A federal law came into force in the UAE under which DeFi protocols, Web3 infrastructure providers, and digital service operators fall under the direct supervision of the country’s central bank and are required to comply with a licensing regime.
The UAE enacted a new central bank (CBUAE) law that repeals Federal Decree-Law No. 14 of 2018 and Federal Decree-Law No. 48 of 2023, consolidating the regulation of banking, insurance, digital assets, and FinTech services. The law also brings blockchain technologies, decentralized apps, and DeFi infrastructure into the regulatory and licensing framework.
The new legal framework expands the list of licensable financial activities and introduces a rule stating that any person carrying out, offering, issuing, or facilitating licensable financial activities by means of any technology, including platforms, protocols, decentralized applications, or Web3 infrastructure, is subject to the CBUAE’s oversight.
This approach means that DeFi protocols, cross-chain bridges, wallet operators, and API integrators will be required to obtain a license if they serve users from the UAE or if their services are accessible to UAE residents. The law doesn’t prohibit storing assets in non-custodial wallets. Restrictions apply only to intermediaries that provide payments, transfers, or other financial services through their platforms.
The law also introduces a significant increase in penalties for non-compliance. The maximum administrative fine is raised from 200 million dirhams (~$55 million) to 1 billion dirhams (~$272 million). It also establishes criminal liability for operating without a license — fines of up to 500 million dirhams (~$135 million) and imprisonment.
A transition period for meeting the new requirements is set until September 16, 2026.
Notably, the bill only partially affects the UAE’s free financial zones. The main regulators for the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) remain the Dubai Financial Services Authority (DFSA) and the Abu Dhabi Financial Services Regulatory Authority (FSRA), respectively. However, if companies’ activities target residents of mainland UAE, federal regulation will also apply.
Last year, the Dubai Virtual Assets Regulatory Authority (VARA) and the UAE Securities and Commodities Authority (SCA) agreed to implement a unified licensing system for virtual asset service providers (VASP).
