DFSA Crypto Token Suitability Assessment for DIFC Firms

By the Guardian team Updated November 2026 5 min read

Quick answer. Since January 12, 2026, DIFC firms must assess each non-fiat token against GEN Rule 3A.2.1’s five criteria and conclude on reasonable grounds that it suits the activity. Negative indicators put the onus on the firm, with documented reasoning.

Watch: DFSA Crypto Token Suitability Assessment for DIFC Firms 1:40

Video transcript

The DFSA no longer publishes a list of Recognised Crypto Tokens. Since January 12, 2026, each DIFC firm decides for itself, on reasoned and documented grounds.

Suitability moved from the regulator to the firm, and so did the token list. Fiat Crypto Tokens stay with the DFSA, and privacy and algorithmic tokens remain banned.

GEN Rule 3A.2.1 sets five criteria: characteristics, regulatory status, market, technology and compliance. Four of the five leave evidence on the chain.

Any negative indicator shifts the onus to the firm, which must show why the token is still suitable, backed by objective evidence.

These are examples, not thresholds: the guidelines cite the top 10 wallets holding five percent of supply as a positive example.

Three checks carry most of the weight, each read at a recorded block: admin and mint roles, every upgrade path against the documented process, and holder concentration.

Keep one file per token and activity, with contract addresses, role holders, concentration figures, each negative indicator, and triggers to reassess.

Guardian's audits and deployment verification read roles and upgrade paths from chain state, and its Regulatory and Compliance service turns that into dated evidence.

Read the full article for the indicator tables, and talk to Guardian about token files that survive supervision. It is not legal advice, so confirm with counsel.

On January 12, 2026, the DFSA brought its updated Crypto Token rules into force. It no longer publishes a list of Recognised Crypto Tokens.

Instead, each firm decides, on a reasoned and documented basis, whether a token meets the criteria. The duty covers financial services, promotions, public offers and fund activities involving the token.

Many of the indicators the DFSA lists are technical, and the chain can answer them.

This article explains the technical and security side of GEN Rule 3A.2.1 and the DFSA’s Supervisory Guidelines on crypto token suitability. It is not legal advice; confirm how it applies to you with counsel.

What Changed in January

	Before	From January 12, 2026
Who assesses suitability	The DFSA	Each firm
Token list	The DFSA’s Recognised Crypto Tokens	Each firm’s own, shown to its clients

The rule itself is GEN 3A.2.1. Its key parts:

(2)(a): the firm has “undertaken a prior assessment” and “concluded on reasonable grounds” the token is suitable.
(2)(b): Fiat Crypto Tokens stay with the DFSA, which must be satisfied they are suitable.
(3): the five criteria the assessment covers.
(4): the financial services ban in (1)(a) does not apply to custody of a token.

Privacy tokens and devices (GEN 3A.2.2) and algorithmic tokens (GEN 3A.2.3) are banned. No assessment can clear them.

The DFSA also issued Supervisory Guidelines on December 15, 2025, per Clyde & Co and Dechert. They set out how the DFSA expects a firm will typically comply.

The Five Criteria

GEN 3A.2.1(3) lists them. Four of the five leave technical evidence on the chain.

Criterion	What it covers	Technical evidence
(a) Characteristics	Purpose, governance arrangements, founders	Admin roles, upgrade process, holder concentration
(b) Regulatory status	Assessment or approval by other regulators	Little; this is a legal check
(c) Market	Size, liquidity, global trading history	Supply verifiable onchain, concentration
(d) Technology	The technology behind the token	Chain resilience, pause and upgrade paths
(e) Compliance	Whether the token blocks DFSA compliance	Traceability for AML screening

The guidelines say a firm should weigh each criterion against its activity, its clients and the scale of its DIFC business.

Their example: a large fund manager may accept a low market cap for a closed-ended fund sold only to Professional Clients. A small firm dealing for Retail Clients may not.

A token suitable for one activity or firm is not automatically suitable for another.

