A fintech or DeFi product in the MENA region is not regulated by one body or one rulebook. Kuwait treats crypto-assets as outside every licensing perimeter and says so in a circular of its Capital Markets Authority. Egypt bans crypto-asset activity without a license under Article 206 of the Central Bank and Banking System Law (Law 194 of 2020). The UAE has a federal central bank law, Decree-Law 6 of 2025, that now reaches decentralized technology, and Dubai has its own virtual asset regulator. Saudi Arabia regulates payments under a dedicated law and has no retail crypto license. Bahrain has a full crypto-asset module in the Central Bank of Bahrain Rulebook. Our standing advice is to trace the product first, then match each step to the regulator that owns it in each country, and to date every conclusion.
Trace the product before you name it
When we review a fintech or DeFi product, we do not start with the label the client uses. We follow the money and the user. Who sends value, who holds it, who can move it, who is promised a return, who sees the interface, and where the code and the team sit. A wallet, an exchange, a lending pool and a payment app can all be called fintech, and each lands in a different regulatory box.
The same trace shows which countries are touched. A platform built in one jurisdiction but marketed to users in another can fall under the second country's rules, and several of the laws below say so in terms. Kuwait, the UAE and Saudi Arabia each reach promotion and holding out, not only operation. We record the answer in a short map that lists each activity, each user market and each regulator, before any filing or launch decision.
Kuwait: the crypto-asset position
Kuwait has no licensing route for crypto-asset activity. The Capital Markets Authority issued Circular 10 of 2023, published on 18 July 2023, which set out five points. Crypto-assets are not recognized as a means of payment. They are not recognized as an investment product. No entity is licensed to deal in them. Securities regulated by the Central Bank of Kuwait and other securities and financial instruments regulated by the CMA are exempt from this prohibition. Mining is prohibited. The circular also requires firms to keep warning clients about the risks, and it points to penalties under Article 15 of Law 106 of 2013 on Anti-Money Laundering and Combating the Financing of Terrorism. The Ministry of Commerce and Industry issued a parallel circular dated 17 July 2023.
The Central Bank of Kuwait had already issued a public statement on crypto-assets and their risks on 22 May 2021. We read the 2021 statement and the 2023 circular together as one position: no regulated crypto business exists in Kuwait today. For a client, the consequence is practical. A Kuwait-facing product cannot rely on a license, so we advise that it not take Kuwait users, not use Kuwait entities and not promote to Kuwait residents, and we check any token or yield feature against the securities rules before we say more. Our article on blockchain legal consultancy in Kuwait covers the wider picture.
Kuwait: payments, the sandbox and open banking
Payments are different from crypto. The Central Bank of Kuwait issued Instructions for Regulating the Electronic Payment of Funds in May 2023 under Law 20 of 2014, and an e-payment circular in June 2025 tightened its oversight of payment providers. A business that accepts, holds or moves client funds in Kuwait needs to ask first whether it is a payment service provider under those instructions, and the answer decides whether it needs the Central Bank's approval.
The Central Bank also runs the Wolooj regulatory sandbox, which lets an applicant test a product with limited users under supervision before full licensing. On 4 June 2025 it issued a draft open banking regulatory framework for consultation. We treat a draft as a draft: it signals direction and does not give any right to access bank data. A product that needs account data from Kuwaiti banks should be designed with a fallback until the final framework is issued. Our articles on banking and finance in Kuwait cover the banking side.
Egypt: the Central Bank and Article 206
Article 206 of the Central Bank and Banking System Law (Law 194 of 2020) prohibits issuing, trading in, promoting or running platforms for crypto-assets and other cryptocurrencies without a license from the Central Bank of Egypt board. Article 225 sets fines from EGP 1 million to EGP 10 million for breaches of Articles 184, 205 and 206. The Central Bank issued public warnings in January 2018 and on 13 September 2022 saying that dealing in crypto-assets carries legal risk. We read Article 206 as a prohibition with a licensing door that is, in practice, closed unless the Central Bank opens it for a named applicant.
Payments are licensed separately. Article 209 requires a license for money transfer activity and Article 233 provides the penalty. The Central Bank's licensing rules for payment system operators and payment service providers date from June 2025, and the Central Bank and the Financial Regulatory Authority each run a sandbox. Service continuity is covered by Article 198 and consumer protection by Article 216. Our article on banking and finance in Egypt and our article on blockchain legal consultancy in Egypt cover these points in more detail.
