Introduction
One of the most innovative technological advancements of the twenty-first century is blockchain technology. Blockchain is a distributed database or ledger that maintains an ever-expanding collection of ordered documents, called blocks (Al-Tawil Reference Al-Tawil2022). Blockchain technology enables a user to maintain a secure and decentralized record of transactions by making data and data collection points immutable and unalterable. Imagine each block as a point of stored data that cannot be changed except by the user or program that entered it. Blockchain reduces the need for trusted third parties, such as auditors or other humans, who add costs and can make mistakes (Hayes Reference Hayes2025). Blockchain provides the infrastructure for various cryptocurrencies and other applications, such as non-fungible tokens (NFTs) (Al-Tawil Reference Al-Tawil2022). NFTs represent an investor’s claim to ownership of a unique digital asset such as an image, video or music file.
In some cases, NFTs have also started to represent tokenized investments in larger assets such as real estate. This asset is recorded as non-interchangeable data on a blockchain, which is also used to verify and establish individual ownership of these digital assets. NFTs are tradable, and their uniqueness and market demand drive their value. Their decentralized nature, owing to blockchain and the pseudonymous environment in which these assets operate, can seem lucrative to individuals seeking to maintain privacy over their assets or investments. It is important to note that NFTs are not inherently anonymous, but the use of pseudonyms and the absence of direct identification from blockchain addresses can make it difficult to trace an NFT owner’s real-world, government-issued identity. In this age, where Know-Your-Customer (KYC) processes underpin all financial transactions, NFT records are typically not associated with identifiable personal information, making it challenging to track individuals who may be using NFTs for illicit purposes.
The intersection of digital assets like NFTs and money laundering has sparked worldwide discussions about the need for industry regulation. Blockchain was created to limit the involvement of governments, financial institutions and other third parties in financial transactions. Consequently, regulatory issues are of paramount importance (Bartoletti et al. Reference Bartoletti, Lande, Loddo, Pompianu and Serusi2021). Governments and regulatory agencies paid little attention to this silent revolution, as the sector was relatively minor. Nevertheless, the cryptocurrency and crypto assets market has grown beyond initial projections to become a billion-dollar industry, with a significant chunk of that money invested in NFTs. The development of alternatives has further bolstered this market value. As mentioned earlier, cybercriminals have been emboldened by the pseudonymity features of cryptocurrencies, which is the primary concern. Amidst the chaos, developing industry regulation without stifling nascent innovation is the real challenge (Bartoletti et al. Reference Bartoletti, Lande, Loddo, Pompianu and Serusi2021). This study aims to investigate the concept of NFTs, analyse their classification as digital assets, and assess the risks and challenges they present in the context of money laundering and terrorist financing. The legal frameworks of the United Arab Emirates (UAE) and the United Kingdom (UK) are the primary focus of this research. It is intended to evaluate the current rules and regulations governing NFTs within the legal frameworks under consideration, conduct comparative legal analysis where relevant, and offer policy-driven recommendations to improve regulatory clarity, enforcement capabilities and international cooperation.
Money Laundering using Crypto Assets such as NFTs
A broader understanding of money laundering is pivotal to comprehending the role that NFTs play in this process. Money laundering is the act of concealing the origin of funds obtained illegally. It delineates the “behavior that transpires after the commission of another, ‘predicate’, offense” (Levi and Reuter Reference Levi and Reuter2006: 311) in order to validate the resulting proceeds. Money laundering typically occurs in three phases: the “placement” of funds, which involves the initial entry of illicit proceeds into the financial system, followed by the “layering” of those funds. Layering refers to the execution of numerous, intricate transactions to render the source of the funds untraceable; layering is followed by an “integration” which involves the smooth integration of the proceeds into the economic system as legitimate funds (Tanzi Reference Tanzi1996). The United Nations estimates that approximately $800 billion to $2 trillion is laundered annually, equivalent to 2–5% of global gross domestic product. This is a testament to the extent of the problem. The use of crypto assets, such as NFTs, can further facilitate fund allocation. This allows for the rapid execution of a series of transactions, as they are automated and relatively anonymous in comparison to other forms of transactions. Consequently, it enables sufficient compounding (Paphitis Reference Paphitis2022).
