The headline 0% or 9% corporate tax rate is not automatic — a VASP loses it the moment its UAE office becomes a mailbox, and the test for adequate substance is far stricter than most founders assume.
The question behind the comparison
Coverage contrasting Dubai and Hong Kong as crypto hubs tends to stop at headline tax rates. The practical question a founder or CFO actually needs answered is narrower: what does the UAE require, operationally, before a licensed exchange, custodian or token issuer is allowed to keep the 0% Qualifying Free Zone Person (QFZP) rate under the Corporate Tax Law (Federal Decree-Law No. 47 of 2021)? Get the substance wrong and the entity is pushed onto the standard 9% rate — retroactively, for a multi-year lock-out period, not just for the year of the breach.
What "adequate substance" means for a VASP
A free zone company — including one licensed by VARA, the DFSA in the DIFC, or the FSRA in ADGM — only qualifies for 0% on its qualifying income if it satisfies the adequate substance requirement in the free zone. In practice, for a crypto business this is tested against three things:
- Core income-generating activities (CIGA) — the functions that actually produce the entity's revenue (matching engine operation, custody controls, compliance decision-making, treasury management) must be directed and carried out inside the UAE, not run from an offshore parent with a UAE shell beneath it.
- Adequate, qualified full-time employees — headcount must be proportionate to the scale and nature of the business. A token issuance or exchange licence with two nominee directors and a part-time compliance officer will not survive scrutiny if trading volumes or assets under custody are material.
- Adequate operating expenditure and physical assets — real office space, IT infrastructure and a budget consistent with the CIGA being performed, not a registered agent's virtual desk.
Where CIGA is outsourced — common for smaller VASPs using a group entity or third-party technology provider — the UAE company must still exercise adequate monitoring and control over the outsourced function from within the UAE, evidenced by governance minutes, service-level reporting and decision logs, not just a services agreement on file.
The de minimis trap
Even a well-substantiated entity can lose QFZP status through its revenue mix. Non-qualifying revenue — broadly, income from excluded activities or from UAE mainland counterparties outside the permitted categories — must stay below a de minimis threshold set by reference to total revenue. For a crypto exchange this is the clause that bites hardest: fee income from onshore retail clients, or ancillary consulting and technology-licensing revenue booked through the same entity, can tip the balance if it is not tracked and capped. Groups running exchange, custody and advisory activity through one licence rather than separate entities are the most exposed.
The 0% rate is not a status you hold — it is a test you pass every financial year, and a crypto business's revenue mix is exactly the kind of thing that drifts without anyone noticing.
Consequences of failure
If a Qualifying Free Zone Person fails the substance or de minimis conditions in a given tax period, it does not simply pay 9% that year. Under the Corporate Tax Law framework it is disqualified from QFZP status for that period and the following four tax periods — a five-year exposure window triggered by a single bad year, with no fast route back to 0% in the interim.
What to check before the next filing
- Map every revenue line against the qualifying/non-qualifying categories relevant to the licence (VARA, DFSA or FSRA) and confirm the de minimis calculation is monitored quarterly, not left to year-end.
- Document where CIGA is actually performed — board and management decisions, IT infrastructure location, key-holder locations for custody — and keep contemporaneous evidence, not retrospective justification.
- Where functions are outsourced to a foreign affiliate, build a monitoring file: reporting cadence, escalation rights, and evidence the UAE entity can and does direct the outsourced provider.
- Treat headcount and office footprint as a function of transaction volume and assets under management, reviewed as the business scales, not fixed at incorporation.
Compared against Hong Kong's profits-tax regime, the UAE's advantage is real but conditional — it rewards genuine operational presence and penalises the paper-thin free zone structure just as readily as any onshore jurisdiction would.
Key instruments: Federal Decree-Law No. 47 of 2021 (Corporate Tax Law); Cabinet and Ministerial Decisions on Qualifying Free Zone Persons and qualifying income; VARA, DFSA and FSRA licensing frameworks. General information, not legal advice.