The Uae's Commercial Gaming Regime: What the New Civil Transactions Law Means for Operators and Suppliers

The UAE’s commercial gaming regime marks one of the most consequential regulatory shifts the sector has seen in the Gulf. At its core sits a structural change to the country’s civil law and the emergence of a dedicated federal regulator with competence over commercial gaming. The essential takeaway for operators, suppliers and investors is nuanced but critical: the reform does not amount to a blanket legalisation of gambling. Instead, it clears legacy civil-code provisions and channels regulatory authority into a licensing-led model administered at the federal level.

This article is written for international operators, software and hardware suppliers, investors and the UAE counsel advising them, and it maps the legal effect of the change alongside a practical roadmap from structuring to launch.

What Changed: The Civil Transactions Law and the Effect of Recent Reform

To understand the UAE’s commercial gaming regime, it is necessary to start with the civil law that came before it. For decades, the UAE’s Civil Transactions Law contained a discrete set of provisions dealing with the civil consequences of gambling and wagering contracts. These provisions treated such contracts as unenforceable and set out the civil-law default for money paid or won through them. Their presence in the code reflected a policy position rooted in the country’s broader legal and cultural framework.

Quick Legal History

Under the previous regime, the Civil Transactions Law (Federal Law No. 5 of 1985, as amended) addressed gambling and betting from a civil-transactions perspective. Its provisions rendered gambling debts unenforceable and denied civil remedies to parties to such arrangements. This meant that, quite apart from any criminal dimension, a person could not sue in the civil courts to recover gambling winnings or enforce a wager. The civil code therefore operated as a comprehensive statement that the legal system would not lend its enforcement machinery to gambling contracts.

What “Not Carried Forward” Means in Practice

The reform that shapes the UAE’s commercial gaming regime did not simply amend those articles, the gambling-specific civil provisions were reconsidered as part of the modernisation of the country’s civil legislative framework. Removing or narrowing the default civil-law treatment of gambling contracts is structurally significant. It withdraws the automatic civil-code position that previously governed such arrangements and, in doing so, creates regulatory space for a licensed, supervised activity to be treated differently under a bespoke regime.

Three points must be understood clearly. First, any change to the civil-code provisions is not the same as legalisation. The absence of a civil default does not, on its own, authorise anyone to offer or operate gaming. Second, criminal law continues to operate; conduct that falls outside the licensed perimeter remains exposed to criminal prohibition. Third, the change is best read as a delegation of the regulatory perimeter to a dedicated authority rather than a liberalisation of gambling in general terms. In other words, the reform builds the legal foundation on which a licensing regime can stand, it does not itself hand out permission to trade.

The Regulator: The General Commercial Gaming Regulatory Authority (GCGRA)

The centrepiece of the UAE’s commercial gaming regime is the General Commercial Gaming Regulatory Authority, or GCGRA, established as the federal body charged with regulating and supervising commercial gaming across the country. The GCGRA is positioned as the competent authority for the licensing and oversight of commercial gaming activity throughout the emirates. For operators and suppliers accustomed to fragmented, emirate-by-emirate approaches, this federal consolidation is a defining feature of the new landscape.

Federal Versus Emirate Roles

The federal design has important practical consequences. Because the GCGRA holds competence at the national level, licensing routes for commercial gaming are directed through the federal authority rather than negotiated separately with each emirate’s local government. This matters for operators evaluating locations across Abu Dhabi, Dubai, Ras Al Khaimah and the other emirates: while local considerations, real estate, tourism strategy, and host-emirate arrangements, remain commercially relevant, the licensing and supervisory authority for the gaming activity itself is federal. Operators should therefore plan for a single regulatory relationship with the GCGRA while managing local commercial and land arrangements separately.

How to Engage with the GCGRA

Engagement with the GCGRA should be approached as a structured, staged process rather than a single filing. The authority is expected to operate a licensing pipeline in which applicants demonstrate corporate substance, probity, financial standing, anti-money-laundering readiness and technical compliance before a licence is granted. The practical effect is expected to be a multi-stage assessment with iterative information requests, and prudent applicants will treat early, well-documented engagement as central to managing timelines. Because the framework is new, applicants should anticipate that guidance, forms and detailed conditions will continue to develop, and they should verify current requirements directly with the regulator before committing to a timeline.

