India and the UAE: the cost of rules, and the cost of uncertainty > NEWS

- Soham Jethani and Rhea Shah

A licence is expensive. So is building a business without knowing what a future licensing regime might require you to change.

For a founder building a virtual asset exchange, where customers buy and sell assets such as cryptocurrencies, that is the commercial issue behind the India–UAE regulatory comparison. Before committing money, the founder needs to understand which services the business can offer, how it must protect customers’ assets and what it will cost to operate.

The UAE has made more of those questions answerable. India has imposed obligations on virtual asset businesses while leaving important questions about their licensing and supervision unresolved. The difference matters when a founder moves from identifying a market opportunity to deciding how to build the business.

Registration is only part of India’s answer

India’s virtual asset sector does not operate outside the law. Under the Prevention of Money-Laundering Act, 2002, businesses carrying out specified activities involving “virtual digital assets”, the Indian statutory term covering cryptocurrencies and other qualifying digital assets, must register with the Financial Intelligence Unit–India (FIU-IND).

Covered activities include exchanging, transferring and safeguarding assets for others. Businesses must identify customers, maintain records and report prescribed transactions, including suspicious transactions.^[1]

Those obligations help authorities trace money and investigate financial crime. They serve a different purpose from authorising a business to operate an exchange or assessing the safeguards for its custody service, which involves holding customers’ assets.

The Ministry of Finance itself drew attention to this distinction in a parliamentary answer on 30 March 2026. It explained that publishing a list of FIU-IND-registered businesses could mislead people into believing those businesses had government approval and that customers enjoyed regulatory protection against fraud or loss.^[2]

For a founder, this distinction is fundamental. FIU-IND registration does not establish that a financial regulator has approved the business’s exchange or custody services. Compliance with financial-crime controls answers only part of the question about how the business should operate.

Tax obligations also apply. A token representing a share or bond can remain a security under the Securities Contracts (Regulation) Act, 1956.^[3] But laws addressing particular issues do not supply a comprehensive operating framework. The founder is left planning the business without the sector-wide licensing and supervisory standards that such a framework would provide.

Dubai makes the business model part of the approval

The UAE gives the founder a more concrete starting point. It has several regulatory regimes, including separate frameworks in the Dubai International Financial Centre and Abu Dhabi Global Market.^[4] Dubai outside the Dubai International Financial Centre offers a useful comparison through its Virtual Assets Regulatory Authority (VARA).

Under the Virtual Assets and Related Activities Regulations 2023, carrying on specified virtual asset activities as a business requires VARA authorisation, subject to defined exemptions. Exchange services and custody have distinct licensing categories.^[5] Calling the business a “virtual asset platform” therefore tells the regulator too little. What matters is what it will actually do.

That becomes particularly useful when the founder considers expanding the offering. An exchange seeking to offer exchange-traded derivatives, contracts whose value depends on an underlying asset, needs additional approval under VARA’s Exchange Services Rulebook.

VARA can examine the proposed contracts, risk disclosures and systems for managing risk. The exchange must also assess customers’ understanding of the risks and ability to meet their financial obligations.^[6]

Each requirement affects a commercial decision. Customer assessments must be built into the service. Risk controls require investment. Approval affects the launch timetable.

The founder may decide that the expected revenue does not justify the expense. Knowing the requirements early makes that decision possible before the business has paid to build something it cannot profitably operate.

A customer balance needs assets behind it

For a founder building an exchange, safeguarding customers’ assets is part of the operating model from the outset. Displaying a balance on a screen is one thing. Holding the assets needed to honour it, and keeping them separate from the business’s own property, takes systems, records and discipline.

VARA’s Compliance and Risk Management Rulebook requires customer virtual assets to be held in wallets separate from the business’s own assets. Those customer assets are not the business’s property and must not form part of its insolvency estate.^[7]

The Company Rulebook addresses another question: are there enough assets? It requires reserves covering all liabilities to customers arising from virtual asset services. Those reserves must be held one-for-one in the same virtual asset, checked against customer liabilities daily and independently audited at least every six months.^[8]

Holding cash of equivalent value would not meet that requirement. If the virtual asset’s price rose, the cash might no longer buy enough to satisfy customers’ entitlements.

Separation addresses whose property is being held. Reserves address whether enough is held. For the founder, both translate into controls the business must implement and expenditure it must fund. Protecting customers’ assets becomes a defined part of the business plan.

