SCA Security Token Rules UAE 2026: Issuer Guide

Issuing a security token in the UAE means answering one question before anything else: is your token a regulated security? If it carries investment rights such as profit share, dividends, equity or debt, the Securities and Commodities Authority (SCA) treats it as a financial instrument, and a compliant path can start from roughly AED 40,000 in application fees plus AED 80,000 in annual supervision where a related VARA activity is involved, before legal, audit and capital costs. Getting the classification right is the difference between a lawful raise and an unlicensed securities offering.

This guide explains SCA security token rules for 2026 from an issuer's point of view: how tokens are classified, which authority regulates what, the licensing and disclosure steps, realistic costs, tax treatment and the mistakes that sink offerings. It is a compliance and structuring guide only. Nothing here is investment advice, and it never tells anyone what to buy.

What are the SCA security token rules in the UAE?

Under UAE rules, a token that represents a security — shares, bonds, fund units or similar investment rights — falls within the Securities and Commodities Authority's federal mandate. The SCA regulates securities and commodity tokens nationwide, while VARA covers virtual assets inside Dubai. Issuers typically need a legal classification, an approved offering document and, depending on structure, fees starting around AED 40,000 plus AED 80,000 annual supervision.

The core principle is "substance over label." A project cannot escape securities regulation by calling its instrument a "utility token" or "reward coin" if the economic reality is that buyers expect a return derived from the efforts of the issuer. The SCA, like most global regulators, looks at the rights attached to the token. If those rights resemble equity, debt, a collective investment scheme or a derivative, the token is a security and the full weight of securities law applies.

This matters because the UAE runs a layered regulatory map. The SCA sits at the federal level for securities and commodity-based digital assets. VARA (the Virtual Assets Regulatory Authority) governs virtual asset activities inside the Emirate of Dubai but outside the DIFC financial free zone. Inside the financial free zones, the DFSA regulates the DIFC and the FSRA regulates ADGM. The Central Bank of the UAE (CBUAE) oversees payment tokens and stablecoins through its Payment Token Services Regulation. A single project can touch several of these bodies at once, which is exactly why classification must come first.

The figures above reflect the official VARA fee schedule for related activities and are indicative of the order of magnitude. SCA and free-zone charges are set per activity, capital band and risk profile, so they should be confirmed against the current fee schedule during structuring rather than assumed.

How the SCA defines a security token

A security token is a cryptographic token whose economic characteristics mirror a traditional security. The most common categories issuers encounter are tokenised equity (a digital share carrying ownership and often dividend or voting rights), tokenised debt (a bond-like instrument promising repayment and interest), tokenised fund units (an interest in a pooled investment vehicle), and asset-backed instruments where the token gives an economic claim over real estate, commodities or revenue streams.

The distinction that trips up founders is the line between a security token and a genuine utility token. A true utility token gives access to a live product or service — think a network fee credit that can only be spent inside a functioning platform. The moment a token is marketed on the promise of price appreciation, profit distribution or a share in the venture's success, regulators lean toward treating it as a security. Payment tokens and stablecoins are a separate category again, sitting primarily with the CBUAE rather than the SCA.

Because the classification drives everything downstream, a written legal opinion on token characterisation is the practical starting point of any UAE offering. That opinion examines the rights bundle, the marketing narrative, the buyer expectations and the technical mechanics of the token, then concludes which regime — securities, virtual assets, payment tokens, or a combination — governs the raise.

Who regulates security tokens: SCA, VARA and the free zones

The UAE deliberately operates parallel regimes, and understanding the split prevents costly mistakes. The SCA is the federal securities regulator. Where a token is a security or a commodity-linked instrument offered to the UAE public, the SCA's framework is the reference point, and it has been actively building rules for digital securities and crowdfunding-style raises.

