UAE’s Financial Law Expands to Cover DeFi and Web3
The United Arab Emirates has implemented a new central bank law that brings decentralized finance protocols and Web3 infrastructure under regulatory oversight. Federal Decree Law No. 6 of 2025, which took effect in September 2025, represents what legal experts describe as one of the most significant regulatory developments for the crypto industry in the region.
Irina Heaver, a crypto lawyer and founder of NeosLegal, explains that the legislation extends regulatory requirements to “protocols, DeFi platforms, middleware, and even infrastructure providers” if they enable financial activities like payments, exchange, lending, custody, or investment services. This means projects operating in the UAE need to treat this as a crucial regulatory milestone and align their systems before the September 2026 transition deadline.
“Just Code” No Longer a Valid Defense
The law’s key provisions, specifically Article 61 and Article 62, establish that any person or entity conducting licensed financial activities “through any means, medium, or technology” falls under the Central Bank of the UAE’s regulatory perimeter. In practical terms, this eliminates the ability for DeFi projects to avoid regulation by claiming they are “just code.” The argument of decentralization no longer exempts protocols from compliance requirements.
Heaver notes that protocols supporting stablecoins, real-world assets, decentralized exchange functions, bridges, or liquidity routing may now require licensing. Enforcement is already active, with penalties for unlicensed activity including fines up to 1 billion dirhams (approximately $272 million) and potential criminal sanctions.
Self-Custody Wallets Remain Permitted
There has been some confusion about whether the law affects self-custody or non-custodial wallets. Kokila Alagh, founder of Karm Legal Consultants, clarifies that the legislation does not ban self-custody or restrict individuals from using their own wallets. Instead, it expands the regulatory perimeter for companies.
“If a wallet provider enables payments, transfers, or other regulated financial services for UAE users, licensing requirements may apply,” Alagh explains. Her firm has received numerous queries about this issue and is actively following up with the Central Bank for further clarification, though no specific timeline has been provided.
Some industry observers had suggested the law effectively bans crypto and self-custodial wallet apps in the UAE, but both Alagh and Heaver dispute this interpretation. The law primarily targets companies providing stored value services rather than individual users managing their own assets.
This regulatory development comes as the UAE continues to position itself as a hub for digital asset innovation while establishing clear legal frameworks. The approach appears to balance innovation with consumer protection, though the practical implementation details will likely become clearer as the September 2026 deadline approaches and the Central Bank provides additional guidance.
