There is a date that every fintech, crypto and payments founder operating in the UAE should have circled, whether they realise it yet or not: 16 September 2026. On that day, a one-year grace period expires, and one of the most sweeping financial laws the country has passed in over a decade comes into full force. It dramatically expands what counts as a regulated financial activity and who the Central Bank can license, and it was written specifically so that the businesses most likely to think they fall outside the rules are the ones most likely to be caught by them. The clock is now down to a matter of weeks.
What the law actually is
The instrument is Federal Decree-Law No. 6 of 2025, known as the new Central Bank Law. It was issued on 8 September 2025, published in the Official Gazette on 15 September, and took legal effect on 16 September 2025, with affected entities granted a one-year transition period to become compliant by 16 September 2026. The Central Bank retains discretion to extend that period, but no business should plan around a reprieve that may never come.
This is not a minor amendment. The law repeals and replaces both the 2018 Central Bank Law and the 2023 Insurance Law, consolidating banking, payments and insurance regulation under a single statute. It represents the most significant overhaul of the UAE’s financial regulatory architecture in more than ten years. But the consolidation is not what should worry founders. Two specific articles are.
The two articles that change everything
The heart of the law, for anyone building at the edge of finance and technology, sits in Articles 61 and 62.
Article 61 expands the official list of Licensed Financial Activities. For the first time, it explicitly names open finance services, payment services using virtual assets, and even the promotion of licensed financial activities as regulated activities in their own right. Categories that previously lived in a grey zone are now unambiguously inside the perimeter.
Article 62 is the one that redraws the map. It extends the Central Bank’s licensing jurisdiction to any person who carries on, offers, issues or facilitates a licensed financial activity, and it does so with a phrase that founders need to read carefully: regardless of the medium, technology or form employed. In plain terms, the law reaches DeFi structures, decentralised applications, blockchain systems and the technological platforms that enable financial services. It brings virtual assets, DeFi protocols, stablecoins, tokenised real-world assets, decentralised exchanges, wallets, bridges and the supporting blockchain infrastructure under Central Bank authority. Any crypto or blockchain organisation conducting business in or from the UAE must be licensed, whatever technology it runs on.
Why “function over form” is the crucial idea
The principle underlying Article 62 has been described by legal advisers as function over form, and it is the single most important concept in the whole law. The regulator has deliberately made its jurisdiction technology-neutral. It does not care how you are structured, what legal wrapper you use, or which technology powers your product. It cares what you do. If your business facilitates a financial activity, you are in scope, full stop.
This matters because it closes the escape hatches that a generation of fintech and Web3 businesses have relied on. The argument that a protocol is merely software, or that a decentralised structure has no operator to regulate, or that a platform is just infrastructure rather than a financial service, no longer works in the UAE. The law was written precisely to defeat those arguments. Where the activity is financial, the regulator follows it, through whatever form it takes. For founders accustomed to operating in the ambiguity that has surrounded digital assets almost everywhere, this is a decisive removal of that ambiguity.
The stakes, in both directions
The penalties give the deadline its teeth. Operating an unlicensed financial activity can attract fines reported at up to 1 billion dirhams, roughly 272 million dollars. Beyond the headline number, the law strengthens governance and board-accountability requirements, introduces risk-based capital rules, expands early-intervention and resolution powers, and imposes tougher consumer-protection, fraud-notification and transparency obligations, including a duty to notify customers promptly of security breaches. It also channels consumer disputes through a consolidated redress unit covering both banks and insurers.
But the law is not purely a stick, and it would be a mistake to read it that way. It also offers a genuinely attractive framework for legitimate players. Licensing decisions are meant to be delivered within 60 days, which is fast by global standards. It provides real regulatory clarity where there was none. And it includes enhanced Shariah-governance provisions that create a clear runway for Islamic DeFi and for tokenised Sukuk, blockchain-based versions of traditional Islamic bonds, in a market where global Sukuk issuance already runs into the tens of billions and is projected to grow enormously. The signal is unmistakable: the UAE has chosen to regulate and host digital finance rather than to ban it, which is a far more welcoming posture than many major economies have taken. The price of that welcome is compliance.
