Dubai–Turkey Crypto P2P Law: Licensing, Tax and Cross-Border Transactions

By Av. Ahmet Karaca · PEGA Hukuk & Danışmanlık
Legal sources reviewed: 4 October 2026 · Dubai / Türkiye · English

A Dubai company, a Turkish bank account and a P2P platform profile can belong to three different legal relationships. Connecting them with USDT does not make the resulting business lawful, tax-free or immune from a bank freeze. The decisive questions are who owns the money, what service is promised, where customers are approached and where the activity is actually managed.

This guide addresses English-speaking investors, P2P merchants, OTC operators and business owners with a Dubai–Türkiye connection. It explains how to assess that connection before launch and how to reconstruct it when a payment, account or transaction is disputed. For the wider Turkish framework, start with the English crypto P2P law collection. A separate Turkish-language Dubai P2P guide covers related company and tax questions.

1. Map the activity before choosing a jurisdiction

“Dubai crypto business” is too broad a description for either a licence application or a bank explanation. Locate the entity, the people making decisions, the customers, the fiat accounts and the wallets. Then identify the promise made to the customer: delivery of a crypto asset, execution of an order, safekeeping, or delivery of money to another person.

Dubai Law No. 4 of 2022, Articles 3 and 15–16, defines VARA’s territorial and activity framework, excluding DIFC. The DFSA’s crypto framework applies separately in DIFC. Nor should Dubai be treated as interchangeable with Abu Dhabi or another emirate. This guide focuses on Dubai and the Turkish connection, rather than assuming a single licence works throughout the UAE.

2. Personal investment, P2P merchant and OTC dealer are different models

A person selling an asset bought for their own investment makes a different promise from a desk that continuously quotes prices to customers. The difference cannot be resolved solely by asking whose wallet held the USDT a minute before release.

Consider an operator who uses company capital, publishes a daily AED/USDT spread, accepts customer requests and delivers from inventory. The assets may genuinely belong to the company. Nevertheless, dealing as principal in response to customers can constitute a service. VARA’s broker-dealer definition includes entering into virtual-asset transactions as a dealer for the entity’s own account; using owned inventory therefore does not by itself place a customer-facing desk outside regulation. Conversely, simply using a licensed exchange for a private investment does not mean the investor operates that exchange. The facts must fit the activity definition. See the VARA Regulations, Schedule 1.

VARA’s official proprietary-trading guidance distinguishes entities investing their own funds without clients from entities transacting at a third party’s initiation. It also describes a no-objection certificate (NOC) route for proprietary-trading businesses. An NOC is different from a VASP licence. Separately, Regulation IV.A.7 requires registration for entities actively investing their own portfolios at or above USD 250 million equivalent in a rolling 30-day period. That large-volume registration rule is not a general exemption allowing customer services below the threshold.

• Whose decision? Record whether the trade follows the owner’s investment decision or a customer’s instruction.
• Whose risk? Identify who bears inventory-price risk and whether the customer is promised a fixed amount or result.
• Whose property? Separate owned inventory from assets held or controlled for customers.
• Which service? Test dealing, arranging, exchange, transfer and custody functions separately. One workflow can contain several.

A platform’s “verified merchant” badge is a platform status. It does not answer those regulatory questions. For the Turkish side of the same distinction, see P2P merchants and OTC regulation in Turkey.

3. What to verify in a Dubai licence or company package

A company-formation quotation should identify the actual entity, incorporation location, commercial activity and regulatory approvals included. A package describing “crypto trading”, visas and bank-account assistance is not, by that description alone, a licence to accept retail clients.

VARA’s application process distinguishes Approval to Incorporate from the subsequent VASP licensing process. Approval to incorporate allows preparations; it does not permit the applicant to start virtual-asset activities. An in-principle approval is not a full licence: its holder must not start virtual-asset operations or serve clients before obtaining the full VASP licence. A full licence may itself carry operational conditions. Check the current VARA application process and public register, rather than relying on an old announcement or a certificate image.

A useful verification file contains five things: the exact legal name and registration number; current licence status; permitted activities; permitted client categories and restrictions; and confirmation that the website, platform account and contracting entity actually belong to that licensee. A group brand can contain several entities with different permissions. The company named on the bank account must also be reconciled with the contractual seller.

