Detailed Explanation of the RWA Regulatory Sandbox Guidelines Released by the Dubai DFSA

Written by: Iris, Liu Honglin

Since the beginning of 2024, RWA (Real-World Assets) has become a hot topic in the digitalization of Web3 and traditional finance. From real estate tokens, bills, and supply chain finance to the tokenization of bonds and fund shares, more and more project parties and capital are beginning to seek compliant channels for implementation on a global scale.

On March 17, 2025, the Dubai Financial Services Authority (DFSA) released the "Tokenisation Regulatory Sandbox Guide," which explicitly incorporates tokenization into regulatory priorities for the first time and introduces an Innovative Testing License mechanism (ITL), providing a realistic, clear, and practically operable compliance path.

Currently, the Expression of Interest window is open from March 17 to April 24, 2025. Therefore, for RWA project parties planning to go overseas, this path is an important option worth focusing on and grasping at the current stage.

What signals are released by the DFSA tokenized sandbox?

This guide clearly states that the DFSA will incorporate Tokenised Investments into the regulatory framework and will specifically distinguish tokens as follows:

Security Token

Derivative Token

In this way, tokenized assets will no longer be in a regulatory gray area. RWA projects in the Dubai market, especially the tokenization of traditional assets such as real estate, supply chain finance, bills, and bonds, will also have clearer compliance bases and regulatory guidelines.

At the same time, the DFSA’s setup for sandbox applicants provides practical operational space for different types of RWA project parties. According to DFSA guidelines, the types of company entities that can currently apply to participate in the sandbox include:

Companies that issue, trade, hold, or settle tokenized investments (such as stocks, bonds, sukuk, and collective investment fund units);

Financial institutions that have obtained a DFSA license and plan to expand their tokenization business;

A company team with a deep understanding of applicable laws and regulatory frameworks.

In other words, both traditional financial institutions with a certain financial background that wish to expand their tokenization business and entrepreneurial projects that are in the exploratory phase and focus on the digitalization of RWA assets can apply to enter through the DFSA sandbox mechanism and gain low-threshold compliance testing opportunities.

Especially for small and medium-sized RWA startup teams, the phased regulatory exemptions and supportive policies provided within the sandbox can help teams validate their business models at a lower cost in the early stages while clarifying the future compliance and licensing pathway.

What is more noteworthy is that the DFSA has launched an innovative testing license mechanism called the ITL Tokenisation Cohort, allowing RWA project parties to enter the market early without fully meeting all capital requirements and risk control obligations, enabling low-threshold testing of products and models in a real environment before transitioning to the licensed phase.

The overall process is divided into three stages:

1. Intent Expression Stage

The project party needs to submit a letter of intent, indicating plans to carry out Tokenisation business in DIFC (Dubai International Financial Centre). The DFSA will conduct a preliminary assessment based on background, governance, technical solutions, etc.

2. ITL Testing Phase

After the preliminary evaluation, projects can enjoy exemptions from certain capital requirements, prudential obligations, and reporting requirements within a 6 to 12-month window, allowing low-cost access to a real market environment to test their business models. However, the DFSA also clearly states that participating projects must still be subject to ongoing supervision, and project parties must ensure that key risk points such as information disclosure, DLT system security, and custodial arrangements comply with regulatory requirements.

3. Licensing Transition Stage

After the testing period ends, the project must choose to apply for a complete DFSA license or exit the business according to the exit mechanism. The DFSA will strictly enforce market exit for projects that do not meet the "graduation" standards.

It is important to note that this sandbox only serves the tokenization of traditional financial assets and real-world assets, therefore, other pure cryptocurrency projects (Crypto Tokens) and fiat stablecoins (Fiat Crypto Tokens) are not applicable.

Why is the DFSA tokenization sandbox worth paying attention to?

Currently, there are clear regulatory frameworks for RWA or tokenized assets mainly concentrated in the markets of Dubai and Hong Kong. Although both are actively promoting the clarity of RWA regulations, there are significant differences in their specific implementations.

