Saudi Arabia's Crypto Stance: VARA, SAMA, and What It Means for Halal Investing

A factual note up front, because the three acronyms are often used interchangeably and they should not be: SAMA is the Saudi Central Bank. CMA is the Saudi Capital Market Authority. VARA is the Virtual Assets Regulatory Authority — and VARA is a Dubai (UAE) regulator, not a Saudi one. We are covering both jurisdictions because Gulf Muslim investors regularly hold accounts across both, but they are different regulators with different rules.

This guide covers what each authority has said about crypto, how it affects what you can actually do as a Muslim investor in 2026, and where the halal screen and the regulatory screen diverge.

HalalCrypto is not a Saudi or UAE regulator and is not affiliated with SAMA, CMA, or VARA. This is educational screening context, not legal advice. Cross-check any compliance-sensitive action with a licensed practitioner in your jurisdiction.

Saudi Arabia: SAMA + CMA

SAMA is the Saudi Central Bank. Its mandate covers monetary policy, banking supervision, and payment systems. CMA is the capital markets regulator. Crypto sits at the intersection of both because crypto can function as a payment instrument and as an investment vehicle.

What SAMA has said

SAMA's public posture since 2018 has been one of caution. The headline messages from SAMA-linked communications:

• Cryptocurrencies are not legal tender in Saudi Arabia.
• Banks in the Kingdom are not licensed to deal in cryptocurrencies as principal.
• Saudi residents are not prohibited from holding or trading crypto, but they trade at their own risk and have no consumer-protection coverage from the banking regulator for crypto losses.

This is not a ban. It is closer to the position the US Federal Reserve took for many years — "we are not in this market, we are not going to clean up after this market, do what you want."

In parallel, the Saudi Central Bank has been actively researching CBDCs, including bilateral pilots like Project Aber with the UAE Central Bank. CBDC research is not crypto regulation, but it signals that the policy direction is toward state-controlled digital money rather than open permissionless networks.

What CMA has said

CMA's posture is more about investor protection than monetary stability. Repeated CMA notices have emphasized:

• Saudi-licensed financial institutions are not authorized to offer crypto-related investment products to retail clients without explicit permission.
• Some unlicensed actors marketing crypto investment products to Saudi residents are operating in violation of CMA rules and have been the subject of enforcement actions.
• The CMA has been incrementally expanding its FinTech sandbox; some sandbox participants work with tokenized real-world assets.

For a Muslim investor in Saudi Arabia, the operative takeaway is: holding and trading crypto on a foreign venue is not prohibited, but you have no domestic recourse, and you should be alert to whether a service marketing to you is licensed somewhere meaningful.

What is licensed today

As of mid-2026, there is no Saudi-issued crypto exchange license analogous to a CMA-licensed broker. There are several Saudi-licensed sandbox FinTechs working on tokenized assets and digital sukuk; these are not retail crypto exchanges. Most Saudi residents who trade crypto use foreign venues that accept Saudi residents.

UAE: VARA + others

The UAE is structurally different. Crypto regulation is split across multiple bodies:

• VARA (Virtual Assets Regulatory Authority) — Dubai-based, established 2022. Licenses crypto exchanges, brokers, custodians, asset managers, and lending providers operating in the Emirate of Dubai (excluding DIFC).
• FSRA (Financial Services Regulatory Authority of Abu Dhabi Global Market) — handles ADGM-based crypto firms.
• SCA (Securities and Commodities Authority) — federal-level UAE regulator.
• DFSA (Dubai Financial Services Authority) — DIFC-based.

If you hold an account at a Dubai-licensed exchange, it is most likely VARA-licensed. If you hold an account at an ADGM-based service, it is FSRA-regulated. These have similar but not identical rule sets.

VARA's rule book is more crypto-specific than anything in Saudi Arabia. It covers licensing categories, capital requirements, custody segregation, market conduct, and AML. For a Muslim investor in the UAE, the practical effect is that:

• You can trade on a licensed exchange with onshore recourse.
• You have consumer-protection coverage analogous to other financial services.
• You can hold a retail account that supports SAR-equivalent (AED) on-ramps.

VARA does not certify halal compliance. That is not its job. A coin can be VARA-licensed for trading and still fail our halal screen, and vice versa.

How the regulatory screen interacts with the halal screen

The two screens are independent. They overlap in some places and diverge in others.