Permission is only one part of operational readiness. A business model that requires collecting customer money needs an account and control structure appropriate to that role. A personal account should not be presented to a bank as private investment activity while it receives company customer payments. Equally, a successful company bank-account opening is not a regulatory opinion approving every future transaction.

4. Can a Dubai company serve Turkish P2P customers?

A Dubai licence has no automatic passport into Turkey. Under Article 99/A of Turkey’s Capital Markets Law, introduced by Law No. 7518, foreign-platform activity directed at Turkish residents is assessed within the Turkish framework. The statutory indicators include a Turkish workplace, a Turkish-language website, or promotion and marketing directed at residents, directly or through persons or institutions in Turkey. These are alternative statutory indicators, not a checklist requiring every item to be present.

Article 9 of Communiqué III-35/B.2 separately addresses residents obtaining foreign services entirely on their own initiative, subject to the foreign entity not carrying out the relevant promotion, advertising or marketing toward Turkish residents. A pre-written declaration saying “reverse solicitation” does not establish that a customer independently found a service when the actual records show local sales campaigns.

The practical review therefore examines customer-acquisition channels, Turkish representatives, language choices, contracts and actual operations. A person’s Turkish nationality is not identical to residence in Turkey. Nor does an individual using an overseas platform necessarily operate an unauthorised platform. The question is whose activity is being assessed and which rule applies to it.

For example, a Dubai company advertising Turkish-lira liquidity to residents through an Istanbul sales team needs a Turkish perimeter assessment even if its incorporation certificate, invoices and server are overseas. Replacing the corporate address on an invoice cannot change who solicited the customer or performed the service. Our guide for foreigners and cross-border P2P users addresses the separate questions faced by an individual account holder.

5. AED → USDT → TRY: asset trading or a money-transfer service?

The clearest way to analyse a cross-border flow is to write the customer’s promised outcome in one sentence. “I sell you my USDT” is different from “give me AED in Dubai and I will ensure your supplier receives TRY in Istanbul”. The second promise makes the ultimate fiat delivery central to the service.

Depending on the complete model, payment or remittance regulation may apply alongside virtual-asset regulation. The UAE’s Federal Decree-Law No. 6 of 2025, Articles 60–62, provides the central-bank licensing framework. The CBUAE Payment Token Services Regulation separately addresses issuance, conversion, custody and transfer; Article 8 contains a non-objection route for specified virtual-asset businesses. These categories must be assessed on their own terms. A VARA licence does not answer every central-bank question.

The UAE payment-token rules also distinguish trading a token from accepting it as payment for goods or services. Article 2(7) restricts business acceptance to specified licensed-issuer dirham tokens or registered-issuer foreign payment tokens used to purchase virtual assets or their derivatives. A familiar dollar stablecoin is not automatically approved for paying Dubai rent, property or ordinary purchases. Article 2(13) excludes Financial Free Zones from that article’s definition of the UAE; their separate framework must be assessed.

In Turkey, money remittance is among the payment services described under Law No. 6493. The CBRT’s official guide to payment business models emphasises assessment of the actual service and the permissions it requires. A business cannot remove that issue merely by choosing USDT as the intermediate asset.

Also distinguish the fiat purchase of a crypto asset from using crypto to pay for ordinary goods or services. Turkey’s Regulation on the Disuse of Crypto Assets in Payments restricts direct and indirect crypto use in payments and the facilitation of that use. It is not a general prohibition on owning crypto. Whether a particular conversion-and-settlement product falls within the restrictions requires analysis of the full arrangement.

Before launch, draw two flows: the movement of value and the contractual obligations. If the people or entities in those diagrams differ, explain why. An employee, relative or unrelated customer providing a bank account cannot simply be omitted from the legal model.

6. Turkish transfer controls can affect the Dubai leg

A transfer to Dubai is not a universal exception from Turkish AML controls. MASAK’s enhanced-measures guide, section 4.7, distinguishes withdrawal routes and types of control. The 48-hour rule—and 72 hours for the first covered withdrawal—concerns specified routes following purchase, exchange or deposit, including relevant transfers to unhosted wallets or certain overseas providers. It should not be described as a waiting period for every conceivable transfer.

