Counsel for the UAE's technology, fintech and startup founders.

The right holding vehicle depends on where you raise and who you sell to. Most venture-backed UAE startups incorporate a holding company in the DIFC or ADGM — both are common-law jurisdictions with English-language courts, 100% foreign ownership, no restriction on share classes, and structures international investors recognise and can paper with standard SAFE, convertible-note and shareholders'-agreement documents. A DIFC/ADGM holdco can own a mainland or free-zone operating company where a local trade licence is needed to invoice UAE customers or sponsor visas. Incorporating the holdco on the mainland, or splitting equity informally between founders, is the most common structural mistake — it forces a costly restructuring before the first institutional round. We advise on the holdco/opco split, share classes, founder vesting and the foundation route for estate planning, and prepare the incorporation documents.

If your product involves virtual assets and has a Dubai nexus, assume VARA (the Virtual Assets Regulatory Authority) applies until advised otherwise. VARA licenses seven activity categories — advisory, broker-dealer, custody, exchange, lending/borrowing, management/investment, and transfer/settlement — and marketing virtual assets to persons in Dubai is itself a regulated activity. ADGM (via the FSRA) and DIFC (DFSA) operate separate virtual-asset regimes, so the right regulator depends on where you sit and who you serve. Token issuance raises further questions: whether the token is a security, a utility or a payment token, and whether a whitepaper is required. Launching or marketing before a licensing view is the highest-risk path — enforcement and account freezes follow. We map your model to the correct regulator, advise on whether a licence or exemption applies, manage the application, and structure token launches to reduce securities-law exposure.

Federal Decree-Law No. 45 of 2021 (the PDPL) is the UAE's onshore data-protection law; the DIFC (DP Law 2020) and ADGM (Data Protection Regulations 2021) have their own GDPR-aligned regimes that apply if you sit in those centres. In practice a fintech or SaaS handling personal data must establish a lawful basis for processing, publish a compliant privacy notice, sign data-processing agreements with vendors (cloud, analytics, KYC providers), assess and document cross-border transfers (many SaaS stacks send data outside the UAE), honour data-subject rights, and notify breaches. Regulated fintechs face additional Central Bank and outsourcing requirements. The most common gap we see is a product built on international SaaS infrastructure with no transfer assessment and no processor agreements — a problem that surfaces during investor or bank due diligence. We deliver the notice, DPA suite, transfer assessment and records-of-processing framework proportionate to your stage.

Employee share option plans are standard for attracting engineering and commercial talent, but they must sit on the right corporate base. A DIFC or ADGM holding company is the practical home for an ESOP because it permits a dedicated option pool, multiple share classes and enforceable vesting — features mainland LLC structures handle poorly. A typical plan sets a pool (often 10–15% fully diluted), a scheme document and individual option agreements, a vesting schedule (commonly four years with a one-year cliff), and good/bad-leaver provisions that determine what happens on exit. UAE tax treatment is generally favourable, but employees in other jurisdictions may face home-country tax on grant, vest or exercise — a point that needs flagging. We design the pool and scheme, draft the plan and grant documents, align them with the shareholders' agreement and investor rights, and advise on the interaction with UAE employment law and end-of-service entitlements.

The Central Bank of the UAE (CBUAE) regulates stored value and payment activity under the Retail Payment Services and Card Schemes Regulation and the Stored Value Facilities framework. If your product holds customer funds, issues wallets or prepaid value, processes payments, or facilitates transfers, you likely need a Retail Payment Services (RPS) or an SVF licence — the category depends on the activity and volumes. Some activities can be conducted via a partnership with an already-licensed institution (a 'BaaS' or agency model) rather than a direct licence, which is often the faster route to market for an early-stage fintech. ADGM and DIFC also license fintech through the FSRA and DFSA, including regulatory sandboxes (RegLab / Innovation Testing Licence) that let you test with real customers under tailored conditions. We assess which regime applies, advise on the sandbox route, and manage the licence or partnership documentation.