Table of Contents
A merchant in Dubai has been accepting USDT as payment for two years. It worked fine, customers preferred it, and nobody told them it was a problem.
After July 2025, it became one.
The Payment Token Services Regulation, issued by the Central Bank of the UAE in Circular No. 2/2024, establishes a framework for stablecoins, referred to as Payment Tokens, and their use across the UAE. The one-year transitional period that followed its introduction is over. The UAE Payment Token Services Regulation is now fully in force.
Every business issuing, converting, custodying, or accepting payment tokens in the UAE must be licensed or registered to do so legally.
This guide covers everything: what the PTSR regulates, who needs which license, what the reserve and compliance requirements look like, what is prohibited, and what the fully operational framework means for every type of business operating in this space.
What is the UAE Payment Token Services Regulation and Why Did the CBUAE Issue It?
The Payment Token Services Regulation lays down the rules and conditions established by the Central Bank for granting a license or registration for the provision of Payment Token Services, digital payment services in the UAE comprising three categories: Payment Token Issuance, Payment Token Conversion, and Payment Token Custody and Transfer.
The regulation’s timing was deliberate. Stablecoins had grown from a niche crypto product into a functioning payments layer used daily by businesses, expatriates, and financial institutions. The UAE has emerged as a hotspot for cryptocurrency adoption, driven by a commercially focused regulatory environment and a fast-growing financial sector. But the legal framework governing how stablecoins could be issued, held, converted, and transferred had not kept pace with that growth.
The PTSR changed that, treating stablecoins that function as money with the same regulatory seriousness as any other payment instrument.
What is a Payment Token?
The PTSR uses the term payment token rather than stablecoin, and the distinction is intentional.
The PTSR defines a Payment Token as a Virtual Asset that purports to maintain a stable value by referencing the value of fiat currency or another Payment Token denominated in the same currency.
The regulation differentiates between Dirham Payment Tokens, which require a full license, and Foreign Payment Tokens, which require registration with the CBUAE.
Also, read UAE Stablecoin Licensing: What the CBUAE Framework Means for Crypto Businesses in 2026
What falls outside the scope?
Certain types of Payment Tokens are exempted from the PTSR, including Payment Tokens used for certain reward schemes and bonus point schemes, and Payment Tokens that can only be used as a means of payment for non-financial goods or services provided by the Payment Token Issuer.
Additionally, any operations already regulated or requiring licensing under the Retail Payment Services and Card Schemes Regulation or the Central Bank’s Stored Value Facilities regulations are not included.
In plain terms, a closed-loop loyalty points scheme that cannot be used as general currency outside the issuer’s own ecosystem does not fall under the PTSR. A USDT wallet available to UAE residents does.
The Three Regulated Services
Payment Token Services comprise three categories:
- Payment Token Issuance, covering the creation and management of stablecoins;
- Payment Token Conversion, involving the exchange of tokens for fiat currency, other cryptocurrencies, or different tokens;
- Payment Token Custody and Transfer, governing the safekeeping and transfer of tokens.
Article 2 of the PTSR states that no Person shall perform any Payment Token Service within the UAE or direct it to Persons in the UAE unless such Person is licensed by the CBUAE to perform such Payment Token Service.
The jurisdictional reach is deliberately broad; it applies not just to companies physically located in the UAE but also to any entity whose services target UAE residents, regardless of where the company is incorporated.
Who Needs a License and What Kind?
The PTSR creates four distinct licensing categories:
| Dirham Payment Token Issuer License | Licenses may only be granted to companies incorporated in the UAE, including free zones, but excluding financial free zones, the DIFC and ADGM. This is the most demanding category, with the highest capital and reserve requirements. AE Coin holds this license, the only one currently issued for an AED-pegged stablecoin. |
| Foreign Payment Token Issuer Registration | Non-UAE entities, including those established in the DIFC or ADGM, may offer to UAE investors Payment Tokens that are not UAE Dirham-denominated, provided the issuer is registered with the CBUAE as a Registered Foreign Payment Token Issuer. This is the primary entry point for global stablecoin issuers, including those of USDT and USDC, seeking to legally serve the UAE market. |
| Conversion Provider License | Required for any firm facilitating exchanges between payment tokens and fiat currency, other cryptocurrencies, or different tokens. |
| Custodian and Transferor License | Required for firms holding or moving payment tokens on behalf of clients, functionally equivalent to a custody service for stablecoins. |
The VARA Intersection – a Compliance Trap Many Miss
Entities holding a license from VARA or the Emirates Securities and Commodities Authority must apply for a Non-Objection Registration to continue providing custody, transfer, and conversion services for stablecoins under their current license. When applying for a NOR, these entities must demonstrate compliance with specific rules under the PTSR.
