’Web3’ is a term that has come from virtually nowhere to now regularly find itself rolling off the tongues of senior bankers as often as it does those of young start-up founders. Interest in the concept has even spread from the co-working spaces of California to the business districts of Abu Dhabi, Dubai and Riyadh. In this article, we explore UAE and GCC-specific issues to be aware of in the context of Web3 M&A transactions.
What Is Web3?
Web3 is the third generation of the internet. Whilst Web2 entails centralised control of key aspects of the internet (including internet searches and social networking), Web3’s technologies are all about decentralisation.
Trends And Developments In The UAE
The UAE’s technology and Web3 space has seen significant growth in recent years. Reports suggest there were upwards of 1,000 industry participants operating in the Web3 space in the UAE at the start of 2023. Such growth in the UAE’s Web3 sector is expected to continue and provide further support to the UAE Government’s ambition to develop its digital economy, which it anticipates will contribute to approximately 20 per cent of the country’s GDP over the next decade.
The rise of the UAE’s prominence as one of the key players on the world’s technology stage has been supported by significant investment from both local investors (including its sovereign wealth funds) and the UAE Government, which has been instrumental in cultivating a risk-sensitive and business-friendly regulatory landscape, as well as exhibiting strong commitment to support the development of start-ups in this area. For instance, the Government of Abu Dhabi has contributed USD 2 billion to Hub 71+ Digital Assets, an accelerator initiative established to specifically support the growth and development of Web3 and blockchain technology start-ups.
Key Considerations For Web3 M&A Transactions
But what Web3-specific points should an investor think about before engaging in M&A in the Web3 space in the UAE or GCC more widely?
Financial Services Regulation
When buying a Web3 business in any jurisdiction, it is important to understand whether a regulated activity is being undertaken from a financial services regulatory perspective.
In the context of UAE financial services regulation, there are two categories of jurisdiction. First, there is ‘onshore UAE.’ This comprises the geographic territory of the UAE’s seven emirates and includes over 40 economic free zones, but excludes the UAE’s two financial free zones. The regulation of financial services in onshore UAE falls to the Central Bank of the UAE (CBUAE) and the Securities and Commodities Authority (SCA). Since February 2022, a further regulator authority, the Virtual Asset Regulatory Authority (VARA), has governed virtual asset activities in the emirate of Dubai (but excluding the Dubai International Financial Centre (DIFC)).
The second of these categories constitutes ‘offshore UAE’. This comprises the UAE’s two financial free zones – DIFC and Abu Dhabi Global Market (ADGM). In DIFC, regulated financial activities are governed by the Dubai Financial Services Authority (DFSA), whilst in ADGM, the Financial Services Regulatory Authority (FSRA) is responsible for regulating such activities.
Ultimately, irrespective of whether a Web3 business is regulated by the CBUAE, SCA, VARA, DFSA or FSRA, if it is regulated, it will be required to comply with a series of anti-money laundering, consumer protection, and corporate governance obligations and standards. A buyer will therefore need to do due diligence on the extent to which the target group has implemented the required policies and procedures. The UAE and its financial free zones also have various requirements as regards the officers of a regulated business that must be appointed as well as their physical location. Equivalent obligations exist in Saudi Arabia but with additional requirements to hire Saudi nationals for certain roles.
If a regulated business in the UAE undergoes a change of control, the regulated entity will need to obtain the approval of the relevant regulator. This means that conditions precedent will likely need to be built into the share purchase agreement and factored into transaction timing, as obtaining such regulatory approvals may take several months.
Data Privacy And Digital Regulation
The free flow of personal data and the ability to process, store and monetise it, is integral to many Web3 businesses. However, Web3 businesses can face particular challenges. For example, the nature of decentralised technologies like blockchain (which constitutes one of the foundational elements of Web3) is such that once data is stored within them, it is virtually impossible to remove. This poses obvious challenges in respect of certain data protection requirements. For example, it makes compliance with an individual’s right to be forgotten (which can now be found in the data privacy laws being enacted in a number of GCC States) far more challenging.
Much is changing across the GCC. The UAE’s two financial free zones have both updated their data privacy regimes in the last three years, while the UAE introduced its first onshore data privacy law in September 2021. Saudi Arabia also recently amended its first ever sector wide data privacy law of general application, which was itself only released in 2021. Final executive regulations fleshing out the requirements in each of the latter two jurisdictions are yet to be released. Yet more change is therefore on the horizon.
There are also examples of GCC jurisdictions going beyond the regulations that exist in Europe. For example, the DIFC has proposed amendments to its Data Protection Regulations that seek to provide guidance to companies using digital enablement technology systems such as artificial intelligence. Relevant agencies in Saudi Arabia are also implementing cutting edge data privacy and technology regulations that regulate matters ranging from digital transformation and the internet of things, to digital content and open banking.
