UAE Stablecoin Regulation in 2026: Inside the CBUAE Payment Token Services Regulation and the New Central Bank Law Deadline
Updated: 1 hour ago
The Central Bank of the United Arab Emirates (CBUAE) has built one of the most surgical stablecoin regimes in the world, and a second, broader law is now pulling decentralised finance (DeFi) protocols, decentralised exchanges (DEXs) and Web3 platforms into the same perimeter, with a transition window closing in September 2026.
Here is what the Payment Token Services Regulation (PTSR) actually captures, how it interacts with the new Central Bank Law of the United Arab Emirates (UAE), why the popular reading of "the UAE embraces stablecoins" is only half right, and what Boards, exchanges, banks, payment platforms and DeFi teams need to do before the window closes.
Something in the UAE (United Arab Emirates) stablecoin story keeps getting oversimplified. The market narrative reads as if the CBUAE (Central Bank of the United Arab Emirates) has thrown its doors open to digital-dollar rails. The regulatory reality is more precise: the UAE (United Arab Emirates) has embraced the dirham on-chain, gated every other stablecoin to a narrow, crypto-only corridor, and has just extended central-bank licensing to the wider DeFi (decentralised finance) and Web3 stack that used to sit outside it.
On 21 August 2024, the CBUAE (Central Bank of the United Arab Emirates) issued Circular No. 2/2024, the PTSR (Payment Token Services Regulation). Its own one-year transition period, the window in which existing payment-token issuers, custodians, transferors and conversion providers had to become licensed or registered, closed in 2025. If your business already issues, custodies, transfers or converts payment tokens in the UAE, that compliance clock has already run out.
What has changed since is broader, not a re-run of the same deadline. On 16 September 2025, the UAE overhauled its central-banking framework with Federal Decree-Law No. 6 of 2025 (the "CB Law"), which folds virtual-asset activity that was never squarely inside the 2024 rulebook, DeFi protocols, DEXs, Web3 platforms and blockchain bridges, into the same CBUAE licensing perimeter.
The CB Law carries its own one-year transitional period for newly in-scope persons to reconcile their status, which lands in September 2026. It is this second, wider deadline, not a rerun of the 2025 transition under the PTSR, that is now concentrating minds across the market. Secondary reporting on the exact day varies; we have seen both 16 and 30 September cited. If your business is affected, confirm the precise date against the CBUAE's own circulars rather than press coverage, including this article.
The reading that matters is not that the UAE has legalised stablecoins. It is that the UAE has drawn a precise perimeter around who may issue, who may transfer, who may custody, and, critically, for what purpose those tokens may be used inside the country, and it has just widened that perimeter to catch the DeFi and Web3 rails that used to sit outside it.
For institutions still assuming that United States Dollar Coin (USDC), Tether (USDT), PayPal USD (PYUSD) or any other foreign stablecoin can flow freely through UAE payment rails, or that a DeFi protocol with no UAE incorporation is out of reach, the 2026 deadline is a hard stop.
This is the reality on the ground.
Key takeaways
The PTSR (Circular No. 2/2024) has governed dirham and foreign stablecoin services since 2024; its own transition period already closed in 2025 - that deadline has passed.
A second, broader law, Federal Decree-Law No. 6 of 2025, took effect in September 2025 and gives DeFi protocols, DEXs, Web3 platforms and bridges a one-year transition window landing in September 2026.
Foreign stablecoins such as USDC (United States Dollar Coin), USDT (Tether) and PYUSD (PayPal USD) may only be used in the UAE to buy a Virtual Asset or Virtual Asset derivative, not for general commerce, salaries or merchant payments.
Four stablecoins pegged to the United Arab Emirates Dirham (AED) currently hold CBUAE approval at different stages: AE Coin (full licence), Zand AED (full approval), DDSC (approved to go live), and RAKBANK AED (in-principle approval only).
Algorithmic stablecoins and privacy tokens are banned outright, with no carve-out for firms already licensed by the Securities and Commodities Authority (SCA) or the Virtual Assets Regulatory Authority (VARA).
