UAE Technology / Fintech LawCabinet Resolution No. (28) of 2023 on the Executive Regulations of Federal Decree-Law No. (46) of 2021 on Electronic Transactions and Trust Services

Article (1) Definitions The definitions set forth in Federal Decree-Law No. (46) of 2021, referred to hereinabove, shall be applied to this Resolution; otherwise, the following words and expressions shall bear the meanings assigned thereto respectively, unless the context requires otherwise: Decree-Law : Federal Decree-Law No. (46) of 2021, on Electronic Transactions and Trust Services.

-- 1 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 2 Competent Authority : The authority that issues the Trade License. Termination Plan : A document that sets out the procedures related to the Licensee’s plan and preparedness to…

Article (2) License Application 1. The TDRA shall publish necessary information on all procedures, application forms and information required for the License purposes, on the website of the TDRA or by any means it deems appropriate. 2. The License application shall include all information required by the TDRA, and such information shall be provided by methods and means determined by the TDRA. 3. The License applicant shall abide by all procedures and shall use application forms determined by the TDRA. 4. The TDRA shall determine documents and data to be included in the License application, including the following documents and data: a. A copy of the License issued by the Competent Authority…

Article (3) License Application Examination Procedures 1. The TDRA shall complete and examine the License application and shall verify the information and documents submitted, within a month following the completion date of the application. In cases that require more time for review and verification, the License applicant shall be notified of the further updated period. 2. In the event of any justifiable alterations of the data or documents submitted in the License application, or where the License applicant desires to cancel the License application, the latter shall so notify the TDRA and shall bear the relevant fees and costs. 3. The TDRA may relieve the License applicant from certain lice…

Article (4) TDRA Decision After the License Application Examination 1. The TDRA shall issue its decision after reviewing and examining the License application as follows: a. Approving the License application for providing Trust Services or specific Qualified Trust Services if the TDRA is convinced that the License applicant has fulfilled the requirements set forth in the Decree-Law and this Resolution and

-- 4 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 5 the resolutions issued by the TDRA in implementation of both of which, and the requirements of the Competent Authorities. b. Rejecting the License applicatio…

Article (5) Power to Issue the License The TDRA shall issue the License decision following the approval of the Chairman or his delegate.

Article (6) Term of the License The term of the License shall be two years, commencing from the date of issuing the License.

-- 5 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 6

Article (7) License Renewal Application 1. At least (3) months prior to the expiry of the License term, the Licensee shall fulfill all requirements for the License renewal, subject to the following: a. The License renewal application shall include all details and documents mentioned in Clause (4) of Article (2) above, along with any other details or documents identified by the TDRA. b. The License renewal application shall include a proof of payment of the License renewal application fees, as per the method and means determined by the TDRA.

Article (8) Failure to Timely Renew the License A Licensee, whose License term expires without getting the License renewed (30) thirty days prior to the License expiry date, shall be deemed in breach, and shall be sanctioned according to the administrative sanctions applicable in that respect.

Article (9) License Renewal Application Examination Procedures The TDRA shall review and verify the data and documents submitted within the License renewal application, as per the procedures set out in Article (3) above.

-- 6 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 7

Article (10) Decision on License Renewal The TDRA shall issue its decision after reviewing and examining the License renewal application as follows: 1. Approving the License renewal application if the TDRA is convinced that the License renewal applicant has fulfilled the requirements set forth in the Decree-Law and this Resolution and the resolutions issued by the TDRA in implementation of both of which, and the requirements of the Competent Authorities, and, accordingly, the TDRA shall: a. Issue a License authorizing the applicant to provide the approved Trust Services or Qualified Trust Services after paying the License issuance fees; and b. Update the UAE Trust List according to the Licen…

Article (11) Grievance Against TDRA’s Decision The License applicant or the License renewal applicant whose application is rejected may submit a new application, as per the procedures applicable thereto, or file a grievance within (14) days against the TDRA’s rejection decision.

