Consider this scenario: an Asian merchant establishes a sales company in Dubai and wishes to receive payment in Dirhams. The local buyer holds USDT. An Asian payment institution plans to accept this cryptocurrency at checkout, convert it into Dirhams, and then transfer the funds to the merchant. If the institution only holds a VARA (Virtual Assets Regulatory Authority) transfer and settlement license, can it operate compliantly under this business model?

Operating crypto payments in Dubai may be more complex than anticipated. The buyer clicks “pay” just once on the checkout page, but behind the scenes, the platform must receive crypto, convert it, and settle the funds in fiat currency to the merchant. If the platform intends to handle all these steps internally, a single VARA license might not suffice. This article traces the flow of this payment to clarify where VARA licensing ends—and when additional authorization or registration with the Central Bank of the UAE (CBUAE) is required.

When Is a VARA License Enough?

When a platform facilitates the transfer of BTC for investment clients, or receives USDT at a goods checkout page, both scenarios may involve on-chain transfers. To determine whether a VARA license is sufficient, the first step is distinguishing whether the platform is transferring investment assets—or processing a commercial payment.

In Dubai and VARA-regulated free zones, if an institution solely engages in investment-related activities involving non-payment tokens such as BTC, ETH, including peer-to-peer trading, custody, and asset transfers—without involving commodity payments, crypto-to-fiat conversions, remittances, or other financial services subject to CBUAE oversight—no additional CBUAE payment license or registration is required.

Each activity—trading, custody, and transfer—falls within distinct VARA licensing scopes and must be provided by entities authorized for that specific service.

The new Central Bank Law effective September 16, 2025, explicitly distinguishes between investment and payment activities. Article 61 classifies the provision of payment services using virtual assets as a regulated financial activity under CBUAE jurisdiction. Article 187 excludes virtual assets used for investment, peer-to-peer exchange, or transactional derivatives from the scope of this law, meaning those activities remain governed by other applicable rules.

When using virtual assets for payment or converting them into fiat currency, the relevant CBUAE regulations must apply. If the platform offers services involving payment tokens like USDT, it must also comply with the CBUAE’s Payment Token Services Regulations.

Specifically, the VARA Transfer and Settlement License held by this institution covers services for transferring virtual assets between wallets, addresses, or different parties. Since the VARA rules came into effect on June 19, 2025, licensed institutions are also required to adhere to applicable CBUAE payment and remittance regulations. Cross-border transfers and settlements must be legally executable and complete across all jurisdictions involved in the transaction.

Can This Order Be Processed: Buyer Pays in USDT, Merchant Receives Dirhams?

If the buyer directly sends USDT to the Dubai-based sales company as payment for ordinary goods, this route is not viable. According to Clause 2(7) of the CBUAE Payment Token Services Regulations, local merchants may only accept payment tokens issued by a CBUAE-licensed issuer for standard goods or services. Foreign payment tokens issued by registered issuers may only be used for purchasing virtual assets or their derivatives under this clause.

Dubai-based stores have already tested Dirham-denominated payment token collections. In September 2026, Network International piloted DDSC (Dubai Digital Currency) at a Marks & Spencer store in Dubai Festival City. Customers scanned a QR code via wallets supporting DDSC, and merchants could choose to either deposit DDSC into the customer’s wallet or settle in Dirhams.

The pilot used Dirham payment tokens issued by a CBUAE-licensed issuer.

What if the buyer pays in USDT, and the payment institution converts it to Dirhams before paying the merchant? If the platform provides services regulated under the Payment Token Services Regulations and knowingly processes USDT payments for ordinary goods, Clause 2(4) prohibits licensed or registered institutions from facilitating such transfers during payment token services. The fact that the merchant ultimately receives Dirhams does not alter the purpose of the underlying USDT transfer.

If buyers instead use compliant channels to convert their holdings into usable fiat currency before making payments, the conversion and payment must each be handled according to their respective regulatory frameworks. Whether these two activities are operationally independent depends on who controls the converted funds and when payment settlement occurs.

The market already features products enabling payment confirmation on crypto platforms with merchants settling in Dirhams. In August 2026, Duty Free Shops launched Crypto.com Pay at physical locations and on its official website. Eligible UAE residents can authorize payments via their Crypto.com accounts at checkout; the retailer receives funds in Dirhams.

The service provider, Foris DAX Middle East FZE, holds a VARA Virtual Asset Services License and a CBUAE Stored Value Facility (SVF) License. Crypto.com’s UAE website explicitly states that Crypto.com Pay operates under the SVF License.

In both arrangements, merchants receive Dirhams. The DDSC pilot disclosed the tokens used by buyers. However, the Duty Free announcement did not specify which cryptocurrency was deducted per transaction, at what stage conversion occurred, nor did it publish the full fund flow. Other payment institutions aiming to replicate similar models must still assess who handles the token transfer on behalf of the buyer, who executes the final payment, and what services each party is authorized to provide.

If the merchant sells goods through an Asian entity and the proceeds are ultimately repatriated to Asia, the payment institution must still evaluate where it operates and to whom it provides services. Clause 2(1) of the regulations applies to payment token services provided within the UAE and also to services offered to individuals located in the UAE. Even if the merchant is based offshore, if the platform operates such services in Dubai or a VARA-regulated free zone, it remains subject to these rules.

