Federal Decree-Law No. 6 of 2025: What It Means for DeFi
Quick answer. It can: Article 62 of Federal Decree-Law No. 6 of 2025 reaches anyone who carries on, offers or facilitates a CBUAE-licensed activity by any technology, naming DeFi, dApps and protocols. Whether yours is caught is for UAE counsel.
Video transcript
Can the UAE's new Central Bank law reach your DeFi protocol? Under Federal Decree-Law Number 6 of 2025, it can.
Article 62 reaches anyone who carries on, offers or facilitates a licensed financial activity, whatever the technology. It names DeFi, dApps and protocols.
The test is function. Payments using virtual assets, deposits, credit and money transfer are Article 61 activities. Token-to-token swaps and investment holdings fall in the Article 187(3) carve-out.
The stakes are high. Under Article 170, unlicensed activity can mean imprisonment and a fine of up to 500 million dirhams. Article 181 can make managers personally liable.
Free zone firms should not assume they are safe. Gibson Dunn reads the ban as reaching DIFC and ADGM firms that target UAE retail customers. The transition was reported to end September 15, 2026, so confirm with counsel.
Whether a team facilitates turns on control facts: who runs the front end, who holds admin and upgrade keys, who can change fees, who runs relayers, and who markets to UAE users.
Guardian builds the evidence counsel needs. We map every privileged role and its holder, verify deployed bytecode against the audited commit, check domains and DNS, and keep it current with Managed Security.
This is not legal advice. Read the full article, then talk to Guardian about giving your UAE counsel the control facts.
Federal Decree-Law No. 6 of 2025, the new CBUAE law, replaced the UAE's 2018 Central Bank law and its 2023 insurance law with one statute.
The CBUAE Rulebook lists it as in force from September 16, 2025, the day after its publication in the Official Gazette (Article 188).
For DeFi teams, Article 62 matters most. It extends Central Bank licensing to anyone who facilitates a licensed activity, whatever the technology.
Article 184 gave one year to bring positions into line. Hadef & Partners put the deadline at September 15, 2026.
On August 26, 2026 they reported that no general extension had been announced. The Board can extend it, so confirm the current position with the CBUAE or counsel.
This article explains the technical and security side of Federal Decree-Law No. 6 of 2025. It is not legal advice; confirm how it applies to you with counsel.
The Law on One Page
| Point | What the text says | Article |
|---|---|---|
| In force | The day after Gazette publication: September 16, 2025 | 188 |
| Replaces | Law No. 14 of 2018 and Decree-Law No. 48 of 2023 | 185 |
| Existing rules | Stay in force until replaced | 183 |
| Transition | One year to reconcile positions; the Board may extend | 184 |
| Licensing | No Licensed Financial Activity without a license | 60 |
| Activities | The list of Licensed Financial Activities | 61 |
| Technology | Facilitation by any technology is in scope, including DeFi and dApps | 62 |
| Free zones | Not the Financial Free Zones or institutions their authorities regulate | 2 |
| Virtual assets | Investment, token-to-token exchange and trading swaps excluded | 187(3) |
| Penalties | Administrative, criminal and personal liability | 168, 170, 181 |
Article 61 and Article 62
Article 61(1) lists the activities that need a Central Bank license. They include:
- taking deposits, and credit and funding facilities;
- open finance, currency exchange and money transfer;
- payment services using virtual assets;
- stored value, retail payment and digital money services; and
- arranging, promoting or marketing licensed activities.
The Board can add, delete or amend activities after consulting the Financial Stability Board.
Article 62 covers “any Person carrying on, offering, issuing, or facilitating, whether directly or indirectly, any Licensed Financial Activity” by any medium or technology.
Such persons “shall be subject to the licensing, regulatory, and oversight jurisdiction of the Central Bank.”
It names DeFi. The scope includes the “offering or operation of platforms, decentralized applications (dApps), protocols, or technological infrastructure” that facilitate, intermediate or enable financial services such as payments, credit or deposits.
Article 60 adds a promotion rule. Licensed activities may be promoted in or from the UAE only in line with the law.
What the Law Leaves Out
Article 187 limits the reach. Virtual assets are not Currency under the law (187(2)).
Under Article 187(3), the law does not cover virtual assets held for investment, exchanged for another virtual asset, or swapped for trading purposes. Those are left to other UAE legislation.
TLP Advisors reads this as limiting the law's virtual asset scope to payment functions. The excluded activity stays with VARA, the Capital Markets Authority and, in their free zones, the ADGM FSRA and the DFSA.
In TLP's words, “the exclusion from the CBUAE's perimeter is not an exclusion from regulation.”
So the map is functional. On the text, a pure token-to-token swap falls in the Article 187(3) carve-out.
A stablecoin payment rail, a product marketed as a deposit, a lending market or a remittance flow may map onto Article 61 activities.
Existing CBUAE rules continue under Article 183, such as the Payment Token Services Regulation in force since August 31, 2024.
How Law Firms Read Article 62
- Gibson Dunn (November 13, 2025): technology providers “may themselves fall within the regulatory perimeter,” even without offering the financial product.
