Qatar’s New DLT Guidelines: Balancing Innovation and Regulation in the FinTech Landscape

Dall·e 2024 08 16 11.32.28 A Featured Image For A Case Study Titled 'qatar's New Dlt Guidelines Balancing Innovation And Regulation In The Fintech Landscape.' The Image Shows A

KEY TAKEAWAYS

The Qatar Central Bank has introduced the Distributed Ledger Technology Guideline, effective 22 July 2024, to provide a regulatory framework for DLT applications in the financial sector.
The Guideline offers a flexible, principles-based approach to governance, encouraging innovation while maintaining stringent regulatory standards for safety and efficiency.
The Guideline categorises DLT businesses into several types, including internal tools, permissioned networks, and networks interacting with customers.
DLT businesses must adhere to various regulatory requirements, including risk assessments, governance responsibilities, and maintaining a register of DLT applications.

BACKGROUND

Nations worldwide have sought to leverage the benefits of Distributed Ledger Technology (“DLT“). Yet, many need help to balance investment and innovation against the need for regulation to address challenges and uncertainties. Similarly, Qatar, through its FinTech (Financial Technology) Strategy,¹ has shown an interest in embracing DLT but has traditionally taken a cautious regulatory approach.²

Given the rise of businesses³ involved in DLT worldwide, especially in Gulf countries like the United Arab Emirates (“UAE”)⁴ and Bahrain, Qatar aims to establish itself as a global FinTech hub with clear regulations. Qatar’s Islamic FinTech market is projected to grow to USD 4 billion over the next three years from USD 2.1 billion in 2022-23.⁵

Until recently, DLT-specific regulations were absent in Qatar, with its applications falling under broader legal frameworks such as the Cyberlaw of 2014⁶ and the Data Privacy Protection Law of 2016.⁷ However, to better govern this emerging sector, the Qatar Central Bank (“QCB“) issued the Distributed Ledger Technology Guideline (“Guideline“) on 22 July 2024.⁸ The Guideline includes governance protocols to effectively manage DLT in the financial sector, aiming to foster innovation while maintaining robust regulatory standards.

THE NEED FOR DLT GUIDELINES

Recognising DLT’s transformative potential, the Guideline establishes a robust regulatory framework for DLT businesses. This initiative aims to create a structured environment where businesses can leverage DLT to develop innovative solutions while ensuring safety, security, and efficiency.⁹

The Guideline introduces DLT¹⁰ as a type of shared database that can be updated by a set of Participants¹¹ using a Consensus Mechanism,¹² eliminating the need for a central management system. Think of it as a super-advanced ledger that every Participant can see and update, but only with everyone’s agreement. While blockchain¹³ is a well-known form of DLT, there are numerous other applications of DLT.

The Guideline provides clear oversight requirements for DLT applications, adopting a flexible approach that allows entities to achieve their goals based on guiding principles rather than rigid rules, except where specific requirements are necessary.¹⁴ It also sets out best practice standards to govern the conduct of entities, encouraging compliance as part of their regulatory responsibilities. Additionally, the Guideline offers detailed management protocols for different DLT activities,¹⁵ ensuring financial institutions can safely and effectively integrate DLT into their operations.

In many ways, the Guideline is similar to the new guidelines issued by the Securities and Commodities Authority of the UAE.¹⁶

UNDERSTANDING DLT BUSINESS

The Guideline classifies DLT systems used by businesses into different types based on governance and risk control issues. These businesses have to go through various levels of scrutiny as per the DLT Guideline. The primary types of DLT applications include:

Internal Tool: These are DLT applications used internally for administrative tasks or risk evaluation in financial assets and transactions business.
Participation in a Permissioned Network: This covers the vast majority of external DLT activities. Three main sub-types are identified:

Type 1: Regulated networks, such as Financial Market Infrastructures.¹⁷
Type 2: Single-entity networks, either regulated or unregulated, without participant rights in the Consensus Mechanism process.
Type 3: Multi-entity networks involving regulated and/or unregulated firms, possibly co-sponsored by the Entity.

DLT network interacting with Customers: This is a subset of the above type, largely focused on putting existing customer products and information onto DLT applications.
Participation in a Permissionless Network: QCB currently does not permit Permissionless DLT Networks.¹⁸

WHAT DOES IT MEAN FOR BUSINESSES

DLT businesses operating in Qatar must now adhere to the Guideline, which provides clear regulations for governance and compliance standards essential for business operations and strategic planning.