How are NFTs Used to Launder Funds?
As mentioned earlier, NFTs are digital tokens that represent real-life assets. Although NFTs have existed since 2014, their prices have risen sharply in recent months (Paphitis Reference Paphitis2022). The price rise is exorbitant; for reference, an NFT artwork by Beeple titled “Every Day: The First Five Thousand Days” sold for $69.3 million in 2021.
Another artwork, “The Merge”, was sold in the same year for a whopping $91.8 million (Tashev Reference Tashev2025). While there are no existing concerns about the exorbitant auctions and pricing of these NFTs, one can comprehend the potential for laundering through digital art. First, the purchase of artwork is a traditional method of laundering, given the challenge of determining a fair market value for artworks that are frequently overpriced. Second, the anonymity it provides makes it easier to use proxy or shell companies to purchase these artworks (King Reference King2021).
In addition, NFTs present new and fresh opportunities for money laundering, often through inflated sales prices. Launderers can disguise illicit income as proceeds from digital asset sales by overpaying for an NFT, thereby transmitting funds under the guise of legitimate transactions. Conversely, the illicit origins of funds can be further obscured by the creation and sale of NFTs to oneself or accomplices at inflated prices, resulting in a complex web of transactions (Punia and Drain Reference Punia and Drain2025). This is further exacerbated by challenges in determining the real fair value of NFTs. The assessment of NFTs is exceedingly subjective.
In contrast to conventional assets, the value of an NFT is often determined by perceived value, sentiment or rarity rather than tangible metrics. This valuation ambiguity complicates authorities’ ability to determine whether a transaction is genuine or intentionally inflated to facilitate money laundering. For example, evidence that the transaction was a cover for illicit activities becomes a complex challenge, even though a piece of digital art might sell for millions (Kulakova Reference Kulakova2022).
In this pursuit, another approach entails producing one’s own NFTs and subsequently selling them to oneself or accomplices at exorbitant prices. This not only facilitates fund transfers but also creates the illusion of legitimate trading activity. It is possible to establish a network of transactions that is more difficult to trace back to its illicit origins when it is performed repeatedly or with multiple accomplices (LexisNexis 2023). NFT marketplaces and the decentralized way they operate further add to these challenges. NFT marketplaces operate in a decentralized environment, independent of any singular entity or jurisdiction. This global reach enables an NFT to be listed, purchased or sold from virtually any location, thereby facilitating cross-border transactions. This decentralization presents a vast arena for money launderers, as it is difficult for any single regulatory body to monitor or control all the activities (LexisNexis 2023). These challenges exist equally in the UK, the UAE and the rest of the world. The inherent privacy-first design and decentralized nature of blockchain stand as hurdles that regulators must overcome. The combination of these factors renders NFTs a highly effective instrument for money laundering. Regulators and the community must remain vigilant and proactive in addressing these concerns as the NFT ecosystem continues to evolve.
Anti-Money Laundering: The Oman Perspective
Anti-money laundering (AML) law was first introduced in Oman in 2002, and was later replaced by the Anti-Money Laundering and Combating Terrorism Financing Law in 2010. This legislation meets virtually all of the Financial Action Task Force (FATF) standards. Oman made money laundering and terrorist financing offences in response to the Vienna and Palermo Conventions. The AML law of Oman provides for a broad spectrum of sanctions and penalties for money laundering and terrorism financing (FATF-GAFI 2011).