VARA regulates virtual asset service providers and issuance inside mainland Dubai. Its licence categories cover advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, and virtual asset transfer and settlement, plus a dedicated VA issuance category. If your security-token business also carries out any of those activities — for example running a trading venue or holding client assets — you need the matching VARA authorisation on top of respecting SCA securities principles.

The financial free zones run their own regimes. The DFSA in the DIFC and the FSRA in ADGM each have mature frameworks for investment tokens and security tokens, with ADGM in particular known for an early, detailed digital-securities regime. A token that is a security inside ADGM is regulated by the FSRA; inside DIFC, by the DFSA. Choosing where to domicile the issuer therefore changes which rulebook you follow, which is a strategic decision, not an afterthought.

The CBUAE completes the map for payment tokens and stablecoins through the Payment Token Services Regulation, a nationwide overlay. Most security token issuers will not touch this unless their model includes a settlement stablecoin, but it is worth confirming so nothing falls between the cracks.

Licensing and approval process for security token issuers

While the exact route depends on your chosen jurisdiction, the shape of a compliant security token offering in the UAE is consistent. The first phase is classification and structuring: obtain the legal opinion, decide the issuing entity's jurisdiction (mainland via DET, a free zone, or a financial free zone), and confirm which authorities must approve or be notified.

The second phase is entity formation and capitalisation. You incorporate the issuing vehicle, meet any minimum capital set for the activity, appoint fit-and-proper directors and a compliance officer, and put governance documents in place. Regulators expect substance — real management, real systems, real controls — not a shell.

The third phase is the offering document. A security token offering generally requires an approved prospectus or offering memorandum containing full, fair and non-misleading disclosure: the rights attached to the token, the risks, the use of proceeds, the team, financials and the technology. This is the single most scrutinised item in the file. A marketing whitepaper does not satisfy a securities prospectus requirement.

The fourth phase is operational readiness. Regulators assess your custody solution (how token holders' assets are safeguarded), your smart-contract audits, your AML/CFT programme, your investor onboarding and KYC, and your ongoing reporting capability. If you are also seeking a VARA activity licence, expect a technology and cybersecurity assessment as part of the review.

The final phase is authorisation and launch, followed by continuous compliance. Approval is not the finish line; it is the start of ongoing supervision, periodic reporting and, in most cases, annual supervision fees paid in advance.

Cost breakdown for a UAE security token offering

Founders should budget in layers. The first layer is regulatory fees. Where the model requires a VARA activity, the official schedule sets AED 40,000 application and AED 80,000 annual supervision for advisory or virtual asset transfer and settlement services, rising to AED 100,000 application and AED 200,000 annual for broker-dealer, custody, exchange, lending and borrowing, or management and investment services. Category 1 VA issuance carries AED 100,000 application and AED 200,000 annual supervision. Each additional activity added to a licence attracts an extension fee equal to 50% of the lower application fee, and custody must be a segregated standalone entity that cannot be aggregated with other activities.

The second layer is professional costs: legal classification and prospectus drafting, audit, tax advisory and the smart-contract security review. These frequently exceed the regulatory fees for a first offering because the documentation burden is heavy.

The third layer is operating substance: office space appropriate to your jurisdiction, qualified compliance staff, technology infrastructure and custody arrangements. The fourth layer is ongoing: annual supervision fees, audit renewals, reporting and continuing legal support.

Treat any single headline number with suspicion. A credible budget is built activity by activity from the current official schedules, then stress-tested against your specific model.

Tax treatment of security token issuers in the UAE

The UAE introduced a federal corporate tax that applies to business profits. The headline rate is 9% on taxable profit above AED 375,000, with profit up to that threshold effectively taxed at 0%. There is no personal income tax on individuals. Every security token issuer operating as a UAE entity must register with the Federal Tax Authority and file returns, even in early years where profit may be limited or negative.