What the PTSR Actually Regulates: Three Services, Not Just Issuance
The most common misreading of the PTSR is that it is a "dirham stablecoin regulation." It is not. It is a services regulation covering three distinct regulated activities, any one of which pulls a firm inside the CBUAE's perimeter:
Regulated activity | What it covers | Who typically needs it |
Payment Token Issuance | Issuing a fiat-referenced stablecoin | Issuers of dirham or foreign stablecoins |
Payment Token Custody and Transfer | Holding or moving stablecoins on behalf of clients | Exchanges, wallets, custodians, payment platforms |
Payment Token Conversion | Swapping stablecoin ↔ fiat, stablecoin ↔ stablecoin, or stablecoin ↔ virtual asset | On/off-ramps, brokers, exchanges, over-the-counter (OTC) desks |
That definition captures far more than the four Dirham Payment Token issuers currently in the market.
Any UAE-facing exchange holding USDT (Tether) for its clients, any wallet transferring USDC (United States Dollar Coin) between users, any conversion desk routing between AED (United Arab Emirates Dirham) and PYUSD (PayPal USD), all of them sit inside the PTSR perimeter and need either a licence or, where applicable, a registration.
The prohibitions are equally decisive. Algorithmic stablecoins and privacy tokens are banned outright, including for firms already licensed by the SCA (Securities and Commodities Authority) or the VARA (Virtual Assets Regulatory Authority). There is no in-principle "grandfathering" and no reverse-solicitation exception.
The Foreign Payment Token Corridor: Why USDC and USDT Cannot Buy You Coffee
This is the provision that trips up most international operators, and it is the single sharpest feature of the PTSR.
Under Article 2 of the Regulation, a Foreign Payment Token, meaning any stablecoin denominated in a foreign currency, with USDC, USDT and PYUSD being the canonical examples, can only be used in the UAE for one specific purpose: as a means of payment for the purchase of a Virtual Asset or a derivative of a Virtual Asset.
That is the entire permitted use case. Not general commerce. Not payroll. Not utility bills. Not car purchases. Not real estate. Not restaurant tabs.
Specifically, the regulation states:
A licensee or registree must not knowingly initiate, facilitate, effect or direct a Foreign Payment Token transfer as part of its Payment Token Service unless the token is issued by a Registered Foreign Payment Token Issuer and is being used, or sold for use, to purchase a Virtual Asset or a Virtual Asset derivative.
No merchant or other person in the UAE selling goods or services in the course of business may accept a Foreign Payment Token toward payment for that sale unless it is being used to buy a Virtual Asset or Virtual Asset derivative.
Promotion of Foreign Payment Tokens is limited to that same crypto-purchase use case.
Only licensed Dirham Payment Tokens, today that is AE Coin, with Zand AED, RAKBANK AED and the Dirham Digital Stablecoin (DDSC) in phased rollout, may serve as general merchant payment instruments inside the UAE.
A practical worked example
Consider a Dubai boutique hotel operator that wants to accept stablecoin payments from guests.
Scenario | PTSR position |
Guest pays for a room in USDT | Prohibited - the hotel is a merchant selling services, USDT is a Foreign Payment Token, and the payment is not for a Virtual Asset purchase. |
Guest pays for a room in AE Coin | Permitted - AE Coin is a licensed Dirham Payment Token and may be used for any lawful purpose. |
Guest funds a wallet on a UAE-licensed exchange with USDT to then buy Bitcoin | Permitted - this is exactly the corridor the regulation authorises, provided the exchange is a licensed Payment Token Custodian and Transferor and USDT's issuer is registered as a Foreign Payment Token Issuer. |
The hotel converts USDT received abroad to AED via its UAE bank | Requires a licensed Payment Token Conversion Provider; the transaction cannot be a general-payment settlement disguised as a conversion. |
The corridor is real, but it is narrow. Any firm currently accepting foreign stablecoins for general commercial purposes in the UAE is operating outside the regulation.
Cross-Border Settlement: The Deliberately Ambiguous Zone
If foreign stablecoins are locked into a virtual-asset corridor, what about the use case most international corporates actually care about, cross-border settlement, treasury management, business-to-business (B2B) payments, remittances, and trade finance?
Here the PTSR is deliberately silent, and that silence is itself instructive.
The regulation does not expressly authorise the use of Foreign Payment Tokens for cross-border settlement, treasury, remittance or trade finance. But it also does not directly prohibit stablecoin-based settlement between two corporates that never touches a PTSR-regulated intermediary. The practical rule that emerges is this:
The Article 2(4) restriction on foreign-token transfers is service-agnostic. If a licensee or registree, an issuer, custodian, transferor, or conversion provider, touches the transfer at any point, the transfer must be for a Virtual Asset or Virtual Asset derivative purchase.
