Regulatory Framework for Token Exchanges

Swiss law differentiates tokens by function and regulates exchanges accordingly. The Swiss Financial Market Supervisory Authority (FINMA) classifies payment tokens (cryptocurrencies used as means of payment), utility tokens (access to an application/service), and asset tokens (analogous to securities). Payment token exchanges are not subject to securities law but are deemed financial intermediaries – they must self-regulate or be licensed for AML purposes. Asset tokens (security tokens) and exchanges dealing in them fall under securities law requirements (prospectus, licensing as securities dealers or trading venues). In 2021, Switzerland introduced a DLT Trading Facility license for blockchain-based trading systems: any exchange permitting multilateral trading of DLT securities (e.g. tokenized equities or bonds) with retail access or performing central custody/settlement must obtain FINMA authorization under the Financial Market Infrastructure Act. There is no separate license for pure cryptocurrency (non-security) trading platforms beyond AML registration, but many Swiss crypto brokers voluntarily adhere to standards via FINMA-supervised SROs. Stablecoins are treated on a case-by-case basis: FINMA’s guidance notes that a CHF-pegged or asset-backed token may be considered a deposit (triggering banking law) or a security, depending on its structure. FINMA has warned of increased AML risks in stablecoin arrangements and requires issuers or guarantors to meet prudential safeguards.

 

Overall, Swiss regulators emphasize technology-neutral principles: crypto exchanges must either fit into an existing regulatory category (and get that license) or limit activities to remain outside regulated financial markets, all while complying with AML obligations under the Swiss Anti-Money Laundering Act.

​Singapore imposes full regulatory licensing on both centralized exchanges and certain decentralized asset services under its Payment Services Act 2019 (PSA). Operating a crypto exchange is regulated as providing a “digital payment token service,” which covers buying/selling digital tokens or facilitating the exchange of digital tokens between parties as a business.

 

Such providers must obtain a license from the Monetary Authority of Singapore (MAS) – typically a Major Payment Institution license if volumes exceed set thresholds – and comply with requirements on technology risk management, user asset safeguarding, and AML/CFT (per MAS Notice PSN02). Exchanges that list security tokens or derivatives are instead regulated under securities laws (the Securities and Futures Act): they may need recognition as an approved exchange or a licensed market operator, unless operating under MAS sandbox relief.

 

In 2023, MAS finalized a new framework for single-currency stablecoins (SCS) aimed at regulating issuers (requiring reserve backing, redemption at par, and prudential standards). While this framework primarily targets issuers, exchanges dealing in stablecoins may only list MAS-regulated SCS or properly vetted foreign stablecoins, as part of their obligation to ensure the suitability of tokens offered.

 

Singapore explicitly bans exchanges from offering bank-like returns on tokens and from facilitating token lending/staking for retail users without further regulatory approval.

 

Overall, Singapore’s regime is strict on AML/KYC (all crypto exchanges must identify customers and report suspicious transactions, per PSA and MAS Notices) and is expanding investor protections (new rules in 2024 require segregation of customer assets and prohibit misuse of customer tokens). Enforcement is handled by MAS, which has powers to inspect, impose fines, or revoke licenses for non-compliance, and has notably fined or shut down unlicensed operators.

• Dubai’s Virtual Assets Regulatory Authority (VARA) requires token issuers to obtain a VARA permit for regulated virtual asset activities (e.g. offering or selling “Virtual Tokens”) within Dubai (excluding the DIFC free zone). Under Dubai Law No. 4 of 2022, any person issuing virtual assets in Dubai must establish a local entity and be licensed by VARA (especially for Category 1 issuances such as stablecoins). VARA’s framework mandates comprehensive disclosure (Whitepapers) and ongoing compliance for token offerings, and strictly controls marketing of virtual assets, including by foreign issuers targeting Dubai.
   

• At the UAE federal level, the Securities and Commodities Authority (SCA) is the primary regulator of virtual assets outside the financial free zones. Cabinet Decision 111/2022 (in force 14 Jan 2023) requires SCA licensing and oversight for key virtual asset activities (exchange, transfer, custody, brokerage, etc.), while carving out payment tokens under Central Bank jurisdiction. Pursuant to Cabinet Decision 112/2022, Dubai’s VARA is formally delegated to license and supervise virtual asset activities within Dubai in coordination with SCA.
   

• Security tokens (digital tokens conferring rights similar to stocks, bonds, or other securities) are excluded from the “virtual asset” regime and instead treated as securities under UAE law. Issuers of security tokens must comply with SCA’s securities offering regulations (e.g. public offer prospectus requirements or private placement limits) and cannot rely on VARA’s virtual asset license; any public token offering that constitutes a security requires prior SCA approval and registration in accordance with federal securities laws.

