Getting evidence from a UAE-licensed crypto exchange: the mutual legal assistance route

When a foreign prosecutor or fraud victim needs account data from an exchange operating out of the UAE, there is no direct subpoena route — only a formal state-to-state channel, and understanding it is the difference between recovering funds and losing the trail.

Why a US subpoena alone does not work

A US grand jury subpoena or a civil discovery request compels production from a person or entity within the issuing court's jurisdiction. A UAE-incorporated entity, or a foreign entity's UAE branch or licensed subsidiary, is not automatically within that jurisdiction. Where the exchange has genuinely relocated data custody, corporate decision-making or licensed operations to the UAE, US law enforcement cannot simply serve process locally — it must ask the UAE state to obtain and hand over the material. That request travels through mutual legal assistance (MLA), not compulsory process.

How the MLA channel actually runs

The UAE's Ministry of Justice acts as the central authority for incoming MLA requests in criminal matters, whether they arrive under a bilateral treaty such as the US-UAE mutual legal assistance arrangement or, absent a treaty basis, through diplomatic channels or Interpol's NCB-to-NCB network. A typical request must:

• identify the specific criminal proceeding and the offence under the requesting state's law;
• specify the data or records sought — account KYC files, transaction logs, IP and device metadata, correspondence — with enough precision that the UAE authority can direct a named entity to produce it;
• be routed to the Ministry, which screens it for compliance with UAE public policy and dual criminality principles before referring it to the Public Prosecution for execution;
• result in the Public Prosecution issuing a domestic production order to the exchange, enforceable under UAE criminal procedure exactly as if it were a local investigation.

This is the same architecture used for bank records, and it explains why regulated VASPs in the UAE — those licensed by VARA in Dubai, the FSRA in ADGM, or the DFSA in the DIFC — sit inside a state apparatus that only responds to requests coming through this front door, not directly from a foreign agency's letterhead.

A production order issued by the UAE Public Prosecution has teeth; a foreign subpoena served by courier does not.

Where the delay actually comes from

The friction cited by US prosecutors is rarely bad faith by the UAE authorities; it is structural. MLA requests queue behind translation into Arabic, verification of dual criminality, confirmation that the request does not touch matters the UAE treats as sensitive (state security, banking secrecy carve-outs, data protection compliance), and internal referral between the Ministry, the Public Prosecution and, where a licensed VASP is involved, the relevant regulator. Realistic turnaround for a well-drafted request is measured in months, not weeks, and a poorly specified request — vague date ranges, no named account identifiers, no clear predicate offence — can add another round-trip before execution even begins.

What victims and counsel can do without waiting on MLA

Waiting for state-to-state cooperation is not the only option, and GCs advising defrauded clients should run parallel tracks:

• File a UAE criminal complaint directly. A victim, or UAE counsel on their behalf, can lodge a complaint with the Public Prosecution or police in the emirate where the exchange or its assets sit. This creates an independent domestic investigative file that does not depend on the foreign MLA request landing first, and it can trigger production orders on the exchange far faster than an incoming diplomatic request.
• Seek a precautionary attachment. Under the UAE Civil Procedure Law, a claimant with a prima facie claim can apply for an urgent freezing order over identifiable funds or crypto-asset balances before judgment, preserving the position while the underlying fraud claim or MLA request proceeds.
• Raise it with the regulator. A regulatory complaint to VARA, the FSRA or the DFSA against a licensed VASP for non-cooperation, AML failures or misrepresentation can produce supervisory pressure — including licence conditions — that a criminal MLA request alone cannot achieve on the same timeline.
• Engage local litigation counsel early. Onshore civil claims for restitution or unjust enrichment, filed in parallel with the criminal track, keep pressure on the exchange to preserve data voluntarily rather than wait for compulsion.

The practical lesson for any GC advising a fraud victim, or defending an exchange accused of obstruction, is the same: the UAE is not stonewalling by design, but its cooperation architecture is genuinely slower than direct compulsory process, and clients who rely solely on the foreign MLA request without opening a parallel domestic file are choosing the slowest available route.

Key instruments: UAE Federal Law on International Judicial Cooperation in Criminal Matters; UAE Criminal Procedure Law; Federal Decree-Law No. 42 of 2022 (Civil Procedure Law), precautionary attachment provisions; US-UAE mutual legal assistance arrangements; VARA, FSRA and DFSA licensing frameworks. General information, not legal advice.