Egypt: the Financial Regulatory Authority
Fintech in non-banking financial activities sits with the Financial Regulatory Authority under Law 5 of 2022. The Authority issued Board Decisions 139, 140 and 141 of 2023 to implement it, and Decision 58 of 2022 deals with related licensing. It keeps an outsourcing register that a regulated firm must use when it hands functions to a technology provider. A lending, insurance-technology or investment platform in Egypt needs a license from this Authority, not from the Central Bank.
The Authority is also quick to change course. By Board Decision 43 of 2026, published in the Egyptian Gazette (Al-Waqa'i Al-Misriyya), issue 45 (supplement A), on 24 February 2026, it stopped accepting applications for establishment and for a license to practice consumer finance under the Fintech Law (Law 5 of 2022) for one renewable year from 25 February 2026, except applications filed before the decision took effect. A business plan that depends on consumer lending in Egypt must therefore be checked against the live status of that suspension before any commitment. Personal data handling falls under Personal Data Protection Law 151 of 2020, and anti-money-laundering duties under Law 80 of 2002. We cross-refer our data protection analysis for the MENA region.
The UAE: federal law and the central bank
Federal Decree-Law 6 of 2025 on the regulation of the Central Bank, financial institutions and activities, in force from 16 September 2025, is now the base text. Article 60 prohibits carrying on licensed financial activity without a license and extends the prohibition to promotion. Article 61 lists the licensed financial activities. Article 62 deals with licensed activities carried out through emerging technologies, and the Central Bank's rulebook reads it as reaching decentralized finance and decentralized applications. Article 184 gave existing firms one year to reconcile their position, with power for the board to extend it.
A secondary source we reviewed numbered Article 61 as the marketing prohibition. The Central Bank's own rulebook is the authority here, and we cite its numbering. We have not verified whether the board extended the Article 184 period, so any client that relied on the transition must confirm its status with the Central Bank in writing. Payment tokens are covered by the Payment Token Services Regulation, which took effect on 31 August 2024, and Cabinet Decision 111 of 2022 sets the Securities and Commodities Authority framework for virtual assets and their service providers.
Dubai: VARA and the virtual asset regime
Dubai Law 4 of 2022 created the Virtual Assets Regulatory Authority. Article 15 requires a permit for virtual asset activity, Article 17 deals with the permit conditions and Article 18 gives the Authority its powers. The Authority is the sole regulator for virtual asset activity in Dubai, including its free zones but excluding the Dubai International Financial Centre, which has its own rules. A firm that offers services to users in Dubai without a permit risks enforcement even if its servers sit abroad.
The VARA rulebooks are organized in two layers. Four mandatory rulebooks apply to every licensed firm: Company, Compliance and Risk, Technology and Information, and Market Conduct. Activity rulebooks then add rules for each licensed activity, such as exchange or custody. Schedule 3 sets the fines. We review which activity rulebook applies to each feature of a product, because a single platform often holds more than one activity and must meet each rulebook separately.
Saudi Arabia: payments law and the capital market
Saudi payments are regulated by the Law of Payments and Payment Services, Royal Decree M/26 dated 22/03/1443H, whose Article 4 requires a license from the Saudi Central Bank. The implementing regulations were issued on 13 June 2023, and the Central Bank runs a regulatory sandbox. Open banking is licensed by the Central Bank under its own framework. A payment app, a wallet or a buy-now-pay-later product serving Saudi users starts from that law.
Saudi Arabia has no licensing regime for retail crypto-asset providers. Fiat on-ramps and off-ramps fall under the payments law, and a tokenized instrument that is a security falls under the Capital Market Law, Royal Decree M/30 of 2003, supervised by the Capital Market Authority, which also runs an experimental permit framework. The Authority has warned that virtual currencies are not regulated, and firms that hold themselves out to Saudi users can be reached even when they sit abroad. We therefore treat Saudi Arabia as a market to enter only through a licensed rail.
Bahrain: a crypto-asset module with license categories
Bahrain is the clearest of the markets. The Central Bank of Bahrain Rulebook, Volume 6, contains the Crypto-Asset Module. Module CRA-1.1.1 requires a license, CRA-1.1.2 covers holding out, CRA-1.1.6 lists the regulated services, and CRA-1.1.8 sets four license categories. The Module was added in April 2019, amended in April 2023, and gained a stablecoin reporting rule at CRA-4.1.10 in July 2025. Its legal basis is Article 44(c) of the Central Bank of Bahrain Law, Decree-Law 64 of 2006.
Stablecoin issuers are covered by the Stablecoin Issuance and Offering Module of July 2025, which rests on Article 37. Payment service providers are governed by the Payment Service Providers Module in Volume 5; a revised version was published for consultation in February 2026 (comments due 5 March 2026), so the version in force must be checked. Open banking is governed by its own module, building on the framework the Central Bank launched on 28 October 2020. A firm choosing Bahrain still has to pick its license category with care, because the category sets capital, governance and permitted activity.