It is important to point out the Anti-Money Laundering and Combating the Financing of Terrorism Law, Royal Decree No. 30/2016 (Oman) (2016; Sultanate of Oman 2016), showing the Sultanate of Oman’s interest in creating a solid base for financial crime regulations. Article 1 of the law defines “funds” in broad terms as “movable or immovable property”, including assets in digital and electronic form, meaning clearly that NFTs are covered by its wording. The law has classified NFTs as digital assets, meaning “gold-standard” AML and counter-terrorism financing (CTF) laws apply to these new technologies. This broad definition confirms the Gulf state’s proactive stance regarding evolving financial technologies and the potential for their misuse (Anti-Money Laundering and Combating the Financing of Terrorism Law, Royal Decree No. 30/2016 (Oman) 2016).
The Role of the National Centre for Financial Information
The National Centre for Financial Information (NCFI) is Oman’s financial intelligence unit, which receives, analyses and disseminates suspicious transaction reports from financial institutions and designated non-financial businesses. Reporting entities are required to report unusual transactions – such as dealing with novel digital assets like NFTs – to the NCFI within an unspecified time frame, without telling the customer (Arctic Intelligence Reference Intelligence2024). This stringent system means that platforms also cover the detection and investigation of potential money laundering or terrorist financing through the latest electronic and digital methods.
Regulation of Smart Contracts and NFTs pursuant to the Electronic Transactions Law
The Electronic Transactions Law of 2025 established the legal basis for electronic signatures, authentication, intermediary liability and even data protection in connection with electronic transactions. Unlike its predecessor, the new Electronic Transactions Law of 2025 does not introduce any “game-changing” concepts missing from the comprehensive framework established by the Electronic Transactions Law of 2008. Instead, it only refines its coverage, updates the technological concepts the law operates on, and increases the severity of sanctions inflicted for breaching the law; the new law also abandons the notion of “certification services” and relies instead on the much broader concept of “trust services”, which are defined in Article 24 of the law comprising issuance of electronic authentication certificates, qualified electronic signatures, electronic seals, character verification of electronic identity, and electronic delivery services (Al-Bahri Reference Al-Bahri2025).
In addition to the above, the new law distinguishes between simple, advanced and qualified electronic signatures; establishes new rules for proving the reliability of such signatures; and specifies which of the new types qualify as trust services. It also adds more severe penalties for transgressions, with fines of up to 50,000 Omani rials and up to five years in jail for unauthorized provision of trust services, forgery or misuse. While NFTs are not explicitly mentioned in the law, the provisions on smart contracts and electronic authentication frameworks establish a regulated environment where smart contracts executing NFT transactions are legally recognized and proven (Nair Reference Nair2025).
As you can see, there is no specific legal provision or regulatory framework that addresses this kind of contractual arrangement. This statutory imprecision, especially when cast in the context of criminal prosecutions, is likely to leave a reasonable doubt in its wake – and doubt inures to the benefit of the defendant. There will be acquittals, and offenders will get away with crimes. This is the sort of situation that cries out for sound, substantive legal rules to regulate it.
Prevention of Cybercrimes and Security of Digital Assets
In light of the growing number of blockchain-based applications, NFTs have become not only digital goods for legal trading and possession but also potential tools for unlawful financing (Europol 2021). Under Omani law, misuse is intentionally addressed by the Cybercrime Law. Article 21 of the Law makes punishable conduct relating to the use of information networks or technology to move, transfer, conceal or disguise the true nature of illicit proceeds, or the receipt or possession of illicit proceeds knowing they were the product of an offence (Royal Decree No. 12/2011) (Sultanate of Oman 2011). It also increases the punishment for asking for help laundering money or for teaching others to launder money. A perpetrator shall be punished by an imprisonment term of not less than three years and not more than 15 years, and a fine (of not less than 50,000 Omani rials) or an amount equal to the value of the laundered monies, whichever is higher. This is a legal provision that is particularly relevant to NFTs used to disguise the source of illicit funds, and is thus categorized by such conduct as cyber-enabled money laundering or terrorism financing (Financial Action Task Force 2023). Leveraging decentralized platforms and pseudonymous NFT transactions adds to the challenge of tracking funds and underscores the importance of immutable legal enforcement to confront ever-changing financial cybercrime (INTERPOL 2024).