Being VARA-licensed does not mean PTSR compliance is automatic. It requires a separate engagement with the CBUAE. This is one of the most commonly misunderstood aspects of the dual-regulator landscape.
What Full Backing Actually Means? Reserve Requirements
The reserve requirement is the operational heart of the PTSR, and the detail that most business plans underestimate.
Issuers are required to maintain 100% reserves in liquid, high-quality assets, with at least half held as cash in UAE banks. Tokens must be redeemable at par within one business day.
Monthly external auditor attestations are required to confirm that reserves equaled or exceeded outstanding tokens for the prior month. Reserve assets must be ring-fenced; in the event of insolvency, customers have a direct legal claim on the reserve.
This framework was a direct policy response to the 2022 collapse of TerraUSD, an algorithmic stablecoin that lost its peg catastrophically because it was backed by code rather than real assets. The CBUAE’s approach is unambiguous: every token in circulation must be backed one-to-one by real, liquid financial assets, and that fact must be independently verified monthly.
The CBUAE also has the authority to exempt a payment token issuer from licensing and other requirements where the required reserve of assets does not exceed AED 500,000, and there are no more than 100 token holders, a narrow carve-out for very small-scale operations.
What Is Prohibited (With No Exceptions)
The PTSR draws hard lines around three categories:
- Algorithmic stablecoins: PTSR provides that no person shall, within the UAE, or direct persons in the UAE to, issue algorithmic stablecoins or privacy tokens, or perform services relating to them. This prohibition applies to all persons, including those acting in the course of performing virtual asset activities for which they are licensed or regulated by the SCA or VARA.
- Privacy Tokens: Privacy tokens are virtual assets that anonymize the sender and receiver of a transaction. They are incompatible with the UAE’s AML and KYC framework and are prohibited outright, not just restricted.
- Promotion of Prohibited Tokens: Promotions within the UAE or directed to persons in the UAE for the issuance of algorithmic stablecoins and privacy tokens or services relating to them are also prohibited. The prohibition extends to marketing, not just operations.
The merchant restriction, what it actually says
Merchants and businesses in the UAE are restricted from accepting virtual assets as payment unless the asset is a Dirham Payment Token issued by a Licensed Payment Token Issuer, or a Foreign Payment Token issued by a Registered Foreign Payment Token Issuer and is being used to purchase a virtual asset or its derivative.
That second condition is critical and widely misunderstood. Foreign payment tokens, USDT, USDC, and equivalents, can only be used by UAE merchants for a specific purpose: purchasing a virtual asset or a derivative of a virtual asset. They cannot be used as a general payment for goods and services by UAE merchants. Only licensed Dirham Payment Tokens, currently, AE Coin, can serve that function.
Why Payment Tokens Cannot Be Yield Products – The Interest Prohibitions
One PTSR provision that trips up many product designers is the explicit prohibition on yield.
A licensed Payment Token Issuer may not pay to or for the benefit of a customer interest related to the length of time during which the customer holds a Payment Token, or any other benefit related to the length of time during which the customer holds a Payment Token.
This is deliberate.
It prevents payment tokens from being marketed or structured as investment products, keeping a clear regulatory boundary between regulated payment instruments and unregulated investment schemes. Any stablecoin product offering a yield or return to holders falls outside the PTSR’s permitted scope and likely into a different, and currently unlicensed, regulatory category.
Consumer Protection Under PTSR
The PTSR includes various provisions to ensure consumer protection, including requirements on firms to comply with Consumer Protection Regulations covering: regulatory capital requirements, AML/CTF obligations, protection of payment and customer data, risk management and control system requirements, and technology risk and IT security requirements.