Article 2(6) expressly says there is no territorial restriction on where a Dirham Payment Token may be used or transferred, apart from the rule that it may only be issued to persons resident in the UAE. That permissive language is not extended to Foreign Payment Tokens.
The practical read is straightforward: the UAE has designed the dirham as its cross-border settlement rail. That is precisely why International Holding Company (IHC), First Abu Dhabi Bank (FAB) and Sirius International Holding chose to launch DDSC (Dirham Digital Stablecoin) as a licensed Dirham Payment Token, and why IHC executed a landmark institutional transaction of AED 110 million (United Arab Emirates Dirham), roughly US$30 million, on the ADI Chain in May 2026, targeting cross-border payments, treasury, and trade settlement for FAB clients.
If you want to move value cross-border using a stablecoin under CBUAE oversight, the regulation points you to a licensed dirham rail, not to USDC or USDT.
Practical example: a UAE corporate treasury
A UAE-headquartered trading company wants to pay a supplier in Singapore.
Route | PTSR position |
Wire USDT from a UAE-licensed exchange wallet to the supplier's exchange in Singapore | Prohibited for the licensee - the transfer is not for a Virtual Asset purchase, so the UAE exchange cannot facilitate it. |
Wire USDT from a self-custody wallet to the supplier's self-custody wallet, with no PTSR-regulated intermediary in the chain | Not directly captured, but the corporate treasurer must consider Anti-Money Laundering / Counter-Terrorist Financing (AML/CFT) obligations, banking-relationship exposure, and, if either side involves a regulated conversion, the PTSR bites at that point. |
Wire DDSC or Zand AED cross-border to the supplier's wallet, with the supplier converting locally | Permitted under Article 2(6) - no territorial restriction on dirham token transfers. |
Use USDC on a foreign-licensed rail into a UAE-licensed conversion provider, then settle in AED | Requires the transfer to be within the Virtual Asset corridor, or the conversion provider will breach Article 2(4). |
The design intent is clear: the dirham is the sanctioned settlement token; the foreign token is the sanctioned crypto on-ramp.
UAE Stablecoin Regulation in 2026: The Four Licensed Dirham Rails
The AED stablecoin market is small, deliberate, and increasingly differentiated. Four issuers have received CBUAE approval at different stages, one full licence, one full approval, one consortium-issued token cleared to go live, and one in-principle approval. Each targets a different institutional segment.
Token | Issuer | CBUAE status | Distribution model | Notable use case |
AE Coin | AED Stablecoin LLC / AEC Wallet | Full licence, October–December 2024 - the first Dirham Payment Token Issuer Licence | Consumer wallet with UAE Pass identity binding; monthly independent audits | Dubai Department of Finance government payments pilot, October 2025 |
Zand AED | Zand Trust, a wholly-owned subsidiary of Zand Bank PJSC | Full CBUAE approval, November 2025 | Multi-chain public blockchain deployment; independently audited smart contracts; real-time attestations | PRYPCO Mint tokenised real estate; DeFi bridge positioning |
DDSC | Consortium of IHC, FAB and Sirius International Holding | CBUAE approval to go live, February 2026 | Institutional Layer-2 (ADI Chain by ADI Foundation); consortium-backed | Cross-border payments, treasury and trade settlement for FAB clients; AED 110 million (US$30 million) IHC transaction executed May 2026 |
RAKBANK AED | The National Bank of Ras Al Khaimah (RAKBANK) | In-principle approval only, January 2026 - not yet a full licence | 1:1 AED-backed reserves in segregated regulated accounts; distribution via existing branch network | Retail-bank distribution rail (pending full licensing) |
Note the structural constraint that runs through this list.
Banks cannot issue directly — they must establish a subsidiary or affiliate. Zand's use of Zand Trust is the template; RAKBANK's structural arrangements are expected to follow the same pattern.
The Capital and Reserve Backbone
The prudential architecture of the PTSR is stricter than most international regimes, and it is built on the assumption that a Dirham Payment Token is functionally a claim on segregated fiat held under central-bank oversight:
Minimum capital: AED 15 million initial and ongoing for a Dirham Payment Token Issuer.