Stablecoin withdrawal limits have a separately defined, broader scope. The guide sets USD 3,000 equivalent daily and USD 50,000 monthly limits, with possible doubling where the prescribed Travel Rule conditions apply. Customer-specific arrangements for liquidity, market making or inter-market arbitrage require the documented conditions and provider approvals; calling oneself an arbitrage trader does not activate an exemption.

The MASAK crypto-provider compliance guide also addresses originator and beneficiary information. A small transfer is not necessarily anonymous or documentation-free. Provider procedures may require information beyond the minimum legal fields. See Turkey’s crypto transfer rules, waiting periods and Travel Rule for the detailed scope of each control.

For a Dubai–Turkey transaction, retain the identity of the sending and receiving institution, wallet ownership evidence, transfer purpose and any provider approval actually relied upon. Splitting transactions or inventing a payment description does not resolve an underlying compliance problem and can make the records less credible.

The Dubai side has its own controls. The VARA Compliance and Risk Management Rulebook, Parts III.G–H, addresses transfer information, counterparty-provider checks, unhosted-wallet risk and sanctions. One platform having completed identification does not ensure that the receiving institution has all information it must obtain. A sanctions restriction is also a separate issue from an ordinary request to explain source of funds.

7. Dubai P2P tax: distinguish the taxpayer, turnover and profit

“Dubai has no crypto tax” is an unreliable basis for a trading business. Ask which person earned the income, whether the activity is personal investment or a business, and which country’s tax rules apply. UAE corporate tax, VAT and Turkish income taxation are separate analyses.

Individuals: the AED 1 million test is a business-turnover test

The FTA states that a natural person is subject to UAE corporate tax where they conduct a business or business activity in the UAE and the relevant annual turnover exceeds AED 1 million. Wages, qualifying personal investment income and qualifying real-estate investment income are excluded. This condition concerns individuals; it is not a general registration or tax-free threshold for companies. FTA: basis of taxation for natural persons.

Cabinet Decision No. 49 of 2023 defines personal investment income by reference to activity in a personal capacity that is neither conducted through, nor required to be conducted through, a licence, and is not a commercial business under the relevant law. Owning the wallet is therefore insufficient to establish the exclusion. A customer-facing merchant business requires a different analysis from the disposal of an individual’s passive investment.

Companies: the general tax rate applies to taxable income

Under the ordinary UAE corporate-tax framework, the general rates are 0% on taxable income up to AED 375,000 and 9% above that amount. These are not percentages of the gross amount passing through a P2P bank account. Separate regimes and relief conditions must be assessed where relevant. Cabinet Decision No. 116 of 2022: ordinary taxable-income threshold.

A simplified example makes the distinction visible. If a company within the ordinary regime has AED 475,000 of taxable income, with no applicable relief or credit affecting the calculation, tax at 9% on the AED 100,000 excess is AED 9,000. Its much larger annual sale proceeds do not themselves equal taxable profit. Conversely, repeated use of the same capital does not make all receipts irrelevant to turnover. Sales, acquisition costs, fees, principal-versus-agent accounting and the taxpayer’s actual role need consistent records.

Eligible businesses should also test Small Business Relief separately. In August 2026, the Ministry of Finance announced its extension to tax periods ending on or before 31 December 2029, retaining the AED 3 million revenue threshold subject to the applicable conditions. This is a distinct relief analysis, not a different interpretation of the ordinary profit bands.

Free-zone incorporation is not a blanket 0% outcome

A qualifying free-zone person’s treatment depends on qualifying income and the applicable conditions. Ministerial Decision No. 229 of 2025, Article 2, treats transactions with natural persons as excluded activities, subject to listed exceptions. A retail USDT desk cannot infer qualifying-income treatment simply because it has a free-zone trade licence. The nature of the income, counterparties, exceptions, substance and non-qualifying revenue rules must be reviewed together.

The Ministry of Finance’s February 2026 announcement concerning Decision No. 336 of 2025 recognises VARA for specified fund-management and wealth/investment-management purposes. It does not announce a general 0% regime for all VARA-regulated P2P businesses.