-- 7 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 8

Article (12) Suspension or Revocation of the License 1. If the License of Trust Service Providers or Qualified Trust Service Providers is suspended, the Licensee shall promptly cease to list any new Subscribers to services set out in the License, and shall keep providing the services to Subscribers existing before the effective date of the suspension decision. 2. If the License of Trust Service Providers or Qualified Trust Service Providers is revoked, such provider shall be served with a notice to activate the Termination Plan for all or any of the services set out in the License, along with adjusting the UAE Trust List when completing the implementation of the Termination Plan. 3. If a Qua…

Article (13) Cases of Amendment to the License 1. The Licensee shall notify the TDRA within one week in case of any amendments to or changes in the information submitted in the License or renewal application or the documents submitted for obtaining the compliance report. 2. The Licensee shall be required to obtain the prior approval of the TDRA in cases of adjustment or change of data and information that had been provided to TDRA, as determined by the TDRA, including the following data and information: a. Details of the establishment and ownership and the business office of the Licensee in the State; b. Technical, administrative and financial capacity for the management and operation of the…

Article (14) Costs of License Suspension or Revocation The License renewal applicant or the Licensee, whose Status of Qualified Service Provider is withdrawn or whose License is suspended or revoked, shall bear all expenses related to the Compliance Assessment reports.

-- 9 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 10

Article (15) Obligations of the Licensee The Licensee shall satisfy the following requirements: 1. Details and documents submitted by the Licensee to the TDRA must be up-to-date and accurate throughout the License period. 2. Acting in a fair and impartial way in respect of all its activities, transactions and service offer and marketing, without causing monopoly or an impact on the sector competitiveness or Subscribers, including the Licensee’s obligation not to publish incorrect or inaccurate information or preclude the mechanisms of executing the Decree-Law, the present Resolution, resolutions issued by the TDRA in pursuance of the Decree-Law and the present Resolution and the requirements…

Article (16) Obligations of the Qualified Trust Service Provider In addition to the obligations set forth in Article (15) above, the Qualified Trust Service Providers shall comply with the following controls and procedures: 1. Fair, honest and professional business conduct in the course of all their activities and operations. 2. Appointing personnel with specialized expertise, as per the competence and the required and reliable practical and scientific expertise, from among those who hold adequate certifications and trainings on the rules of information security and personal data protection, and of those who are familiar with the relevant national and international standards. 3. Securing ade…

Article (17) Discontinuation of Services 1. The Licensee may not discontinue any of its activities or services without the prior approval of the TDRA. 2. The application for discontinuation of Trust Services or Qualified Trust Services shall be made according to the means identified by the TDRA. 3. The TDRA shall reply to the application for discontinuation of Trust Services or Qualified Trust Services within one month from the date of submitting the application. In cases where more time is required for review and examination, the Licensee shall be notified of the updated period. 4. The Licensee shall notify the TDRA of its desire to discontinue providing any Trust Services or Qualified Trus…

Article (18) Licensee's Obligations to Activate the Termination Plan The Licensee shall activate its service Terminal Plan and shall take the following actions: 1. Revoking all certificates of authentication or data of Subscribers’ accounts issued by the Licensee pertaining to the services intended to be terminated, which had not been revoked or which will not expire before the Licensee terminates its services, whether the Subscribers request to terminate the same or not; 2. Revoking all other relevant certificates; 3. Destroying, suspending or preventing the use of all data of creation of Electronic Signature/Seal of the Licensee or Subscribers, including backups, so that the data of Electr…

Article (19) Reliable Electronic Signatures and Seals 1. A Reliable Electronic Signature/Seal shall fulfill the specifications and standards of Encryption, the mechanism and requirements for an Electronic Signature/Seal creation, information security controls and additional requirements under the resolutions issued by the TDRA. 2. A Reliable Electronic Signature/Seal shall be created according to one or more of the templates and formats identified under the resolutions issued by the TDRA.

-- 15 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 16

Article (19) above at the time of signature; 2. Not to compromise the integrity of data signed; 3. The device used to create a Qualified Electronic Signature/Seal shall fulfill the requirements set out in Article (26) hereunder; and 4. Any additional requirements set by the TDRA under the resolutions issued by the TDRA in implementation of the Decree-Law and this Resolution, and the Competent Authorities’ requirements.