The Central Bank of Oman has warned in the past that it has not licensed any company to trade in cryptocurrencies, adding that currency and banking law does not apply to any virtual currencies or activities involving them, noting that a great deal of digital currency holders exist in the Sultanate. In February 2023, the Capital Market Authority (CMA) of Oman announced the future introduction of the Virtual Assets Regulatory Framework (De Ramos Reference De Ramos2023).
This framework will include licensing processes for virtual asset service providers (VASPs), supervision of virtual asset activities and risks associated with a new class of assets. The framework aims to develop a sound virtual asset market while providing investor protection and investment protection from market abuse, as well as supporting capital formation and financial services, with risk management incorporated into the system. It will cover a range of business activities involving virtual assets, including token issuance, digital assets, VASPs and initial coin offerings (LeanTech n.d.).
The CMA of Oman released Decision No. 35/2023, published in June 2023 (Oman Financial Services Authority 2023), on governing virtual assets and VASPs. The ruling establishes a regulatory framework that includes licensing of VASPs, monitoring of all virtual asset activities, and a risk-based system for tracking and mitigating new asset classes (Al Roya Reference Roya2023).
Although promulgated, the decision has not been officially published in the Official Gazette, which creates prima facie serious legal issues regarding its validity, enforceability and constitutional soundness. As an application of this principle, under the Constitution of Oman, decrees require promulgation to have legal force.
This is stipulated in Article 5 of the Law of Interpretation and General Provisions (Royal Decree No. 3/1973) (Sultanate of Oman 1973), which states that:
1 – Save where provision is made under Article (6) of this law, it shall be mandatory that every law be published in the Official Gazette and shall take force from the date of its publication thereof, unless another date – prior to or after – is provided for the coming into force of the law.
This makes publication in the Official Gazette a condition sine qua non for the declaration of its legal effect. Therefore, no decision that has not been rendered can be enforceable against anybody.
Under Article 8 of that same law,
Any person shall be deemed to know any law upon its publication in the Official Gazette. Furthermore, every person shall be presumed to know all laws enacted prior to the issuance of the Official Gazette. Every person shall be bound by all laws from the date of their entry into force, after it has been promulgated in the Official Gazette. Everyone also should be presumed to know all laws in force at the time when the Official Gazette containing such laws was issued. All laws shall apply to and bind all individuals as of the date of their promulgation.
However, the term “law” is defined in Article 3 as:
In this Law, and in any other law, the following words and expressions shall have the meanings assigned to each of them, unless the context requires otherwise or a different meaning or interpretation is provided in that other law: “Law” means any legislation, regulation, any Royal Decree, any legislative Royal Order, and all regulations, rules and legislative orders issued pursuant to any law.
Decision No. 35/2023 (Oman Financial Services Authority 2023), as an implied general regulation, is encompassed in “law” as stipulated by Article 3 and has, therefore, to satisfy the standard requirement of publication to take effect.
Non-publication of the decision in the Official Gazette is, thus, an essential procedural defect in it, making it amenable to judicial review and devoid of any legal effect or any binding character. This unpublished decision may impose certain regulatory requirements, particularly on regulated financial institutions, that could later be found to be unenforceable as a matter of law.
This is especially true for the Oman Investment Authority (OIA), the Sultanate’s sovereign wealth fund that manages strategic financial investments, both nationally and overseas. The OIA is subject to stringent AML/CFT requirements, including KYC policies. Introducing obligations by way of an unpublished decision is contrary to the principles of legal certainty and regulatory predictability and may be inconsistent with the governance of the OIA and its obligations as a member of good international reputation.
