- within Finance and Banking topic(s)
- with readers working within the Business & Consumer Services and Construction & Engineering industries
- within Finance and Banking, Tax, Government and Public Sector topic(s)
KEY TAKEAWAYS
- Federal Decree-Law No. (6) of 2025 repeals the 2018 Central Bank Law and the 2023 Insurance Decree-Law, consolidating banking, payments, and insurance regulation under a single statute and expanding the CBUAE's licensing perimeter.
- Article (61) expands the list of Licensed Financial Activities, introducing open finance services, payment services using virtual assets, and the promotion of Licensed Financial Activities as regulated activities.
- Article (62) extends the regulatory perimeter to persons facilitating Licensed Financial Activities, including through DeFi structures, dApps, blockchain systems, and technological platforms enabling financial services.
- CBUAE clarifications confirm that technology providers supplying software or infrastructure are not automatically subject to licensing, although platforms performing Licensed Financial Activities cannot rely on decentralisation alone to avoid regulation.
- Existing regulations remain in force and affected entities have until 16 September 2026 to assess whether their activities fall within the expanded licensing framework.
BACKGROUND
Federal Decree-Law No. (6) of 2025 ("New CBUAE Law")1 was enacted by the CBUAE, repealing the 2018 Central Bank Law2 and the 2023 Insurance Decree-Law.3 It consolidates banking, payments, and insurance regulation under one statute, expands the CBUAE's licensing perimeter, and significantly increases penalties for non-compliance.
WHAT CHANGED: THE REGULATED ACTIVITIES
The table below compares the Licensed Financial Activities under the 2018 Central Bank Law Law with the expanded list under Article (61) of the New CBUAE Law.
| Activity | 2018 Law | New CBUAE Law | Status |
| Deposits | Taking deposits of all types, including Shari'ah-compliant deposits | Taking deposits of all types, including Shari'ah-compliant deposits4 | Unchanged |
| Credit facilities | Providing credit facilities of all types | Providing credit facilities of all types5 | Unchanged |
| Funding facilities | Providing funding facilities of all types, including Shari'ah-compliant | Providing funding facilities of all types, including Shari'ah-compliant6 | Unchanged |
| Open finance services | — | Providing open finance services7 | New |
| Currency exchange and money transfer | Providing currency exchange and money transfer services | Providing currency exchange and money transfer services, including instant money transfer services8 | Modified |
| Payment services using virtual assets | — | Providing payment services using Virtual Assets9 | New |
| Stored value, retail payments, digital money | Providing stored values services, electronic retail payments and digital money services | Providing stored values services, retail payments and digital money services10 | Modified |
| Arranging, promoting, marketing | Arranging and/or marketing for Licensed Financial Activities | Arranging, promoting, marketing for Licensed Financial Activities11 | Modified |
| Acting as principal | Acting as a principal in financial products (FX, derivatives, bonds, sukuk, equities, commodities, others) | Acting as a principal in financial products (FX, derivatives, bonds, sukuk, equities, commodities, others)12 | Unchanged |
| Insurance and related professions | – | Providing insurance, reinsurance, and insurance-related professions, including Takaful and Re-Takaful insurance business and services13 | New |
| Monetary intermediating services | Providing monetary intermediating services | — | Removed |
| Virtual banking services | Providing virtual banking services | — | Removed |
| The activities listed above under the New CBUAE Law are collectively referred to as the "Licensed Financial Activities." |
The key additions reflect regulatory frameworks the CBUAE had already begun building. Payment services using virtual assets is now a standalone Licensed Financial Activity, aligning with the Payment Token Services Regulations.14 Instant money transfer services are expressly included under currency exchange and money transfer, aligning with Category 4 under the Exchange Business Regulations.15 Insurance, reinsurance, and insurance-related professions are consolidated into the same statute, replacing the separate 2023 Insurance Decree-Law. The arranging and marketing category now expressly captures "promoting," meaning that promotional activity in connection with Licensed Financial Activities is itself a regulated activity.
