Untangling A Web Of ‘Middle East Issues’: Key Considerations For Web3 M&A In The UAE

What Is Web3?

Web3 is the third generation of the internet. Whilst Web2 entails centralised control of key aspects of the internet (including internet searches and social networking), Web3’s technologies are all about decentralisation.

Trends And Developments In The UAE

The UAE’s technology and Web3 space has seen significant growth in recent years. Reports suggest there were upwards of 1,000 industry participants operating in the Web3 space in the UAE at the start of 2023. Such growth in the UAE’s Web3 sector is expected to continue and provide further support to the UAE Government’s ambition to develop its digital economy, which it anticipates will contribute to approximately 20 per cent of the country’s GDP over the next decade.

The rise of the UAE’s prominence as one of the key players on the world’s technology stage has been supported by significant investment from both local investors (including its sovereign wealth funds) and the UAE Government, which has been instrumental in cultivating a risk-sensitive and business-friendly regulatory landscape, as well as exhibiting strong commitment to support the development of start-ups in this area. For instance, the Government of Abu Dhabi has contributed USD 2 billion to Hub 71+ Digital Assets, an accelerator initiative established to specifically support the growth and development of Web3 and blockchain technology start-ups.

Key Considerations For Web3 M&A Transactions

But what Web3-specific points should an investor think about before engaging in M&A in the Web3 space in the UAE or GCC more widely?

Financial Services Regulation

When buying a Web3 business in any jurisdiction, it is important to understand whether a regulated activity is being undertaken from a financial services regulatory perspective.

In the context of UAE financial services regulation, there are two categories of jurisdiction. First, there is ‘onshore UAE.’ This comprises the geographic territory of the UAE’s seven emirates and includes over 40 economic free zones, but excludes the UAE’s two financial free zones. The regulation of financial services in onshore UAE falls to the Central Bank of the UAE (CBUAE) and the Securities and Commodities Authority (SCA). Since February 2022, a further regulator authority, the Virtual Asset Regulatory Authority (VARA), has governed virtual asset activities in the emirate of Dubai (but excluding the Dubai International Financial Centre (DIFC)).

The second of these categories constitutes ‘offshore UAE’. This comprises the UAE’s two financial free zones – DIFC and Abu Dhabi Global Market (ADGM). In DIFC, regulated financial activities are governed by the Dubai Financial Services Authority (DFSA), whilst in ADGM, the Financial Services Regulatory Authority (FSRA) is responsible for regulating such activities.

Ultimately, irrespective of whether a Web3 business is regulated by the CBUAE, SCA, VARA, DFSA or FSRA, if it is regulated, it will be required to comply with a series of anti-money laundering, consumer protection, and corporate governance obligations and standards. A buyer will therefore need to do due diligence on the extent to which the target group has implemented the required policies and procedures. The UAE and its financial free zones also have various requirements as regards the officers of a regulated business that must be appointed as well as their physical location. Equivalent obligations exist in Saudi Arabia but with additional requirements to hire Saudi nationals for certain roles.

If a regulated business in the UAE undergoes a change of control, the regulated entity will need to obtain the approval of the relevant regulator. This means that conditions precedent will likely need to be built into the share purchase agreement and factored into transaction timing, as obtaining such regulatory approvals may take several months.

Data Privacy And Digital Regulation

The free flow of personal data and the ability to process, store and monetise it, is integral to many Web3 businesses. However, Web3 businesses can face particular challenges. For example, the nature of decentralised technologies like blockchain (which constitutes one of the foundational elements of Web3) is such that once data is stored within them, it is virtually impossible to remove. This poses obvious challenges in respect of certain data protection requirements. For example, it makes compliance with an individual’s right to be forgotten (which can now be found in the data privacy laws being enacted in a number of GCC States) far more challenging.

Much is changing across the GCC. The UAE’s two financial free zones have both updated their data privacy regimes in the last three years, while the UAE introduced its first onshore data privacy law in September 2021. Saudi Arabia also recently amended its first ever sector wide data privacy law of general application, which was itself only released in 2021. Final executive regulations fleshing out the requirements in each of the latter two jurisdictions are yet to be released. Yet more change is therefore on the horizon.

There are also examples of GCC jurisdictions going beyond the regulations that exist in Europe. For example, the DIFC has proposed amendments to its Data Protection Regulations that seek to provide guidance to companies using digital enablement technology systems such as artificial intelligence. Relevant agencies in Saudi Arabia are also implementing cutting edge data privacy and technology regulations that regulate matters ranging from digital transformation and the internet of things, to digital content and open banking.

Whilst varying in their levels of sophistication, each of these regimes are clearly inspired by the EU’s GDPR and impose similar obligations on businesses. As part of their diligence exercise, buyers therefore need to obtain an understanding of how personal data is used by a target group, the quality of the processes and procedures it has in place, and the extent to which there may have been breaches of applicable requirements. In this context, it is now market standard for buyers of GCC assets to ask for far more robust warranty packages covering financial services regulatory, data privacy and cybersecurity compliance than was the case seven or eight years ago.

Intellectual Property

IP rights are often the most valuable assets of a Web3 business. In the UAE, the protection of IP rights is now further supported by patent, trademark and copyright laws newly issued in 2021. Together these laws comprise the most significant reform of the UAE’s IP protection for many years.

As part of a prospective buyer’s due diligence investigation into a Web3 business, it will need to ascertain what IP rights the business owns, and whether this is through copyright or registered IP rights. Equally, the buyer will need to carefully assess the target group’s existing IP licences and agreements in order to determine the extent to which the transaction impacts such arrangements. For instance, if open-source code underpins any part of a target group’s propriety software, this may have implications for the target group’s ownership of the software as well as its ability to commercialise it in the future. The employment contracts of the target group’s employees should also be examined to ensure appropriate provisions are in place to assign any IP rights arising out of the employee’s employment back to the business.

Foreign Ownership

For several decades, the UAE has had in place a series of foreign ownership restrictions. Until recently, this meant that 100 per cent foreign ownership of UAE companies was only possible in the UAE’s free zones. By contrast, 100 per cent foreign ownership in Saudi Arabia has long been permitted, subject to obtaining Government permission to acquire the shares in question.

As things stand, a potential investment in onshore UAE now falls into one of three categories. The first category comprises business activities that are on a “positive list”. The majority of Web3 businesses will fall into this category. It is now possible for these businesses to be owned entirely by a foreigner. The second category comprises so-called “strategic impact activities”, which constitute commercially sensitive business activities. From a Web3 perspective, an investor should note that these strategic impact activities include certain financial services and telecommunications activities. Some Web3 businesses will therefore run the risk of falling into this category. If that is the case, the investor will need to discuss with the relevant UAE regulatory authority whether it is permitted to acquire the shares and what percentage of foreign ownership will be allowed. The third category comprises activities that fall outside of the first two categories. In this third category, it is understood that the previous foreign ownership restrictions (ie 49 per cent foreign ownership / 51 per cent Emirati ownership) apply.

Web3 may be the world of tomorrow, but the technologies underpinning it present huge opportunities for investors today. Those wishing to embrace the new reality have much to gain but should keep in mind the above considerations when navigating a unique web of legal and commercial issues in the UAE and GCC more widely.