Federal Decree-Law No. 6 of 2025 has been in the Official Gazette since 15 September 2025 and gave existing operators one year to come into line. That year ends in sixteen days. Many businesses that set up between 2023 and 2025 built their structure on a Dubai virtual assets licence or on their own free zone's rulebook, and have never checked whether the federal decree reaches them. Licence applications carry a stated decision period of sixty days: an application filed today produces no answer before the deadline.
What happened
Federal Decree-Law No. 6 of 2025, published in the Official Gazette on 15 September 2025, rewrote the UAE central bank law and widened the supervisory perimeter of the CBUAE, the Central Bank of the United Arab Emirates. Before the decree, businesses dealing in digital assets answered to a local authority — VARA, the Virtual Assets Regulatory Authority, for the Emirate of Dubai, or ADGM, Abu Dhabi Global Market, and DIFC, the Dubai International Financial Centre, for their own jurisdictions — while anyone who regarded itself as a pure technology provider answered to nobody. The federal decree overlays those competences and brings the subject under a single national supervisor. The regulator justified the move by reference to the integrity of the payment system and to the UAE's anti-money-laundering commitments, which are under mutual evaluation by the FATF, the Financial Action Task Force, the global standard-setter on financial crime. Businesses already operating at the date of publication were granted a transitional period of one year to come into line: that period closes on 16 September 2026. The central bank has the power to extend it and, as at today, has announced no extension.
What changes in practice
From 17 September 2026, anyone carrying on an activity that falls inside the perimeter must be in one of three positions: holding a licence issued by the central bank, operating through an entity that already holds one, or having ceased the activity. There is no fourth position, and there is no recognised position for an applicant awaiting an outcome: licence applications carry a stated decision period of sixty days, so an application filed today reaches the deadline without an answer. That shifts the decision that is actually available. In the next two weeks nobody obtains a licence; what can be established is whether one is required, and what defensible position the business is standing in.
Who it applies to
The decree lists the activities brought under central bank supervision, and there are more of them than the market expected. They fall into six families. First, virtual asset activity: trading, custody and transfer of crypto-assets on behalf of third parties. Second, stablecoins, including those used purely as a means of collecting payment. Third, tokenised real-world assets — property, receivables and shareholdings represented by a token. Fourth, decentralised finance protocols, known as DeFi, meaning financial services delivered by code rather than by an intermediary, together with decentralised exchanges. Fifth, wallets and bridges, meaning the software that holds keys and the infrastructure that moves value from one blockchain to another. Sixth, the blockchain infrastructure that provides technical support to anyone carrying on the activities above. It is that last item that catches operators unprepared: a business supplying only the technology to a third-party operator has always regarded itself as outside the financial perimeter, and the decree names it expressly.
The exposure
The statutory maximum for administrative penalties reaches AED 1 billion, approximately USD 272 million, and that figure does not describe what actually happens. What actually happens is loss of the operating licence and closure of banking relationships, and that arrives before any penalty does. UAE banks are already asking clients in the sector for evidence of their licensing status, and a suspended account stops a business within a week. The second risk is one of interpretation: the question almost everyone asks is «do I hold a licence», while the question that decides the outcome is «does the activity I actually carry on fall inside the perimeter of the decree». Those are two different questions, and answering only the first leaves the second uncovered.
What to do now
Take the trade licence of the UAE entity and read the activities listed on it, then write alongside them what the company actually does: collects payment in stablecoins on behalf of clients, holds private keys, operates a wallet, supplies code to a third-party protocol. If the two lists do not match, the problem is already present and does not begin on 17 September. If one of the real activities falls into any of the six families, establish in writing whether there is a licensed entity to operate through — that is the route that can be completed in sixteen days, whereas obtaining a licence is not. And record the date on which the review was carried out: in front of a bank, the difference between a business that moved before the deadline and one that moved after it is demonstrated with a dated document.
Sources
Published 31 August 2026 on the basis of public sources and official United Arab Emirates instruments. This is not legal or tax advice. Verify your position with a qualified professional before acting.