Licence Structure Under the UAE’s Commercial Gaming Regime

A workable licensing taxonomy is the practical heart of any gaming regime, and the UAE’s commercial gaming structure is expected to differentiate between those who run gaming, those who supply it, and the individuals who work within it. Understanding which category applies is the first analytical step for any business assessing UAE entry.

Operator Licence

The operator licence is the authorisation required by a business that offers gaming to the public. This category is expected to capture both in-person offerings, such as venue-based gaming, and, where permitted, online or remote offerings. Operator licensing sits at the top of the compliance pyramid: it carries the fullest set of obligations across governance, financial standing, responsible gaming, anti-money-laundering systems and technical integrity. An operator is ultimately accountable to the regulator for the conduct of its business and the integrity of the games it presents.

Supplier and Vendor Licence

The supplier or vendor licence is directed at businesses that provide the products and services that make gaming possible without themselves offering gaming to players. This category typically includes software platform providers, game studios, and hardware manufacturers supplying gaming equipment. A gaming supplier licence in the UAE is significant because regulators increasingly recognise that the integrity of a gaming market depends as much on the suppliers of critical systems as on the operators who deploy them. Suppliers should expect scrutiny of their products, their corporate ownership and their compliance controls, even though they do not hold player funds or offer games directly.

Occupational Licences

Occupational licences apply to individuals working within the sector. These are commonly split between supervisory or key-person roles, those who exercise significant control, management or influence, and non-supervisory operational roles. Key persons attract the most rigorous probity examination, reflecting their capacity to affect the integrity of a licensed business. The occupational tier ensures that vetting reaches the people who make decisions and handle sensitive functions, not merely the corporate entities that employ them.

What a Licence Application Looks Like: Corporate, Governance and Substance Requirements

For an international operator, the practical work of obtaining a UAE gaming licence begins well before any application form is submitted. The GCGRA is expected to assess not only what an applicant proposes to do, but whether the applicant has a genuine, substantive presence and the governance capacity to run a regulated business responsibly. This means corporate structuring is a foundational, not incidental, exercise.

Corporate Form and UAE Presence

Most operator applications are expected to require an onshore UAE entity or an approved legal presence that demonstrates sufficient substance. Substance in this context is more than a registered address. Regulators in mature gaming markets look for evidence that decision-making, management and key functions genuinely occur within the jurisdiction, that the licensed business is real and locally accountable rather than a nameplate. Applicants should expect the GCGRA to assess corporate form and business substance on a case-by-case basis, taking into account the scale and nature of the proposed activity.

Local Directors, Powers of Attorney and Incorporation

Where operators consider whether to appoint local directors, grant powers of attorney or fully incorporate a UAE company, the answer will depend on the substance the regulator expects for the specific licence. Arrangements that place genuine authority and oversight in the UAE will carry more weight than formalistic appointments. Offshore-structured groups should assume that the regulator will look through the corporate chart to identify who actually controls and manages the business, and should design their structure accordingly rather than retrofitting substance after an application is filed.

Financials, Business Plan and Physical Substance

A complete application will typically call for audited financial statements, evidence of financial standing sufficient to support the proposed operation, and a detailed business plan articulating the model, target market, revenue assumptions and risk controls. For in-person offerings, physical premises and their suitability form part of the assessment. Employee substance, the presence of appropriately qualified staff performing key functions locally, reinforces the case that the applicant is a real operating business. Together, these elements allow the regulator to test whether the applicant can deliver what it promises and absorb the compliance burden that a licence imposes.

Fit-and-Proper, Probity and Background Checks

Probity is the gatekeeping mechanism of any credible gaming regime, and the fit-and-proper assessment under the UAE gaming framework is expected to be searching. The purpose is to ensure that those who own, control and manage licensed businesses are honest, competent and financially sound, and that they have no history that would undermine confidence in the integrity of the sector.