Who needs to worry
The list of businesses that should be running a scope assessment right now is long, and longer than most of them assume. It includes fintechs and payment providers, virtual-asset service providers, DeFi projects, stablecoin issuers, tokenisation platforms, digital wallets, and open-finance and data-aggregation services. Crucially, it also includes technology providers and enablers who have always assumed they were simply infrastructure sitting outside the financial perimeter. Under Article 62, an enabler of a financial activity can be as much in scope as the activity itself.
There is a jurisdictional layer to navigate as well. This Central Bank framework sits alongside the virtual-asset regimes run by VARA in Dubai and the free-zone regulators in the DIFC and ADGM, so a founder must map carefully which regulator or regulators actually apply to their specific activities and client base. Being licensed in one place does not automatically resolve obligations in another. And all of this connects to the broader digital-money build-out the country is pursuing, from the Digital Dirham’s status as legal tender to the new national payment rails and the regulated stablecoin market. The Central Bank is assembling a complete, coherent regulatory perimeter around the future of money, and this law is the fence around it.
What to do now
For any business that might be in scope, the advisers are unanimous on the sequence. Start with a comprehensive gap analysis against the new consolidated framework, confirming your licensing status and regulatory classification. Map every activity you conduct that touches virtual assets, open finance or enabling technology, to determine whether it now falls inside the perimeter and requires authorisation. Strengthen governance, board oversight and senior-management accountability. Align your risk, capital and liquidity arrangements with the new standards. Upgrade your conduct, transparency, fraud and consumer-protection controls. And engage qualified legal counsel early, because interpreting scope under a function-over-form standard is genuinely difficult and getting it wrong is expensive.
The timing is the pressure point. With the deadline roughly six weeks out as of early August, and licensing itself taking time to secure, any in-scope business that has not started is already behind. The Central Bank’s discretion to extend is real, but building a compliance strategy around the hope of an extension is not a strategy at all.
The strategic reading
Step back, and this law is the UAE doing what it does across every strategic domain: building comprehensive, modern infrastructure, in this case regulatory rather than physical, to make itself the credible home for the next generation of the activity in question. The function-over-form approach is genuinely sophisticated. By making the rules technology-neutral, the regulator has future-proofed them against the endless inventiveness of financial structuring. You cannot dodge a rule that follows the function rather than the form, no matter what new wrapper you invent.
For serious, legitimate operators, this is better news than it first appears. Regulatory clarity, a fast licensing path, and a jurisdiction that has decided to embrace digital finance rather than prohibit it are exactly the conditions under which durable businesses get built. The UAE has opened its doors to this sector wider than almost anywhere on earth. But an open door is not an unguarded one, and the grace period for walking through it properly is almost over.
The 16 September deadline is not a soft target. It is the moment a much larger net closes. For the many founders building at the intersection of finance and technology in the UAE, the question is no longer whether the rules will reach them, because the law was deliberately written so they would. The question is whether they will be ready when they do. The invoice for admission to one of the world’s most welcoming digital-finance jurisdictions comes due in September, and it is settled in the currency of compliance.
Sources: Federal Decree-Law No. 6 of 2025 via the CBUAE Rulebook; Ashurst, UAE Enacts Landmark Central Bank Law, November 2025; Mondaq and the named advisory, Function Over Form: What the UAE’s New CBUAE Law Means for Fintech, DeFi and Technology Providers, March 2026; Paul Hastings, New UAE Banking Law Clarifies Digital Finance; GLA & Company, New CBUAE Law No. 6 of 2025; CoinDesk, New UAE Sweeping Banking Decree, November 2025; Neos Legal, CBUAE Law 2025: What L1s and DeFi Protocols Must Know.
