The new DFSA company-led suitability model and AML criteria may make it impossible for licensed enterprises to explain why they support assets that protect privacy.
The Dubai Financial Services Authority (DFSA) changed its rules for crypto tokens in a dramatic way. Now, organisations who are licensed to conduct business in the Dubai International Financial Centre (DIFC), which is Dubai’s free economic zone for finance, are in charge of evaluating if crypto tokens are right for them.
From regulator approval to firm-level accountability
Companies that offer financial services that use crypto tokens must now check to determine if the tokens they work with meet the DFSA’s guidelines for appropriateness. On Monday, these new rules took effect. As part of the change, the DFSA will no longer maintain or publish a list of accepted crypto coins.
The renovation comes after a consultation process that began in October 2025. It reveals that the regulator’s plan has altered since it started its crypto token program in 2022. Since then, the DFSA has been keeping a close eye on things and talking to stakeholders to make sure the framework stays in line with what is done throughout the world.
DFSA’s managing director of policy and legal stated that the changes are part of a planned move towards a more flexible and principle-based strategy. The DFSA’s changes to the crypto token regime demonstrate our openness to new developments. According to Robins, the company prioritises innovative concepts and promptly adapts to market shifts and feedback.
The DFSA’s new laws don’t indicate that any one sort of digital asset is against the law. Still, the changes give licensed enterprises that work in the DIFC the power to decide if tokens are acceptable instead of the regulator.
Implications for privacy-enhancing digital assets
The DFSA’s new rules may make it easier to look at privacy-focused tokens like Monero (XMR $571.13) and Zcash (ZEC$406.44), even though there isn’t a definite ban on them. Some internal compliance teams may think that some privacy tokens are riskier, which could lead companies to perform additional study or not use them at all.
The reform also changes a lot about how jurisdictions work. The DFSA is in charge of financial services in the DIFC. This is different from Dubai’s onshore regulatory framework, which follows common law.
Several sections of Dubai and the UAE are run by several crypto regulators, each with its own set of rules.
Contrasting approaches among UAE regulators
The DFSA’s principles-based approach is considerably different from what other groups in Dubai are doing.
Issuing “anonymity-enhanced cryptocurrencies” or doing any other virtual asset operations related to them is illegal in VARA’s jurisdiction, which includes most of Dubai outside of DIFC.
There are still no clear restrictions concerning cryptocurrencies in the remainder of the UAE. The Abu Dhabi Global Market (ADGM), which runs Abu Dhabi, is careful and based on risk. It doesn’t outright forbid anything. Federal officials, on the other hand, are more concerned with making sure that corporations follow rules against money laundering (AML) and funding terrorism (CTF).
For this reason, crypto assets that guarantee privacy are legal in some regions of the UAE. However, how they are viewed is very different from one place to another.