Probity Evidence List

Owners, controllers, beneficial owners and key persons should expect to provide detailed personal and corporate information. Commonly requested evidence in comparable regimes includes:

• Curricula vitae and career histories for all key persons and controllers.
• Criminal record and police-clearance certificates from relevant jurisdictions.
• Corporate ownership and control charts identifying ultimate beneficial owners.
• Audited accounts and financial statements evidencing financial soundness.
• Regulatory history disclosing prior licences, refusals, sanctions or disciplinary action.
• Identity verification documents and, where required, biometric data such as fingerprints.

Timelines and Disqualification Risks

Probity checks take time, and international applicants should build realistic buffers into their planning to allow for the collection of certificates and clearances across multiple jurisdictions. The consequences of adverse findings are serious: undisclosed criminal history, sanctions exposure, or a poor regulatory record can lead to refusal or disqualification. Full and candid disclosure is invariably the safer course. Attempting to minimise or omit adverse information tends to compound risk, because regulators treat non-disclosure as an integrity failure in its own right.

AML/CFT and Responsible Gaming Obligations

Anti-money-laundering and counter-terrorist-financing controls are central to the credibility of the UAE’s commercial gaming regime, and operators should expect obligations aligned with the UAE’s federal AML/CFT framework and the international standards promulgated by the Financial Action Task Force. Gaming is recognised globally as a sector with money-laundering vulnerabilities, and the UAE’s regime is expected to reflect a risk-based approach consistent with that international consensus.

Operators should build AML compliance frameworks that address, at a minimum:

• Customer due diligence and KYC, verifying customer identity at onboarding and at appropriate thresholds thereafter.
• Transaction monitoring, systems to detect unusual or suspicious patterns of activity.
• Suspicious transaction reporting, mechanisms to file reports with the competent UAE authorities.
• PEP screening, identifying politically exposed persons and applying enhanced measures.
• Enterprise risk assessments, documenting and periodically updating the business’s money-laundering risk profile.
• Record-keeping, retaining customer and transaction records for the required periods.

Because gaming payments often move through banks and payment service providers, operators must also align with the AML expectations that apply to those financial intermediaries. Guidance issued under the UAE’s AML/CFT framework on KYC and transaction monitoring is relevant to how gaming payment flows should be handled, and cross-border transactions attract additional scrutiny under FATF standards addressing money-laundering typologies and enforcement.

Responsible Gaming Controls

Alongside AML, responsible gaming is a compliance pillar in its own right. Operators should expect to implement player-protection measures such as deposit and activity limits, self-exclusion mechanisms, age verification and tools to identify and support players at risk of harm. These controls are not merely reputational; in modern regimes they are conditions of the licence and a focus of supervision.

Reporting and On-Site Inspections

Licensed operators should anticipate ongoing reporting obligations and the prospect of on-site inspections. Regulators typically require periodic returns, prompt notification of material events, and cooperation with audits and inspections. Building compliance as an embedded operational function, rather than a document produced for the application, is essential to sustaining a licence over time.

Technical Standards and Platform Certification

Technical integrity underpins fair play and consumer trust, and gaming technical standards in the UAE are expected to require rigorous certification of platforms and games. Operators and suppliers should prepare for requirements addressing randomness, security, fairness and data governance.

Expected technical requirements, drawing on standards commonly referenced by regulators, include:

• RNG certification, independent verification that random number generators produce genuinely unpredictable outcomes.
• Game fairness testing, confirmation that game logic and return-to-player figures match published parameters.
• Platform security, controls against unauthorised access, including penetration testing and recognised security assurance.
• Data residency and protection, requirements governing where and how player and transaction data is stored.
• Change management, controlled processes for deploying updates so that certified systems remain compliant after changes.

Certification Partners and Testing Labs

Certification is typically carried out by accredited independent testing laboratories. Operators and suppliers should engage recognised testing partners early, because certification can be a rate-limiting step in the path to launch. Selecting a lab familiar with the standards the regulator will accept reduces the risk of rework.

Live-Game Roll-Out and Staging

A disciplined roll-out, moving from staging environments to live operation only after certification and sign-off, protects both the operator and the integrity of the market. Staging allows technical and compliance teams to validate systems under realistic conditions before players are exposed to them, and it supports the change-management discipline the regulator expects.

