Guide · updated 08.09.2026 · 17 min read · Lucent Legal team

Is P2P Crypto Legal in Dubai? Where a Private Sale Ends and a Criminal Case Begins

You sold a friend some USDT for dirhams, and a week later your bank asks where the money came from. A one-off deal between two people needs no licence. Do it regularly and the regulator calls it a business, and unlicensed business in Dubai costs an individual up to AED 20 million.

Short answer

• The legal base changed completely. The AML statute is Federal Decree-Law 10/2025, not 20/2018. The Central Bank statute is 6/2025, not 14/2018. The federal regulator is the CMA, not the SCA. Anything still citing the old three quotes repealed law.
• In Dubai, virtual asset activity is licensed by VARA across the emirate including free zones, but excluding the DIFC. Outside Dubai it is the CMA, in the DIFC the DFSA, in ADGM the FSRA.
• The prohibition reaches private individuals. In VARA's rulebook, "Entity" means any legal entity or individual. The only exemption is for government bodies.
• The dividing line is the "by way of business" test. VARA looks at three things: whether you hold yourself out as running the activity, the regularity and scale of it, and whether there is a commercial element such as a spread or a fee.
• Penalty for unlicensed activity: an individual, up to the higher of AED 20,000,000 or 200% of profits gained; a company, up to AED 50,000,000, 15% of annual revenue, or 300% of profits.
• The biggest change for P2P is Article 2(3) of the new AML law. Knowledge that funds are criminal proceeds can now be inferred from objective circumstances. "I never asked where the cash came from" is no longer a defence.
• There is no confirmed case in the UAE of a private individual being prosecuted for a one-off casual swap. Every published case involves organised networks or cash-for-crypto shops.

How this interacts with tax: crypto tax and cashing out in the UAE.

What changed in 2025 and 2026

Three laws most English-language articles on UAE crypto still cite are no longer in force.

The federal regime for virtual asset service providers was rewritten too. CMA Decision No. 4/R.M/2026, issued 13 February 2026, replaced the SCA framework in full: eight licensed activities, paid-up capital of AED 500,000 to AED 4 million, and until 13 February 2027 for existing licence holders to comply.

Dubai Law No. 4 of 2022 on virtual assets survived unchanged. For the wider picture, see the guide on crypto law in the UAE.

One date is worth marking. The transition period under the new Central Bank Law runs out on 16 September 2026. After that, a licensed financial activity needs a licence or has to stop.

Where the line runs

Any swap of crypto for dirhams falls inside VARA's definition of Exchange Services: "conducting an exchange, trade or conversion between Virtual Assets and fiat currency". It makes no carve-out for private individuals. Selling for your own account can also fall under Broker-Dealer Services.

What saves an ordinary person is the business test. VARA's regulations bar carrying out any virtual asset activity by way of business without a licence, and list three factors:

1. Whether the person holds themselves out as running the activity as a business. Adverts, a Telegram channel, a published rate.
2. The regularity, scale and continuity of the activity.
3. A commercial element: remuneration, a spread, or value in kind.

VARA decides whether the test is met at its "sole and absolute discretion". There is no numeric threshold. No transaction count and no dirham amount has been named safe.

A single sale to someone you know, at the market rate, no markup, triggers none of the three. Three or four deals a month at a spread, advertised in a group chat, triggers all three at once.

There is a separate trap at federal level. Cabinet Decision No. 111 of 2022, Article 4(4), bars dealing with any person carrying on virtual asset activities without a licence. No business test, no minimum. It bites the buyer, not only the exchanger.

Unlicensed crypto exchange in the UAE: the penalty

Dubai Law 4/2022 names no figures. Article 20 delegates that to VARA board resolutions. The numbers sit in Schedule 3 to VARA's regulations, under the ground "carrying out VA Activity(ies) in violation of Regulation III.A.1, e.g. without being authorised and Licensed by VARA":

• Individual: up to the higher of AED 20,000,000 or 200% of profits gained or losses avoided.
• Company: up to the higher of AED 50,000,000, 15% of annual revenue, or 300% of profits.
• An unpaid fine grows 1% per month, compounding.

On top of the fine, VARA can suspend a permit for up to six months or revoke it and have the commercial licence cancelled with it. Its officers hold law enforcement capacity and can call in the police.

The federal layer adds its own menu. Cabinet Decision 111/2022, Article 12: a warning, suspension of trading, shutting down a platform, barring a natural person from any related function, closing the premises, a fine of up to AED 10 million or equal to the proceeds, and referral to the Public Prosecution.

A warning about secondary sources. Several legal-services websites claim Article 17 of Dubai Law 4/2022 creates criminal liability with fines up to AED 50 million. Article 17 is about the assignment of a permit. Those figures are invented.

Selling USDT for cash and the Central Bank Law

The second layer of risk is heavier than the first. Federal Decree-Law 6/2025, Article 60(1): "No Person may carry on any of the Licensed Financial Activities without obtaining the required license." The list in Article 61(1) includes "providing currency exchange and money transfer services, including instant money transfer services" and "providing payment services using Virtual Assets".

