Saudi CMA vs UAE VARA: Digital Asset Regulatory Framework Comparison

Side-by-side comparison of Saudi CMA and UAE VARA digital asset regulatory frameworks — covering licensing requirements, capital thresholds, custody standards, and enforcement approaches across the two largest Gulf digital asset jurisdictions.

Regulatory Framework Comparison

This comparison examines the structural differences between the regulatory approaches, identifying where Saudi Arabia’s framework exceeds, matches, or trails peer jurisdictions in specific regulatory dimensions.

Licensing and Authorization

Saudi Arabia’s CMA Digital Assets Framework establishes 7 specific license categories for digital asset activities, with capital requirements ranging from SAR 2M (advisory) to SAR 100M (clearing). This compares to varying approaches in peer jurisdictions, reflecting different priorities around market access, investor protection, and systemic risk management.

Capital Requirements

Saudi Arabia’s capital requirements for digital asset activities are among the highest globally, reflecting the CMA’s emphasis on institutional-grade participants:

• Trading platforms: SAR 50M (~$13.3M) — exceeding most peer jurisdictions
• Custody providers: SAR 25M (~$6.7M) with 95% cold storage mandate
• Issuers: SAR 10M (~$2.7M) with mandatory Sharia board costs

Investor Protection

The CMA’s investor protection framework includes:

• Three-tier investor classification (QI, SQI, Retail)
• Mandatory suitability assessments with digital asset-specific risk evaluation
• 72-hour cooling-off period for first-time retail investors
• Investor Protection Fund coverage up to SAR 1M per investor

Custody Standards

Saudi Arabia’s custody standards mandate:

• 95% cold storage minimum
• Quarterly proof-of-reserves attestation
• Mandatory Saudi data residency for all key management infrastructure
• SAR 65M minimum insurance coverage

Disclosure Requirements

The CMA mandates 14 digital asset-specific disclosure categories beyond standard securities disclosures, including smart contract code, blockchain protocol details, and Sharia compliance documentation.

AML/CFT Framework

Saudi Arabia’s joint CMA-SAMA AML/CFT framework requires:

• Real-time blockchain analytics from approved providers
• Travel rule compliance at SAR 3,750 threshold
• Enhanced due diligence for unhosted wallet transfers
• 24-hour STR filing deadline

Enforcement

The CMA has issued 7 enforcement actions totaling SAR 20.5M since the framework’s launch, establishing precedents for territorial jurisdiction, substance-over-form classification, and smart contract governance oversight.

Market Infrastructure Comparison

Settlement

Saudi Arabia’s blockchain settlement infrastructure offers T+0 atomic settlement through Tadawul’s R3 Corda-based platform, with Edaa serving as central depository. This represents one of the most advanced exchange-integrated DLT settlement systems globally.

Market Access

The Tadawul digital securities platform provides:

• Continuous auction trading integrated with the conventional exchange
• 3 designated market makers
• 12 connected broker-dealers
• Average daily volume of SAR 12-18M (pilot phase)

Innovation Environment

Sandbox

Saudi Arabia operates two complementary sandboxes:

• CMA sandbox for securities-related digital asset activities (19 participants, 7 graduated)
• SAMA sandbox for fintech and payment token activities (43 participants, 28 graduated)

Ecosystem Support

• Fintech Saudi accelerator programs
• Saudi Blockchain Lab research support
• SAR 1.2B in fintech venture capital investment (2025)

Conclusions

Saudi Arabia’s tokenization regulatory framework is distinguished by:

1. Comprehensiveness — Covering securities, payments, and settlement in a coordinated framework
2. Sharia integration — The only jurisdiction mandating Islamic finance compliance at the regulatory level
3. Infrastructure investment — Tadawul and Edaa DLT integration provides production-grade market infrastructure
4. High standards — Capital, custody, and disclosure requirements exceed most peer jurisdictions

The tradeoff is higher compliance costs and longer licensing timelines, which may disadvantage Saudi Arabia for smaller or early-stage digital asset firms that can operate more quickly in jurisdictions with lower barriers to entry.

