UAE puts Bitcoin wallets at risk of crime in global tech crackdown

• UAE’s Federal Decree Law No. 6 of 2025 came into force on 16 September.
• Article 62 puts APIs, explorers and decentralized platforms under central bank control.
• Section 61 regulates all marketing, email, and online postings regarding cryptographic services.

In a major shift from its crypto-friendly image, the United Arab Emirates has enacted sweeping new legislation that classifies basic crypto infrastructure, including Bitcoin wallets, as potentially criminal unless approved by the central bank.

Legal experts at Gibson Dunn warned that the law was unusually broad in scope and that its language posed significant risks to global technology providers.

This transition is incorporated into Federal Decree Law No. 6 of 2025 and will come into effect on September 16th, with global implications for developers and platforms that provide cryptographic access.

This law replaces the Banking Act of 2018 and significantly expands the definition of financial activities. This law is unique not only in its scope but also in its means of enforcement.

Penalties for violations range from fines of AED 50,000 to AED 500,000,000 (up to $136 million) and may include imprisonment.

Importantly, this applies not only to companies operating within the UAE, but also to those that can access their products from within the country.

Licenses now apply to wallets, APIs, and even analytics

The most important element of the new law is found in Article 62. The law grants central banks control over any technology that “involves, provides for, issues or facilitates” financial activities.

The term is broad enough to include self-custodial wallets, API services, blockchain explorers, analytics platforms, and even decentralized protocols.

This marks a fundamental change in the way crypto infrastructure is regulated in the UAE.

Previously, licensing obligations were focused on traditional financial institutions, but the updated framework shifts this focus to software and data tools.

Even consumer-facing tools like CoinMarketCap and open-source Bitcoin wallets may require licenses to remain accessible within the UAE, according to developer analysis.

For the first time, developers could face criminal penalties for providing unauthorized cryptographic tools, even if they are based overseas.

This expanded jurisdiction signals a new regulatory stance that treats access to cryptocurrencies as strictly as its ownership and exchange.

Communication and marketing will be subject to regulation

The crackdown is not limited to financial infrastructure. Section 61 of the Act defines the marketing, promotion or advertising of financial services as a licensed activity.

In practice, this means that simply hosting a website, publishing an article, or sharing a tweet about unauthorized crypto services can be considered a violation of the law if that content reaches a UAE resident.

This change dramatically expands compliance coverage for businesses and developers.

Gibson-Dunn emphasized that these provisions significantly expand the scope of enforcement, especially for companies that do not have a formal presence in the UAE.

This law applies to communications that originate outside the country and are accessible within the country.

The result is a regulatory environment in which developers, content creators, and infrastructure providers must consider whether their platforms can be indirectly accessed by users in the UAE.

In many cases, it is necessary to disable access or completely stop the service to avoid legal exposure.

Dubai free zone no longer protects crypto services

In recent years, the UAE has positioned itself as a hub for blockchain innovation.

Jurisdictions such as Dubai’s Virtual Assets Regulatory Authority (VARA) and Abu Dhabi Global Market (ADGM) have gained global attention with their dedicated crypto licensing frameworks.

However, a new federal law invalidates these free zone agreements and asserts central bank control nationwide.

The federal law supersedes any rules introduced by the UAE’s free zones, effectively eliminating the regulatory arbitrage that once attracted companies to Dubai.

The broader context includes the country’s history of digital restrictions.

For example, WhatsApp voice calls remain blocked across the UAE, reinforcing a consistent policy approach to centralize communications and digital tools.

While this may bring the UAE more closely aligned with international pressure from groups like the Financial Action Task Force, it also puts crypto service providers in a difficult position.

In other jurisdictions facing similar pressures, companies have retreated altogether to avoid the risk of law enforcement.

Enforcement begins in 2026 with further rules expected

Businesses have one year from September 16, 2025 to become compliant. This grace period may be extended at the discretion of the Central Bank.

During this time, further regulations are expected to clarify how these broad rules will be applied in practice.

Nevertheless, the scope of the law is already raising concerns.

The language on facilitation and communication, together with the harsh penalties under Article 170, suggests that companies providing cryptographic tools globally will need to consider the risk of accidental exposure to UAE users.

For software developers and platform operators, this represents a major departure from the norm of decentralized access and open source innovation.