Practical Roadmap for Offshore-Licensed Operators: Sequencing and Timelines

Operators already licensed offshore frequently ask whether their existing authorisation offers a shortcut into the UAE. The honest answer is that offshore licensure helps demonstrate regulatory experience but does not guarantee fast-tracking. Under the UAE’s commercial gaming regime, an applicant must still satisfy UAE corporate, probity, AML and technical requirements in their own right. A logical sequence allows work to proceed efficiently and, where possible, in parallel:

1. Market assessment, evaluate the commercial case, the applicable licence category and the host-emirate considerations.
2. Corporate structuring, establish the UAE entity or approved presence with genuine substance from the outset.
3. Probity and documentation, begin collecting criminal-record certificates, ownership charts and financials early, given cross-jurisdiction lead times.
4. AML and responsible-gaming build, design and document policies, systems and controls aligned with UAE and FATF expectations.
5. Technical certification, engage accredited labs and complete RNG, fairness and security testing.
6. Application submission, file a complete, well-evidenced application with the GCGRA.
7. Inspection and go-live, accommodate regulator inspection and staged launch.

Several of these workstreams, probity collection, AML build and technical certification, can and should run in parallel to compress the overall timeline. Because the regime is new and detailed timelines will evolve, operators should validate current expectations with the regulator and build contingency into their launch plans.

Commercial and Contractual Considerations for Suppliers

Suppliers entering the UAE market must think beyond their own licence to the contracts that govern their relationships with operators. Supply agreements should address warranties as to certification and compliance, indemnities for regulatory breaches, data-protection obligations, intellectual-property ownership and licensing, and clear termination rights triggered by regulatory action. Regulator-notification clauses, obliging each party to inform the other of material regulatory developments, help both sides manage compliance risk.

Procurement and Due Diligence by Operators

From the operator’s perspective, procuring from a supplier carries regulatory consequences. Operators should conduct due diligence on suppliers’ licences, product certifications and corporate probity, because deficiencies in a supplier’s compliance can affect the operator’s own standing. Well-drafted contracts allocate these risks explicitly and provide remedies where a supplier’s non-compliance jeopardises the operator’s licence.

Risk Checklist and Enforcement Landscape

Operating in a newly regulated sector demands a clear-eyed view of risk. Key exposures include criminal liability for activity outside the licensed perimeter, restrictions on advertising and promotion, and the sensitivity of payment rails, where banks and payment service providers apply their own risk appetites to gaming flows. Enforcement penalties for non-compliance can be significant, and reputational consequences compound the financial ones.

Dispute Resolution

Disputes arising in the sector may be resolved through the UAE courts, and commercial parties frequently also consider arbitration, particularly for cross-border supply arrangements. Contracts should specify governing law and forum with care, recognising that regulatory questions may sit alongside commercial ones. Where criminal or civil disputes touch on gaming, parties should take specialist advice on how the courts approach such matters.

Conclusion: Practical Next Steps

The UAE’s commercial gaming regime represents a decisive move from a civil-code default of non-enforcement toward a federal, regulator-led licensing model administered by the GCGRA. The single most important point to carry forward is that reform of the legacy civil-code gambling provisions is not legalisation; it is the creation of legal space for a supervised, licensed activity, with criminal prohibitions continuing to govern conduct outside that perimeter. Operators and suppliers preparing for the UAE’s commercial gaming landscape should act now: assess the applicable licence category, build genuine UAE corporate substance, begin probity documentation early, design AML and responsible-gaming systems to UAE and FATF standards, and engage accredited technical testing partners.

Because detailed rules and forms will continue to develop, verify current requirements directly with the regulator and take UAE-qualified legal advice before committing to a timeline or structure. To discuss a licence-readiness plan tailored to your business, contact an expert through Global Law Experts.

Sources

1. UAE Government official portal (laws & decrees)
2. UAE Ministry of Justice
3. Central Bank of the UAE
4. Financial Action Task Force (FATF)
5. Abu Dhabi Judicial Department