Ultimately, the decision not to publish it in the Official Gazette is in non-compliance with the mandatory provisions of Articles 3, 5 and 8 of Royal Decree No. 3/1973 (Sultanate of Oman 1973) – rendering the decision legally ineffective and unenforceable, let alone against entities acting under exclusive and regulatory mandates.
AML: The UAE Perspective
The corporate environment in the UAE is highly regulated. To understand the application of current AML laws and regulations, it is necessary to provide a concise summary of the UAE’s governance structures. Seven Emiratis comprise the federal administration of the UAE. Each Emirati has its own designated open zones. The free zones have limited autonomy from both the Emirates and federal law, including in matters of customs and foreign investment. However, the UAE has two independent financial free zones – the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC). Our only point is that the DIFC and ADGM have separate and independent jurisdictional oversight by the Dubai Financial Services Authority (DFSA) and the Financial Services Regulatory Authority (FSRA), both established by the UAE Constitution and federal law, respectively. Both are independent because their civil, financial and commercial laws differ from those of the UAE. However, UAE criminal law still applies in scope (Al-Tawil Reference Al-Tawil2022). In 2018, the FSRA issued a comprehensive set of regulations that made the ADGM the first jurisdiction in the world to establish a regulatory framework for spot virtual asset activities, including those conducted by brokers, custodians, asset managers and multilateral trading facilities. Since then, these laws, regulations and guidance have been consistently revised, with the most recent iterations being published in September 2022.
Starting in 2020, key onshore regulations governing crypto assets have witnessed tremendous development. Key developments included the issuance of Decision No. 23 of 2020 (Securities and Commodities Authority Virtual Asset Regulation), the Stored Value Facilities Regulation, and the Retail Payment Services and Card Schemes Regulation. The key focus remained on payment tokens (e.g. stablecoins), while security and commodity tokens were excluded. Subsequently, in 2023, the licensing requirements for virtual asset platforms and trading activities were made more stringent. However, it is important to note that, until now, it was unclear whether NFTs were regulated. In this context, Dubai made substantial regulatory progress via its Dubai Law No. 4 of 2022, which established the Virtual Asset Regulatory Authority (VARA). The VARA was tasked with overseeing the licensing and supervision of issuers, exchanges and custodial service providers in the Emirate. However, these regulations, despite collectively referring to “virtual assets”, do not expressly mention NFTs (Sheffield et al. Reference Sheffield, Davis, Smith and Colautti2024).
Subsequently, in March 2022, the DFSA released Consultation Paper No. 143 on the Regulation of Crypto Tokens, which was implemented and incorporated into the DFSA’s Rulebook (Dubai Financial Services Authority n.d.). The definition of a crypto token was then amended in the rulebook to include any token that serves as a medium of exchange, for payment or investment purposes, or that confers a right or interest in another token that meets the said requirements. Once again, the utility tokens, NFTs and digital currencies were designated as excluded tokens. However, in a recent development, NFTs have been expressly brought within the DFSA’s AML and counter-terrorist financing regime. The DFSA has incorporated this requirement into AML 3.2.1, which mandates that an individual who conducts business or a profession that involves the issuance of, or the provision of services related to, an NFT must apply to the DFSA for registration as a Designated Non-Financial Business or Profession (Shanahan and Pirbhai Reference Shanahan and Pirbhai2022). This would mean the issuers must comply with the DFSA’s AML Rulebook, conduct adequate due diligence on customers, maintain records of the KYC protocols and report suspicious transactions from time to time. All issuing entities must also ensure record-keeping and assign a money laundering reporting officer to ensure compliance, among other things. It is worth noting that money laundering and terrorist financing are criminal offences in the UAE and can result in fines and severe imprisonment.
