By Soham Jethani and Rhea Shah

A customer buys a token advertised as “backed by gold”. What have they bought? A share of gold in a vault? A promise that someone will deliver gold? Or an investment that pays according to the gold price? If the business cannot answer that question clearly, neither can the customer.

That uncertainty also matters to regulation. The label describes a connection to gold but leaves the customer’s legal entitlement unexplained. For a business planning a token launch, the analysis begins with that entitlement, the services offered around it and the jurisdiction in which those services take place.

Two sets of rules administered by the UAE Capital Market Authority (CMA) help explain the distinction: the 2025 regulation for security tokens and commodity token contracts, and the 2026 framework for virtual asset service providers and alternative trading systems. They address different aspects of a token business. Understanding their relationship helps a founder ask the right questions before committing to a product structure.^[1]

Establish which regulator is relevant

A token business cannot select its regulator simply by choosing a product label. Where it operates and what it does are essential. This article focuses on the CMA rules. Dubai’s Virtual Assets Regulatory Authority (VARA) regulates virtual asset activities in or from Dubai outside the Dubai International Financial Centre (DIFC). The DIFC and Abu Dhabi Global Market (ADGM) have their own financial regulators and digital asset frameworks. Payment token services also require consideration of the UAE Central Bank’s rules. Assess those boundaries before treating the CMA framework as the answer for a particular project.^[2]

Explain what the holder can claim

Returning to the gold example, ownership of identified gold and a contractual promise to deliver gold are different entitlements. An investment linked to the gold price raises further questions about its legal form. These are illustrations, not automatic classifications: the terms, structure and applicable definitions must be examined together.

The distinction is especially important because the 2025 regulation expressly excludes virtual assets and excludes real-world assets unless the tokenised real-world asset represents securities. A commodity token contract is defined by reference to an underlying commodity contract whose rights are registered, exercisable and transferable through a distributed ledger under a registration agreement. Gold backing alone therefore does not establish that a token falls into that category.^[3]

Make the legal promise work on the ledger

A tokenised bond illustrates this more clearly. A business promises repayment to investors and uses a blockchain to record and transfer their entitlement. The questions remain familiar: who owes the money, when is it payable, and who can enforce repayment? The 2025 regulation preserves the applicable securities and commodity-contract rules while adding provisions for rights recorded on a distributed ledger, a shared electronic record maintained across a network.^[4]

This is more than a change in recordkeeping. The registration agreement defines the parties’ legal relationship and the conditions for recording, holding and transferring the rights. The regulation also addresses how the ledger must operate. For the bond issuer, the practical task is to ensure that the repayment promise, the agreement and the technology work together. A token balance should correspond to an entitlement explained in the product documents.^[5]

Separate the product from the services

The CMA’s 2026 General Framework Module defines virtual assets as digitally tradable or transferable representations of value used for investment. It excludes digital representations of fiat currencies, securities and other financial instruments. A share does not become a virtual asset within that definition merely because it is recorded on a blockchain.^[6]

For a product that does fall within the virtual asset framework, examine each business activity separately. Buying and selling for the firm’s own account differs from executing transactions for clients. Safeguarding client assets differs from arranging for another firm to safeguard them. Investment advice, portfolio management and arranging investment deals are also identified activities.^[7]

This distinction matters when a business relies on partners. Under the module, helping a client negotiate custody terms or complete the custody application can constitute arranging custody even though another provider holds the assets. The exception for a mere introduction does not apply if the custodian belongs to the introducer’s group or the introducer receives monetary compensation. Outsourcing part of the customer journey therefore requires assessing the role the business retains.^[8]

Issuing the token is a separate question

The module contains an exception from dealing as principal for issuing or redeeming one’s own virtual assets. But that exception is qualified: it does not apply where the person holds themselves out as willing to enter transactions involving the asset, including through promotion, advertising or marketing, or as conducting the dealing activity. The module also regulates financial services connected with offerings and sales. A business should therefore assess its issuance arrangements and promotional conduct together; the exception is not a general permission to launch.^[9]

The route to subsequent trading also needs attention. For security tokens and commodity contract tokens, the 2025 regulation specifies permitted trading arrangements and an over-the-counter exception involving digital wallets, with pre-authorisation and whitelisting requirements for self-custodial wallets. A product should not promise unrestricted transfers without checking how those rules affect its design.^[10]

What to establish before launch

Before choosing a licensing route, put the proposed product into a short, plain-language description. State what the holder receives, who must perform the obligation, how the entitlement transfers and what happens if performance fails. Then identify every service the business and its partners will provide, and where they will provide it. Use that description to test the relevant definitions, exclusions and permissions.

For the gold project, the first useful deliverable is a precise explanation of the customer’s claim. That explanation lets you assess the legal documents, technology, and business model to be assessed together. It also gives the customer something essential: an understandable account of what they are buying.

About this article

This article is for general information only and does not constitute legal, regulatory, tax, financial or other professional advice. Readers should not act, or refrain from acting, based on this article without seeking advice from suitably qualified counsel on their specific circumstances.

Septten Advisors is a UAE-registered legal consultancy advising founders, investors, technology companies, financial services businesses and virtual asset market participants on legal, regulatory, transactional and strategic matters. The content reflects our general views as at 14 September 2026 and may not reflect later legal, regulatory or market developments. No advisor-client relationship is created by reading this article. To the fullest extent permitted by law, Septten Advisors accept no liability for any reliance placed on it