Function Over Form: What the UAE’s New CBUAE Law Means for Fintech, DeFi and Technology Providers

KEY TAKEAWAYS

Federal Decree-Law No. (6) of 2025 repeals the 2018 Central Bank Law and the 2023 Insurance Decree-Law, consolidating banking, payments, and insurance regulation under a single statute and expanding the CBUAE’s licensing perimeter.
Article (61) expands the list of Licensed Financial Activities, introducing open finance services, payment services using virtual assets, and the promotion of Licensed Financial Activities as regulated activities.
Article (62) extends the regulatory perimeter to persons facilitating Licensed Financial Activities, including through DeFi structures, dApps, blockchain systems, and technological platforms enabling financial services.
CBUAE clarifications confirm that technology providers supplying software or infrastructure are not automatically subject to licensing, although platforms performing Licensed Financial Activities cannot rely on decentralisation alone to avoid regulation.
Existing regulations remain in force and affected entities have until 16 September 2026 to assess whether their activities fall within the expanded licensing framework.

BACKGROUND

Federal Decree-Law No. (6) of 2025 (“New CBUAE Law”)¹ was enacted by the CBUAE, repealing the 2018 Central Bank Law² and the 2023 Insurance Decree-Law.³ It consolidates banking, payments, and insurance regulation under one statute, expands the CBUAE’s licensing perimeter, and significantly increases penalties for non-compliance.

WHAT CHANGED: THE REGULATED ACTIVITIES

The table below compares the Licensed Financial Activities under the 2018 Central Bank Law Law with the expanded list under Article (61) of the New CBUAE Law.

Activity	2018 Law	New CBUAE Law	Status
Deposits	Taking deposits of all types, including Shari’ah-compliant deposits	Taking deposits of all types, including Shari’ah-compliant deposits⁴	Unchanged
Credit facilities	Providing credit facilities of all types	Providing credit facilities of all types⁵	Unchanged
Funding facilities	Providing funding facilities of all types, including Shari’ah-compliant	Providing funding facilities of all types, including Shari’ah-compliant⁶	Unchanged
Open finance services	—	Providing open finance services⁷	New
Currency exchange and money transfer	Providing currency exchange and money transfer services	Providing currency exchange and money transfer services, including instant money transfer services⁸	Modified
Payment services using virtual assets	—	Providing payment services using Virtual Assets⁹	New
Stored value, retail payments, digital money	Providing stored values services, electronic retail payments and digital money services	Providing stored values services, retail payments and digital money services¹⁰	Modified
Arranging, promoting, marketing	Arranging and/or marketing for Licensed Financial Activities	Arranging, promoting, marketing for Licensed Financial Activities¹¹	Modified
Acting as principal	Acting as a principal in financial products (FX, derivatives, bonds, sukuk, equities, commodities, others)	Acting as a principal in financial products (FX, derivatives, bonds, sukuk, equities, commodities, others)¹²	Unchanged
Insurance and related professions	–	Providing insurance, reinsurance, and insurance-related professions, including Takaful and Re-Takaful insurance business and services¹³	New
Monetary intermediating services	Providing monetary intermediating services	—	Removed
Virtual banking services	Providing virtual banking services	—	Removed
		The activities listed above under the New CBUAE Law are collectively referred to as the “*Licensed Financial Activities*.”

The key additions reflect regulatory frameworks the CBUAE had already begun building. Payment services using virtual assets is now a standalone Licensed Financial Activity, aligning with the Payment Token Services Regulations.¹⁴ Instant money transfer services are expressly included under currency exchange and money transfer, aligning with Category 4 under the Exchange Business Regulations.¹⁵ Insurance, reinsurance, and insurance-related professions are consolidated into the same statute, replacing the separate 2023 Insurance Decree-Law. The arranging and marketing category now expressly captures “promoting,” meaning that promotional activity in connection with Licensed Financial Activities is itself a regulated activity.

Importantly, the New CBUAE Law does not capture all virtual asset activity. Its scope is limited to virtual assets used in connection with payment functions. The law expressly excludes virtual assets held for investment purposes, token-to-token exchanges, and swap operations for trading purposes.¹⁶ These remain within the jurisdiction of Virtual Assets Regulatory Authority, the Capital Markets Authority, or the Abu Dhabi Global Market’s Financial Services Regulatory Authority and Dubai International Financial Centre’s Dubai Financial Services Authority within their respective free zones. The exclusion from the CBUAE’s perimeter is not an exclusion from regulation.

ARTICLE (62) of the NEW CBUAE LAW

The Expansion and the Clarification

If Article (61) of the New CBUAE Law was codification, Article (62)¹⁷ is the genuine expansion. For the first time, the CBUAE’s licensing perimeter extends beyond the entity performing a Licensed Financial Activity to any person who facilitates one, regardless of the medium, technology, or form used. This expressly covers DeFi structures, dApps, blockchain-based systems, and platforms or protocols that facilitate financial services.

This generated immediate market concern. Technology service providers and infrastructure developers began assessing whether their activities could fall within scope simply because their tools are used in connection with financial services.

Clarifications in the FAQs

The CBUAE has since published a clarification through its official FAQs on its website.¹⁸ These clarifications provide the following clarity:

Article (62) does not create new categories of Licensed Financial Activity. It confirms that existing regulated activities remain regulated when delivered through new technologies.
Technology providers are not automatically in scope. Supplying software, infrastructure, or technical solutions to a licensed financial institution does not, in that capacity alone, amount to facilitating a Licensed Financial Activity.
Decentralisation is not a safe harbour. The regulatory question turns on whether the entity itself performs or facilitates a Licensed Financial Activity. Where a DeFi protocol, wallet service, or payment token arrangement performs a regulated function, it may fall within the CBUAE’s perimeter regardless of its technological architecture.

PRACTICAL IMPLICATIONS AND LOOKING FORWARD

Entities subject to the New CBUAE Law must reconcile their positions within one (1) year from its entry into force. Existing regulations under the repealed laws remain in force until expressly replaced.

As next steps, affected entities should map their activities against Article (61), paying particular attention to payment services using virtual assets, open finance, and the new promotion category.

Further, those providing technology that supports financial services should assess whether their role crosses the line from supplying tools to a licensed entity into facilitating a Licensed Financial Activity directly. Entities clearly within scope should begin aligning governance, compliance, and AML/CFT frameworks now rather than waiting for implementing regulations.

Article (62), read alongside the clarification, positions the UAE as one of the first jurisdictions to move toward licensing decentralised protocols based on economic function rather than corporate form. If implementing regulations follow this logic, the UAE could offer one of the first regimes in which decentralised entities can be licensed rather than merely tolerated or pursued.

***

DISCLAIMER: This article is provided for informational and educational purposes only and does not constitute legal advice. Readers should not act upon this information without seeking professional legal counsel tailored to their specific circumstances. The analysis presented herein reflects the authors’ interpretation of legal developments as of the date of publication and may not reflect subsequent changes in law or regulation.

At TLP Advisors, we are a legal consulting firm specialising in tokenised finance, agentic financial systems, digital assets, and emerging technologies. With deep roots in the financial services, Web3, and broader technology sectors, we offer unparalleled expertise and tailored support to navigate the unique challenges and opportunities of these rapidly evolving industries. TLP Advisors has consistently been the firm of choice for web3, fintech and other financial services companies. We have built a reputation for guiding clients through complex regulatory landscapes while supporting the development of innovative and compliant financial platforms.

www.techlawpolicy.com

***