The United Arab Emirates has enacted a new central bank statute that extends regulatory oversight to decentralized finance (DeFi) and broader Web3 activities. Federal Decree Law No. 6 of 2025, which took effect on Sept. 16, 2025, expands the Central Bank of the UAE’s (CBUAE) authority to cover crypto-related services and introduces penalties of up to 1 billion dirhams ($272.3 million) for unlicensed activities.
Regulatory Impact on DeFi and Web3
Irina Heaver, a UAE-based crypto attorney and founder of NeosLegal, stated that the measure represents one of the region’s most significant regulatory developments for the sector. According to Heaver, the law brings protocols, DeFi platforms, middleware, and infrastructure providers into scope when they facilitate payments, exchange, lending, custody, or investment services. She advised projects operating in or targeting the UAE to adapt their frameworks ahead of the transition period ending in September 2026.
"Just Code" No Longer a Defense
Published in the Official Gazette, Federal Decree Law No. 6 governs financial institutions, the insurance sector, and digital asset-related activities. Articles 61 and 62 set out activities that require a CBUAE license, including crypto payments and digital stored value. Heaver noted that Article 62 places “any person who carries on, offers, issues, or facilitates a licensed financial activity ‘through any means, medium, or technology’” within the central bank’s regulatory perimeter.
In practical terms, Heaver explained that DeFi projects can no longer claim to be outside the rules by asserting they are “just code,” and that decentralization alone does not remove a protocol from compliance obligations. Protocols supporting stablecoins, real-world assets (RWA), decentralized exchange (DEX) functionality, bridges, or liquidity routing may require licensing, she added. Enforcement is already underway, with potential fines up to 1 billion dirhams ($272.3 million) and possible criminal consequences for operating without authorization.
Self-Custody Remains Permitted
The law’s provisions on “stored value services” are expected to impact cryptocurrency wallet providers, according to Kokila Alagh, founder and managing partner at Karm Legal Consultants. Alagh clarified that there has been confusion over whether the rules affect self-custodial wallets, which allow users to control their assets without intermediaries.
Alagh stated that the law does not prohibit self-custody or restrict the use of personal wallets by individuals. Instead, it broadens the regulatory scope for companies. If a wallet provider enables payments, transfers, or other regulated financial services for users in the UAE, licensing requirements may apply, she said.
She added that Karm Legal has received numerous inquiries on the matter. While further guidance from the CBUAE is expected as implementation progresses, Alagh indicated that individuals remain unaffected at present, and companies should determine whether their operations fall within regulated activities.
Some commentators, including Trading Strategy’s Mikko Ohtamaa, have characterized the measure as a de facto ban on crypto and self-custodial wallet apps in the UAE. He also criticized UAE-based legal practitioners over their views on the law. In response, Alagh stated that her firm is actively engaging with the CBUAE for clarification, though no date has been set for official guidance.