DeFi, smart contracts and cross-border promotion
DeFi tests every one of these regimes because there may be no operator to license. We ask who controls the contracts, who collects fees, who can upgrade the code, who designs the front end and who targets the user. If a person or group has real control, regulators in Dubai, the UAE federal system, Bahrain and Saudi Arabia are likely to treat it as the operator. Article 62 of Decree-Law 6 of 2025 is explicit that licensed activity does not escape licensing by being carried out through a decentralized application.
Promotion creates its own exposure. Article 60 of the UAE federal law covers promotion, the Kuwait circular warns against marketing, and the Saudi position reaches holding out. A website that is open to residents of one of these countries and invites them to trade or earn yield can be treated as targeting that country. Geo-blocking is a control that works only if it is real and documented, and we ask for the logs.
Versioning and the triggers that change the answer
This field moves quickly, so we date every conclusion and name what would change it. In the current set, the triggers are the final Kuwait open banking framework, any change to the Egyptian suspension of consumer finance applications, whether the UAE central bank extended the Article 184 period, new VARA rulebook versions, Saudi implementing rules for open banking and tokenization, and further Central Bank of Bahrain module amendments.
We keep a dated country file for each client, with the product map, the license position, the documents we relied on and a review date. A file that has not been refreshed since the last trigger is a draft and not advice. Our MENA technology, media and telecoms analysis and our data protection analysis for the region sit alongside it.
What we review in a MENA fintech or DeFi engagement
When we review a fintech or DeFi product, we map each activity and each user market, identify the regulator for each step, test the structure against the crypto-asset rules in Kuwait, Egypt, the UAE, Saudi Arabia and Bahrain, review the payment, custody and token flows, check marketing and geo-blocking, review terms for users and for any smart contract role, assess data protection and anti-money-laundering duties, and prepare a dated country file. We then send a scoped plan that names the licenses, the order of filings and the points that depend on a regulator's answer.
See also: our Kuwait blockchain and virtual assets guide and our Kuwait banking and finance guide, plus our commercial and corporate practice.
Frequently asked questions
Can a crypto exchange be licensed in Kuwait?
No. Circular 10 of 2023 of the Capital Markets Authority states that crypto-assets are not recognized for payment or investment, that no entity is licensed to deal in them and that mining is prohibited, with penalties under Article 15 of Law 106 of 2013. We advise against any Kuwait-facing exchange offer.
Is crypto legal in Egypt?
Not without a license. Article 206 of the Central Bank and Banking System Law (Law 194 of 2020) bans issuing, trading in, promoting or operating platforms for crypto-assets without a Central Bank of Egypt board license, and Article 225 sets fines from EGP 1 million to EGP 10 million for breaching Article 206.
Which law now governs fintech in the UAE federal system?
Federal Decree-Law 6 of 2025, in force from 16 September 2025. Article 60 prohibits unlicensed financial activity including promotion, Article 61 lists licensed activities and Article 62 covers activity carried out through emerging technologies such as decentralized finance.
Who regulates virtual assets in Dubai?
The Virtual Assets Regulatory Authority under Dubai Law 4 of 2022, with Article 15 requiring a permit. It is the sole regulator for Dubai and its free zones, excluding the Dubai International Financial Centre.
Does Saudi Arabia license crypto exchanges?
Not as retail crypto businesses. Payments need a Saudi Central Bank license under Article 4 of the Law of Payments and Payment Services, fiat on-ramps fall under that law, and tokenized securities fall under the Capital Market Law, Royal Decree M/30 of 2003.
Does Bahrain license crypto-asset services?
Yes. Module CRA of the Central Bank of Bahrain Rulebook, Volume 6, requires a license under CRA-1.1.1 and sets four categories under CRA-1.1.8. Stablecoin issuers follow the separate Stablecoin Issuance and Offering Module of July 2025.
Is a DeFi protocol outside the law because it has no company?
No. Article 62 of UAE Decree-Law 6 of 2025 applies to licensed activity carried out through decentralized applications, and Dubai Law 4 of 2022 and Bahrain's Module CRA reach whoever controls the service. We look for the person with real control and the user-facing front end.
How can we help with a MENA fintech or DeFi project?
Our offices in Kuwait and Cairo review the product map, the license position and the marketing plan country by country before any launch or filing. Send us a description of the product, the user markets and the token or payment flow through the contact page, and we will reply with a scoped review plan and a filing order.