Free zone entities may access specific corporate tax treatment where they meet the conditions to be a qualifying free zone person and earn qualifying income, but this is a technical determination that turns on the activity, the counterparties and the substance maintained. Do not assume a free zone automatically means a 0% rate; confirm the position with a tax adviser and the FTA framework. VAT and any transaction-level considerations should also be reviewed for token sales, platform fees and services. Authoritative guidance and registration sit with the Federal Tax Authority at https://tax.gov.ae/, which every issuer should consult early in structuring so the tax position is designed in, not bolted on.

SCA vs VARA vs free zones: choosing your route

There is no universally "best" jurisdiction; there is only the best fit for a specific model. If your token is unambiguously a security offered to UAE investors, the SCA framework is unavoidable at the federal layer, and you then choose where the issuing entity lives. If you also run virtual-asset activities in mainland Dubai, VARA authorisation is required for those activities. If you want a mature, detailed digital-securities rulebook and an English-common-law environment, ADGM under the FSRA or DIFC under the DFSA are natural homes for tokenised securities.

The decision variables are your investor base (retail versus professional), whether you need to run a trading or custody function, your appetite for capital and substance requirements, and how the token must interoperate with banking and settlement. Because these regimes overlap, the winning move is to map the whole activity set against every relevant authority before you incorporate, so you do not build in one jurisdiction only to discover a second regulator also has a claim.

Ongoing compliance obligations after launch

Authorisation begins a continuous relationship with your regulator. Expect periodic financial and prudential reporting, ongoing AML/CFT monitoring with suspicious-activity reporting, maintenance of fit-and-proper standards for key personnel, and prompt notification of material changes to your business, ownership or technology. Annual supervision fees where applicable are payable in advance, per activity, every year.

You will also need to keep your disclosures current. If the rights attached to the token change, if the risk profile shifts, or if the use of proceeds evolves, investors must be informed through the proper channels. Custody arrangements must remain robust and, for VARA custody activity, housed in a segregated standalone entity. Smart contracts that are upgraded should be re-audited. In short, compliance is an operating function, not a one-off project, and issuers who under-resource it after launch are the ones who run into trouble.

Disclosure and investor-protection obligations

Securities regulation exists to protect investors, and the disclosure regime is where that protection lives. A UAE security token offering is expected to give investors full, fair and non-misleading information so they can make an informed decision. That means the offering document must set out the rights attached to the token in plain terms, the risks specific to the project and the technology, the intended use of proceeds, the identity and track record of the team, the financial position of the issuer, and the terms on which the token can be transferred or redeemed. Omitting a material risk, or dressing up a speculative venture as a safe one, is precisely the conduct securities law is designed to punish.

Ongoing disclosure matters as much as the initial prospectus. If a fact that would influence an investor's decision changes after the offering — a shift in the business model, a material contract, a change in control, a technology failure or a regulatory development — the issuer generally has a duty to keep the market informed. For a tokenised security, this ongoing duty interacts with the immutability and transparency of blockchain, so issuers should design their communications and record-keeping to satisfy the regulator's expectations rather than assuming that an on-chain record substitutes for formal disclosure.

Investor protection also shapes who may participate. Many security token offerings are structured for qualified or professional investors, who are presumed to have the sophistication and resources to assess and bear the risk. Extending an offering to retail investors typically brings stricter disclosure, suitability and marketing requirements, because retail participants receive a higher level of protection. Deciding the target investor base early therefore drives the entire structure, from the offering document to the onboarding process and the marketing that is permitted.

Marketing, distribution and cross-border considerations

How a security token is marketed is regulated, not free. Promotional material for a regulated offering must be consistent with the approved disclosures, must not be misleading, and must respect any restrictions on who may be approached. Aggressive marketing that promises returns, downplays risk or targets the general public where only professional investors are permitted is a common route to enforcement. Issuers should treat every piece of marketing — website copy, social posts, investor decks, webinars — as subject to the same standards of accuracy as the prospectus itself.