It can be seen that both the Dubai DFSA and the Hong Kong HKMA are actively promoting the clarification of tokenization regulations, but there are significant differences in the participation thresholds and applicable entities between the two regions.

For RWA entrepreneurs, the ITL sandbox mechanism launched by DFSA this time has several practical advantages worth special attention:

1. Suitable for startups and small to medium-sized teams, independently applying flexibly.

The Hong Kong Ensemble Sandbox is designed to emphasize participation from traditional financial institutions, with licensed entities such as banks and brokers taking the lead. Startups often need to collaborate with partners and the application process is relatively complex.

In contrast, the ITL mechanism of DFSA allows project parties to apply directly as independent entities, without relying on existing financial institutions. This provides greater autonomy and operational flexibility for RWA projects that have limited resources and are in the exploratory phase.

2. Phase-based exemption during the testing period to reduce compliance trial costs.

The DFSA clearly provides a testing window of 6-12 months, during which capital requirements and prudent risk management obligations are subject to phased exemptions, especially allowing projects to quickly validate their business models in a real market environment, while significantly reducing early testing costs and operational burdens. Therefore, the DFSA ITL mechanism can be considered one of the few practical cases under the current global diversified regulatory system that offers an independent application channel, phased exemptions, and a full pathway to graduation for RWA entrepreneurial projects.

The overall compliance threshold for the Hong Kong path is relatively high, especially since the SFC licensing system has strict requirements for capital, governance structure, and so on, which poses significant challenges for startup teams in the short term.

3. The regulatory framework is clear, and RWA assets are officially under management.

The DFSA has incorporated Security Tokens and Derivative Tokens into the existing financial regulatory framework, eliminating the policy gaps and legal risks that tokenized assets previously faced. Project parties only need to adhere to the existing financial product regulatory framework of the DFSA to legally and compliantly develop businesses such as issuance and trading, with strong policy predictability.

In comparison, the Hong Kong Ensemble sandbox is currently still in the collaborative pilot phase between banks and financial institutions, with a scope more focused on the financial infrastructure level. The direct regulatory channel for Web3 project parties, especially for startups, still needs to be improved.

It can be seen that the launch of the DFSA sandbox is not just a simple compliance innovation, but also reflects Dubai's policy intention to strive for a first-mover advantage in the RWA track as the fintech hub of the Middle East.

Mankun lawyer suggests

Whether choosing Hong Kong or Dubai, the key to the RWA project always lies in how to find the most suitable compliance path for the project at its current stage based on its own stage, resources, and strategic planning.

The tokenized regulatory sandbox launched by DFSA provides a realistic opportunity for RWA project parties that are in the exploratory phase and wish to quickly validate their models, with a moderate threshold, a clear regulatory framework, and controllable costs.

However, it is worth noting that this window is not open for a long time. The project team not only needs to seize the opportunity but also needs to complete compliance preparations in advance to truly be the first to implement.

In this regard, Mr. Mankiw recommends focusing on the following points:

Complete the DIFC registration and legal framework design as soon as possible. Only by establishing a registered entity in the DIFC can one enter the DFSA regulatory framework. It is advisable to plan the equity structure and tax arrangements in advance to avoid missing the application window due to insufficient compliance preparation.

Prepare technical solutions and risk control materials in advance. The DFSA has detailed requirements for DLT system design, custody mechanisms, and compliance processes. It is recommended to hire a compliance team to assist in preparing relevant materials to ensure a successful application during the ITL phase.

Plan the licensed pathway after ITL graduation. The sandbox period is only a temporary convenience; the ultimate goal should be to obtain a complete DFSA formal license. It is recommended to simultaneously prepare for long-term plans such as capital replenishment and improvement of governance documents to avoid operational interruptions after the sandbox period ends.

It is foreseeable that the DFSA sandbox will attract a influx of global projects. However, those that can successfully land and graduate will still be the teams that have made early arrangements in governance, risk control, and compliance preparation.

The regulatory window has opened, and the time left for actors in the market is often limited.

Ready for the next step?