Author: Shao Jiadian, Mankun Blockchain Legal Services
Consider this scenario: An Asian merchant has set up a sales company in Dubai and wants to receive payments in dirhams. Local buyers hold USDT, and an Asian payment institution plans to accept the tokens at checkout, convert them into dirhams, and then pay the proceeds to the merchant. If the institution holds only a transfer and settlement license from Dubai’s Virtual Assets Regulatory Authority (VARA), can it legally operate this business model?
Crypto payments in Dubai may be more complicated than they seem. A buyer may click the pay button just once at checkout, but behind the scenes the platform must receive the tokens, convert them, and settle the payment to the merchant in fiat currency. If the platform plans to handle all these steps itself, a single VARA license may not be enough. This article follows the payment through each stage to examine how far VARA’s licensing requirements extend, and when a license or registration from the Central Bank of the UAE may also be required.
When is a VARA licence alone enough?
Transferring BTC on behalf of investment customers and accepting USDT at a goods checkout can both involve on-chain transfers. To determine whether a VARA licence is sufficient, first distinguish whether the platform is transferring investment assets or processing a payment for goods.
In mainland Dubai and free zones under VARA’s jurisdiction, institutions that deal only in the investment, crypto-to-crypto trading, and related custody and transfer of non-payment tokens such as BTC and ETH—and do not handle payments for goods, currency conversion, remittances or other financial services regulated by the Central Bank—do not need a separate Central Bank payment licence or registration for those activities alone.
Trading, custody and transfer each fall under a corresponding VARA licence scope and must be provided by an entity authorised to conduct that activity.
The new Central Bank Law, which came into force on 16 September 2025, also distinguishes investment from payment. Article 61 includes the provision of payment services using virtual assets among the financial activities requiring Central Bank authorisation. Article 187 excludes virtual assets used for investment, crypto-to-crypto exchange or trading swaps from the scope of that Central Bank Law; the relevant activities remain subject to other applicable rules.
When virtual assets are used to make payments or are converted into currency, that article requires compliance with the Central Bank’s regulations for the relevant activities. If the platform exchanges payment tokens such as USDT, it must also consider the Central Bank’s Payment Token Services Regulation.
The VARA transfer and settlement licence held by this institution covers services that transfer virtual assets between wallets, addresses or different entities. VARA’s rules, effective from 19 June 2025, require licensed institutions to also comply with applicable Central Bank payment and remittance regulations. Cross-border transfers and settlements must be legally permitted and completed in every jurisdiction involved in the transaction.
Diagram: Comparing the business boundaries of the VARA and UAE Central Bank regulatory frameworks
Can the buyer pay in USDT while the merchant receives dirhams?
If a buyer sends USDT directly to a mainland Dubai sales company to pay for ordinary goods, this route is not permitted. Under Clause 2(7) of the Central Bank’s Payment Token Services Regulation, local merchants accepting payment for ordinary goods or services in tokens may accept dirham payment tokens issued by a Central Bank-licensed issuer. Under this clause, foreign-currency payment tokens issued by a registered issuer may be used only to purchase virtual assets or their derivatives.
A store in Dubai has already piloted accepting a dirham payment token. In September 2026, Network International piloted DDSC at the Marks & Spencer store in Dubai Festival City. Buyers scan the checkout terminal’s QR code using a DDSC-enabled wallet, and the merchant can choose to receive DDSC in a wallet or settle in dirhams.
The pilot used a dirham payment token issued by a Central Bank-licensed issuer.
What if the buyer pays in USDT and a payment institution converts it into dirhams before paying the merchant? If the platform knows that the buyer is using USDT to pay for ordinary goods while the platform provides a service regulated by the Payment Token Services Regulation, Clause 2(4) does not allow a licensed or registered institution to process that transfer as part of providing payment token services. The fact that the merchant ultimately receives dirhams does not change the purpose of the USDT transfer.
If the buyer separately converts the funds through a compliant channel and then pays for the goods in fiat currency they control, the conversion and payment must each be handled under their respective rules. Whether the two activities are independent in practice depends on who controls the conversion proceeds and when the payment for the goods is settled.
There are also products on the market that confirm payment on a crypto-asset platform while settling with the merchant in dirhams. In August 2026, Dubai Duty Free launched Crypto.com Pay in its physical stores and on its website. Eligible UAE residents can authorise payment at checkout using their Crypto.com account, while Dubai Duty Free receives dirhams.
Foris DAX Middle East FZE, which provides this service, holds a VARA virtual asset service licence and a UAE Central Bank Stored Value Facility (SVF) licence. Crypto.com’s UAE website explicitly states that Crypto.com Pay is provided under its SVF licence.
In both arrangements, the merchant can receive dirhams. The DDSC pilot disclosed which token buyers used. The Dubai Duty Free launch announcement, however, did not specify which currency is actually debited in each transaction, at what stage conversion takes place, or the complete flow of funds. Other payment institutions looking to offer similar products still need to consider who handles the buyer’s tokens, who completes the payment, and what services each party is authorised to provide.
If a merchant sells goods directly through an Asian company and the proceeds are ultimately remitted to Asia, the payment institution must still consider where it operates and to whom it provides services. Clause 2(1) of the Regulation covers both payment token services provided within the UAE and services provided to persons in the UAE. Even if the merchant is based abroad, the rules still need to be considered if the platform conducts these services in mainland Dubai or a free zone under VARA’s jurisdiction.
