Launching a Crypto Fund in the DIFC: DFSA Rules, Licensing, and Structure

The DFSA's revised Crypto Token framework came into force on 12 January 2026 and changed the basic question a fund manager has to answer before launching a DIFC-domiciled crypto fund. The old question was whether the token was on the DFSA's Recognised list. The new question is whether the firm can defend, on documented grounds, that the token is suitable for the specific activity it is carrying on.

• The DFSA no longer publishes a list of Recognised Crypto Tokens. Authorised firms now assess each token's suitability themselves and must maintain a documented, monitored record.
• Previous caps on fund exposure to crypto tokens have been removed. A DIFC Qualified Investor Fund can now hold up to 100% exposure to non-fiat crypto tokens that the manager has assessed as suitable.
• Three fiat crypto tokens are currently assessed as suitable by the DFSA for use in the DIFC: Circle USD Coin, Circle Euro Coin, and Ripple USD. Algorithmic stablecoins fall outside the fiat token category.
• Privacy tokens such as Monero and Zcash, and privacy-enhancing tools such as mixers and tumblers, are now prohibited in the DIFC.

Who this applies to

The framework applies to any firm that carries on a DFSA-regulated financial service in or from the DIFC involving a crypto token, and to any DIFC-domiciled fund that takes direct or indirect crypto token exposure. In practice that covers:

• Fund managers authorised under Category 3C that manage or propose to manage a DIFC Public Fund, Exempt Fund, or Qualified Investor Fund with crypto exposure
• External managers based in an acceptable jurisdiction that establish a DIFC-domiciled crypto fund through a DFSA-licensed Fund Administrator or Trustee
• Firms providing custody of crypto tokens in or from the DIFC, whether on behalf of a fund or other clients
• Authorised firms offering units of a foreign fund that invests in crypto tokens to DIFC clients

It does not apply to VARA-licensed virtual asset service providers operating in mainland Dubai outside the DIFC, which sit under a different regime. For a comparison of the mainland crypto framework, see our VARA licence guide.

What a DIFC crypto fund actually is in 2026

A DIFC crypto fund is a collective investment fund, domiciled in the DIFC, that holds direct or indirect exposure to crypto tokens as part of its investment strategy. The fund sits on top of two separate regulatory layers.

The first layer is the generic DIFC fund regime under the DFSA's Collective Investment Law and the Collective Investment Rules (CIR). This determines the type of fund vehicle, who can invest in it, how units are offered, and the disclosure and governance obligations. The three domestic fund types remain Public Fund, Exempt Fund, and Qualified Investor Fund. For the mechanics of each and the parallel ADGM regime, see our UAE fund manager licensing guide.

The second layer is the crypto-specific overlay in the DFSA General Module (GEN) Chapter 3A and the supervisory guidelines issued on 15 December 2025. This overlay determines which tokens the fund can take exposure to, how that exposure is documented and monitored, and how the manager reports to the DFSA.

The key change from the 2022 regime is that the second layer is now firm-led rather than regulator-led. Before 12 January 2026, a DIFC fund could only invest in tokens that appeared on the DFSA's Recognised Crypto Token list. That list is gone. The manager now has to reach its own conclusion on suitability under GEN Rule 3A.2.1 and defend it.

The suitability test every DIFC crypto fund manager has to pass

A manager has to assess suitability for each non-fiat crypto token it proposes to hold or arrange exposure to, and has to keep that assessment under continuous review. The DFSA's supervisory guidelines set out five broad criteria.

Characteristics and purpose

The manager has to understand what the token is, how it works, what it is designed to do, whether its governance arrangements are credible, and whether the founders or responsible persons behind it can be identified. Anonymous or pseudonymous issuer teams without verifiable track records are a red flag.

Regulatory status in other jurisdictions

The manager has to consider how the token is treated by other financial services regulators. A token that has been assessed or approved by a recognised regulator gains credibility. A token that has been subject to enforcement action or regulatory concerns elsewhere is harder to defend as suitable.

Size, liquidity and trading history

The manager has to look at trading volume, price volatility, market capitalisation relative to volume, and the reliability of market data. Tokens with concentrated holders, thin liquidity, or susceptibility to market manipulation fail this limb.

Technology resilience

The manager has to assess the maturity and stability of the underlying blockchain, including uptime history and any major security incidents. A well-established network with multi-year operational history and no significant breach history is preferred.

Transparency of supply

The manager has to verify that the total, circulating, and maximum supply of the token is disclosed and independently verifiable on-chain, with consistency across blockchain explorers and the token's whitepaper.