The sanction: imprisonment and a fine of AED 50,000 to AED 500,000,000, or either one of those. The separate administrative fine for carrying on or promoting financial activities without a licence is not less than AED 1,000,000.

Selling an asset you own is not formally a money transfer. But someone who routinely takes cash from one person and hands USDT to another is functionally running a hawala, which has needed a Central Bank certificate since 2019, for a resident natural person as much as a company. Where the boundary sits between selling an asset and transmitting value has not been explained.

Why your bank asks where the money came from

The new AML law lowered the standard of proof. Article 2(3) lets knowledge that funds are criminal proceeds be inferred from factual and objective circumstances.

The old law required actual knowledge. Now the circumstances argue against the seller on their own: a rate better than the market, urgency, an unknown counterparty, a refusal to show where the cash came from.

Article 26 penalties for a natural person run from one to ten years' imprisonment plus a fine of AED 100,000 to AED 5,000,000, or the value of the criminal property if greater. The aggravated form runs from AED 1,000,000 to AED 10,000,000, or twice that value.

The Central Bank has published a policy paper on stablecoin risk in which P2P and OTC "merchants" appear as a risk typology in their own right. Its red flags are what open a file on your account:

• the counterparty identifies himself by a messenger handle instead of the name of a licensed company;
• stablecoins bought with cash and then deposited straight onto an exchange;
• incoming funds from parties absent from the public registers of the CBUAE, CMA, VARA, DFSA and FSRA;
• regular cash deposits timed against transfers to crypto exchanges.

There is no blanket banking ban on crypto. RAKBANK has sold bitcoin, ether, SOL and XRP for dirhams in its own app since July 2025, through a VARA-licensed broker. The pattern draws scrutiny, not the asset.

What enforcement actually looks like

VARA's public enforcement register held 34 published actions by January 2026. Among them:

• 7 October 2025: 19 firms fined AED 100,000 to AED 600,000 each for unlicensed virtual asset activity and marketing breaches, with cease-and-desist orders.
• May 2023: the OPNX exchange, AED 10 million on the company and AED 200,000 on each of four executives.
• December 2024: a Dh180 million laundering scheme run through cryptocurrency with unlicensed intermediaries. Thirty individuals and three companies were referred to the Money Laundering Court and accounts were frozen.

None of the published cases involves a private person swapping with a friend. Every one involves an organised network or a shopfront operation. That gap is worth stating plainly rather than hinting at a precedent that does not exist.

The UAE left the FATF grey list in February 2024, and a further on-site assessment is expected during 2026. That is why compliance pressure inside UAE banks keeps rising.

Cash rules: what is allowed and what has to be declared

• There is no cap on cash in a private transaction between individuals. Nothing equivalent to the European cash payment limits exists.
• The border declaration threshold is AED 60,000 or the equivalent, in both directions. It covers currency, bearer negotiable instruments, precious metals and precious stones. Since 14 October 2025 the duty sits in Article 10 of the AML law itself, with the penalty in Article 34.
• The reporting threshold for regulated sectors is AED 55,000: dealers in precious metals and stones, and real estate deals, including where payment is in virtual assets.
• Virtual assets are not named in the border declaration rules, as included or excluded.

How to lower your risk

1. Trade through a licensed venue. VARA's public register showed 36 active entries on 8 September 2026, among them Binance FZE, OKX Middle East Fintech, Foris DAX Middle East (Crypto.com), Deribit FZE, BitOasis, Bitpanda, HashKey MENA and Zand Bank. Check it on the day you trade, and check the category: a broker-dealer licence is not an exchange licence.
2. Ask your counterparty for a licence number. What the licence involves and costs is covered in the guide on the VARA licence in Dubai. An exchanger who will not give a number, and is not in the register, is operating outside the law by definition.
3. Keep paperwork on every deal. The order screenshot, the exchange statement, the transfer reference. That is what a bank asks for six months later.
4. Refuse a rate better than the market. A markup in your favour is the first thing a compliance officer asks about, and one of the circumstances Article 2(3) lets a prosecutor rely on.

If an account is already frozen: frozen bank account in the UAE and when a bank closes your account. If a counterparty took your crypto and disappeared, see reporting fraud in the UAE.

Grey zone: what the law does not say

• The "by way of business" test has no numeric threshold. That a single trade is lawful follows from reading the regulations, but no regulator has confirmed it in guidance.
• Article 4(4) of Cabinet Decision 111/2022 bars dealing with an unlicensed person, with no minimum and no business test. How that sits alongside Dubai's test has never been explained.
• Nobody has said how much diligence is enough for a private seller. An individual has no KYC duty and no access to the reporting system, yet the objective knowledge standard still applies.
• Two private individuals in different emirates or zones: whether VARA, the CMA or the DFSA governs the deal does not follow from the texts.

Topic: Crypto & Digital Assets in the UAE 2026

This material is for information only and is not legal advice. UAE law changes — a lawyer will assess how it applies to your situation.