The term “UAE” in Regulation 2 does not include financial free zones such as the Dubai International Financial Centre (DIFC). VARA’s jurisdiction also excludes DIFC, where financial services are regulated under the DFSA (Dubai Financial Services Authority) regime.

What Does the Platform Need to Apply for If It Handles Receipt and Conversion?

If the platform intends to receive or convert cryptocurrencies itself, it must first confirm whether the assets involved qualify as “payment tokens” under CBUAE definitions. The Payment Token Services Regulations took effect on August 31, 2024. These tokens primarily refer to virtual assets denominated in fiat currencies and claiming to maintain value pegged to such fiat or equivalent payment tokens—such as USDT and USDC, dollar-backed stablecoins.

Even if the platform hasn’t yet integrated merchant orders, any service falling within the regulation’s scope—without qualifying for an exclusion or exemption—requires appropriate CBUAE authorization.

First, consider how the platform receives the tokens. If the platform, in the course of business, holds payment tokens on behalf of clients, manages private keys for storage, holding, or transfer of such tokens, or receives, holds, and transfers payment tokens on behalf of clients, this constitutes payment token custody and transfer. Operating such a business requires a CBUAE Payment Token Custodian and Transferor license, in principle.

If the institution already holds a virtual asset custody license granted by the Capital Markets Authority (CMA, formerly SCA) or another relevant local authority, it may apply for non-objection registration under Clause 8(3) for foreign currency payment token custody and transfer. However, merely holding a VARA Transfer and Settlement License cannot substitute for custody qualification. Registration eligibility still requires approval from the CBUAE.

Next, consider who conducts the conversion. If the platform engages in paid spot trading of payment tokens or facilitates offer and acceptance mechanisms between counterparties, this falls under the definition of “conversion” in the regulations. To conduct such activities, the platform must obtain a CBUAE Payment Token Conversion license—or secure non-objection registration through an applicable channel.

Clause 8(1) provides a registration pathway for operators meeting the regulatory definition of a virtual asset trading platform. The CBUAE will assess the platform’s operational qualifications and regulatory oversight status before granting permission to conduct conversions within the registered scope. A VARA Transfer and Settlement License alone is insufficient for applying for this registration.

Exclusions under the Payment Token Services Regulations target specific activities. If a particular business is already licensed under retail payment or stored value facility rules—or would otherwise fall under those regimes—it must comply with the corresponding framework. Article 39 provides transition provisions: after the grace period ends, existing licenses under old rules no longer cover related crypto activities. When a product involves stored value, conversion, and transfer simultaneously, each component must be evaluated against applicable rules and authorized scope.

To apply for either of these CBUAE licenses, the applicant must be a company established in the UAE, excluding financial free zones (Article 6). If the same entity plans to conduct additional services, it must also comply with the restrictions on permitted business activities under Article 17.

How Are Funds Delivered to the Merchant’s Account?

When the payment settles in Dirhams, the question remains: who handles the fiat collection and settlement? If the payment institution provides fiat acquiring, payment aggregation, payment accounts, or fund transfer services to the merchant, it must hold the relevant CBUAE license or statutory authorization. VARA licenses do not cover these services. If the funds are to be transferred to Asia, the cross-border money transfer must also fall within the scope of the service provider’s authorized activities.

The merchant may sign directly with a qualified bank or payment institution responsible for handling funds and settlement. If the Asian payment institution only performs services it is authorized to provide and does not actually provide or facilitate any regulated service, it does not need to obtain the same qualification for services delivered directly by its partner. Conversion, custody, and transfer can also be provided directly by institutions with appropriate licensing.

If conversion is part of the VARA Transfer and Settlement service, the institution must use a VARA-licensed exchange service provider. If using a provider outside the Emirate of Dubai, prior VARA approval is required. The institution performing the transfer and settlement remains responsible for completing the service to its client.

If the merchant’s collection agreement is signed by the Asian payment institution, and the institution collects, forwards, and manages refunds for the payment, even if the bank only opens an account and executes fund transfers, the collection service is effectively being performed by the Asian payment institution—thus requiring proper authorization. When structuring responsibilities, one should walk through the actual process: Who does the merchant contract with? Who controls the wallet and account? Who receives payment instructions? To whom should one turn if funds fail to arrive?

An alternative arrangement involves providing only interfaces or wallet software, with assets controlled by the client or a licensed entity. If the technical team meets the conditions for exclusion, it may not need a separate license for the supported payment services. Even without handling funds, if the team actually provides or enables regulated services such as payment initiation, it must be assessed under the applicable rules. Similarly, operating, providing, or facilitating regulated financial services via smart contracts—directly or indirectly—is subject to Article 62 of the new CBUAE Law.

What Should a Dubai-Based Company Do First?

For the initial Asian payment institution, changing the checkout page to allow buyers to pay directly in fiat currency would enable early-stage merchants to partner with qualified providers who handle collection and settlement directly. The Dubai entity can initially focus on product integration. Once operations stabilize, the institution may then decide whether to assume settlement responsibilities internally.

If the plan is for the Dubai entity to collect payments and manage disbursement and refunds, it must confirm and obtain the necessary qualifications before switching, while also adjusting merchant contracts and fund flows accordingly.

Author: Shao Jiadi, Man Kun Blockchain Legal Services | Image: Comparison of operational boundaries between VARA and CBUAE regulatory frameworks