The manager has to document each assessment, retain evidence, and re-run the review when circumstances change. If a token ceases to be suitable, the fund has to divest.

What has changed for funds specifically

Three changes in the Collective Investment Rules directly affect how crypto funds can be structured from 12 January 2026.

Fund exposure caps are gone

Under the previous regime, a DIFC fund could hold a maximum of 20% of gross asset value in Recognised Crypto Tokens, and a Domestic Qualified Investor Fund was capped at 10% in unrecognised tokens. All of those numerical caps have been removed. A DIFC-domiciled Qualified Investor Fund, an Exempt Fund, or a Public Fund can now hold up to the full extent of its assets in non-fiat crypto tokens, provided the manager has carried out and maintained a defensible suitability assessment, has adequate risk management, and makes appropriate disclosures.

Indirect exposure through other funds now has a 5% threshold

Under the updated CIR rulebook, a fund is treated as investing in a crypto token not only when it holds the token directly, but also when it has indirect exposure through another fund or vehicle where that exposure exceeds 5% of the underlying fund's gross asset value. Exposure through an index tracker that does not itself track a crypto token is excluded. The change closes a gap in the previous rules that inadvertently caught broad-market ETFs tracking the Nasdaq 100 or S&P 500.

Monthly reporting is now standardised

Authorised firms dealing with crypto tokens have to file a Monthly Crypto Token Information Return with the DFSA within 14 days of each month-end. The return lists tokens assessed as suitable, tokens that have ceased to be used, and any material developments affecting suitability. For a fund manager, this is a continuous supervisory touchpoint rather than a one-off filing.

Stablecoins, privacy tokens, and the tokens in between

The DFSA's treatment of fiat crypto tokens (stablecoins) remains regulator-led. The DFSA maintains a policy statement setting out the assessment criteria for fiat crypto tokens and publishes the list of those currently assessed as suitable. As of 12 January 2026, the list has three entries: Circle USD Coin (USDC), Circle Euro Coin (EURC), and Ripple USD (RLUSD).

A fiat crypto token, for DFSA purposes, is a token pegged to a fiat currency and backed by high-quality, liquid reserves capable of meeting redemption demands under stress conditions. Algorithmic stablecoins that maintain their peg through derivatives, hedging, or market mechanisms rather than direct fiat reserves fall outside the fiat token category. The DFSA cited Ethena's USDe as an example: it is not prohibited, but it is treated as a non-fiat crypto token subject to the firm-led suitability assessment rather than the fiat token regime.

Privacy tokens sit at the opposite end. The DFSA has prohibited the use of privacy tokens (tokens whose design obscures transaction history or holder identity, including Monero and Zcash) in or from the DIFC. The prohibition extends to related tools such as mixers, tumblers, and other obfuscation services. The DFSA's position is that firms cannot meet Financial Action Task Force AML and sanctions obligations while transacting in privacy tokens. For the wider AML obligations that apply to DIFC firms, see our AML compliance guide for DIFC fintech.

Comparing the three DIFC fund vehicles for a crypto strategy

The choice of fund vehicle drives the investor base, the marketing approach, and the depth of regulatory obligation. The table below compares the three domestic options for a fund manager setting up a DIFC crypto fund.

The Qualified Investor Fund has become the dominant vehicle for DIFC crypto strategies, primarily because the USD 500,000 minimum subscription matches the investor base that allocates meaningfully to digital assets, and because the fast-track process compresses the authorisation timeline. The Exempt Fund remains viable for smaller offerings. A crypto Public Fund is technically possible after January 2026 but rarely the right structure: the prospectus, retail conduct, and ongoing disclosure obligations outweigh the benefit of a broader investor base for most digital asset strategies.

Setting up the manager — Category 3C, capital, and timeline

Managing a DIFC-domiciled crypto fund requires the manager to hold a Category 3C licence from the DFSA with the permission to manage a Collective Investment Fund, together with the crypto token endorsement on the licence. Alternatively, a fund manager based in an acceptable foreign jurisdiction can establish a DIFC-domiciled fund without obtaining a DFSA licence itself, by appointing a DFSA-licensed Fund Administrator or Trustee as local agent. For first-time managers without an existing regulated presence in an acceptable jurisdiction, the direct Category 3C route is usually the only workable path.

Capital

The base capital requirement for a Category 3C manager of an Exempt Fund or Qualified Investor Fund is USD 70,000. For a Public Fund manager it is USD 140,000. Those figures are the floor. The actual requirement is the higher of base capital, risk-based capital, and expenditure-based capital, calculated in the Regulatory Business Plan during the application. For a manager running a modest digital asset strategy, the expense-based calculation usually ends up as the binding constraint, and firms typically budget USD 150,000 to USD 350,000 to comfortably cover the first 12 months.

