Blockchain Legal in Dubai Mainland: Complete Guide
The test is functional: if customers hand you an asset and expect it back, that is custody.
Written for blockchain businesses trading on a Dubai mainland trade licence. It explains why the activity on the licence has to match what the product actually does, what the removal of the 51% national-ownership requirement means for structures and nominee arrangements put in place before it, which regulator covers virtual asset activity in Dubai outside the DIFC, and how the federal data protection law applies to onboarding files and wallet addresses when part of the record sits on an immutable ledger. It also covers corporate tax and VAT, the closed economic substance regime, employment and code ownership terms for developers, and why disputes are often sent to arbitration rather than the Arabic-language mainland courts.
The licence decides what you may build
A Dubai mainland company can only carry on the activities written on its trade licence. For a blockchain business this matters more than it does for a trading company, because the same product can sit in very different activity categories depending on how it works. Software development is one thing. Operating a platform where customers buy, sell or store a digital asset is another, and it is licensed by a different route. If the licence does not cover what the product actually does, the position is not fixed by disclaimers in the terms of use.
Start by writing down, in ordinary language, what happens when a customer uses the product: what they send, what you hold, who takes the risk if it disappears, and who you pay. That description is what the licensing analysis runs on, and it is usually more revealing than the whitepaper.
Ownership and structure on the mainland
The requirement for 51% UAE-national ownership of mainland limited liability companies was removed by Federal Decree-Law No. 26 of 2020, effective 1 June 2021. Full foreign ownership is now available for most mainland activities, subject to a list of activities of strategic impact. Two practical consequences follow. First, a shareholding structure put in place before that change may no longer reflect what the founders intended, and nominee arrangements entered into to satisfy the old rule are worth unwinding properly rather than leaving in place. Second, the exemption is activity-specific: confirm the position for the activity you are actually licensed for, not for mainland companies in general. A local service agent for the branch of a foreign company is a different arrangement and remains lawful.
The company itself is governed by Federal Decree-Law No. 32 of 2021 on Commercial Companies, in force 2 January 2022, which replaced Federal Law No. 2 of 2015. Constitutional documents drafted against the old law should be read again, particularly the provisions on transfers of shares, reserved matters and what happens when a founder leaves.
Who regulates digital asset activity in Dubai
Dubai has a dedicated virtual assets regulator whose remit covers virtual asset activity in the emirate outside the DIFC. Securities and commodities regulation sits federally with the Securities and Commodities Authority. The DIFC is a separate common-law jurisdiction with its own courts and its own regulator, the DFSA; ADGM sits under the FSRA. A mainland licence does not carry any of those permissions with it, and being licensed by the Department of Economy and Tourism does not settle whether a further authorisation is needed.
The honest test is functional. If customers give you an asset and expect it back, that is custody. If they trade against each other on your infrastructure, that is a market. If they hand over money expecting a return generated by your effort, that will be examined as an investment product whatever it is called in the marketing. Take that analysis before launch, in writing, and keep it. Regulators respond very differently to a business that reasoned its position and recorded it than to one that never asked.
Data, and why chain design does not exempt you
Federal Decree-Law No. 45 of 2021, the PDPL, governs the processing of personal data. A blockchain business processes plenty of it: identity documents collected at onboarding, screening results, device and transaction logs, support correspondence, and wallet addresses once they are tied to an identified customer. The fact that some records sit on an immutable ledger is a design constraint you must work around, not an exemption from the obligations. Decide before launch what goes on chain, what stays in a system you control, and how a request about a customer's data can be answered without rewriting history.
Cross-border transfers deserve a specific answer rather than a general intention. Note where your infrastructure providers actually hold data, including backups. DIFC and ADGM apply their own data regimes, so a group with entities in both a free zone and the mainland is running more than one rulebook.
Tax positions that people get wrong
Corporate tax under Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023, at 0% on taxable income up to AED 375,000 and 9% above that. VAT is 5% under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022. Descriptions of the UAE as tax-free are simply out of date, and pitch decks that still say it invite questions from investors who know better.
Separately, the Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 by Cabinet Decision No. 98 of 2024, with obligations remaining only for FY2019 to FY2022. If the company existed in those years, check that the historic filings were made; if it did not, there is nothing outstanding.
Your developers are an employment law question
Federal Decree-Law No. 33 of 2021 replaced Federal Law No. 8 of 1980 and governs employment on the mainland. For a blockchain company the sensitive points are predictable: what a developer may do after leaving, who owns code written during employment, and what happens to access credentials on the last day. Deal with all three in the employment documents and in a written assignment of intellectual property, and revoke access on departure as a matter of process rather than goodwill. Restrictions on former employees are enforceable only within limits, so draft them to be defensible rather than maximal.
Where disputes are heard
Mainland court proceedings are conducted in Arabic, and documents relied on must be translated. That is a cost and a timetable, and it is a reason many technology contracts choose arbitration instead. Federal Law No. 6 of 2018, amended in 2023, governs arbitration seated in the UAE. The DIFC-LCIA was abolished by Dubai Decree No. 34 of 2021 and its caseload transferred to DIAC, though DIFC remains available as a seat, and ADCCAC was restructured as arbitrateAD from 2024. Templates naming the abolished institution are still in circulation; if yours does, agree a replacement clause with the counterparty now rather than at the point of filing.
Whatever forum you choose, name it once and name it consistently across the contract stack. Clauses that point to a court in one document and an arbitral institution in another produce a preliminary fight about where the fight happens. Getting the clause right is the least expensive part of technology dispute resolution, and the part most often skipped.
A short checklist before launch
- Confirm the licensed activities match the product as built.
- Take a written view on whether a further authorisation is required, and keep it.
- Review the shareholding against the current ownership rules and remove any legacy arrangement that no longer serves a purpose.
- Map personal data, including what goes on chain and what leaves the country.
- Register for tax where required and drop tax-free language from all materials.
- Put IP assignments and access controls in place for every developer and contractor.
- Align the dispute clause across user terms, vendor contracts and investor documents.
If you are licensing a blockchain product in Dubai, or reviewing documents drafted before the current company, data and tax laws took effect, contact the Nour Attorneys team.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
Explore more of our insights on related topics:
- AI Regulations Compliance Requirements in the UAE
- Blockchain Legal Defense Strategies for Dubai Businesses
- Cryptocurrency Compliance Guidelines for UAE Operators
- Data Privacy Laws for Multinational Entities