Whilst varying in their levels of sophistication, each of these regimes are clearly inspired by the EU’s GDPR and impose similar obligations on businesses. As part of their diligence exercise, buyers therefore need to obtain an understanding of how personal data is used by a target group, the quality of the processes and procedures it has in place, and the extent to which there may have been breaches of applicable requirements. In this context, it is now market standard for buyers of GCC assets to ask for far more robust warranty packages covering financial services regulatory, data privacy and cybersecurity compliance than was the case seven or eight years ago.
IP rights are often the most valuable assets of a Web3 business. In the UAE, the protection of IP rights is now further supported by patent, trademark and copyright laws newly issued in 2021. Together these laws comprise the most significant reform of the UAE’s IP protection for many years.
As part of a prospective buyer’s due diligence investigation into a Web3 business, it will need to ascertain what IP rights the business owns, and whether this is through copyright or registered IP rights. Equally, the buyer will need to carefully assess the target group’s existing IP licences and agreements in order to determine the extent to which the transaction impacts such arrangements. For instance, if open-source code underpins any part of a target group’s propriety software, this may have implications for the target group’s ownership of the software as well as its ability to commercialise it in the future. The employment contracts of the target group’s employees should also be examined to ensure appropriate provisions are in place to assign any IP rights arising out of the employee’s employment back to the business.
For several decades, the UAE has had in place a series of foreign ownership restrictions. Until recently, this meant that 100 per cent foreign ownership of UAE companies was only possible in the UAE’s free zones. By contrast, 100 per cent foreign ownership in Saudi Arabia has long been permitted, subject to obtaining Government permission to acquire the shares in question.
As things stand, a potential investment in onshore UAE now falls into one of three categories. The first category comprises business activities that are on a “positive list”. The majority of Web3 businesses will fall into this category. It is now possible for these businesses to be owned entirely by a foreigner. The second category comprises so-called “strategic impact activities”, which constitute commercially sensitive business activities. From a Web3 perspective, an investor should note that these strategic impact activities include certain financial services and telecommunications activities. Some Web3 businesses will therefore run the risk of falling into this category. If that is the case, the investor will need to discuss with the relevant UAE regulatory authority whether it is permitted to acquire the shares and what percentage of foreign ownership will be allowed. The third category comprises activities that fall outside of the first two categories. In this third category, it is understood that the previous foreign ownership restrictions (ie 49 per cent foreign ownership / 51 per cent Emirati ownership) apply.
Web3 may be the world of tomorrow, but the technologies underpinning it present huge opportunities for investors today. Those wishing to embrace the new reality have much to gain but should keep in mind the above considerations when navigating a unique web of legal and commercial issues in the UAE and GCC more widely.
Stefan is a Corporate M&A/Regulatory Partner at White & Case, Dubai. He advises Middle East and Western corporates, financial institutions, fintechs and technology companies in connection with corporate M&A, joint venture, financial services regulatory and tech matters. Any views expressed in this publication are strictly those of the authors and should not be attributed in any way to White & Case LLP.
Gabrielle is a UK-qualified lawyer based in White & Case’s Dubai office, advising FinTech companies, large technology conglomerates and financial institutions on a range of contentious and non-contentious matters through the Middle East. Gabrielle has worked on a variety of matters, including writing data protection laws, payments laws, and FinTech specific legislation for governments, ministries and regulatory authorities across the GCC, as well as advising on matters related to digital assets (including cryptocurrency, utility tokens, investment tokens and security tokens), technology-specific anti-money laundering and sanctions requirements and financial services licensing. She has been recognised as the Rising Star of the Year 2023 in LexisNexis Women in Law Middle East Awards and as an “Associate to Watch” for UAE FinTech in the 2023 Chambers rankings. Any views expressed in this publication are strictly those of the authors and should not be attributed in any way to White & Case LLP.
Arnold is an associate in the White & Case Dubai office, having joined from the London office of Kirkland & Ellis in October 2022. Arnold has experience advising alternative investment funds, fund managers, GCC sovereigns and investment firms across a wide range of matters with a principal focus on financial services regulatory (including acquisitions in the financial services sector), funds and funds regulatory matters in the DIFC, the ADGM, mainland UAE and the wider Middle East region. He also has experience advising technology companies and fintechs on matters related to technology, Web3, the metaverse and digital tokens. Any views expressed in this publication are strictly those of the authors and should not be attributed in any way to White & Case LLP.
Serena is a Paralegal at White & Case, Dubai. She has experience advising international and MENA-based technology and fintech companies, financial institutions, and multinational conglomerates with regards to varying technology, data protection and privacy matters, financial services regulation as well as general corporate M&A matters. Any views expressed in this publication are strictly those of the authors and should not be attributed in any way to White & Case LLP.