An exclusion to this, however, applies for an issuer if the value of the issued NFT is less than $15,000 (Dubai Financial Services Authority n.d.). The exclusion for amounts under $15,000 is a loophole that exempts NFT issuers from registration if the value of the issued NFT is less than $15,000. Malicious actors may exploit this by issuing numerous NFTs just below the threshold to evade regulatory scrutiny. This is like structuring or smurfing in traditional money laundering scenarios (Packin and Volovelsky Reference Packin, Volovelsky and Packin2024). The rule also applies only to individuals who are “conducting business or professions”, potentially excluding occasional or peer-to-peer sellers from the regulatory framework. This results in a substantial proportion of NFT transactions remaining unregulated, which criminals could potentially exploit to launder illicit funds. It is also worth noting that NFT valuation is inherently speculative and volatile. Particularly in pre-sale or early-stage markets, it may be difficult to determine whether an NFT will exceed the $15,000 threshold. This could result in inconsistent enforcement or manipulation of the declared value.
A critical question that remains is whether NFTs should be subject to the same regulations as other crypto assets or otherwise. More importantly, it is an important question to answer. NFTs are increasingly violating intellectual property law and consumer protection laws. The exorbitant volumes flowing through the NFT market are prompting growing apprehension about the potential for NFTs to be used as a gateway for money laundering. The NFT market needs wider recognition and legislative intervention, as it is susceptible to exploitation by bad actors seeking to avoid AML/CTF regulations (Gaviyau and Godi Reference Gaviyau and Godi2025).
AML: The UK Perspective
Much like the Sultanate of Oman and the UAE, the recognition of NFTs as a medium for laundering illicit funds is a relatively recent development. The UK law categorizes NFTs as “crypto assets” and further classifies crypto assets into security tokens, e-money tokens or unregulated tokens. The regulatory status of a crypto asset is contingent on its characteristics, which determine which of the three categories it falls into. Consequently, certain crypto assets may be classified as “specified investments” under the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 by virtue of their attributes (i.e. security tokens). Some crypto assets, such as e-money certificates, may be classified as electronic money under the Electronic Money Regulations 2011 and fall under the second category (Artinian Reference Artinian2023). As the current UK law stands, NFTs, whether collectible or non-collectible, will not be classified as either a security token or an e-money token. Consequently, they are classified as unregulated tokens and fall into the third category (Gherson 2022).
By incorporating the requirements of the European Union’s Fifth Anti-Money Laundering Directive (AMLD5), the UK Government has transposed AML requirements about crypto assets into national law. The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (the “2019 regulations”) implement AMLD5 in UK national law. The 2019 regulations have broadened the definition of individuals who are subject to the current AML regulations to encompass fiduciary wallet providers and crypto asset exchange providers. This was accomplished by substituting the term “virtual currencies” with “crypto assets”, which encompasses a broader range of service providers within the Regulations’ perimeter. Consequently, any UK business that offers services of exchange or custody of a crypto asset will be subject to the 2019 regulations and will be required to comply with AML requirements. The 2019 regulations also designate the Financial Conduct Authority (FCA) as the supervisory authority for crypto asset businesses for AML purposes. Businesses in scope will be required to register with the FCA and comply with all regulatory requirements (Paphitis Reference Paphitis2022). It is imperative to acknowledge that service providers are obligated to comply with specific regulations, including implementing customer due diligence or, in the case of high-risk transactions, enhanced due diligence.
Furthermore, to comply with these regulations, crypto asset service providers must first obtain prior authorization from the FCA through a registration procedure. This process entails providing specific information about the provider and its key personnel. This information encompasses, among other things, the business’s and marketing plans, its organizational structure and beneficial owners, and its AML and risk assessment frameworks.
Much like the UAE, the legal and regulatory status of NFTs in the UK also remains ambiguous, uncertain and practically unregulated. The FCA issued guidance on the 2019 Act, stating that each NFT case should be assessed on a case-by-case basis (Financial Conduct Authority 2019). Determining whether AML requirements apply to a specific NFT depends largely on how the NFT is marketed, sold and used as a store of value (Financial Conduct Authority 2019). This lack of definitive classification creates ambiguity for businesses involved in the NFT space. AML regulations governing traditional art markets may offer a useful comparative framework, given the growing similarities between digital and physical artworks.