VAT exemption does not mean every related fee is exempt

The FTA’s VATP040 clarification explains the exemption for transfers of ownership and conversion of virtual assets, applying retroactively from 1 January 2018. That conclusion should not be extended automatically to separately supplied custody, management, advice or other fee-based services. Exemption and zero-rating are also different VAT treatments, including for input-tax recovery.

Use the actual transaction description. Renaming a dealing spread “consultancy” on an invoice does not change the underlying supply. A defensible ledger explains gross proceeds, asset costs, trading results and separate service fees. For Turkish classification and the distinction between enacted law and proposed crypto-tax measures, see P2P crypto tax and transaction records in Turkey.

8. A Dubai visa does not settle Turkish tax residence

Immigration residence, domestic tax residence and residence for a tax treaty are related but distinct. Emirates ID, a lease or a company certificate can be relevant evidence; none should be treated as a universal answer covering every income stream and year.

Turkey’s domestic framework distinguishes domicile and continuous presence for more than six months in a calendar year, subject to statutory exceptions. A person who remains resident for Turkish tax purposes may fall within worldwide-income taxation, subject to applicable exemptions and treaty rules. Spending “183 days outside Turkey” is not, on its own, a complete analysis of domicile. See Income Tax Law No. 193, Articles 3–5. The FTA likewise distinguishes tax-residency certificates for treaty and non-treaty purposes.

The Turkey–UAE tax treaty, Article 4, must be applied to the relevant taxpayer. For dual-resident individuals, the treaty examines permanent home, centre of vital interests, habitual abode and subsequent criteria in sequence. A certificate is evidence for the treaty analysis, not permission to disregard the other country’s facts. Do not assume that every foreign passport holder with UAE domestic residence satisfies the treaty definition without checking the text.

The company’s position is separate from its owner’s. Under Turkish corporate-tax rules, a legal seat or business centre in Turkey can create full tax liability; the business centre concerns where business is actually concentrated and managed. If customer acceptance, pricing, treasury and wallet withdrawals are consistently controlled from Istanbul, the company needs that assessment even if it was incorporated in Dubai. Turkish Corporate Tax General Communiqué: full and limited liability.

Do not simplify the treaty’s corporate rule to “effective management always decides”. Article 4(3) contains a specific competent-authority agreement mechanism where the legal seat is in one state and the business centre in the other. Permanent-establishment and business-profit provisions may also matter. First identify the entity and income; then apply domestic law and the treaty.

Turkey’s 2026 conditional exemption for qualifying new residents’ foreign-source income is another separate question. It has prior-residence, prior-tax-status, income-source and procedural conditions. Forming a Dubai company while continuing an existing life and business in Turkey does not establish entitlement. The Income Tax General Communiqué No. 333 explains the regime and application requirements. Money arriving from a foreign bank account is not, for that reason alone, foreign-source income.

9. When the Turkish payment is frozen or disputed

A valid Dubai licence can help explain the business, but it does not prove the lawful origin of a particular Turkish bank payment. The payment may be a genuine buyer’s money, a company’s authorised payment, or money sent by an unrelated person deceived by someone else.

In a triangle-fraud scenario, the apparent P2P buyer directs a victim to pay the seller and then receives the crypto. The seller’s platform record may show successful release while the payer’s bank record concerns an entirely different story. Establishing delivery to the platform buyer does not, by itself, determine the seller’s criminal knowledge, a payer’s civil claim or the correct recipient of a refund. See P2P triangle fraud and third-party payments.

The immediate response should identify the institution imposing the restriction and its legal basis. A bank compliance review, a platform withdrawal restriction, a temporary statutory suspension and a judicial seizure have different procedures. Turkey’s CMK 128/A, introduced by Law No. 7571, Article 22, provides a maximum 48-hour institutional suspension in specified suspected-offence circumstances. It is not a promise that every frozen account will reopen after 48 hours; a different or subsequent legal measure may apply. The P2P bank-freeze guide explains the distinction and review routes.

1. Preserve the exact transaction. Save order IDs, counterpart profiles, messages, account statements, release timestamps and platform appeal references.
2. Explain each party. Identify the contractual buyer, actual fiat sender, account holder, recipient of the crypto and any company or agent connecting them.
3. Request the relevant basis. Obtain the available bank or platform notice and, through the appropriate procedure, the authority, file number, scope and date of any order.
4. Separate the proceedings. A platform appeal concerns its order and custody process; a Turkish criminal or civil matter concerns legal rights and liability. Neither automatically resolves the other.

