Blockchain Legal in UAE Federal: Complete Guide
Regulators look at what a token does, not at what the whitepaper calls it.
There is no single UAE blockchain law, so this guide works through the ordinary questions that decide these cases. It explains what makes a token regulated and which body supervises it — the Central Bank, the Securities and Commodities Authority, Dubai's virtual assets regulator, the DFSA in DIFC or the FSRA in ADGM — why enterprise ledgers that issue no transferable token usually sit outside all of that, and what a written classification analysis is for. It then covers the contract terms a smart contract cannot supply on its own, including which text prevails and who may pause or upgrade a live contract; how the federal data protection law is reconciled with an append-only ledger; ownership of code and open source obligations; and the company, employment and tax rules around the project.
There is no single UAE blockchain law, and looking for one is the first mistake most projects make. What exists instead is a set of ordinary legal questions — who is regulated, whose contract is it, who owns the code, where does the data live, who pays tax, which court decides — applied to a technology that distributes the answers across parties, jurisdictions and machines. A project that answers those questions early rarely has a legal problem later. A project that treats them as documentation to be produced after launch usually does.
Whether you are regulated depends on the token, not the technology
Building on a distributed ledger is not itself a regulated activity. What triggers supervision is issuing or dealing in something that has the characteristics of a financial instrument, or providing a service in relation to it. Regulators look at economic substance, not at the label in the whitepaper.
- Tokens that function as payment instruments or as stablecoins engage the Central Bank of the UAE.
- Tokens with the characteristics of securities or investment products engage the Securities and Commodities Authority at federal level.
- Virtual asset activity in the Emirate of Dubai, including its free zones but excluding DIFC, falls to the Virtual Assets Regulatory Authority.
- Firms in DIFC answer to the Dubai Financial Services Authority; firms in Abu Dhabi Global Market answer to the Financial Services Regulatory Authority. Both centres are common-law jurisdictions with their own courts, and both have developed frameworks for distributed ledger and virtual asset business.
Enterprise blockchain that never issues a transferable token — supply chain tracking, document notarisation, internal settlement between group companies — usually sits outside all of this. Say so in a written classification analysis, kept on file. Auditors, banks and investors ask for it, and it is much harder to produce convincingly once a product has shipped.
The contract question smart contracts do not answer
Code that executes automatically still sits inside a legal relationship. When a transfer fires, the question of whether the parties had agreed to that outcome is decided by contract law, not by the transaction hash. Commercial dealings on the mainland sit under Federal Decree-Law No. 50 of 2022 on commercial transactions, which replaced Federal Law No. 18 of 1993, alongside the civil law; DIFC and ADGM apply their own common-law regimes.
Two practical consequences follow. First, write the agreement in words as well as in code, and say which prevails if they diverge — because they will, whether through an upgrade, an oracle failure or a bug. Second, deal expressly with the situations code cannot resolve on its own: mistaken transfers, a compromised key, an oracle feeding bad data, a fork, and the circumstances in which anyone may pause or upgrade a contract. A protocol described as immutable that in fact has an admin key should say so plainly and identify who holds it.
Electronic records and signatures are recognised under UAE law, which is what allows on-chain records to function as evidence, but the evidential weight of a record depends on being able to show how it was created and controlled. Keep the surrounding documentation.
Data protection meets an append-only ledger
Federal Decree-Law No. 45 of 2021 governs personal data at federal level, with DIFC and ADGM maintaining their own regimes. The friction with distributed ledgers is built in and well known: the law contemplates correcting and erasing personal data, while the ledger is designed not to forget.
The workable answer is nearly always a design choice made early. Keep personal data off-chain, hold only references, commitments or hashes on-chain, and design so that deleting the off-chain record makes the on-chain reference meaningless. Decide before launch whether wallet addresses and transaction patterns in your system amount to personal data in the hands of anyone who can link them to an individual. Identify who is the controller of the data on a permissionless network, and record the analysis; a consortium chain with named participants needs an agreement allocating those roles among them. Cross-border transfers need a lawful basis, and nodes located outside the UAE are a transfer.
Ownership: code, protocol and brand
Open-source licences are binding contracts, and the copyleft ones can require you to release your own modifications on the same terms. Run a licence review before the first release, keep an inventory of dependencies, and check what obligations attach to each. Where a development contract is signed, say expressly who owns the resulting code, who may reuse it, and what happens to it if the relationship ends — developers and founders both tend to assume the answer runs their way.
Protect the brand rather than the ledger: trade marks for the project name and logo, registered in the jurisdictions where you operate, and confidentiality agreements around anything genuinely proprietary. Patents are of limited use where the underlying mechanism is public.
Structuring, tax and disputes
A mainland company is formed under Federal Decree-Law No. 32 of 2021, which replaced Federal Law No. 2 of 2015. Foreign ownership restrictions on mainland companies were removed by Federal Decree-Law No. 26 of 2020, subject to a strategic-impact list, so foreign founders generally do not need a UAE-national shareholder; a local service agent for a foreign company's branch is a different arrangement and remains lawful. Staff on the mainland are employed under Federal Decree-Law No. 33 of 2021, which replaced Federal Law No. 8 of 1980; DIFC and ADGM apply their own employment regulations. A foundation or similar vehicle in a financial centre is a common home for protocol governance, but it is a legal entity with directors, filings and duties, not a way of making governance disappear.
On tax, the frequently repeated claim that blockchain projects operate tax-free in the UAE is wrong. Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023: no corporate tax on taxable income up to AED 375,000, and 9% above that. VAT applies at 5% under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022. The treatment of token issuance, staking rewards and protocol fees needs specific advice. Note also that the federal Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 by Cabinet Decision No. 98 of 2024, with obligations surviving only for financial years 2019 to 2022.
For dispute resolution, decide the forum in advance and make it consistent across the token terms, the development agreements and the shareholder documents. Arbitration with a UAE seat runs under Federal Law No. 6 of 2018, as amended in 2023. The DIFC-LCIA was abolished by Dubai Decree No. 34 of 2021 and its caseload moved to the Dubai International Arbitration Centre, while DIFC remains available as a seat; in Abu Dhabi, ADCCAC was restructured as arbitrateAD from 2024. Clauses copied from older templates still name the abolished institution, and that alone can produce a jurisdictional fight before anyone reaches the merits. Our team advises on drafting those clauses and on the technology dispute resolution that follows when they were never checked.
For advice on token classification, protocol structuring or blockchain contracts in the UAE, contact the Nour Attorneys team.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
Explore more of our insights on related topics:
- AI Regulations Compliance Requirements in the UAE
- Blockchain Legal Defense Strategies for Dubai Businesses
- Cryptocurrency Compliance Guidelines for UAE Operators
- Data Privacy Laws for Multinational Entities
