer that is Registered pursuant to Article (5)2”.

[13] Part 4, Article (8), Payment Token Services Regulation.

[14] Part 3, Article (2), Section 1, Payment Token Services Regulation.

[15] Part 3, Article (3), Section 1, Payment Token Services Regulation.

[16] As per Part 2, Article (2), Section 38, “Foreign Payment Token Registration” means “a registration granted by the Central Bank to an Applicant registered and located outside of the UAE (which for the purposes of this Regulation would include a juridical person incorporated and located in a Financial Free Zone) to perform Payment Token Issuing with respect to Foreign Payment Tokens, pursuant to Article (5)2, and Foreign Payment Token Registree refers to a Foreign Payment Token Issuer holding a valid Foreign Payment Token Registration”.

[17] Part 3, Article (2), Section 7, Payment Token Services Regulation.

[18] Part 4, Article (8), Section 3 of the Regulations