Implements the 2021 electronic transactions law: licensing conditions and obligations for trust service providers, technical and security standards for electronic signatures, seals, time stamps and electronic delivery, the national trust list, and the procedures for recognising foreign certificates and for suspending or revoking licences.
Cabinet Resolution No. 28 of 2023 is the executive regulation of Federal Decree-Law No. 46 of 2021 on electronic transactions. Issued on 31 March 2023, it entered into force 90 days after Official Gazette publication (Article 37), on 13 July 2023, and remains in force. It is addressed mainly to trust service providers, the businesses that issue electronic signature certificates, seals, time stamps and electronic delivery, and it is administered by the Telecommunications and Digital Government Regulatory Authority (TDRA).
Licensing takes up Articles 2 to 14. An applicant files business details, an action plan, a termination plan, a compliance report, a bank guarantee and fees, and an accredited auditor must confirm financial resources of AED 5,000,000 (Article 2). The TDRA reviews within one month, extendable (Article 3); an approved licence runs for two years (Article 6), with renewal applied for at least three months before expiry (Article 7); failing to renew by 30 days before expiry is a breach (Article 8). Rejected applicants may re-apply or lodge a grievance within 14 days (Article 11). Article 12 governs suspension and revocation, activation of the termination plan and removal from the trust list; Article 13 requires changes to be notified within one week, some with prior approval.
Article 15 lists every licensee's obligations: accurate information, fair dealing, liability, risk management, data protection, incident notification, disclosure of terms, a termination plan, complaints handling, policies published in Arabic and English, and record retention of 15 years (10 years for identification proofs). Article 16 adds professional conduct, qualified staff, adequate resources and secure systems for qualified providers. Articles 17 and 18 govern discontinuing services (TDRA approval, three months' notice to the TDRA, two months' public notice, help with transfers).
Articles 19 to 32 set the technical regime: reliable signatures and seals to TDRA specifications (Article 19), the conditions for a qualified electronic signature or seal (Article 20), the content of a qualified certificate (Article 21), revocation recorded and published within 24 hours with validity data kept free for 15 years (Article 25), signature creation devices (Article 26), remote signing (Article 27), qualified retention for at least 15 years (Article 28), validation (Article 30), qualified time stamps (Article 31) and qualified electronic delivery whose records evidence integrity, sender, recipient and date (Article 32). Article 33 restricts compliance assessment to TDRA-approved assessors. Article 34 creates the UAE Trust List showing each provider and service's status, and Article 35 the Qualified Trust Mark.
Penalties are not in this resolution; they are in Cabinet Resolution No. 52 of 2024. Status: in force; no amendment recorded.
Trust service providers and qualified trust service providers licensed by the TDRA (issuers of electronic signature and seal certificates, time stamps, validation, retention and electronic delivery services), compliance assessment bodies, government authorities archiving signed documents, and any business or individual relying on an electronic signature in the UAE outside the financial free zones.
| Article 2 | Licence application: business details, action plan, termination plan, compliance report, bank guarantee and fees, plus an accredited auditor's confirmation of financial resources of AED 5,000,000. |
| Article 6 | A licence is valid for two years from issuance; renewal is applied for at least three months before expiry (Article 7) and failing to renew by 30 days before expiry is a breach subject to sanction (Article 8). |
| Article 12 | Suspension and revocation of a licence or withdrawal of qualified status: treatment of new and existing subscribers, activation of the termination plan and updating of the trust list, without prejudice to sanctions. |
| Article 15 | Licensee obligations: accurate information, fairness, liability, risk management, data protection, incident notification, disclosed terms, termination planning, complaints handling, bilingual published policies and record retention of 15 years (10 years for identification proofs). |
| Article 17 | Discontinuing a service needs prior TDRA approval, three months' notice to the TDRA and two months' public notice; the provider must help subscribers move and preserve verifiability of past signatures. |
| Article 20 | Conditions a qualified electronic signature or seal must satisfy at the time of signing, including data integrity, use of an approved creation device and any further TDRA rules. |
| Article 21 | Content of a qualified certificate: provider and signer identity, validity period, unique identifier, verification links and related fields. |
| Article 25 | Certificate revocations must be recorded and published within 24 hours of the request; validity status information must stay free and accessible for 15 years after expiry. |
| Article 32 | Qualified electronic delivery identifies sender and recipient at high assurance; the delivery record is evidence of integrity, sender, recipient and date and time. |
| Article 34 | The TDRA creates and publishes the UAE Trust List, showing each provider's and service's status and linking each service to a digital identifier. |
| Article 37 | Published in the Official Gazette and in force 90 days after publication. |
None in this resolution; Articles 8 and 12 refer to administrative sanctions and to penalties under the decree-law. The schedule is Cabinet Resolution No. 52 of 2024: fines from AED 10,000 to AED 50,000 per violation, AED 300 or AED 500 per day for late renewal or expired operation, doubled for repetition within a year, with suspension or cancellation of the licence.
We use this regulation to answer one recurring question: which electronic signature will a UAE registrar, bank or court accept. Articles 20, 21 and 34 give the test. A signature backed by a qualified certificate from a provider on the UAE Trust List meets the qualified standard; a foreign e-signature platform that is not on the list produces a signature whose legal effect depends on the decree-law's general rules and on the counterparty's willingness to accept it. We therefore advise clients to execute resolutions, share transfer instruments and powers of attorney either in wet ink with notarisation or through a listed qualified provider, and we check the Trust List before relying on a platform for documents that will be filed. For clients who want to offer signature, identity or certificate services themselves, the AED 5,000,000 financial resources, two-year licence and 15-year retention duties set the scale of the undertaking before we form the entity.
Electronic Transactions and Trust Services Law
Replaces the 2006 e-commerce law: electronic documents, signatures and seals cannot be denied legal effect merely because they are electronic; trust service providers mus…
Electronic Transactions Penalties
Lists the violations and administrative fines for trust service providers and other persons breaching the electronic transactions law and its executive regulations, such …
Personal Data Protection Law (PDPL)
The UAE's first federal personal data protection law. It sets lawful-basis, consent, purpose limitation, security, breach notification and data subject rights requirement…
Cybercrime Law
The UAE cybercrime law, replacing the 2012 law. It criminalises unauthorised access to systems and data, electronic fraud and forgery, online defamation, spreading rumour…
KYC Digital Platform Law
Establishes a national Know Your Client digital platform, run by a company whose board is chaired by an assistant Central Bank governor and regulated by the Central Bank,…
Whether you are establishing a new venture, restructuring an existing enterprise, or exploring residency pathways — we are here to advise.
Arrange a Consultation →