- TLP Advisors (March 24, 2026): platforms performing licensed activities cannot rely on decentralization alone, but supplying software to a licensed institution is not, by itself, facilitating.
- Hadef & Partners (August 26, 2026): a technology or business model does not, by itself, take an activity outside the perimeter.
- Ashraf Hendi and Maryam Tarek, in Chambers and Partners (January 19, 2026): the provision captures DeFi, dApps and other protocols that facilitate financial services.
None of them sets out a test for when a protocol team facilitates. That comes back to facts.
Free Zones and Penalties
Article 2 says the law does not apply to the Financial Free Zones, which covers the DIFC and ADGM, or to institutions their authorities regulate.
Gibson Dunn still reads the ban on unlicensed activity as reaching DIFC and ADGM firms, citing Article 4 of Federal Law No. 8 of 2004.
It concludes that a firm targeting UAE retail customers may face criminal sanctions even with a free zone license. Hendi and Tarek write that the law does not apply within the free zones.
So a free zone or VARA license should not be assumed to cover an onshore payment, deposit or credit function. For ADGM's own approach, see our guide to its draft DeFi monitoring guidance.
The penalties are serious:
- Article 168: administrative fines of at least AED 1 million for unlicensed activity or promotion, and up to ten times the funds involved.
- Article 170: imprisonment, a fine of AED 50,000 to AED 500 million, or both, for unlicensed Article 61(1) activity.
- Article 181: managers face the same penalties if they knew of a company's violation, or it resulted from their negligence.
The Control Facts Counsel Needs
Whether a team facilitates is a legal conclusion, but it rests on facts an engineer can establish. They overlap with the facts other regulators use, compared in our guide to decentralization tests.
Start with function: which flows touch payments, deposits, credit or remittances, and which are token-to-token only. Then state each fact, where it was read from and when:
| Fact | Read from | Why counsel asks |
|---|---|---|
| Every deployed contract, by chain and address | Deployment records, verified against the chain | Defines what the protocol is |
| Each privileged role, its holder, threshold and timelock | Contract state onchain | Shows who can change the system |
| Multisig signers and who they are | Onchain signer sets, matched to people | Shows whether a team controls it |
| Fee parameters and recipients | Contract state and transaction history | Shows who earns from the activity |
| Front end, domains and hosting | Registrar, DNS and cloud accounts | Shows who offers the service |
| Offchain infrastructure operators | Keeper, relayer and oracle configurations | Shows who operates the service |
| UAE user access and marketing | Geofencing rules, campaigns, terms | Bears on offering and Article 60 promotion |
Date every row. Control facts change with each upgrade, signer rotation or governance vote.
For the same powers in US terms, see which admin powers make a protocol centralized. For the wider picture, see who controls DeFi admin keys.
How Guardian Helps
Guardian's regulatory readiness assessment maps your activities, entities and customer locations to the regulations that reach them. Your counsel owns the legal reading.
The evidence is technical: every privileged role with its holder, threshold and timelock, deployment verification against the audited commit, and registrar, DNS and frontend checks.
Managed Security keeps those facts current, maintaining the threat model in real time and reviewing every multisig transaction before it is signed.
Frequently Asked Questions
Does Federal Decree-Law No. 6 of 2025 apply to DeFi protocols?
It can. Article 62 reaches anyone who carries on, offers or facilitates a licensed activity by any technology, and names DeFi, dApps and protocols. Token-to-token exchange falls in the Article 187(3) carve-out.
When did the new CBUAE law take effect, and when did the transition end?
The CBUAE Rulebook lists it as in force from September 16, 2025. Hadef & Partners put the end of the one-year transition at September 15, 2026; the Board may extend it.
What are the penalties for unlicensed activity under the new CBUAE law?
Article 170 provides for imprisonment, a fine of AED 50,000 to AED 500 million, or both. Article 168 adds administrative fines, and Article 181 can make managers personally liable.
Does the new CBUAE law apply in the DIFC and ADGM?
Article 2 excludes the Financial Free Zones. Gibson Dunn still reads the ban on unlicensed activity as reaching free zone firms that target UAE retail customers, so take advice.
Sources
- CBUAE Rulebook: Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business (in force September 16, 2025)
- CBUAE Rulebook: Payment Token Services Regulation (in force August 31, 2024)
- Gibson Dunn: UAE Central Bank Issues New Central Bank Law Consolidating Financial Sector Regulation (November 13, 2025)
- TLP Advisors via Legal 500: Function Over Form: What the UAE's New CBUAE Law Means for Fintech, DeFi and Technology Providers (March 24, 2026)
- Hadef & Partners: UAE Central Bank Law: 2026 Developments and the September 2026 Reconciliation Deadline (August 26, 2026)
- Chambers and Partners: New CBUAE Law No. 6 of 2025, a Consolidated Overhaul of the UAE Financial Regulatory Framework, by Ashraf Hendi and Maryam Tarek (January 19, 2026)
- Guardian: Regulatory and Compliance Assessments
Give your UAE counsel the control facts
Guardian reads your roles, keys, thresholds, timelocks and front end infrastructure from the systems themselves and hands counsel a dated inventory.