The Technical Indicators

The guidelines’ annex gives positive and negative examples under each criterion. The technical ones:

Topic	Positive example	Negative example
Concentration	Top 10 wallets hold 5% of supply collectively	Meme coin whose developers’ affiliates hold 15%+
Governance	Documents who can propose changes and how upgrades happen	Real use differs from the issuer’s claims
Traceability	Public, permissionless chain, full transaction visibility	Ring signatures and stealth addresses
Supply	Total, circulating and maximum supply verifiable onchain	Not given
Resilience	Over five years live, thousands of nodes, no major incidents	Not given
Incidents	Incident procedures, fast patching, coordinated response	Unable to halt exploitative transactions

A negative indicator does not end the assessment. It shifts the onus to the firm to show why the token is still suitable.

That reasoning “should be documented and supported by objective evidence,” the guidelines say.

Evidence From the Chain

Three checks carry most of the technical weight. Read each per chain, at a recorded block.

Admin and mint roles

Every privileged role: owner, minter, pauser, freezer, upgrader.
Who holds each: a single key, a multisig (and its threshold), a timelock or governance.
Mint caps, and mint history against disclosed supply.
Whether anyone can pause transfers during an exploit.

These answer governance under (a), verifiable supply under (c) and incident response under (d).

Upgradeability

Find every path that can change the code: a proxy admin, a migration function, a governance executor. Note any timelock delay.

Then compare it with the documented process. If the docs promise a vote and a delay, but a small multisig can upgrade at once, record the gap and weigh it under (a).

The UK asks similar questions of trading platforms; our FCA admission due diligence guide has a role-by-role table.

Holder concentration

Pull the largest holders at a dated block.
Label exchange, bridge, staking, burn and vesting addresses.
Report the top-10 share raw and with those labels applied.
Identify team, foundation and other affiliate wallets.

The DFSA’s 5% and 15% figures are examples, not thresholds. Explain where your token sits and why.

Documenting the Assessment

GEN 3A.2.1A sets duties that last as long as the firm uses the token. A firm must:

Be able to show the DFSA the grounds for each conclusion.
Monitor each token continuously and review its assessment regularly.
Stop the activity at once, or take reasonable steps to, if a token is no longer suitable.
Show clients a current list of the tokens it has found suitable.
If authorised, file a Crypto Token return each month.

To show those grounds, keep one file per token and activity. Record:

The activity and client type it covers.
Contract addresses on every chain, with the block read.
Role holders, thresholds, timelocks and upgrade history.
Supply and concentration figures, and how you labeled addresses.
Each negative indicator, and the evidence that it is acceptable.
The conclusion, who approved it and when.
Triggers to reassess: an upgrade, a role change, a new chain, an incident.

Relying on another firm

A firm dealing in a product linked to a token can take another firm’s assessment of it into account. The example given is a fund distributor relying on the fund manager.

Clyde & Co notes the firm remains responsible for its own determination.

How Guardian Helps

Guardian’s audits and deployment verification read a token’s deployments, roles and upgrade paths from verified source and chain state.

Its Regulatory & Compliance service turns that work into technical evidence. Each artifact carries its scope and the date it was produced, and is replaced when the system changes.

For how regulators elsewhere treat the same questions, see our crypto regulatory compliance guide.

Frequently Asked Questions

What is the DFSA suitability assessment?

The check GEN Rule 3A.2.1(2)(a) requires before a DIFC firm uses a token. The firm must assess it against five criteria and conclude, on reasonable grounds, that it suits that activity. Fiat Crypto Tokens stay with the DFSA.

Does the DFSA still publish a list of Recognised Crypto Tokens?

No. Since January 12, 2026, the DFSA no longer publishes a list of Recognised Crypto Tokens. Each firm makes its own determination and shows clients a current list of the tokens it has found suitable.

What holder concentration does the DFSA expect?

Its Supervisory Guidelines give the top 10 wallets holding 5% of supply collectively as a positive example. A negative one is a meme coin whose developers’ affiliates hold 15% or more. They are examples, not thresholds.

Can a DIFC firm rely on another firm’s token assessment?

Partly. A firm dealing in a product linked to a token can take another firm’s assessment into account, such as a fund distributor relying on the fund manager. Suitability for one activity or firm does not carry over automatically.

Sources

Build token files that survive supervision

Guardian reads each token’s roles, upgrade paths and deployments from the chain and gives your assessment evidence it can date and trace.

Talk to Guardian Explore regulatory compliance