The UAE scope referred to in Article 2 of the Regulation excludes financial free zones such as the Dubai International Financial Centre (DIFC). DIFC is also outside VARA’s jurisdiction; financial services conducted there are subject to the local regulatory regime administered by the DFSA.
What must the platform apply for from the Central Bank if it collects or converts tokens itself?
If the platform plans to collect or convert tokens itself, it must first determine whether the tokens it handles qualify as payment tokens under the Central Bank’s definition. The Payment Token Services Regulation has been in force since 31 August 2024. These tokens mainly refer to virtual assets denominated in fiat currency and that purport to maintain their value by reference to that fiat currency or a payment token denominated in the same currency. Dollar stablecoins such as USDT and USDC are within scope.
Even if the platform has not yet integrated with merchant orders, it must hold the corresponding Central Bank authorisation if its own services fall within the scope of the Regulation and no applicable exclusion or exemption applies.
First, consider how the platform handles tokens. If, in the course of business, it holds payment tokens or the private keys used to hold, store or transfer them on behalf of customers, or receives, holds and transfers payment tokens for customers, this involves payment token custody and transfer. An entity conducting this activity itself generally needs a Central Bank Payment Token Custodian and Transferor licence.
An institution that has already obtained virtual asset custody authorisation from the Capital Market Authority (CMA, formerly the SCA) or a relevant local licensing authority may apply under Clause 8(3) for a no-objection registration for the custody and transfer of foreign-currency payment tokens. A VARA transfer and settlement licence alone does not qualify as custody authorisation. Even if the registration requirements are met, Central Bank approval is still required.
Next, consider who converts the tokens. If, in the course of business, the platform buys or sells payment tokens on a spot basis for consideration, or enables trading parties to post or accept offers to sell, this constitutes conversion under the Regulation. To conduct this activity itself, the platform needs a Central Bank Payment Token Conversion licence or must obtain a no-objection registration through an applicable route.
The registration route under Clause 8(1) is available to operators of virtual asset trading platforms that meet the Regulation’s definition. The Central Bank will verify the platform operator’s qualifications and regulatory status; only after approval may it conduct conversion within the scope of its registration. A VARA transfer and settlement licence alone cannot be used to apply for this registration.
The exclusions in the Payment Token Services Regulation apply to specific activities. If an activity is already licensed under the retail payment or stored value facility rules, or is required to be licensed under those rules, the relevant rules apply. Article 39 of the Regulation contains additional transitional provisions: once the transition period ends, licences issued under the old rules will no longer cover the relevant crypto-asset activities. If a product involves stored value, conversion and transfer, the applicable rules and authorised scope must be checked for each activity.
To apply for either of the two Central Bank licences above, the applicant must be a company established in the UAE, excluding financial free zones (Article 6). If the same company is also intended to conduct other activities, the restrictions on business activities in Article 17 of the Regulation must also be checked.
How do the proceeds get into the merchant’s account?
Even if the proceeds are ultimately credited in dirhams, it matters who handles the fiat collection and settlement. If the payment institution itself provides fiat acquiring, payment aggregation, payment account or funds transfer services to the merchant, it needs a Central Bank licence or other statutory authorisation for those activities; a VARA licence does not cover them. If the proceeds are also to be sent to Asia, the relevant cross-border funds transfer must likewise fall within the authorised scope of the entity actually providing the service.
A merchant can contract directly with a qualified bank or payment institution, which will handle the funds and settlement. If an Asian payment institution performs only activities for which it is authorised and does not itself provide or facilitate the regulated service in question, it does not need to obtain the same authorisation again for services provided directly by its partner. Currency conversion, custody and transfer can also be provided directly by institutions holding the corresponding authorisations.
If currency conversion is part of a VARA transfer and settlement service, the institution must also be licensed by VARA to provide exchange services. An institution based outside the Emirate of Dubai must have VARA’s approval. The institution handling the transfer and settlement remains responsible to the customer for completing that service.
If the Asian payment institution signs the merchant’s collection contract, collects and forwards the proceeds, and handles refunds, while the bank merely provides it with an account and executes transfers, then the Asian payment institution itself is providing the collection service and needs the corresponding authorisation. When discussing the division of responsibilities, review the actual process: who contracts with the merchant, who can access the wallet and account, who receives payment instructions, and whom to contact if the funds do not arrive.
Another arrangement involves providing only an interface or wallet software, with the assets controlled by the customer or a licensed institution. A technology team that meets the relevant exclusion criteria may not need a separate licence for the payment services it supports. Even if the team does not handle funds, it must still assess the applicable rules if it actually provides a regulated service such as payment initiation. Article 62 of the new Central Bank Law also applies to anyone who directly or indirectly conducts, provides or facilitates regulated financial services through smart contracts.
What should the Dubai company do first?
If the Asian payment institution mentioned at the outset changes its checkout page so that buyers pay for goods directly in fiat currency, the first merchants can contract with qualified partners, which will collect and settle the payments directly. The Dubai company can initially handle product integration. Once the business is stable, the institution can consider whether to handle settlement itself.
If the Dubai company plans to collect the proceeds and handle payouts and refunds, it must confirm and obtain the required authorisations before switching over, and adjust the merchant contracts and funds flow accordingly.