Under the Money Laundering and Terrorist Financing (Amendment) Regulations 2019, “art market participants” such as firms or individuals engaged in the trade, brokerage or storage of works of art must register with HM Revenue and Customs and comply with the associated AML obligations. These obligations include conducting customer due diligence, data retention, KYC and reporting suspicious transactions involving transactions of €10,000 or more. These apply as a single deal or a series of linked transactions. Determining whether a digital artistic asset qualifies as a “work of art” is a key question. AMLD5 is silent and does not define “work of art”. Another important consideration is whether the business in question functions as an art market participant, for instance, by trading, brokering or storing NFTs. As there is currently no formal regulatory guidance on whether NFTs constitute works of art under the 2019 regulations, this determination is likely to fall to regulators in due course; in the meantime, it remains a challenge (Kerrigan and Henderson Reference Kerrigan and Henderson2023). Starting last year, the UK Treasury has been actively proposing amendments to its money laundering regulations. The aim is to bring a wider spectrum of digital asset activities, including NFTs, under the AML regime. As discussed earlier, the NFTs fall into an ambiguous territory under UK AML regimes unless they represent ownership of regulated financial assets. These proposals aim for the NFT issuers to register and be supervised by the FCA for AML and CTF compliance, even if their tokens are not classified as financial instruments (Kaaru Reference Kaaru2024). Once made applicable, NFT issuers, investors and traders are expected to fall under the purview of the Proceeds of Crime Act. Violators can face imprisonment for up to 14 years and unlimited fines for money laundering offences. Failure to disclose suspicious activity may result in imprisonment for up to five years and/or an unlimited fine. Especially when it comes to fines, the FCA has the authority to impose substantial fines on financial institutions for AML violations, including those associated with insufficient transaction monitoring, sanctions screening and customer due diligence (Anderson, Blundell, and Randhawa Reference Anderson, Blundell and Randhawa2025).
Recommendations and Suggestions
NFTs, their issuance and trading are undergoing an overhaul in the UK and the UAE. The change in the regulatory regime is surely a response to concerns regarding money laundering and terrorist financing. In the UK context, NFTs are not explicitly regulated as a distinct asset class but may be subject to existing financial and AML laws when used as investment vehicles or when involving suspicious transactions. The UK’s FCA has actively warned and opened dialogue regarding the risks associated with crypto assets, but subject-specific regulations are yet to be rolled out. In the UAE, in contrast, Dubai shows a more structured approach, particularly through the DFSA. The DFSA has incorporated NFT-related activities into its Designated Non-Financial Businesses or Professions (DNFBP) framework, necessitating registration for entities engaged in the issuance or provision of NFTs (Shanahan and Pirbhai Reference Shanahan and Pirbhai2022). Nevertheless, exemptions are granted if the aggregate value of the issued NFTs is below a specific threshold, which malicious actors could exploit. Some recommendations and suggestions that can be uniformly applied across different jurisdictions are now detailed as follows.
Underdeveloped Legal Concept of NFTs in Omani Laws
Omani laws do not provide a specific legal definition of NFTs or any detailed regulation thereof. Such a lack of regulation creates ambiguity regarding the legal status, ownership interests and validity of NFT-related transactions, potentially hindering regulatory oversight and supervision of this nascent asset class.
Need for a Legislative Initiative to Recognize NFTs
The urgency of legislative action to recognize NFTs in Omani law cannot be overstated. This recognition should include categorizing NFTs as a unique type of digital asset and elucidating their legal status, setting the stage for how they will be used and treated in commerce, art, intellectual property and finance.