Notification to QCB: Entities are encouraged to inform the QCB about potential DLT applications and submit fully developed proposals for evaluation.
DLT Strategy: Entities must develop and periodically review a DLT strategy that aligns with their needs, risk appetite, overall strategies, and internal policies.¹⁹
Governance Responsibilities: The board of directors and senior management are accountable for ensuring effective internal controls, audits, and risk management practices for DLT-related activities.²⁰
DLT Applications Register: Entities must maintain a comprehensive register of all DLT applications, disclosing this information annually to QCB or upon request.²⁰Part B, Article 8, Distributed Ledger Technology (DLT) Guideline.
Risk Assessment: A thorough risk assessment is mandatory for all DLT systems, including governance, regulatory compliance, ledger design, smart contracts, and key management.²¹
Outsourcing Due Diligence: When outsourcing DLT-related activities, entities must conduct regular due diligence on service providers, ensuring they comply with privacy regulations and confidentiality standards.²²
Regulatory Compliance: Entities must adhere to various secondary regulations in addition to QCB Law and the Guideline.²³

Following the governance principles and requirements as set out by the Guideline, a set of secondary regulations are listed that must be adhered to, namely:

Regulations or guidelines issued by QCB, including those related to emerging technology;
Law No. (13) of 2016 on Personal Data Privacy Protection;
The Sector-Specific Security Regulations;
Know Your Customer (KYC), Anti-Money Laundering (AML), Combating Financing of Terrorism (CFT) rules and laws;
E-KYC Regulation, in the event an Entity onboards customers digitally;
Technology Risks Circular of January 2018 issued by the QCB; and
Cloud Computing Regulation, if the Entity wants to adopt cloud computing deployments.

QATAR VS UAE – A COMPARISON

While Qatar recently issued the Guideline, the UAE already took the lead by issuing “Guidelines for Financial Institutions Adopting Enabling Technologies” in 2021. The UAE regulators²⁴ have jointly issued guidelines to promote best practices for financial institutions adopting DLT and other enabling technologies, allowing for Permissionless DLT²⁵ in the UAE. Permissionless DLT allows open and public access, enabling higher transparency and greater flexibility. In contrast, Qatar’s Guideline does not permit Permissionless Networks, which may hinder the development of certain DLT applications.

Further, while the QCB Guidelines do not directly introduce a licensing procedure, they do outline a process for obtaining approval from the QCB to operate a DLT business. In the UAE, regulatory authorities such as the Virtual Assets Regulatory Authority and the Abu Dhabi Global Market provide a clear framework for licence approval to conduct business as a DLT Service Provider.

The UAE’s guidelines strike a balance between innovation and risk management, requiring institutions to develop Permissionless DLT applications to ensure users are not anonymous or pseudonymous. This precaution helps prevent criminal activities like money laundering, terrorism financing, and tax evasion. Qatar’s more restrictive approach may be intended to address similar concerns, but it may also limit the potential benefits of DLT in the country.

In our view, Qatar can reap considerable economic benefits by enhancing its DLT guidelines and introducing a clear licensing regime, enabling such blockchain technology to be adopted. However, as the regulatory landscape continues to evolve, it will be interesting to see how Qatar’s approach compares to the UAE’s more established guidelines.

******

DISCLAIMER: This article is provided for informational and educational purposes only and does not constitute legal advice. Readers should not act upon this information without seeking professional legal counsel tailored to their specific circumstances. The analysis presented herein reflects the authors’ interpretation of legal developments as of the date of publication and may not reflect subsequent changes in law or regulation.

At TLP Advisors, we are a legal consulting firm specialising in tokenised finance, agentic financial systems, digital assets, and emerging technologies. With deep roots in the financial services, Web3, and broader technology sectors, we offer unparalleled expertise and tailored support to navigate the unique challenges and opportunities of these rapidly evolving industries. TLP Advisors has consistently been the firm of choice for web3, fintech and other financial services companies. We have built a reputation for guiding clients through complex regulatory landscapes while supporting the development of innovative and compliant financial platforms.

www.techlawpolicy.com

******