India needs rules that founders can build on

India’s policy discussions recognise the gap. In July 2026, Parliament’s Standing Committee on Finance recommended examining a comprehensive virtual asset framework. Its report on the proposed Securities Markets Code, 2025 suggested considering an interim system of recognised self-regulatory organisations under a designated regulator, with standards covering governance, disclosure, investor protection and complaints.^[9]

The committee also heard evidence from the Department of Economic Affairs on 16 September as part of its separate virtual digital asset study. This work has not yet supplied a licensing route.

The commercial test is what comes next. Another reporting obligation would add to compliance costs without necessarily settling how an exchange should operate or protect customers’ assets. A workable framework must connect the services businesses offer with the permissions and operating standards those services require.

The UAE comparison shows why detailed regulation can be worth paying for. A founder can budget for licensing, controls and audits. It is harder to budget for a future framework that may require the business to change direction.

The UAE gives the founder more of those costs to assess before committing capital. India’s next step should give the founder the same opportunity.

About this article

This article is for general information only and does not constitute legal, regulatory, tax, financial or other professional advice. Readers should not act, or refrain from acting, based on this article without seeking advice from suitably qualified counsel on their specific circumstances.

Septten Advisors is a UAE-registered legal consultancy advising founders, investors, technology companies, financial services businesses and virtual asset market participants on legal, regulatory, transactional and strategic matters. The content reflects our general views as at 10 November 2026 and may not reflect later legal, regulatory or market developments. No advisor-client relationship is created by reading this article. To the fullest extent permitted by law, Septten Advisors accept no liability for any reliance placed on it.

References

1. Financial Intelligence Unit–India, Anti-Money Laundering (AML), Countering the Financing of Terrorism (CFT), and Combating Proliferation Financing (CPF) Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets, updated 8 January 2026, paragraphs 1.1–1.2.7, 1.4 and 2.1–2.2; recording Notification S.O. 1072(E), 7 March 2023. Definitions and notified activities; AML obligations; Scope; Registration [Accessed 10 November 2026]. ↩
2. Ministry of Finance, Lok Sabha Unstarred Question No. 5805, Regulation of Virtual Digital Assets in the Country, answer (f), 30 March 2026, PDF p. 2. Answer (f) [Accessed 10 November 2026]. ↩
3. Lok Sabha, Standing Committee on Finance, Thirty-Sixth Report: The Securities Markets Code, 2025, paragraphs 20.8–20.9, presented 23 July 2026, printed pp. 108–109 (PDF pp. 118–119). Paragraph 20.9 records the explanation of section 2(h) of the Securities Contracts (Regulation) Act, 1956. Paragraph 20.8; Paragraph 20.9 [Accessed 10 November 2026]. ↩
4. Dubai Financial Services Authority, Crypto Token Regulation, “DFSA’s Crypto Token framework” and “Applying for Authorisation”; ADGM Financial Services Regulatory Authority, Guidance – Regulation of Virtual Asset Activities in ADGM, VER07.100625, paragraphs 1–4, printed p. 3 (PDF p. 4). DFSA framework; DFSA authorisation; FSRA guidance, paragraphs 1–4 [Accessed 10 November 2026]. ↩
5. VARA, Virtual Assets and Related Activities Regulations 2023, Part III.A.1–4 and Schedule 1, “Custody Services” and “Exchange Services”. General Prohibition and Exemptions; Schedule 1 [Accessed 10 November 2026]. ↩
6. VARA, Exchange Services Rulebook, Part V.B.1–2 and Part V.C.1–4, current version effective 31 March 2026. VARA Approval and Powers; Client Suitability and Assessment [Accessed 10 November 2026]. ↩
7. VARA, Compliance and Risk Management Rulebook, Part V.B.2–3. Treatment of Client VAs [Accessed 10 November 2026]. ↩
8. VARA, Company Rulebook, Part VI.E.1–3. Reserve Assets [Accessed 10 November 2026]. ↩
9. Lok Sabha, Standing Committee on Finance, Thirty-Sixth Report: The Securities Markets Code, 2025, paragraphs 20.15–20.16, presented 23 July 2026, printed pp. 114–115 (PDF pp. 124–125). Paragraphs 20.15–20.16 [Accessed 10 November 2026]. ↩