What the September 2026 UAE Licensing Deadline Changes for DeFi, DEXs and P2P

Key takeaways

• Federal Decree-Law No. 6 of 2025 was issued on 8 September 2025 and gave affected entities until 16 September 2026 to be compliant.
• Its most consequential change is the width of the perimeter: it reaches platforms, applications and protocols that enable financial services, even where they never deal with a client directly.
• It also names categories that did not previously sit plainly in the law, including virtual asset payment services and open finance services.
• This is a different instrument from the Central Bank's Payment Token Services Regulation, whose own transition ended on 31 August 2025. Summaries that merge the two dates are wrong.
• The deadline binds firms, not individuals. Nothing in it makes holding crypto or trading peer-to-peer an offence for a user.

What the law is, and what it is not

Federal Decree-Law No. 6 of 2025 is a consolidation of the UAE's financial regulatory framework rather than a crypto statute. It restates what a licensed financial activity is, who supervises it, and who needs permission to provide it — and in doing so it pulls a set of digital-finance activities into the main frame.

It is not a ban on anything. It is a licensing law. The question it asks of any given business is whether what that business does now falls inside a regulated activity, and if so, whether it holds the authorisation to keep doing it.

The date that matters, and the one people confuse it with

Two transitions ran close together, which is why the reporting is muddled.

The Payment Token Services Regulation commenced on 31 August 2024 with a one-calendar-year transition built into it. That period expired on 31 August 2025.

Federal Decree-Law No. 6 of 2025 is separate. Issued on 8 September 2025, it carried its own one-year grace period, which placed the compliance date at 16 September 2026. The Central Bank retains discretion to extend it.

If you see the payment-token rules described as having a September 2026 deadline, two different instruments have been collapsed into one.

The change that matters most

Licensing regimes usually catch the firm that faces the customer. The interesting move in this law is that the perimeter is drawn around function rather than around customer contact.

The framework extends to platforms, applications and protocols that enable financial services — including where they have no direct relationship with the end client. That is a substantial broadening. A piece of infrastructure sitting behind someone else's product is no longer obviously outside the regime simply because it never onboards a user.

For anything structured as neutral infrastructure, that is the provision to read carefully.

What it means for DeFi and decentralised exchanges

The honest answer is that it depends entirely on the arrangement, and that anyone offering you a blanket answer is guessing.

What has changed is the starting position. The argument that a protocol is merely published code, with no provider to license, is much harder to run against a definition written around platforms, applications and protocols that enable a financial activity. Where a protocol is maintained, governed, monetised or steered by identifiable people, a regulator now has a clearer basis for asking who is providing the service.

What has not changed is that the law works case by case. Two protocols with similar front ends can sit differently depending on who controls upgrades, who takes fees, where the operators are, and whether the activity is directed at people in the UAE. That last point matters: the Central Bank's framework applies to activity carried out in the UAE or directed at persons in the UAE, which is not a question of where a server is.

What it means for peer-to-peer trading

For a person buying and selling crypto with another person, nothing about the legality of that act has shifted. The deadline is an obligation on entities providing regulated services.

What can shift is the set of venues available to you, and the checks they run. When a licensing perimeter widens, the predictable consequences for users are these:

• Fewer, more formal venues. Platforms either come inside the regime or stop serving the market. Both outcomes reduce choice.
• More identity and source-of-funds questions. Authorised firms carry obligations that unlicensed ones did not, and those obligations land on the customer as paperwork.
• Clearer recourse where it applies. A supervised firm has a regulator to complain to. An unsupervised one has nothing of the kind.

The practical hazards of a P2P trade are unchanged: the fiat leg runs on rails nobody in the trade controls, and a counterparty you cannot assess is still the main risk you are taking.

What has not changed

A few things are worth stating plainly, because they get lost in coverage of a deadline.

• Holding, buying, selling or transferring crypto as an individual is not what this law licenses.
• The UAE's regulatory map remains layered. Dubai's Virtual Assets Regulatory Authority supervises virtual asset activity in the emirate alongside the Central Bank's mandate over payment tokens and financial institutions, and the financial free zones have their own regimes. Which one applies depends on the entity and where it operates.
• A deadline passing is not the same as enforcement action. Grace periods can be extended, and supervisory attention arrives unevenly.

The realistic expectation

Read this law as a change in the burden of argument rather than a switch being thrown. Before, a platform outside the customer relationship could plausibly say the regime was not aimed at it. Now the definition reaches further, and the case has to be made rather than assumed.

If you are a user, the visible effects will be gradual and mostly administrative: which platforms accept you, what they ask for, and how much friction sits between you and a trade. If you are running anything that touches financial activity directed at people in the UAE, the relevant question is not whether the deadline applied to you in general terms but whether your specific arrangement now falls inside a licensed activity — and that is a question for counsel, on your own facts.

This article is general information about a regulatory framework and is current as at the date shown above. It is not legal advice, it is not a compliance assessment, and it does not describe the licensing status of any particular business. Nothing on this website constitutes a financial product offer or solicitation.