A recent financial law in the United Arab Emirates is set to bring decentralized finance (DeFi) and broader Web3 activities into the regulatory framework, marking a significant shift for the industry.
The UAE’s new central bank legislation, Federal Decree Law No. 6 of 2025, introduces “one of the most consequential regulatory shifts” for crypto in the region, according to Irina Heaver, a local crypto lawyer and founder of NeosLegal.
“It brings protocols, DeFi platforms, middleware, and even infrastructure providers into scope if they enable activities such as payments, exchange, lending, custody, or investment services,” Heaver told Cointelegraph. She advised that projects building or operating in the UAE should view the law as a pivotal milestone and align their operations ahead of the September 2026 transition deadline.
‘We’re just code’ is no longer a defense
Published in the Official Gazette and effective since Sept. 16, 2025, Federal Decree Law No. 6 regulates financial institutions, insurance businesses, and digital-asset activities.
Its key provisions, Articles 61 and 62, outline which activities require a license from the Central Bank of the UAE (CBUAE), including crypto payments and digital stored value.
“Article 62 states that anyone who carries on, offers, issues, or facilitates a licensed financial activity ‘through any means, medium, or technology’ falls under the regulatory perimeter of the CBUAE,” Heaver explained.
In practice, DeFi projects can no longer rely on the defense of being “just code,” Heaver said, noting that claims of decentralization do not exempt a protocol from regulatory compliance.
Protocols supporting stablecoins, real-world assets (RWA), decentralized exchanges (DEXs), bridges, or liquidity routing “may require a license,” she added. Enforcement is already underway, with penalties for unlicensed activity including fines of up to 1 billion dirhams ($272.3 million) and potential criminal sanctions.
Self-custody is not banned
Because the law primarily regulates the provision of “stored value services,” it is expected to impact cryptocurrency wallet providers, according to Kokila Alagh, founder and managing partner of Karm Legal Consultants.
Alagh noted there has been “fair bit of confusion” about whether the legislation applies to self-custodial wallets, which allow users to store assets independently without third-party control.
While some observers, such as Trading Strategy’s Mikko Ohtamaa, have suggested the law amounts to a “de facto ban” on crypto and self-custodial wallet apps in the UAE, both Alagh and Heaver emphasized that this interpretation is incorrect.
“The law does not ban self-custody, nor does it prevent individuals from using their own wallets,” Alagh said, emphasizing that it “simply expands” the regulatory scope for companies.
She added, “If a wallet provider facilitates payments, transfers, or other regulated financial services for UAE users, licensing requirements may apply.”
Alagh also noted that Karm Legal has received a substantial number of inquiries regarding the matter, highlighting growing industry interest and concern.
“Further clarification from the Central Bank is expected as the law moves through implementation, but for now, individuals remain unaffected while companies should assess whether their activities fall within regulated scope.”
Ironically, Ohtamaa’s post specifically criticized UAE-based lawyers, claiming their business is “free of interest in the UAE.”
“For independent law firms, anything that makes the UAE less attractive for crypto is a loss of income, and these lawyers are happy to obfuscate facts and legal texts just to secure their yearly bonuses,” he wrote.
Karm Legal’s Alagh told Cointelegraph that the firm is actively engaging with the CBUAE on the matter, though no timeline has been set for the authority to issue formal clarification.
