Blockchain Legal in RAK ICC: Complete Guide
Choose the vehicle after you know who licenses the activity, not before.
Incorporation at RAK ICC gives you a registered vehicle, not permission to run an exchange, hold customer assets or offer a token to the public. Since no UAE statute is called a blockchain law, the article identifies the general laws that decide these cases instead — companies, commercial transactions, personal data, employment, corporate tax and VAT — and notes where economic substance obligations still remain for earlier financial years. It then sets out the corporate records a registered agent should keep current before a bank asks for them, which regulator licenses custody, exchange and token issuance depending on where customers are, and the clauses disputes turn on, including arbitration clauses that still name institutions no longer in existence.
Registration is not permission to trade
A company incorporated at RAK International Corporate Centre is a registered vehicle. It is not a licence to run an exchange, hold customer assets, issue a token to the public, or market a digital asset product to anyone in the UAE. Founders building on blockchain often treat incorporation as the end of the legal work; it is the start of it. The registry records who owns and controls the company. It does not authorise the activity the company intends to carry on.
So the first question is not where to incorporate. It is what the business actually does, who its customers are, and which authority licenses that activity. Answer those three, then choose the vehicle. Doing it the other way round produces a certificate of incorporation and an unlicensed business.
The laws that apply even though they never say "blockchain"
There is no single UAE statute called a blockchain law, and waiting for one is not a plan. Distributed ledger businesses are governed by the general law, which is detailed and enforced.
- Companies. Federal Decree-Law No. 32 of 2021 on Commercial Companies, in force 2 January 2022, replaced Federal Law No. 2 of 2015. Anyone still working from the 2015 law, or from a shareholders' agreement drafted against it, is working from a repealed text.
- Contracts. Federal Decree-Law No. 50 of 2022 on Commercial Transactions replaced Federal Law No. 18 of 1993. Where UAE law governs, token sale terms, custody agreements, development contracts and platform rulebooks are read against it.
- Personal data. Federal Decree-Law No. 45 of 2021, the PDPL, applies to the processing of personal data. Onboarding files, sanctions screening records, support tickets and wallet addresses linked to an identified customer are personal data, whatever the chain itself stores. DIFC and ADGM operate their own data regimes; the PDPL is the federal one.
- Employment. Federal Decree-Law No. 33 of 2021 replaced Federal Law No. 8 of 1980 and governs the development team, including the terms on which developers leave.
- Tax. Corporate tax under Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023, at 0% on taxable income up to AED 375,000 and 9% above that. VAT is 5% under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022. Whether a particular registered entity falls within either regime is a question to have assessed, not assumed, and "we are offshore" is not the answer to it.
Economic substance still causes confusion. The Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 by Cabinet Decision No. 98 of 2024. Obligations remain only for FY2019 to FY2022. A company formed in those years may have an unfinished filing or an open penalty on its record; a company formed since has nothing to file and should not be sold a service saying otherwise.
What the registry expects you to hold
RAK ICC entities are incorporated and maintained through a registered agent, and most of the ongoing compliance runs through that agent. Keep the following current rather than reconstructing it when a bank, an auditor or a counterparty asks:
- Registers of shareholders and directors, matching what the registry holds.
- Beneficial ownership information, updated when it changes rather than at renewal.
- Signed resolutions for share issues, transfers, director changes and any pledge over shares.
- Accounting records that support the financial statements you would show a bank.
- The registered agent's contact details and the address for service, both of which must be reachable.
Banking is where weak records surface. A bank assessing a digital asset company will ask about source of funds, the licensing position of the operating entity, and the identity of controllers. Thin corporate records turn a routine review into a refused account.
Licensing: the question a whitepaper does not answer
Custody, exchange, brokerage, token issuance to the public and similar services are regulated in the UAE, and which regulator applies depends on where the activity is carried on and where the customers are. Securities and commodities regulation sits federally with the Securities and Commodities Authority. Dubai has a dedicated virtual assets regulator. DIFC and ADGM are common-law jurisdictions with their own courts and regulators, the DFSA and the FSRA. A RAK ICC company that intends to serve UAE customers needs to establish which of these applies before launch, and to be honest in the analysis: describing a token as a utility in a marketing deck does not decide how it is treated once its terms are read.
Terms that decide the dispute
When a blockchain project goes wrong, the argument is almost always about a handful of clauses drafted quickly and never revisited.
Governing law and forum
Federal Law No. 6 of 2018, amended in 2023, governs arbitration seated in the UAE. The DIFC-LCIA was abolished by Dubai Decree No. 34 of 2021 and its caseload moved to DIAC, while DIFC remains available as a seat; ADCCAC was restructured as arbitrateAD from 2024. Clauses naming an institution that no longer exists are still circulating in template documents. Check what your contracts name and, where they name the wrong thing, agree a replacement with the counterparty rather than discovering the problem when you need to file.
Custody and keys
Say who holds the keys, on what terms, and what happens on insolvency of the holder. Say whether customer assets are segregated and how that is evidenced. Silence here is read against whoever drafted it.
Intellectual property
Get written assignments from every contractor who touched the codebase, signed before they are paid. Record which open-source licences are in the stack and what they require on distribution, because a copyleft obligation discovered during due diligence can hold up a funding round.
Liability and remedies
Caps and exclusions are worth having, but they do not reach everything: liability for fraud, gross negligence and wilful misconduct is not something a clause disposes of. Build in a period to cure a breach before termination or penalties bite, so that a fixable failure stays fixable.
A workable sequence
- Write down the activity in plain terms, including who pays and who is on the other side of each transaction.
- Identify the licensing authority for that activity, in each place customers sit.
- Choose the entity and the registry to match, not before.
- Map personal data flows against the PDPL, including anything sent outside the UAE.
- Fix the contract stack: user terms, custody, development, IP assignments, dispute clause.
- Confirm the tax position for the financial year in question and register where required.
- Diarise the registry filings and keep the registered agent supplied with current information.
Where an agreement fails and money is at stake, the value of that groundwork becomes obvious: clear records, a valid dispute clause and honest licensing analysis are what make technology dispute resolution a manageable process rather than an open-ended one.
The short version
RAK ICC gives a blockchain business a clean corporate vehicle and a registry that expects accurate information about ownership and control. It does not give the business permission to carry on regulated activity, and it does not answer the tax, data or contract questions that decide whether the project survives its first serious dispute. Treat the incorporation as one item on the list, keep the records the registry and your bank will ask for, and settle the licensing position before you take a customer's money rather than after.
If you are structuring a digital asset business, or reviewing contracts that were signed before the current laws came into force, contact the Nour Attorneys team.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
Explore more of our insights on related topics:
- AI Regulations Compliance Requirements in the UAE
- Blockchain Legal Defense Strategies for Dubai Businesses
- Cryptocurrency Compliance Guidelines for UAE Operators
- Data Privacy Laws for Multinational Entities