Detailed Regulatory Dimension Analysis

Regulatory Philosophy

The fundamental philosophical difference between the Saudi CMA and UAE VARA frameworks shapes every regulatory dimension:

Saudi CMA: Securities-first approach. The CMA views tokenized assets primarily through the lens of capital markets regulation, applying institutional-grade standards derived from decades of conventional securities oversight. The framework assumes that digital asset securities should be regulated at least as rigorously as conventional securities, with additional requirements for technology-specific risks. The CMA’s enforcement actions demonstrate a substance-over-form classification approach — if an asset functions as a security, it is regulated as one regardless of marketing labels.

UAE VARA: Innovation-first approach. VARA was designed specifically for virtual assets, not adapted from existing securities regulation. The framework balances investor protection with market development, accepting lower capital and compliance thresholds to attract a broader base of participants. VARA’s emphasis on speed-to-market (average licensing time 4-6 months versus Saudi Arabia’s 14 months) reflects Dubai’s strategic objective of becoming a global virtual asset hub.

Sharia Compliance: The Saudi Differentiator

The most significant regulatory divergence is Sharia compliance treatment:

Saudi Arabia: Mandatory Sharia certification for all Digital Asset Securities, requiring CMA-approved Sharia board review of both the instrument structure and the smart contract code. This adds SAR 150,000-500,000 per issuance and 3-6 weeks to the timeline, but provides access to the $4.5 trillion global Islamic finance investor base. 85% of Saudi tokenized securities carry active Sharia certification.

UAE VARA: Sharia compliance is optional and managed by the issuer, not the regulator. VARA does not require or facilitate Sharia certification, leaving Islamic compliance as a commercial decision. This reduces regulatory burden but means UAE-issued digital assets may not satisfy the investment mandates of Saudi and other GCC institutional investors with Sharia-compliance requirements.

For institutional investors with Islamic finance mandates — including Saudi pension funds, sovereign wealth vehicles, and Islamic banks — this difference is decisive. Saudi tokenized sukuk carry regulatory-grade Sharia certification that satisfies fiduciary requirements; UAE virtual assets do not carry equivalent regulatory assurance.

Market Infrastructure Integration

Saudi Arabia: The Tadawul digital securities platform is integrated into the Kingdom’s $2.7 trillion national exchange, with Edaa providing central depository services and blockchain settlement infrastructure enabling T+0 atomic settlement. The convergence roadmap targets full integration of digital and conventional securities by 2028.

UAE VARA: Dubai does not have integrated exchange infrastructure for virtual assets. VARA-licensed exchanges operate independently of the Dubai Financial Market (DFM) and Abu Dhabi Securities Exchange (ADX). While ADX has partnered with NASDAQ for digital asset technology, no production-grade exchange-integrated settlement comparable to Tadawul’s infrastructure exists in the UAE.

Cross-Border Enforcement Cooperation

The CMA-UAE SCA bilateral agreement signed in March 2025 facilitates cross-border enforcement cooperation, but jurisdictional boundaries remain. The Q1 2025 CMA enforcement action against a Dubai-based entity promoting unauthorized digital assets to Saudi residents demonstrated both the reach and the limits of cross-border enforcement — the CMA could block the entity’s Saudi-facing operations and impose a penalty, but enforcement of the financial penalty required UAE cooperation through the bilateral agreement mechanism.

Entity Decision Framework

For entities choosing between Saudi CMA and UAE VARA licensing, the decision matrix includes:

Many sophisticated operators are pursuing dual licensing — obtaining both Saudi CMA and UAE VARA authorization through the CMA’s international cooperation framework — to serve the full spectrum of GCC digital asset demand. The ELDAP pathway in Saudi Arabia and VARA’s expedited licensing for established entities facilitate this dual-jurisdiction strategy.

FATF Compliance Positioning

Both Saudi Arabia and the UAE are FATF members, but their digital asset FATF compliance profiles differ:

Saudi Arabia: FATF membership since 2019, with the 2024 mutual evaluation rating the Kingdom’s digital asset framework as “largely compliant” with Recommendations 15 and 16. The CMA’s travel rule implementation at SAR 3,750 threshold and mandatory blockchain analytics deployment are cited as strengths. Saudi Arabia’s G20 membership provides additional institutional credibility and influence over global standard-setting.

