Dubai tightens crypto rules on privacy while widening access for funds under new DFSA regime

Dubai’s financial free zone has introduced sweeping changes to its cryptocurrency regulations. 

The rule tightens controls on privacy-focused assets. Also, it expands institutional access to digital tokens, as the Dubai Financial Services Authority’s [DFSA] latest amendments took effect on 12 January 2026.

Under the new framework, privacy tokens and “privacy devices” are prohibited from or in the Dubai International Financial Centre [DIFC] for regulated activities. 

Also, licensed firms are now responsible for assessing which crypto tokens are suitable for clients, replacing the DFSA’s previous token-list model.

The dual move signals a shift toward traceable, institution-grade crypto markets inside DIFC, aligning the free zone with global anti-money-laundering standards.

It also opens the door to broader participation by funds, brokers, and custodians.

Privacy tokens and privacy tools now barred in Dubai

At the heart of the update is GEN Rule 3A.2.2, which states that a person must not, in or from the DIFC, carry on a financial service relating to a Privacy Token or involving a Privacy Device, nor make or approve a financial promotion or public offer for such assets. 

The DFSA defines “Privacy Device” broadly to include any software, hardware, or process intended to hide or anonymise transaction origins, destinations, identities, keys, values, or beneficial ownership. 

Crypto tokens like Zcash [ZEC] and Monero [XMR], and platforms like Tornado Cash, fall into this category.

In practical terms, the rule excludes anonymity-enhancing tokens and tools from DIFC’s regulated financial system. This ensures that assets used by licensed firms can be monitored, audited and traced.

From token lists to firm-level suitability

At the same time, the DFSA has overhauled the approval process for tokens.

The regulator confirmed that “the DFSA no longer maintains a prescribed list of Recognised Crypto Tokens.” Instead, it has shifted the burden of suitability to licensed firms. They must now assess, disclose, and continuously review the crypto tokens they support.

Firms are now required to publish and maintain their own list of assessed-as-suitable tokens and to keep those assessments under ongoing review.

The change mirrors how banks and brokers evaluate securities and derivatives. This moves DIFC crypto from a regulator-curated whitelist to a risk-based, firm-driven model.

Funds get more room — with controls

While privacy-focused assets have been pushed out, investment funds have been given more flexibility. 

The DFSA said thresholds and restrictions on funds investing in crypto tokens have been removed. It is now subject to suitability assessments and robust risk management. 

That creates a clearer pathway for crypto-exposed funds [ETFs] and structured products to operate in DIFC. This is provided they use compliant tokens and regulated custody and governance arrangements.

What it means for Dubai’s crypto ambitions

Assets that cannot meet traceability, AML, and suitability standards are excluded. At the same time, institutional capital, from funds, brokers, and custodians, faces fewer barriers to entry.

The approach positions DIFC closer in spirit to Europe’s MiCA regime and U.S. ETF market.

Final Thoughts

• Privacy tokens and privacy-obfuscation tools are barred in DIFC, while firms must now assess and disclose which crypto tokens they deem suitable.
• The rules tighten AML traceability while expanding institutional pathways for funds and products to access compliant crypto.