The United Arab Emirates has enacted a new central bank statute that extends regulatory oversight to decentralized finance (DeFi) and broader Web3 activities. Federal Decree Law No. 6 of 2025, which took effect on Sept. 16, 2025, expands the Central Bank of the UAE’s (CBUAE) authority to cover crypto-related services and introduces penalties of up to 1 billion dirhams ($272.3 million) for unlicensed activities.
Irina Heaver, a UAE-based crypto attorney and founder of NeosLegal, said the measure represents one of the region’s most significant regulatory developments for the sector. According to Heaver, the law brings protocols, DeFi platforms, middleware, and infrastructure providers into scope when they facilitate payments, exchange, lending, custody, or investment services. She advised projects operating in or targeting the UAE to adapt their frameworks ahead of the transition period ending in September 2026.
“Just code” no longer a defense
Published in the Official Gazette, Federal Decree Law No. 6 governs financial institutions, the insurance sector, and digital asset-related activities. Articles 61 and 62 set out activities that require a CBUAE license, including crypto payments and digital stored value. Heaver noted that Article 62 places “any person who carries on, offers, issues, or facilitates a licensed financial activity ‘through any means, medium, or technology’” within the central bank’s regulatory perimeter.
In practical terms, Heaver said DeFi projects can no longer claim to be outside the rules by asserting they are “just code,” and that decentralization alone does not remove a protocol from compliance obligations. Protocols supporting stablecoins, real-world assets (RWA), decentralized exchange (DEX) functionality, bridges, or liquidity routing may require licensing, she added. Enforcement is already underway, with potential fines up to 1 billion dirhams ($272.3 million) and possible criminal consequences for operating without authorization.
Self-custody not prohibited
The law’s provisions on “stored value services” are expected to impact cryptocurrency wallet providers, said Kokila Alagh, founder and managing partner at Karm Legal Consultants. Alagh said there has been confusion over whether the rules affect self-custodial wallets, which allow users to control their assets without intermediaries.
Alagh stated that the law does not prohibit self-custody or restrict the use of personal wallets by individuals. Instead, it broadens the regulatory scope for companies. If a wallet provider enables payments, transfers, or other regulated financial services for users in the UAE, licensing requirements may apply, she said.
She added that Karm Legal has received numerous inquiries on the matter. While further guidance from the CBUAE is expected as implementation progresses, Alagh said individuals remain unaffected at present, and companies should determine whether their operations fall within regulated activities.
Some commentators, including Trading Strategy’s Mikko Ohtamaa, have characterized the measure as a de facto ban on crypto and self-custodial wallet apps in the UAE. He also criticized UAE-based legal practitioners over their views on the law. In response, Alagh said her firm is actively engaging with the CBUAE for clarification, though no date has been set for official guidance.
| Disclaimer: This website provides information only and is not financial advice. Cryptocurrency investments are risky. We do not guarantee accuracy and are not liable for losses. Conduct your own research before investing. |