Article (20) Qualified Electronic Signatures and Seals A Qualified Electronic Signature/Seal shall fulfill the following requirements: 1. Fulfilling the conditions under the resolutions issued by the TDRA, as set forth in

Article (21) Requirements for Qualified Electronic Signature/Seal Authentication Certificate 1. A Qualified Electronic Signature/Seal Authentication Certificate shall include the following: a. Wording or reference, in at least automatable format, stating that the certificate has been issued as a Qualified Electronic Signature/Seal Authentication Certificate. b. A set of data that unequivocally identify the Qualified Trust Service Provider that issues Qualified Electronic Signature/Seal Authentication Certificates, including a reference to the United Arab Emirates being the State where the provider provides such service. Such data shall include name and ID number of the Qualified Trust Servic…

Article (21) of the Decree-Law, and the Qualified Electronic Signature/Seal creation device must be approved by entities issuing qualification certificates for such devices, whether public or private entities; provided that such entities are approved by the TDRA. 4. The Qualified Trust Service Provider shall comply with the standards and requirements of security assessment of IT technologies, products and services issued by the TDRA for approving the Qualified Electronic Signature/Seal creation devices. 5. Entities granting qualification certificates for the Qualified Electronic Signature/Seal creation devices shall comply with the list of standards and requirements issued by the TDRA. Any q…

Article (22) Revocation of Authentication Certificates Where a Qualified Electronic Signature/Seal Authentication Certificate is revoked after being issued, it shall become invalid once revoked. In no event may such certificate be reactivated.

Article (23) Prohibition of Temporary Suspension of Authentication Certificates It is prohibited for the Licensee to temporarily suspend a Qualified Electronic Signature/Seal Authentication Certificate, or temporarily suspend its validity period after being activated.

Article (24) Issuance of the Qualified Electronic Signature/Seal Authentication Certificate 1. The Qualified Electronic Signature/Seal Authentication Certificates may be provided as a Qualified Trust Service only through a Qualified Trust Service Provider. 2. The Qualified Trust Service Providers may use a Qualified Electronic Signature/Seal Authentication Certificate issued by another Qualified Trust Service Provider accompanied by a valid Qualified Electronic Signature/Seal to authenticate the Person requesting a Qualified Electronic Signature/Seal Authentication Certificate. 3. Where the Qualified Trust Service Provider uses a procedure equivalent to the appearance in person to verify the…

Article (25) Revocation of Qualified Electronic Signature/Seal Authentication Certificate 1. If the Qualified Trust Service Provider that issued a Qualified Electronic Signature/Seal Authentication Certificate decides to revoke the certificate, at the request of its holder or for the reasons identified by the service provider, they shall record the revocation in their certificate database and publish the certificate revocation case status on the service of verifying the validity of certificates, within a period not exceeding (24) twenty four hours from the date of receiving the certificate holder’s request. The revocation shall take effect once published.

-- 19 of 30 --

Cabinet Resolution…

Article (26) Issuing the Qualified Electronic Signature/Seal Device 1. A Qualified Electronic Signature/Seal creation device may be issued to Signatories as a Qualified Trust Service only through a Qualified Trust Service Provider fulfilling the technological, procedural security and regulatory specifications and standards to be identified under a resolution by the TDRA. 2. The Qualified Trust Service Provider shall identify a set of adequate policies and practices to provide devices for creating the Qualified Electronic Signature/Seal as a Qualified Trust Service. In all cases, such policies and practices shall fulfill the technical requirements and specifications of content and structure i…

Article (27) Remote Management of the Qualified Electronic Signature/Seal Device 1. The Qualified Electronic Signature/Seal creation devices shall be managed remotely as a Trust Service qualified by the Qualified Trust Service Provider that shall:

-- 21 of 30 --

Cabinet Resolution on the Executive Regulations of Federal Decree-Law on Electronic Transactions and Trust Services 22 a. Create and manage the Qualified Electronic Signature/Seal creation data on behalf of the Signatory; and b. Copy the Qualified Electronic Signature/Seal creation data only for backup purposes, subject to the following: 1) The level of security of copied datasets must be at the same level of security of original d…

Article (28) Data Retention of the Qualified Electronic Signature/Seal 1. The Qualified Electronic Signature/Seal data retention service may be provided only by a Qualified Trust Service Provider that uses the procedures and technologies capable of extending the Trust Qualified Electronic Signature/Seal authenticity period beyond the technological validity period identified by a resolution by the TDRA. Such procedures and technologies shall have no impact on the reliability of the Qualified Electronic Signature/Seal. 2. The Qualified Trust Service Provider shall retain the authenticity of the Trust Qualified Electronic Signature/Seal for a period not less than (15) fifteen years from the ret…

Article (29) Archiving Digital Documents When government authorities archive electronic documents signed by a Reliable/Qualified Electronic Signature/Seal, they shall ensure the following: 1. To preserve the Electronic Signature/Seal from change. 2. To preserve the Electronic Signature/Seal from deletion. 3. To ensure that the Electronic Signature/Seal is recreated on a new document should any authorized change is introduced to the Electronic Document.

