DFSA Crypto Token rules after 12 January 2026: the list is gone

The DFSA's Crypto Token framework has applied since 2022 and sits in GEN Rule 3A of the DFSA Rulebook. Its taxonomy is the part most summaries miss: a Crypto Token is a Financial Instrument, like a Security or a Derivative - not a licence category. Using one does not in itself amount to providing a Financial Service; what needs a DFSA Licence is carrying on an activity from the GEN Rule 2.2.2 list - dealing, arranging, advising, managing, custody, operating a trading venue - with Crypto Tokens as the instrument (dfsa.ae).

Until this January the regime ran through a gate the regulator held: a prescribed list of Recognised Crypto Tokens, admission by application. The amendments consulted in CP 168 came into force on 12 January 2026 and removed that list entirely. The DFSA's announcement states the new position in one line: firms "may only engage with Crypto Tokens that they have assessed as suitable" in accordance with DFSA requirements. The same package tightened conduct, governance, custody and disclosure safeguards and refined reporting - more freedom on token selection, in exchange for a heavier, auditable duty of care.

Two limits on the headline. Fiat Crypto Tokens - stablecoins - remain assessed by the DFSA itself under its Policy Statement on Fiat Crypto Tokens; no internal assessment substitutes for the regulator's. And the update removed the token gate, not the licensing perimeter: Crypto Token services still require a Body Corporate under GEN Rule 7.2.2, and the DFSA's writ still covers financial services in or from the DIFC only. A genuine relaxation rode along: the thresholds and restrictions on Funds investing directly or indirectly in Crypto Tokens were removed, subject to appropriate suitability assessment and risk management.

What replaced the list is not deregulation but delegation. GEN Rule 3A.2.1 sets the criteria a firm must assess before engaging with any Crypto Token, and the DFSA's Supervisory Guidelines on Assessing the Suitability of Crypto Tokens describe how it expects the exercise to be run. The assessment must exist in writing before the token is touched and be kept under review afterwards - a listing on a major exchange is not an assessment at all.

In supervision this is the file the DFSA will ask for. A firm that cannot produce a reasoned, dated suitability record for each token it deals in, holds in custody or advises on is not meeting the post-January regime - whatever the token's pedigree. The five headings the record must cover are these.

An existing Authorised Firm brings Crypto Tokens into scope by varying its permissions through the DFSA ePortal, priced by activity under FER Rule 2.2.6. A new entrant goes through the standard five-stage authorisation - enquire, apply, evaluate, fulfil, approve - where the in-principle letter at stage four is a conditional gate, not an operating licence: its conditions must be met before the DFSA grants authorisation, and no Financial Service may be provided on the strength of the letter alone. The DFSA publishes no committed processing times - its own service pages list every stage duration as TBC - so treat any end-to-end timeline you are quoted as an estimate, never a rule.

The recurring line matters more than the entry fee. Annual fees under FER Rule 3.2.1 step up when Crypto Tokens are in scope, every firm adds an expenditure-based component - US$1,000 for the first US$1,000,000 of annual expenditure, then US$1 for each additional US$1,000 - and each additional Financial Service adds US$4,000 a year. Base capital comes from PIB Rule 3.6.2 and is a floor, not a target: risk- and expenditure-based requirements can push the real number higher. The table shows the crypto-specific hooks; the full cost stack lives on the landing page linked above.

A quirk of this search landscape is that much of what ranks was written for the old regime. Pages that explain how to apply for recognition of a Crypto Token, quote per-token recognition fees, or advise waiting for a token to be added to the DFSA's list are describing a mechanism that was abolished on 12 January 2026. There is no recognition application to file and no list to join or check.

The trap is not paying a dead fee - it is structural reliance: assuming a token is cleared for DIFC business because it appeared on the pre-2026 list, or holding a launch while waiting for a recognition decision that will never come. Former presence on the abolished list is not a suitability assessment; every token in scope needs its own documented file under GEN Rule 3A.2.1. When in doubt, check the date on the advice against 12 January 2026, and the rule against the current online rulebook (dfsaen.thomsonreuters.com).

None of the above applies one street outside the DIFC. Dubai runs two crypto regulators with a hard territorial line between them: the DFSA regulates financial services in or from the DIFC, while virtual assets everywhere else in the Emirate - mainland and the other free zones - answer to VARA under Dubai Law No. 4 of 2022, which expressly excludes the DIFC from its scope. Neither permission reaches into the other's territory, and neither is a licence for the UAE mainland at large.

Fit follows the client base. A retail-facing token exchange or broker belongs in VARA's perimeter - start from our VARA route map. Institutional models built on Financial Instruments - tokenised securities, dealing or arranging for Professional Clients, institutional crypto custody - sit naturally with the DFSA, whose regulated population passed 1,050 firms in 2025 with 182 new licences and registrations (DFSA Annual Report 2025); retail permission there is an endorsement that costs extra, at US$20,000 on application and US$4,000 a year under FER. For custody, where the DIFC-ADGM-VARA choice is at its sharpest, see our three-perimeter custody comparison.