UAE Travel Rule for Crypto: AED 3,500 and Unhosted Wallets

Video transcript

The UAE Travel Rule is federal and reaches VASPs nationwide, free zones included. Meeting it is mostly an engineering job.

Four texts stack up. The key dates: a Cabinet Resolution effective December 14, 2025, and VARA's circular of February 24, 2026.

Each transfer must carry full names of both parties, both wallet or account numbers, and the originator's identity details. In a batch, every item carries its own full set.

Never send to an unregulated VASP, in the UAE or abroad. Our reading: keep a counterparty register, and check it before any withdrawal is signed.

The threshold changes verification, not data. Once daily transfers reach 3,500 dirhams in aggregate, the beneficiary's VASP must verify the beneficiary. Below it, data still travels.

Unhosted wallets, smart contracts included, need enhanced due diligence. Outgoing transfers without the data are declined. For incoming ones, ask your customer, then consider delaying or returning.

Article 5 bars any UAE VASP from executing a privacy token transfer. Enforce the ban in your asset registry.

VARA may review your implementation, so test it first. Confirm every transfer carries its data, unregulated counterparties are blocked before signing, split transfers trigger verification, missing-data paths leave a record, and no path moves a privacy token.

Guardian's regulatory readiness assessment maps every provision to a control and evidence. Read the full article, or talk to Guardian at guardian.security.

On February 24, 2026, Dubai's Virtual Assets Regulatory Authority (VARA) sent a circular to every VASP it licenses or authorizes.

It sets out VARA's supervisory expectations for the UAE Virtual Assets Travel Rule. That text is federal, and it reaches VASPs across the country.

Most of the work is engineering: what data travels, which addresses count as unhosted, and what your logs can prove.

This article explains the technical and security side of the UAE Virtual Assets Travel Rule and VARA's February 2026 circular. It is not legal advice; confirm how it applies to you with counsel.

The Legal Chain

Four texts stack up:

The circular calls the Cabinet text a “Decision”; ADGM calls it a “Resolution”. It is one instrument, replacing Cabinet Resolution No. 10 of 2019.

The December 14, 2025 date is from an ADGM notice of December 8, 2025.

The circular sets no separate date. The Travel Rule applies under the Cabinet Decision's commencement provisions, and VASPs are expected to be fully compliant from that date.

For the separate CBUAE law that may reach DeFi, see Federal Decree-Law No. 6 of 2025.

Who Must Comply

The Travel Rule applies to VASPs “within the territorial scope of the UAE Federal and Emirate Laws, any Free Zone and any Financial Free Zone”.

• Dubai: VARA's circular addresses the VASPs it licenses.
• ADGM: the FSRA told its firms to comply on February 3, 2026. Where its AML Rulebook conflicts with the Travel Rule, they should follow the Rulebook.
• Everywhere else: the same text covers VASPs onshore and in every other free zone.

It covers three kinds of transfer:

1. VASP to VASP, in either direction (Article 1).
2. Transfers that pass through an intermediary VASP (Article 2).
3. Transfers to or from an unhosted wallet (Article 3).

Gas fees are out of scope. “Execute” is read broadly: VARA includes initiating, facilitating, effecting or “otherwise materially contributing” to a transfer.

The Data Every Transfer Carries

Article 1(2) bars a transfer unless this data is collected, verified and sent “immediately and securely” with it:

• The full name of the originator and the beneficiary.
• Both wallet or account numbers, or a unique reference that traces the transfer.
• The originator's address, national identity or travel document number, customer identification number, and date and place of birth.

Batched transfers

Each transfer in a batch carries its own full data set (Article 1(3)).

Domestic transfers

If verified data is already available to the beneficiary's VASP by other means, a domestic transfer may carry only the wallet, account or reference number (Article 1(6)).

The full data set must then follow within three working days of a request from the beneficiary's VASP or a supervisor.

Our reading: any past domestic transfer should resolve to its full record by reference.

Counterparty VASP Checks

Before sending, the originator's VASP must ensure the beneficiary's VASP is “appropriately regulated” where it is incorporated and located (Article 1(4)).

It must not send to an unregulated VASP, in the UAE or abroad.

Some counterparties cannot receive Travel Rule data. The sender must then:

• Detect it, with risk-based policies (Article 1(7)).
• Use best efforts to open another channel (Article 1(8)).
• Failing that, consider declining further transfers to that VASP.

Risk factors include value, linked transfers, frequency, and the counterparty's reputation, regulated status and home-country financial crime laws.

Intermediaries must verify both VASPs' status and keep a log of all transfers, “including attempts that were rejected” (Article 2(2)).