Article (30) Validation of the Qualified Electronic Signature/Seal 1. The Qualified Electronic Signature/Seal validation service may only be provided by a Qualified Trust Service Provider that fulfills the provisions of Article (20) of the Decree-Law, and pursuant to the resolutions issued by the TDRA in this regard. 2. The Qualified Electronic Signature/Seal data validation service provider shall identify adequate policies and practices to verify the validity of the Qualified Electronic Signatures/Seals. 3. Time information added to the result of the Qualified Electronic Signature/Seal validation shall be created by using a qualified Time Stamp. 4. The Qualified Trust Service provider shall…

Article (31) Qualified Electronic Time Stamp Creation Service 1. The Qualified Electronic Time Stamp creation service may be provided only by a Qualified Trust Service Provider that fulfills the provisions of Article (23) of the Decree-Law, and pursuant to the resolutions issued by the TDRA in this regard. 2. The Qualified Trust Service Provider that provides the Qualified Electronic Time Stamp creation service shall identify a set of adequate policies and practices to create the Qualified Electronic Time Stamp. In all cases, such policies and practices shall fulfil the technical requirements and specifications of content and structure identified by a resolution issued by the TDRA. 3. The Qu…

Article (32) Qualified Electronic Delivery Service 1. The Qualified Electronic Delivery Service may be provided only by a Qualified Trust Service Provider that fulfills the provisions of Article (24) of the Decree-Law, and pursuant to the resolutions issued by the TDRA in this regard. 2. The Qualified Electronic Delivery Service Provider shall identify the sender and the Addressee at a high level of security and trust and at a high degree of trust and acceptance, so as to eliminate any risks and prevent manipulation of the identity of the sender and the Addressee. 3. The Qualified Electronic Delivery Service Provider shall identify a set of adequate policies and practices to provide the Qual…

Article (33) Compliance Assessment 1. Any entity not approved or authorized by the TDRA may not carry out a compliance assessment for the purpose of implementing the Decree-Law and this Resolution and the resolutions issued by the TDRA in implementation of both of which, and the Competent Authorities’ requirements. 2. An entity assessing the compliance must be approved by and registered with the TDRA. 3. The Compliance Assessment entity shall draw up a report on the conformity of the License applicant or the Licensee and services provided or to be provided with the requirements set forth in the Decree-Law and this Resolution and the resolutions issued by the TDRA in implementation of both of…

Article (34) UAE Trust List 1. The TDRA shall create a list to be called “the UAE Trust List” according to the specifications set by the TDRA, and shall publish the same on its website. Such list shall include the following: a. Information on Trust Service Providers, Trust Services provided by the same and indication of the License status; and b. Information on Qualified Trust Service Providers, Qualified Trust Services provided by the same and indication of the License status and the Status of Qualified Service Provider. 2. The information referred to in Clause (1) above shall be provided by Trust Service Providers or Qualified Trust Service Providers in such a confirmed and reliable manner…

Article (35) Qualified Trust Mark 1. The TDRA shall identify, publish and manage the standards related to the form, content and presentation of the Qualified Trust Mark of the Qualified Trust Services. 2. The Qualified Trust Service Provider may use the provided Qualified Trust Mark; provided that a reference is made to the Status of Qualified Service Provider in the UAE Trust List, as follows: a. Fulfilling the Status of Qualified Service Provider and the licenses necessary for a Qualified Trust Service Provider, pursuant to the Decree-Law and this Resolution and the resolutions issued by the TDRA in implementation of both of which, and the Competent Authorities’ requirements; b. A referenc…

Article (36) Repeals Any provision contrary to or in conflict with the provisions of this Resolution shall hereby be Repealed.

Article (37) Publication and Entry into Force of the Resolution This Resolution shall be published in the Official Gazette, and shall enter into force (90) days following the publication date. Mohammed bin Rashid Al Maktoum Prime Minister Issued by us: On: Ramadan 9th, 1444 H. Corresponding to: March 31st, 2023 AD.

-- 30 of 30 --