The United Arab Emirates (UAE) has introduced one of its most sweeping regulatory overhauls in years, and crypto developers say it amounts to a de facto ban on self-custody.

This new shift raises urgent concerns for Dubai’s standing as one of the world’s top crypto hubs.

UAE Rewrites the Rules for Crypto Access

A newly enacted Central Bank law, effective September 16, dramatically expands licensing requirements. Specifically, it renders it a potential criminal offense to offer even basic cryptocurrency tools, such as Bitcoin wallets or blockchain explorers, to UAE residents without authorization.

The Federal-Decree Law No. 6 of 2025, published in the UAE’s Official Gazette, replaces the 2018 banking law and introduces a far more aggressive regulatory perimeter.

While previous rules required licensing for entities offering regulated financial activities, they did not impose criminal penalties for non-compliance.

According to legal analysis from Gibson Dunn, Article 170 now criminalizes all unlicensed financial activity. Penalties range from imprisonment to fines between AED 50,000 and AED 500 million (up to $136 million).

What stands out is that these penalties apply to companies offering financial products, and also to anyone facilitating them through technology.

Self-Custody Tools Now Fall Under the Licensing Net

This is where the crypto industry sees the biggest shock.

Developer Mikko Ohtamaa warned that the law “makes it a crime” to offer self-custodial Bitcoin wallets, blockchain explorers, or even market-data tools like CoinMarketCap without a license from the Central Bank.

“Only Bitcoin you are allowed to own is one permitted by the Central Bank of the UAE,” he wrote, highlighting how broad the language is.

The relevant provision, Article 62, expands the Central Bank’s authority to cover any technology that “engages in, offers, issues, or facilitates” a financial activity, directly or indirectly.

That includes infrastructure providers, API services, wallet developers, analytics platforms, and decentralized protocols.

In practice, this means that even companies outside the UAE, if their product is accessible to UAE residents, may be considered in violation.

A New Crackdown on Communications and Marketing

Another major shift arises from Article 61, which defines advertising, marketing, or promoting a licensable financial activity as a regulated activity.

That means simply sending an email newsletter, hosting a website, or even publishing a tweet about an unlicensed financial product accessible in the UAE could be treated as a legal breach.

Gibson Dunn notes that this provision “materially broadens” the UAE’s regulatory perimeter, capturing communications originating from abroad. For global crypto companies, this represents a significant compliance risk.

What It Means for Dubai’s Crypto Ambitions

The UAE has spent the past several years branding itself as a global destination for blockchain innovation. It established friendly licensing frameworks through financial free zones, such as VARA in Dubai and ADGM in Abu Dhabi.

However, because federal law supersedes free-zone rules, the new Central Bank law applies everywhere, even within Dubai’s crypto-friendly jurisdictions.

Nonetheless, the latest turn is consistent with the UAE’s broader history of tight digital restrictions, noting that even WhatsApp calls remain blocked nationwide.

The concern now is whether developers, exchanges, and wallet providers will withdraw services from UAE users to avoid compliance risk. Notably, this pattern is observed in jurisdictions under pressure from the FATF to restrict self-custody.

Entities have one year from the law’s effective date to meet licensing requirements, though this period may be extended at the Central Bank’s discretion.

Over the coming months, the UAE will release additional regulations that define how these rules are applied in practice.