Asset / activity	Halal screen	Saudi (SAMA/CMA)	UAE (VARA)
Spot BTC on a foreign venue	Permissible	Allowed at user risk	Allowed at licensed venues
ETH staking via solo node	Permissible	No domestic prohibition	Allowed
Stablecoin held in a wallet	Haram/no-trade in live screener for USDC/USDT	No domestic prohibition	Allowed with licensing
Stablecoin deposit at "earn" product	Fail (riba)	Foreign marketing scrutinized	Licensable activity if Shariah-aligned
Perp DEX trading	Fail	No domestic prohibition for individuals	Restricted product category
Aave/Compound deposits	Fail	No domestic prohibition	May be licensable as lending
Tokenized sukuk (Shariah-supervised)	Permissible	Sandbox track	Licensable; explicitly contemplated
Memecoins	Fail (typically)	No domestic prohibition	No specific bar
Crypto loans against your holdings	Fail (riba)	No domestic prohibition	Licensable

The pattern: the regulatory layer cares about consumer protection and AML; the halal layer cares about riba, gharar, and maysir. They are doing different jobs. A Muslim investor passes both screens by stacking them.

Practical implications for Saudi residents in 2026

A pragmatic playbook:

• Hold spot positions on a reputable foreign venue that accepts Saudi residents. Cross-check the venue against our 3-layer screen — particularly layer 3 (does the operating entity itself fail our screen?).
• Self-custody for any holding above your nisab.
• Avoid "earn" / lending / leverage products regardless of jurisdiction.
• Use the Saudi-specific halal crypto trading guide for venue selection details.
• Compute and pay zakat per our Saudi zakat guide.
• Keep documentation of your transactions. If CMA enforcement reaches a venue you used, you will need it.

Practical implications for UAE residents in 2026

• VARA licensing is meaningful. Prefer VARA-licensed exchanges for the consumer-protection layer.
• The Dubai sukuk-tokenization track is the most interesting development for halal-adjacent finance in 2026. Several Shariah-supervised tokenized-asset issuances have happened.
• The same halal screen applies — VARA does not vouch for permissibility.
• ADGM-based services (FSRA) are a viable alternative; the rule sets are similar.

Where the Gulf regulatory direction is heading

A few signals worth tracking:

• Sukuk tokenization is the most productive area for Shariah-compliant on-chain finance. AAOIFI Standard 21 on sukuk has been extended in commentary to cover tokenized sukuk, and both Saudi and UAE regulators have run sandbox tracks. Expect more issuances in 2026–2027.
• Wholesale CBDCs (central bank digital currencies) are being piloted bilaterally. Retail CBDC introduction in Saudi Arabia remains a multi-year project.
• Cross-border AML is the area where Gulf regulators are converging fastest. Expect tighter KYC requirements on foreign exchanges serving Gulf customers.

The honest weaknesses

• Regulatory text changes fast. We update this article on major rule revisions; if you are reading this more than six months after the last review date, cross-check with the current SAMA/CMA/VARA publications.
• Enforcement priorities are not the same as published rules. A rule that exists on paper may not be enforced consistently, and vice versa.
• Treat this as educational context, not legal advice. A specific transaction with specific counterparties should be reviewed by a licensed practitioner.

Frequently Asked Questions

Is crypto trading legal in Saudi Arabia? Holding and trading crypto on foreign venues is not prohibited for Saudi residents. Saudi-licensed financial institutions are not, in general, authorized to deal in crypto as principal. There is no Saudi crypto exchange license analogous to a CMA brokerage license as of 2026.

Is SAMA the same as VARA? No. SAMA is the Saudi Central Bank. VARA is the Dubai (UAE) Virtual Assets Regulatory Authority. They are different regulators in different jurisdictions.

Does VARA certify halal compliance? No. VARA is a financial regulator, not a Shariah body. A VARA-licensed exchange may sell products that fail a halal screen.

Is a CMA-licensed exchange better than a foreign exchange for a Saudi Muslim? The CMA has not issued retail crypto exchange licenses as of 2026, so the choice is between (a) using a foreign venue or (b) not trading crypto. Foreign venue with our 3-layer screen applied is the operative answer.

Can I trade tokenized sukuk in the UAE? Several Shariah-supervised tokenized sukuk issuances exist on the UAE sandbox tracks. The instruments are evaluated against AAOIFI Standard 21. Cross-check our coverage of tokenized sukuk.

Do I need a license to hold crypto as an individual? No, neither in Saudi Arabia nor in the UAE. Holding crypto for personal investment is not a regulated activity for individuals. Operating an exchange, brokerage, or custody business is.

---

Last reviewed 2026-05-17. Educational, not legal advice. HalalCrypto is not affiliated with SAMA, CMA, VARA, FSRA, SCA, or DFSA.