What to expect as DIFC new crypto regulations take effect

The new DFSA frequently asked questions (PDF, 8pp/3.7mb) are designed to provide further clarification in relation to the DFSA’s updated crypto token regime, and with the deadline for transitioning to these new regulations less than a month away, it is important that companies that will be impacted by the changes make sure they are aware of the new regime and how it will affect them.

Under the DFSA regulations, a crypto token is one which is used, or is intended to be used, as a medium of exchange or for payment or investment purposes; or confers a right or interest in such token. That excludes specific types of tokens – such as non-fungible ones – or tokenised forms of securities.

Suitability of Crypto Tokens

As part of its changes to the crypto token regime, the DFSA has replaced the concept of ‘recognised crypto tokens’ with ‘suitable crypto tokens’. As a result, the DFSA will no longer maintain a list of recognised crypto tokens. Instead, responsibility now rests with firms to conduct their own suitability assessments to determine whether a crypto token is suitable as part of their activities.

In carrying out this assessment, firms must consider the nature of their business, their intended customer base and the products and services they intend to offer.  Firms should also have regard to, among other factors:

• the characteristics of the crypto token, including regarding its purpose, governance arrangements, and founders;
• the regulatory status of the crypto token in other jurisdictions, including whether it has been assessed or approved for use by a financial services regulator;
• the size, liquidity and trading history of the market for the crypto token globally;
• the technology used in connection with the crypto token; and
• whether the use of the crypto token could prevent the firm from complying with legislation administered by the DFSA.

For firms operating or businesses seeking to operate under the DFSA framework, this creates a more transparent, predictable and structured pathway for crypto token activities. Allocating responsibility in this way also aligns its regime with approaches adopted in other jurisdictions, such as the ADGM. The DFSA has retained the power to assess fiat crypto tokens (i.e. stablecoins).

The DFSA has confirmed that suitability is both activity specific and specific to each firm. An assessment of a crypto token as suitable by one firm does not automatically indicate that it will be suitable for all firms, so while a firm may take into account information or due diligence provided by another group member or via external reports or research, the responsibility for conducting the suitability assessment ultimately lies with the DIFC firm.

Importantly, the suitability assessment is not just a one off exercise. Firms must monitor suitability on an ongoing basis - at least once in every six month period, and more frequently, where necessary to identify, assess, and address any emerging issues - and cease all activities in relation to a crypto token if, at any point, it no longer satisfies the suitability criteria.

As part of the updated crypto token regime, firms are also required to make monthly reports to the DFSA in relation to their crypto token activities. Firms reporting on crypto tokens they have assessed as suitable must provide to the DFSA:

• the name of each crypto token assessed as suitable by the authorised firm;
• the number of clients receiving financial services in relation to each crypto token;
• the number of transactions completed in relation to each crypto token; and
• the total volume and value in USD in relation to each crypto token.

Firms are also required to retain records of all decisions made, assessments undertaken, and documentation reviewed and produced by those responsible for overseeing the suitability assessment. Upon the DFSA’s request, firms must be able to produce these records within a reasonable period not exceeding three business days. This requirement underscores the importance of robust record keeping.

Firms are also required to disclose to clients a current list of all crypto tokens it has assessed to be suitable. This information may be disclosed to customers by placing it on its website, including it in emails or other forms of communication with existing or prospective clients or other appropriate means.

Where firms provide crypto token related services to retail clients, the regime imposes additional conduct and investor protection requirements. These include carrying out appropriateness assessments, providing enhanced risk warnings, issuing a key features document containing information on the crypto token’s issuer, characteristics, valuation methodology, technology and risks and complying with restrictions on the offering of incentives. These additional obligations are intended to strengthen consumer protection in a market characterised by heightened volatility and rapid change.

Funds

As part of the DFSA’s updated regime it has confirmed that while it had previously imposed gross asset value based thresholds for funds investing in crypto tokens, these thresholds no longer apply.

As a result, fund managers can now manage domestic, external or foreign funds that invest in crypto tokens, subject to conducting appropriate suitability assessments on the tokens. The requirement to conduct a suitability assessment applies regardless of whether or not firms, including fund managers, hold a DFSA permission which extends to crypto tokens.

What this means for DFSA regulated firms

The DFSA’s shift to a suitability based framework represents a significant recalibration of regulatory responsibility within the DIFC crypto ecosystem. While the removal of the list of recognised tokens and thresholds in relation to funds introduces greater flexibility, it also increases regulatory and governance obligations of firms.

For many firms, the move away from the list of recognised crypto tokens will be welcomed, as businesses will be able to tailor their offerings more closely to their commercial strategies and client demand. Fund managers, in particular, may benefit from the removal of crypto investment thresholds, which opens the door to a broader range of crypto related investments and strategies.

However, this flexibility is accompanied by a clear transfer of accountability. Firms can no longer rely on regulatory approval for suitability and must instead be able to justify their decisions through well documented assessments. In practice, this is likely to increase compliance costs and place greater emphasis on governance and risk management frameworks.

The new rules are also expected to have tangible operational impact across the sector. Firms will need to ensure that their suitability assessments are not only technically robust but also operationally embedded within their business processes. This includes ensuring that ongoing mechanisms are in place to detect changes in token characteristics and maintaining accurate documentation capable of being produced on demand in relation to the suitability assessments.

The monthly reporting requirements signal the DFSA’s intention to adopt a more data driven supervisory approach. Firms should therefore expect increased regulatory scrutiny, particularly if there is a divergence in suitability determinations across the market.

Looking ahead

Firms should now prioritise meeting the transitional requirements by ensuring policies, procedures and assessments are in place and operationally effective. In the longer term, firms can expect suitability assessments to become a core component of ongoing regulatory engagement, particularly as the DFSA continues to monitor market activity and risk exposure through enhanced reporting.

Ultimately, while the new framework introduces additional compliance burdens, it also signals the DFSA’s continued commitment to fostering a credible, flexible and internationally aligned crypto regulatory environment within the DIFC.