Do not send a replacement refund to a newly supplied third-party account simply because someone claims urgency. Confirm the claimant’s entitlement and the lawful destination, account for any existing freeze or order, and avoid paying twice for one loss. For contractual delivery and restitution questions, see P2P disputes and refunds in Turkey. A UAE-based asset or counterparty may require separate local procedures; a Turkish complaint does not automatically freeze assets in Dubai.

10. Build one evidence trail across AED, USDT and TRY

The useful unit of analysis is the economic transaction, not a folder of unrelated screenshots. Create a transaction identifier linking the customer obligation, each fiat movement and the asset movement. Keep original exports as well as readable copies; record when and from which account each export was obtained.

Dubai and Turkey normally use different local time offsets. Preserve the original timestamp and offset, then add a common reference such as UTC. An apparent sequence of payment and release can be reversed if exports from two platforms use different clocks. A quoted AED/USDT or TRY/USDT price is also not evidence that the counterparty actually paid that price.

For example, if 10,000 USDT leaves a company wallet but the order records 9,990 USDT credited, reconcile the difference to an identifiable fee or event. Do not silently change the quantity to make the spreadsheet balance. Record refunds, partial fills and internal transfers explicitly. A wallet move between two accounts of the same owner is not automatically a new sale.

Address labels, blockchain analytics and transaction proximity can guide investigation, but attribution requires supporting evidence. Avoid publishing customers’ identity documents or full account details as a public explanation. Provide necessary records through appropriate secure channels. The P2P evidence-file guide explains bank–order–blockchain reconciliation in greater depth.

11. The file to prepare before launching a Dubai–Turkey P2P model

A useful legal review starts with a concrete model, not a request for the cheapest “crypto company”. Prepare the following materials before accepting customer funds:

• A one-page service description: customer countries, investment or service role, supported assets, settlement promises and revenue sources.
• An ownership and control map: company, beneficial owners, directors, decision-makers, account holders and wallet permissions.
• A worked sample transaction: contract, price, fiat receipt, crypto delivery, fee, refund and accounting entries.
• A permissions matrix: commercial licence, relevant regulator, activities and client limitations, plus bank and platform account terms.
• A tax analysis by taxpayer: company income, individual remuneration or distributions, residence, source and claimed relief.
• An exception procedure: third-party payments, rejected transfers, screening alerts, disputed release, account restrictions and preservation requests.

Use those materials to obtain a determination on the actual activity from appropriately qualified advisers and, where necessary, the relevant regulator. A Turkish-law assessment and UAE licensing or tax work should be coordinated around the same facts. Otherwise, each adviser may approve a different imagined business.

Revisit the model when it changes. A company initially investing its own treasury may later accept client orders; a local Dubai desk may later advertise to Turkish residents; a seller may start promising fiat delivery to third-party beneficiaries. Each change can alter the regulatory, tax and evidential analysis without any change to the company name.

12. Focused questions about Dubai–Turkey P2P

Does a Binance or another platform’s P2P merchant badge replace a licence?

No. It describes the platform relationship. The operator must separately assess the public-law permissions required by the actual service, its location and its customer market.

Can a Dubai company receive sale proceeds in its owner’s Turkish account?

Do not assume the accounts are interchangeable. The arrangement needs a genuine legal and accounting basis, appropriate authority, compliance with account terms and an explanation of why company money is reaching an individual. A personal account does not erase the company’s Turkish connections.

Does using only your own USDT make regular OTC sales proprietary investment?

Not necessarily. A business can deal from its own inventory while fulfilling client orders. Client initiation, the promise made and the ongoing service model matter alongside ownership.

Can a blockchain receipt prove a cross-border payment is complete?

It can establish a particular on-chain event. It does not alone establish the sender’s identity, the contractual entitlement of the recipient, or completion of a separate AED or TRY payment obligation.

Is there a single document that prevents a Turkish bank freeze?

No. A licence, tax certificate or signed contract answers only part of the inquiry. A coherent transaction-specific record is more useful than a collection of unrelated certificates, and no document guarantees that an institution or authority will impose no restriction.