Ongoing capital add-on: at least 0.5% of outstanding token face value, rising to 2% under the alternative reserve-of-assets model.
Reserve: 100% AED reserves held in segregated regulated accounts.
Redemption: at par, within one business day.
No interest, no yield: the issuer may not pay any benefit, return, or reward related to the length of time a customer holds the token. This mirrors the equivalent no-yield rule in the United States GENIUS Act, and is one of the tightest constraints in the regulation.
Real-time attestations via smart contracts are emerging as the best-practice standard, alongside regular independent third-party audits.
Payment Token Custodian and Transferor capital is scaled to volume: AED 3 million where monthly average transfer value is AED 10 million or more, and AED 1.5 million below that threshold. The higher tier is triggered if volumes exceed the threshold for three consecutive months, and a breach must be reported.
Two Laws, One Perimeter: The PTSR and the New Central Bank Law
The most important thing to get right before September 2026 is which of two overlapping instruments actually applies to your business.
The PTSR (Circular No. 2/2024) set out the licensing categories described above, issuance, custody and transfer, and conversion, for both dirham- and foreign-denominated payment tokens. Its own transition period has already closed. If you run a payment-token business that existed before the regulation took hold, you should already be inside the perimeter.
Federal Decree-Law No. 6 of 2025, which took effect on 16 September 2025, is a much broader overhaul of the CBUAE's constituting law. Article 62 of that law extends the licensing requirement to "any person who, by any medium or technology, issues, carries out, offers, or facilitates a licensed financial activity", language broad enough to capture DeFi protocols, dApps, DEXs (decentralised exchanges) and other platforms or protocols that facilitate payments, credit, deposits, exchange, remittances, or investment services. Article 184 of the law gives newly in-scope persons a one-year transitional period to reconcile their status with the CBUAE, and Article 183 confirms that existing regulations, including the PTSR, remain valid until expressly replaced.
Put together: the PTSR still governs how a payment token business gets licensed. The CB Law now governs who has to bother asking the question in the first place, and it asks that question of a much wider set of DeFi, DEX and Web3 operators than the 2024 regulation ever did.
The scale of that shift was on display at the Stablecoin & Digital Asset Innovation Forum in Abu Dhabi on 8 July 2026, where regulators, banks and payment-industry players from across the region gathered to work through exactly this transition.
Free Zones: ADGM, DIFC and the Registration Bridge
One of the most persistent misunderstandings in the market is that firms in the Abu Dhabi Global Market (ADGM) or the Dubai International Financial Centre (DIFC) sit outside the PTSR. That is only half true.
The correct position is:
Firms incorporated in ADGM (Abu Dhabi Global Market) or DIFC (Dubai International Financial Centre) are outside the PTSR licensing perimeter for their primary regulation - ADGM firms remain with the Financial Services Regulatory Authority (FSRA), DIFC firms remain with the Dubai Financial Services Authority (DFSA).
But if an ADGM or DIFC firm intends to issue a Foreign Payment Token that will be offered to UAE residents, or provide Payment Token Services directed at UAE persons, it must register with the CBUAE as a Registered Foreign Payment Token Issuer or, where relevant, as a Registered Foreign Payment Token Custodian and Transferor.
Existing SCA-licensed and VARA-licensed Virtual Asset Service Providers (VASPs) providing stablecoin custody, transfer or conversion services must apply for a Non-Objection Registration with the CBUAE to continue those activities.
In practice, this creates a two-track supervisory architecture. Free-zone firms live under their home regulator for prudential and conduct matters; the CBUAE overlays a payment-token gatekeeping layer whenever those firms touch UAE residents or UAE-side transfers, and, as of the CB Law, that overlay now extends to a wider category of virtual-asset activity than payment tokens alone.
Global Lens: How the UAE Framework Compares to MiCA and the GENIUS Act
The UAE's approach is not an outlier for the sake of being different. It reflects a specific policy view of what stablecoins are, payment instruments, not investments, and on several fronts it is stricter than either the European Union (EU) Markets in Crypto-Assets Regulation (MiCA) or the United States GENIUS Act.