​

• Utility tokens and other non-security virtual assets are regulated as “Virtual Assets.” In onshore UAE, SCA rules (as updated in 2023) generally permit offerings only to qualified investors or through regulated platforms, with SCA approval required for public (retail) sales. In Dubai, VARA’s 2023 Issuance Rulebook similarly distinguishes permitted offerings: Category 1 issuances (e.g. fiat-referenced stablecoins or high-risk tokens) require a full VARA license and prior approval, whereas other Category 2 utility token issuances (non-stablecoin, non-security tokens) do not require a VARA license but must still meet VARA’s disclosure and conduct standards (including publishing an approved Whitepaper and risk warnings). Certain limited-scope tokens (e.g. truly non-transferable or closed-loop tokens) are exempt from VARA’s licensing and disclosure rules.
   

• Payment tokens (stablecoins) are tightly controlled. Central Bank of the UAE regulations (Circular No. 2/2024) establish a licensing regime for “Payment Token” services, effective 2024–2025, which restricts crypto payment use to licensed AED-pegged stablecoins. Unlicensed acceptance of volatile cryptocurrencies (e.g. Bitcoin, Ether) for payments is prohibited onshore. A token issuer intending to issue a stablecoin for UAE users must obtain a CBUAE license and comply with prudential rules (e.g. maintaining 100% reserve assets in segregated custody with qualified custodians), in addition to any VARA licensing if operating in Dubai. This ensures consumer protection and financial stability in the use of crypto for payments.
   

• All token issuers in Dubai and UAE must adhere to strict disclosure obligations. VARA requires publication of a detailed Whitepaper and standalone Risk Disclosure Statement before any token sale or promotion, with ongoing updates to keep information accurate. The Whitepaper must include prescribed content (issuer’s identity, project description, rights and risks, use of proceeds, etc.) and cannot disclaim liability for false or misleading statements. Federal rules likewise mandate filing of offering documents with SCA for token sales and an SCA-approved prospectus for public offerings. Custodial safeguards are also imposed: token issuers raising funds from the public must typically use licensed UAE custodians or escrow arrangements to hold investor assets. For example, stablecoin issuers under VARA’s rules must hold fiat reserves with authorized custodians and segregate them from the issuer’s own funds, ensuring redemption rights are protected.
   

• Crypto asset marketing and promotions in the UAE are subject to strict regulation. VARA’s Marketing Regulation (Administrative Order 1 of 2022, as updated 2024) applies extra-territorially to “any” person (domestic or foreign) who markets virtual assets “in or targeting” Dubai/UAE consumers, regardless of licensing status. All crypto advertisements must be fair, clear and not misleading, clearly identified as marketing, and include prominent consumer warnings (e.g. that crypto assets are volatile and can lose value in full). Misleading or unwarranted statements (e.g. claims that crypto investing is “safe” or guaranteed) are expressly prohibited. Entities that facilitate marketing (publishers, social media platforms, influencers) are obliged to ensure compliance with these rules. Violations can trigger VARA enforcement actions, including substantial fines and suspension of activities under Administrative Order 2 of 2022 (Penalties).
   

• Cross-border token issuance into the UAE is tightly controlled. A foreign token issuer may not offer or advertise tokens to UAE/Dubai investors without local regulatory compliance. Dubai law requires any person conducting virtual asset business in the Emirate to incorporate locally and obtain VARA approval before launch. Similarly, SCA regulations deem overseas token offerings as regulated activities “within the UAE” if UAE investors are targeted. In practice, a foreign issuer must either partner with a locally licensed firm or obtain its own UAE license (through VARA or SCA as applicable) before marketing or selling tokens to the public. UAE authorities coordinate to enforce these requirements: VARA and SCA have a unified mechanism to supervise VASPs and share fees/fines for cross-border activities. In sum, no regulatory arbitrage is allowed – token sales cannot legally be “passported” into Dubai/UAE from abroad without compliance.
   

• All token issuers (whether UAE-based or foreign) must comply with UAE anti-money-laundering (AML/CFT) laws and any sectoral rules. Licensees are subject to ongoing supervision by VARA/SCA, including audits and reporting. Non-compliance can lead to license revocation, fines, or criminal referrals under UAE law. The regulatory framework as of August 23 2025 is comprehensive and still evolving, but its core principle is clear: investor protection and market integrity are paramount in Dubai and the UAE’s approach to crypto token issuance.