UAE’s New Financial Framework Brings DeFi Under Regulation
A significant shift is happening in the United Arab Emirates as the country’s new central bank law extends regulatory oversight to decentralized finance and Web3 platforms. Federal Decree Law No. 6 of 2025, which became effective in September 2025, represents what local crypto lawyer Irina Heaver describes as one of the most important regulatory changes for the crypto industry in the region.
What’s particularly interesting is how broadly the law defines regulated activities. It brings protocols, DeFi platforms, middleware, and even infrastructure providers into scope if they enable activities like payments, exchange, lending, custody, or investment services. This means projects operating in the UAE need to treat this as a pivotal regulatory milestone and align their systems before the September 2026 transition deadline.
The End of “We’re Just Code” Defense
Article 62 of the law states that any person who carries on, offers, issues, or facilitates a licensed financial activity “through any means, medium, or technology” falls under the regulatory perimeter of the Central Bank of the UAE. In practical terms, this means DeFi projects can no longer avoid regulation by claiming they are “just code.” The argument of “decentralization” doesn’t exempt a protocol from compliance requirements anymore.
Protocols supporting stablecoins, real-world assets, decentralized exchange functions, bridges, or liquidity routing may now require licensing. The enforcement is already active, with penalties for unlicensed activity including fines up to 1 billion dirhams (about $272 million) and potential criminal sanctions. That’s not something to take lightly.
Clarifying the Self-Custody Situation
There’s been some confusion about whether the law affects self-custody or non-custodial wallets. Since the law relates to providing “stored value services,” it’s likely to affect cryptocurrency wallet providers. However, according to Kokila Alagh of Karm Legal Consultants, the law doesn’t ban self-custody or restrict individuals from using their own wallets.
What it does do is expand the regulatory perimeter for companies. If a wallet provider enables payments, transfers, or other regulated financial services for UAE users, licensing requirements may apply. Alagh mentioned that her firm has received numerous queries about this issue and is actively following up with the Central Bank for clarification, though there’s no set date for when that guidance might come.
Some industry observers had suggested the law effectively bans crypto and self-custodial wallet apps in the UAE, but both Alagh and Heaver say that’s not accurate. The distinction seems to be between individual use and commercial services. Individuals can still use their own wallets, but companies providing wallet services with additional financial functions may need licenses.
This regulatory development reflects a broader trend of governments worldwide grappling with how to approach decentralized technologies while maintaining financial oversight. The UAE’s approach appears to be more about bringing clarity and structure rather than outright prohibition, which might actually help legitimate projects operate with more certainty about the rules.
For businesses in the space, the message seems clear: understand the new requirements and prepare for compliance. The September 2026 deadline gives some breathing room, but the sooner projects adapt, the better positioned they’ll be in this evolving regulatory landscape.