Feature | UAE (PTSR + CB Law) | EU MiCA | US GENIUS Act |
Algorithmic stablecoins | Prohibited | Restricted (no e-money token status) | Restricted (no PPSI status) |
Privacy tokens | Prohibited | Not directly addressed | Not directly addressed |
Interest / yield to holders | Prohibited | Prohibited for e-money tokens | Prohibited |
Reserve backing | 1:1, segregated regulated accounts | 1:1 for e-money tokens (with tiering) | 1:1 for Permitted Payment Stablecoin Issuers (PPSIs) |
Redemption timing | 1 business day, at par | At par, without undue delay | At par |
Foreign issuers for domestic general commerce | Not permitted (crypto corridor only) | Permitted with authorisation | Permitted via PPSI regime |
Bank-issued stablecoin | Only via subsidiary / affiliate | Permitted for credit institutions | Permitted for federally regulated banks |
DeFi / DEX licensing requirement | Explicit, under CB Law Article 62 | Not directly addressed | Not directly addressed |
Concurrent supervisory layer for free-zone / state-level firms | Yes - CBUAE registration and non-objection | No equivalent | Federal / state dual-track |
The pattern is deliberate.
The UAE regulates the dirham on-chain the way a central bank regulates its currency, draws a security cordon around every foreign stablecoin that enters the country's payment perimeter, and, uniquely among the three regimes compared here, has now put an explicit licensing hook around DeFi and DEX activity rather than leaving it for later.
Board-Level Readiness: What to Do Before September 2026
For institutions with any UAE exposure, banks, exchanges, custodians, payment platforms, DeFi front-ends, corporate treasuries, or professional service firms advising them, the practical work now falls into seven workstreams.
Perimeter mapping under both regimes. Identify every product, wallet, and service line that touches a Payment Token under the PTSR, and separately assess whether Article 62 of the CB Law now captures activity, DeFi, DEX, bridge, or protocol-level, that previously sat outside the 2024 rulebook.
Foreign token corridor audit. For every USDC, USDT, PYUSD or other Foreign Payment Token in your product stack, confirm that the use case fits the Virtual Asset or Virtual Asset derivative purchase corridor. General-commerce, treasury, salary, and merchant-payment use cases must be closed or rerouted.
Licensing and registration selection. Choose between (a) Dirham Payment Token Issuer licence, (b) Payment Token Custodian and Transferor licence, (c) Payment Token Conversion Provider licence, (d) Registered Foreign Payment Token Issuer, (e) Registered Foreign Payment Token Custodian and Transferor, or (f) Non-Objection Registration for SCA- and VARA-licensed VASPs.
Capital and reserve architecture. Confirm AED 15 million minimum capital for issuers plus the 0.5% or 2% ongoing add-on, or the scaled AED 1.5 million / 3 million capital for Custodian and Transferor licences.
Prohibited-token discontinuation. Remove algorithmic stablecoins and privacy tokens from all UAE-facing product surfaces, including for SCA- and VARA-licensed subsidiaries.
Governance evidence pack. Prepare Board-approved risk appetite statements, Anti-Money Laundering / Counter-Terrorist Financing (AML/CFT) policies, technology risk and business continuity documentation, White Paper materials, and controllers-and-agents disclosures for the CBUAE application file.
Confirm your deadline directly with the CBUAE. Because the PTSR's 2025 transition and the CB Law's 2026 transition are separate clocks, do not assume a single filing satisfies both, and verify the exact 2026 date against CBUAE circulars rather than secondary reporting.
After the CB Law's transition window closes, unlicensed operators face a wind-down process. Multiple market reports describe the CBUAE's posture as firm rather than open-ended, though as with the exact date, the precise consequences and any extension are matters to confirm directly with the regulator.
Why This Is the Missing Central-Bank Layer for Stablecoins
The GENIUS Act tells you how the United States wants stablecoin issuers to look. MiCA tells you how the European Union wants the crypto market to function.
Together, the PTSR and the CB Law tell you something different, what a central bank's own view of stablecoin and virtual-asset sovereignty looks like when applied to a payments-first economy.
The UAE has not built the most permissive stablecoin regime. It has built the most surgical one, and then widened the aperture to catch the DeFi and Web3 activity growing up around it. The dirham is designated as the on-chain settlement currency. Foreign stablecoins are legal but confined. Free-zone firms are welcomed but overlaid. Algorithmic and privacy tokens are excluded. DeFi and DEX operators now have an explicit licensing hook instead of a grey area. And the central bank sits as the final arbiter of the entire perimeter.