For consumers, the regulation provides strong protections including guaranteed 1:1 redemption, legal safeguards against fraud, and assurance that licensed tokens are safe for use in digital transactions.
The practical effect for consumers is significant: when using a licensed payment token in the UAE, they have legal recourse, guaranteed redemption rights, and the knowledge that every token they hold is backed by a real, audited reserve.
Key Dates: The Timeline Every Business Needs to Know
The PTSR was issued on 7 June 2024 by the CBUAE and came into effect on 6 July 2024.
The transitional period ended on 14 June 2025, after which all businesses providing payment token services were required to hold the appropriate licence or registration.
The prohibition on payment token services and promotion came into effect following the transition period of one year from 6 July 2025. After this date, operating without a licence is not a grey area, it is a regulatory violation.
The PTSR sits within a broader regulatory reset triggered by Federal Decree-Law No. 6 of 2025, with affected entities granted a one-year transition period until 16 September 2026 to achieve full compliance with the new CB Law.
AE Coin: What a Successful PTSR Application Looks Like
The licensing of AE Coin, the UAE’s first regulated stablecoin provider, by the CBUAE in December 2024, signals that the framework is now moving into full operational effect, marking a critical step in the country’s transition toward a regulated digital asset ecosystem.
AE Coin became the first licensed AED stablecoin in 2024, demonstrating how banks, fintechs, and exchanges can innovate in payments, remittances, and cross-border transactions while remaining fully compliant.
What made AE Coin’s application successful tells you what the CBUAE is looking for:
- full AED reserve backing held in regulated UAE banks,
- an independent monthly audit process,
- identity verification linked to UAE Pass,
- regulated banking partnerships, and
- a dedicated custody wallet accessible only through verified UAE accounts.
For any firm pursuing a Dirham Payment Token Issuer licence, that is the template.
What This Means for Each Type of Business
Fintech companies and crypto exchanges
If you offer custody, conversion, or transfer of stablecoins to UAE residents, regardless of where you are incorporated, you need CBUAE authorisation or registration. If you already have a VARA licence, that does not replace PTSR compliance. You need both.
Merchants and retailers
For businesses and merchants, the PTSR requires a shift from accepting unregulated cryptocurrencies to licensed stablecoins. Accepting USDT for everyday goods and services is now a compliance violation. Only licensed Dirham payment tokens may be used for general merchant payments.
Banks and financial institutions
The CBUAE’s decision to permit businesses and vendors in the UAE to accept CBUAE-approved stablecoin cryptocurrencies for payments marks a significant step toward the mainstream adoption of digital assets. For banks, the PTSR creates a clear and regulated pathway to integrate stablecoin infrastructure into payment products, with regulatory certainty on both sides of the transaction.
International stablecoin issuers
The Foreign Payment Token Issuer registration pathway provides an accessible entry point, one that requires regulatory engagement but does not demand full UAE incorporation. USDT and USDC issuers will need this registration to continue serving UAE residents legally.
What’s Next?
The PTSR is part of the CBUAE’s Financial Infrastructure Transformation Program and supports broader initiatives such as the Digital Dirham CBDC.
With the enactment of CB Law 2025, the CBUAE has officially moved its CBDC strategy from the pilot phase to legislative reality by establishing the Digital Dirham as a recognized legal tender, fundamentally altering the nation’s monetary framework.
The picture that emerges is coherent and deliberate: a sovereign digital currency (Digital Dirham), a regulated private stablecoin market (PTSR), an open finance data-sharing infrastructure (Al Tareq), and a sandbox for fintech experimentation, all developed in parallel, all pointing toward the same destination.
For crypto businesses, fintech companies, merchants, and financial institutions, the UAE Payment Token Services Regulation is not just another compliance requirement to add to a checklist. It is the legal foundation on which the UAE’s digital payment economy is being built. Understanding it is now the baseline for operating in this market.
1 comment
[…] structure rests on a regulatory foundation already in place. The Central Bank of the UAE’s Payment Token Services Regulation, issued 7 June 2024 and effective a month later, was the Middle East’s first comprehensive […]