Governance

Three licensed functions are mandatory: a Senior Executive Officer, a Finance Officer, and a Compliance Officer. For firms with DFSA-regulated activity that involves client money, client assets, or certain types of custody, a Money Laundering Reporting Officer is also mandatory. The SEO, Compliance Officer, and MLRO each have to complete a minimum of 15 hours of Continuing Professional Development per year. For a crypto-focused manager, the DFSA expects the Compliance Officer and MLRO to demonstrate meaningful familiarity with on-chain analytics, wallet attribution tooling, and FATF travel rule compliance.

Timeline

The authorisation process runs approximately 4 to 6 months for a direct Category 3C application, depending on the completeness of the initial submission and the extent of DFSA feedback. The fast-track process for Exempt Fund and Qualified Investor Fund managers compresses the timeline but does not change the substantive requirements. The typical sequence is: pre-application meeting, short-form Regulatory Business Plan review, full application pack (policies, procedures, financial projections, key personnel KYC and Authorised Individual applications), DFSA review and interviews, conditional licence grant, fit-out and operational readiness, and final licence.

Custody, conduct, and the changes most firms underestimate

Three updates to the framework beyond the headline suitability change deserve attention because they affect day-to-day operations.

The Key Features Document is no longer required for Investment Token custody

Firms arranging or providing custody of Investment Tokens (tokens representing securities or fund interests) no longer have to issue a bespoke Key Features Document. Custody-specific disclosures and general business conduct rules continue to apply.

The USD 5,000 token recognition fee is gone

The former fee payable to the DFSA when applying for a Recognised Crypto Token no longer exists because the recognition process itself no longer exists. The cost has moved from a one-off fee to the ongoing internal cost of running the suitability framework.

Third-party custody arrangements trigger additional diligence

Where a firm arranges custody through a third-party agent, the agent is subject to a new suitability assessment under the Conduct of Business (COB) rules, on top of the existing Custodian provisions. For crypto fund managers relying on external institutional custodians such as Fireblocks, BitGo, or Komainu, the diligence pack on the custodian needs to be stronger than it was before and has to be kept under review.

Practical sequence for launching a DIFC crypto fund in 2026

A first-time manager typically works through the following sequence. The external advisory, audit, and administration appointments run in parallel with the licence application rather than after it.

1. Confirm the fund vehicle (QIF in most digital asset cases) and investor base
2. Engage legal counsel, DFSA-approved external auditors, and a Fund Administrator
3. Build the Regulatory Business Plan with three-year financial projections and the Category 3C permission scope, including the crypto token endorsement
4. Build the Crypto Token Suitability Framework document, covering the five DFSA criteria and the ongoing monitoring process
5. File the pre-application package with the DFSA and take the feedback
6. Submit the full application pack, Authorised Individual applications, and AML manual
7. Execute the DIFC office lease (physical presence is required, not a brass plate)
8. Work through DFSA interviews, conditional licence, and final operational readiness
9. Launch the fund, appoint service providers, and begin the monthly suitability and reporting cycle

The DIFC also continues to offer its regulatory sandbox route for early-stage digital asset propositions, which can be an alternative first step for firms still proving their model before committing to a full Category 3C licence.

How should fund managers approach DIFC crypto fund setup in 2026?

The January 2026 reset narrows the gap between what the DIFC permits and what sophisticated digital asset managers actually want to do. Fund exposure caps are gone, the DFSA's token list is gone, and the Qualified Investor Fund has become a credible vehicle for 100% crypto strategies targeted at institutional and high-net-worth investors.

The trade-off is that the regulatory weight has shifted from the DFSA to the firm. A DIFC crypto fund manager now has to run a defensible suitability framework, document every token decision, report to the DFSA every month, and stand behind those assessments during supervisory engagement. A framework that looks suitable on paper but falls apart under a DFSA thematic review will expose the firm to enforcement action faster than the previous regime ever did.

For managers weighing DIFC against ADGM, mainland Dubai under VARA, or offshore fund domiciles, the structural decision is now driven less by what is possible and more by which jurisdiction's supervisory posture, investor base, and service provider ecosystem best fit the strategy. Our DIFC, ADGM, and CMA fund manager licensing comparison sets out the trade-offs in more detail, and our financial services team advises fund managers and institutional sponsors on DIFC crypto fund setup, suitability frameworks, and DFSA engagement.

‍