Distribution channels matter too. In many cases a security token is placed through a licensed intermediary — a broker-dealer or placement agent — rather than sold directly by the issuer to the public. Where a secondary market is contemplated, the venue on which the token trades may itself need to be authorised, which is where a VARA exchange licence or a financial free-zone trading venue comes into play. Building a token that can never lawfully be listed anywhere is a design failure; the trading and settlement pathway should be planned alongside the issuance.

Cross-border reach adds another layer. Because tokens are inherently global, an issuer must consider not only UAE rules but also the rules of every jurisdiction where investors are located or where the token is actively promoted. A UAE-authorised offering does not automatically permit solicitation of investors elsewhere, and marketing into other countries can trigger their securities laws. Sensible issuers put geo-restrictions, investor eligibility checks and clear jurisdictional disclaimers in place, and take local advice wherever they intend to raise. This discipline protects the issuer from foreign enforcement and preserves the integrity of the UAE authorisation.

A worked structuring example

Consider a founder who wants to tokenise equity in a UAE real-estate holding company and offer it to professional investors. The first step is not incorporation; it is the classification opinion, which confirms the token is a security because it carries ownership and economic rights. That single conclusion determines that the SCA framework is the federal reference point and that the offering needs a proper prospectus rather than a whitepaper.

The founder then chooses a jurisdiction for the issuing entity, weighing a financial free zone with a mature digital-securities regime against a mainland or other structure, based on the investor base, the need for a trading venue, and banking and settlement requirements. Because the plan includes a platform where investors can later trade their tokens, the founder maps the secondary-market pathway early, recognising that the venue will need its own authorisation and that custody of investor tokens must be handled through appropriately segregated arrangements.

With the structure set, the workstreams run in parallel: drafting the prospectus and investor disclosures, building the KYC and onboarding process restricted to qualified investors, arranging custody and smart-contract audits, and registering the entity for corporate tax with the Federal Tax Authority. The founder budgets not just the regulatory fees but the legal, audit and technology costs, and resources a compliance function to run the offering and the ongoing obligations that follow. The offering launches only once the file is complete and approvals are in place — because for a security token, launching first and fixing compliance later is the fastest way to an enforcement problem. This sequence, classification first and launch last, is the through-line of every successful UAE security token project.

Common Mistakes When Issuing Security Tokens in the UAE

• Assuming a "utility token" label avoids securities regulation when the economic rights clearly make the token a security under SCA principles.
• Skipping the written legal classification opinion and building the whole raise on an unverified assumption about which regime applies.
• Treating a marketing whitepaper as a substitute for an approved prospectus or offering document with full risk disclosure.
• Ignoring overlap between the SCA, VARA, the DFSA, the FSRA and the CBUAE, and discovering a second regulator's claim only after incorporation.
• Under-budgeting by counting only regulatory fees and forgetting legal, audit, custody, technology and ongoing supervision costs.
• Forgetting to register with the Federal Tax Authority and assuming a free zone automatically delivers a 0% corporate tax rate.
• Marketing to retail investors when the offering structure only permits qualified or professional participation.
• Under-resourcing post-launch compliance, so reporting, AML monitoring and disclosure updates slip once the raise closes.

How Noble Core helps with SCA security token structuring

Security token issuance rewards preparation and punishes guesswork. Noble Core Ventures helps founders start in the right order: classifying the token, mapping every regulator with a potential claim — the SCA at federal level, VARA in Dubai, and the free-zone authorities where relevant — and building an issuance file that survives scrutiny. We coordinate the legal classification, entity structuring, tax registration with the FTA and the operational readiness that regulators expect.

If you are still deciding whether a security token is even the right vehicle, our UAE crypto licence guide covering VARA, ADGM and DMCC lays out the full landscape. To compare regulators head to head, read our breakdown of VARA vs ADGM vs SCA for crypto. For the specific activity permissions you may need alongside a securities offering, see our guide to VARA licence categories, and if you first need to confirm the basics, start with is crypto legal in the UAE. Book a free 20-minute consultation and we will help you find the compliant path for your token.

Frequently Asked Questions