UAE: FATF membership since 2000, but the multi-regulator structure (VARA, ADGM, SCA, Central Bank) creates supervisory coordination challenges that the FATF has flagged. The UAE was placed on the FATF grey list from 2022 to 2024 before demonstrating sufficient compliance improvements to be removed. While the UAE’s current FATF standing is satisfactory, the historical grey list placement continues to affect institutional risk perceptions.

For entities serving international institutional capital, Saudi Arabia’s unbroken FATF compliance record and G20 membership provide a stronger regulatory credibility foundation than the UAE’s more complex compliance history. However, the UAE’s established market presence and larger number of licensed entities (particularly in retail virtual asset trading) provide practical advantages for entities targeting the broader crypto market.

Settlement and Market Infrastructure

The settlement infrastructure comparison reveals fundamental architectural differences:

Saudi Arabia: Tadawul-Edaa DLT integration provides T+0 atomic settlement on R3 Corda, with unified depository and exchange infrastructure serving a $2.7 trillion market. The convergence roadmap targets all securities settling through DLT by 2028.

UAE: ADX-NASDAQ DLT partnership provides near-T+0 settlement for digital securities, with separate exchanges (ADX, DFM) and clearing entities creating a more fragmented but diversified market structure. No convergence roadmap has been announced.

Sharia Compliance Distinction

The most structurally significant difference between the frameworks is Sharia compliance treatment. Saudi Arabia’s CMA mandates Sharia compliance integration at the regulatory level — 85% of Saudi tokenized securities carry Sharia certification, and all tokenized sukuk require CMA-approved Sharia board certification. VARA does not require Sharia compliance, and Islamic finance considerations are optional for UAE digital asset issuers.

This distinction determines each jurisdiction’s addressable market. Saudi Arabia’s mandatory Sharia framework provides access to the global Islamic finance market ($4.5 trillion in assets), where institutional mandates require Sharia-certified instruments. The UAE’s flexibility allows access to both Islamic and conventional investors but without the regulatory-level Sharia guarantee that institutional Islamic finance mandates require.

The CMA-VARA comparison ultimately presents a strategic choice: Saudi Arabia for institutional-grade tokenized securities with Islamic finance integration and the Gulf’s largest market, or the UAE for speed-to-market, retail virtual asset access, and geographic positioning in Dubai’s established hub. The CMA’s international cooperation framework and the emergence of cross-border ELDAP pathways may eventually enable entities to serve both markets efficiently from a dual-licensed position, capturing the complementary strengths of each jurisdiction.

Workforce Development and Regulatory Capacity

Saudi Arabia’s regulatory capacity for digital assets draws on deeper institutional infrastructure. The Saudi Digital Academy has trained 120 regulatory professionals across CMA and SAMA through its “Digital Capital Markets” certification program, while the Saudi Blockchain Lab employs 35 researchers providing technical advisory to the CMA. VARA, while more agile due to its smaller regulatory perimeter, relies on a smaller team that must cover the broader scope of virtual assets including unregulated utility tokens and NFTs that fall outside the CMA’s jurisdiction.

The CMA’s participation in IOSCO’s Crypto-Assets Working Group — where Saudi Arabia co-chairs — and its engagement with the SEC and ESMA through bilateral channels give the Saudi framework international standard-setting influence that VARA’s more operationally focused model does not match. The Saudi FinTech Strategy 2025 provides a 5-year policy framework for digital asset development that connects regulatory design to Vision 2030 economic objectives, while VARA operates within Dubai’s more market-responsive regulatory culture. Both approaches have merit — Saudi Arabia’s provides long-term regulatory predictability favored by institutional investors, while VARA’s provides the adaptability that fast-moving digital asset businesses prefer. For firms evaluating market entry, the choice between Saudi CMA and UAE VARA licensing increasingly depends on target investor base — institutional capital gravitates toward the CMA’s deeper regulatory infrastructure, while retail-focused digital asset platforms may benefit from VARA’s faster licensing timelines and broader asset class coverage.

Tadawul’s $2.7 trillion market capitalization — the largest exchange in the Middle East — provides CMA-licensed entities with an addressable market that dwarfs any single UAE exchange venue.

For comparative analysis inquiries: info@sauditokenisation.com