Recommendation for a Specialized NFT Regulatory Law
Given the technical nature of NFTs and their cross-border impact, it is recommended that Oman issue a specialized NFT regulatory law. This legislation ought to address their creation, ownership, transfer, taxation, potential ill-use, and be in synchronization with the international AML and CTF norms as well.
Defining Legal NFT Sales Protocol
Once the legal status of NFTs is established, clear protocols must be set up to regulate the sale and transfer of NFTs. These steps facilitate compliance with AML and CTF regulations, protect the interests of the buyer and seller, and limit the risk of legal disputes arising from vague contractual obligations. This would help avoid any NFT-backed money transactions from being criminalized by the legislation.
Introduce a Distinct NFT Regulatory Class of Assets
Regulators in Oman, the UAE and the UK should work towards formally recognizing NFTs as a distinct asset class with specific legal definitions. The legislation under study appears well-versed in NFTs’ ability to serve as both digital collectibles and financial instruments, depending on their structure. A tailored classification can help in distinguishing between innocuous uses (e.g. digital art) and high-risk cases (e.g. asset-backed tokens used for speculation or fraud). Specifically in Dubai, the DFSA can expand its DNFBP regime to include a further bifurcation of NFT types, such as gaming-related NFTs, investment-grade NFTs and utility-based NFTs. Similarly, the CMA in Oman and the FCA in the UK can issue guidelines and blueprints to address how NFTs intersect with financial promotion rules, consumer protection and obligations of crypto-asset service providers.
Mandatory KYC and Enhanced Due Diligence Procedures
Lack of user verification is a primary pathway for exploitation and potential fraud in NFT markets. All NFT marketplaces, whether centralized or decentralized, should follow robust KYC/AML procedures mandated by regulators. Inspiration can be drawn from the existing AML/CFT guidelines and mandates. For reference, this would encompass identity verification requirements prior to the minting, purchasing or selling of NFTs, as well as the implementation of risk-based enhanced due diligence for high-value or high-frequency traders. Regulators under the legislation under study can establish joint industry standards for digital identity verification for NFT users. Marketplace operators should also mandate the use of analytics tools to monitor wallet behaviour that suggests illicit activity, such as rapid transfers, mixing services or transfers to sanctioned jurisdictions.
No Exceptions
Specifically, in the DFSA’s context, the exemption for NFT issuers that fall below a specific monetary threshold is a source of concern and should be revoked. As already mentioned, criminal actors may strategically limit transactions to these parameters. This de minimis rule should be either abolished or redesigned to incorporate cumulative thresholds and risk-based reviews, but a blanket approach should be revoked immediately. Regulators may also require issuers to register, regardless of their value, if they interact with high-risk jurisdictions or engage in repeated transactions.
Bring Innovation to Compliance
The regulation should keep pace with technological development. The legislation under study should encourage and fund the development of regulatory technology (RegTech) tools that monitor, trace and flag suspicious NFT transactions. Artificial intelligence integration can be considered to develop platforms for detecting wash trading, wallet clustering to identify illicit actors, and forensic tools for transaction tracing. To further increase acceptance, regulated NFT platforms should be incentivized through tax credits or sandbox exemptions to integrate such tools.
Oman Should Republish the Regulations in the Official Gazette
It is recommended that Decision No. 35/2023, issued by the Oman Financial Services Authority (2023) – concerning the registration of VASPs and the implementation of AML and CFT measures – be officially republished in the Official Gazette.
Acknowledgements
None.
Competing interests
The authors declare that there are no competing interests.
Rashid Hamed Al-Balushi is Professor of Criminal Law at the College of Law, Sultan Qaboos University, Sultanate of Oman.
Zaeem Nasser Al-Shuaibi is a part-time lecturer in Criminal Law at the Arab Open University, Sultanate of Oman and the Acting Head of the Contracts and Agreements Review Section, Legal Affairs Department, Sultan Qaboos University, Sultanate of Oman.
Open access