Our reading: keep a counterparty register with license evidence and a review date. Check it before a withdrawal is signed.

The AED 3,500 Threshold

The threshold changes verification, not data. Data travels with every qualifying transfer, whatever the amount.

The text does not define the day or the conversion rate into AED. Our reading: aggregate per customer per calendar day at a documented rate, so split transfers cannot slip under.

Unhosted Wallets and Privacy Tokens

Unhosted wallets

Before sending to or receiving from an unhosted wallet for a customer, a VASP must perform enhanced due diligence (Article 3(2)).

That includes extra identification documents and source of funds verification.

• Outgoing: request any Article 1(2) data you lack. If it does not arrive, decline the transfer (Article 3(5)).
• Incoming: if data is missing, take reasonable steps to get it from your customer. Then consider delaying or returning the transfer (Article 3(4)).

The definition of an unhosted wallet includes smart contracts. A footnote says firms “must consider how customer information can be incorporated into smart contracts”.

Neither the Travel Rule nor the circular requires proof that a customer controls a wallet. A signed message is a common practice, not a requirement.

ERC-191 sets the format for Ethereum accounts; ERC-1271 lets contract wallets validate signatures.

Our reading: if a destination cannot be matched to a regulated VASP, handle it under the unhosted wallet rules.

See also the FATF report on unhosted wallets.

Privacy tokens

Article 5 says: “No UAE Virtual Asset Service Provider shall Execute a Virtual Asset Transfer of a Privacy Token”.

A privacy token is one that, by design, hides or purports to hide holder or transaction details that would otherwise be visible onchain.

VARA adds that the ban covers executing transfers. It does not affect licensed activities that involve no such execution.

Enforce it in your asset registry. Assets with optional privacy features are not named; ask counsel.

Testing Your Travel Rule Stack

VARA may assess implementation through supervision engagements, inspections and thematic reviews. Test these first:

1. Every transfer, and every item in a batch, carries the Article 1(2) fields.
2. Transfers to unchecked or unregulated VASPs are blocked before signing.
3. Split transfers trigger verification once a day's total reaches AED 3,500.
4. Each missing-data path (reject, delay, return, report) works and leaves a record.
5. Unhosted wallet withdrawals without the data are declined.
6. No transfer path can execute a privacy token transfer.
7. Travel Rule data is encrypted in transit and at rest; its API keys are tightly scoped.
8. Logs cover every transfer, rejection and failed attempt, kept as Article 25 of the Cabinet Resolution requires.
9. Systemic failures by originating VASPs are reported to your supervisor (Article 1(15)).

How Guardian Helps

Guardian's regulatory readiness assessment maps your activities to the licenses that reach them, a VARA license included. It lists every provision with its control and evidence.

Travel Rule data is personal data moving between firms. An API pentest tests what each key can reach, per-object authorization and replay protection.

For another 2026 VARA circular, see the reserve assets audit scope.

Frequently Asked Questions

Does the UAE Travel Rule apply in free zones?

Yes. It covers VASPs under UAE federal and emirate laws, any free zone and any financial free zone. ADGM's FSRA told its firms to comply on February 3, 2026, and to follow its AML Rulebook where the two conflict.

What is the AED 3,500 threshold in the UAE Travel Rule?

At daily aggregated amounts of AED 3,500 or more, the beneficiary's VASP must verify the beneficiary's identity, if not verified before. Below it, the data must still travel, but needs verifying only if a crime is suspected.

Are privacy tokens banned in the UAE?

Yes, for transfers. Article 5 says no UAE VASP shall execute a privacy token transfer. VARA says this does not affect licensed activities that involve no such execution.

What must a VASP do before sending crypto to an unhosted wallet?

Enhanced due diligence on the customer, including extra identification documents and source of funds checks. It must also request any required data it lacks, and decline the transfer if the data does not arrive.

Sources

• VARA: Circular, Implementation of the UAE Virtual Assets Travel Rule Requirements (February 24, 2026)
• NAMLCFTC: The United Arab Emirates' Virtual Assets Travel Rule (copy published by ADGM)
• ADGM FSRA: Notice FSRA/FCCP/25/2026, NAMLCFTC Decision regarding the UAE's Virtual Assets Travel Rule (February 3, 2026)
• ADGM FSRA: Notice FSRA/FCCP/172/2025, Update on the UAE Federal AML/CFT Legislative Framework (December 8, 2025)
• VARA Rulebooks: Federal AML/CFT Laws (accessed November 6, 2026)
• Ethereum Improvement Proposals: ERC-191, Signed Data Standard (January 20, 2016)
• Ethereum Improvement Proposals: ERC-1271, Standard Signature Validation Method for Contracts (July 25, 2018)