For Boards, founders, executives and compliance leaders, the September 2026 deadline is not a filing exercise. It is a strategic checkpoint on how your institution accesses the UAE market for the next decade.
The firms that treat this as a licensing chore will discover the cost of missing the perimeter in Q4 2026. The firms that treat it as an architectural blueprint will find that the CBUAE has laid down one of the clearest institutional-grade stablecoin and virtual-asset frameworks in the world.
How Pnyx Hill Helps
Pnyx Hill advises banks, stablecoin issuers, exchanges, custodians, payment platforms, DeFi teams and international corporates on:
CBUAE Payment Token Services Regulation licensing and registration strategy across all pathways.
Perimeter assessment under Federal Decree-Law No. 6 of 2025 for DeFi protocols, DEXs and Web3 platforms newly captured by Article 62.
Cross-jurisdictional structuring between the CBUAE, ADGM/FSRA, DIFC/DFSA, VARA and SCA/CMA.
Foreign Payment Token corridor mapping and product-perimeter redesign.
Capital, reserve, redemption, and prudential architecture for Dirham Payment Token Issuers.
Board-ready governance, AML/CFT, operational resilience and White Paper documentation.
Post-licensing supervisory readiness, Non-Objection Registration for SCA- and VARA-licensed VASPs, and CBUAE examination preparation.
If your institution has UAE exposure and the September 2026 deadline in view, we would be pleased to help you build a defensible perimeter and a credible application file. Visit pnyxhill.co to get in touch.
FAQ
What is the CBUAE Payment Token Services Regulation (PTSR)?
The PTSR is Circular No. 2/2024, issued by the Central Bank of the United Arab Emirates on 21 August 2024. It regulates three activities, Payment Token Issuance, Payment Token Custody and Transfer, and Payment Token Conversion, and covers both dirham-denominated and foreign-denominated stablecoins.
Is the PTSR transition period still open in 2026?
No. The PTSR's own one-year transition period for existing payment-token businesses closed in 2025. The deadline now in focus for 2026 comes from a separate, broader law, Federal Decree-Law No. 6 of 2025, which extends CBUAE licensing to DeFi protocols, DEXs and other Web3 platforms and carries its own one-year transition window landing in September 2026. Confirm the exact date for your business against the CBUAE's own circulars.
Do DeFi protocols and DEXs need a CBUAE licence?
Under Article 62 of Federal Decree-Law No. 6 of 2025, licensing requirements extend to any person who, by any medium or technology, issues, carries out, offers, or facilitates a licensed financial activity, language broad enough to capture DeFi protocols, decentralised exchanges and similar platforms that facilitate payments, credit, exchange or investment services, even without a UAE incorporation.
Can USDC and USDT be used for general payments in the UAE?
No. Under Article 2 of the PTSR, Foreign Payment Tokens such as USDC, USDT and PYUSD can only be used in the UAE as a means of payment for the purchase of a Virtual Asset or Virtual Asset derivative. General commercial payments, salaries, invoices, and merchant purchases outside the virtual-asset context are not permitted.
Which AED stablecoins are approved by the CBUAE?
Four, at different stages: AE Coin (full licence), Zand AED (full approval), DDSC (Dirham Digital Stablecoin) by IHC / FAB / Sirius (approved to go live), and RAKBANK AED (in-principle approval only, not yet a full licence).
Are ADGM and DIFC firms outside the PTSR?
Only partially. Firms incorporated in ADGM or DIFC remain regulated by FSRA or DFSA respectively for primary prudential and conduct matters. But if they issue Foreign Payment Tokens or provide Payment Token Services to UAE persons, they must register with the CBUAE as a Registered Foreign Payment Token Issuer or, where applicable, obtain a Non-Objection Registration.
Are algorithmic stablecoins allowed in the UAE?
No. Algorithmic stablecoins are prohibited outright by the PTSR, including for firms licensed by the SCA or VARA. Privacy tokens are similarly prohibited.
Can a UAE bank issue its own stablecoin?
Yes, but not directly. A UAE bank must establish a subsidiary or affiliate to hold the Dirham Payment Token Issuer licence. Zand Bank's use of Zand Trust is the current market template.