Importantly, the New CBUAE Law does not capture all virtual asset activity. Its scope is limited to virtual assets used in connection with payment functions. The law expressly excludes virtual assets held for investment purposes, token-to-token exchanges, and swap operations for trading purposes.16 These remain within the jurisdiction of Virtual Assets Regulatory Authority, the Capital Markets Authority, or the Abu Dhabi Global Market's Financial Services Regulatory Authority and Dubai International Financial Centre's Dubai Financial Services Authority within their respective free zones. The exclusion from the CBUAE's perimeter is not an exclusion from regulation.
ARTICLE (62) of the NEW CBUAE LAW
The Expansion and the Clarification
If Article (61) of the New CBUAE Law was codification, Article (62)17 is the genuine expansion. For the first time, the CBUAE's licensing perimeter extends beyond the entity performing a Licensed Financial Activity to any person who facilitates one, regardless of the medium, technology, or form used. This expressly covers DeFi structures, dApps, blockchain-based systems, and platforms or protocols that facilitate financial services.
This generated immediate market concern. Technology service providers and infrastructure developers began assessing whether their activities could fall within scope simply because their tools are used in connection with financial services.
Clarifications in the FAQs
The CBUAE has since published a clarification through its official FAQs on its website.18 These clarifications provide the following clarity:
- Article (62) does not create new categories of Licensed Financial Activity. It confirms that existing regulated activities remain regulated when delivered through new technologies.
- Technology providers are not automatically in scope. Supplying software, infrastructure, or technical solutions to a licensed financial institution does not, in that capacity alone, amount to facilitating a Licensed Financial Activity.
- Decentralisation is not a safe harbour. The regulatory question turns on whether the entity itself performs or facilitates a Licensed Financial Activity. Where a DeFi protocol, wallet service, or payment token arrangement performs a regulated function, it may fall within the CBUAE's perimeter regardless of its technological architecture.
PRACTICAL IMPLICATIONS AND LOOKING FORWARD
Entities subject to the New CBUAE Law must reconcile their positions within one (1) year from its entry into force. Existing regulations under the repealed laws remain in force until expressly replaced.
As next steps, affected entities should map their activities against Article (61), paying particular attention to payment services using virtual assets, open finance, and the new promotion category.
Further, those providing technology that supports financial services should assess whether their role crosses the line from supplying tools to a licensed entity into facilitating a Licensed Financial Activity directly. Entities clearly within scope should begin aligning governance, compliance, and AML/CFT frameworks now rather than waiting for implementing regulations.
Article (62), read alongside the clarification, positions the UAE as one of the first jurisdictions to move toward licensing decentralised protocols based on economic function rather than corporate form. If implementing regulations follow this logic, the UAE could offer one of the first regimes in which decentralised entities can be licensed rather than merely tolerated or pursued.
Footnotes
1 Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business.
2 Decretal Federal Law No. (14) of 2018, Regarding the Central Bank and Organization of Financial Institutions and Activities, and amendments.
3 Federal Decree-Law No. (48) of 2023, Regulating Insurance Activities.
4 Article 61(1)(a) of the New CBUAE Law.
5 Article 61(1)(b) of the New CBUAE Law.
6 Article 61(1)(c) of the New CBUAE Law.
7 Article 61(1)(d) of the New CBUAE Law.
8 Article 61(1)(e) of the New CBUAE Law
9 Article 61(1)(f) of the New CBUAE Law.
10 Article 61(1)(g) of the New CBUAE Law.
11 Article 61(1)(h) of the New CBUAE Law.
12 Article 61(1)(i) of the New CBUAE Law.
13 Article 61(1)(j) of the New CBUAE Law.
14 Circular No. 2/ 2024, Payment Token Services Regulations.
15 Circular No. 7/2025, Exchange Business Regulation.
16 Article 187(3) of the New CBUAE Law.
17 Article 62 of the New CBUAE Law.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
