The UAE’s e-commerce sector is one of the fastest-growing in the region, and its regulatory framework has kept pace. Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means (“Decree Law”) has been in force since September 2023, establishing a comprehensive set of obligations for businesses that sell goods or services through digital channels. However, the framework lacked a detailed enforcement mechanism until the enactment of Cabinet Decision No. 200 of 2025 (“Cabinet Decision”), which came into force on 28 November 2025.
The Cabinet Decision introduced a structured, four-strike penalty regime with fines of up to AED 100,000 and the prospect of permanent closure for repeat offenders. For businesses operating in the UAE’s digital marketplace, compliance has become mandatory now.
The Decree Law applies to any natural or legal person engaging in commercial activity through modern technological means within the UAE, or whose services are received from outside it. "Modern technological means" is defined broadly to include websites, platforms, smart applications, and any electronic, digital, AI-based, blockchain, or biometric tools used in the course of trade. It also extends to social commerce, meaning sales through Instagram, TikTok, WhatsApp, and similar platforms falls within its scope.
Free zones are not exempt. The Decree Law applies to free zone entities where goods or services are sold or provided outside the geographic limits of the free zone, or where the relevant free zone has no e-commerce legislation of its own.
Article 2 excludes government procurement, non-commercial platforms and applications, digital currencies supervised by the Central Bank, and transactions undertaken by licensed financial institutions and insurance companies in connection with their regulated activities.
Article 5 of the Decree Law sets out the baseline obligations that apply to all those trading through modern technological means. They are :
Transparency of terms and pricing: All terms, conditions, prices, logistics fees, and digital payment charges must be disclosed clearly before any transaction takes place. The act of purchase is treated as the consumer’s consent to those terms, but anything not disclosed upfront cannot be imposed later.
Itemised invoicing: A detailed invoice must be provided for every purchase.
Complaints infrastructure: Businesses must maintain an accessible complaints system, including dedicated contact numbers, complaint tracking, and publicly available licensing, address, contact, and website details.
Digital security: Merchants must provide a secure digital environment that complies with cybersecurity and e-security standards prescribed by the Competent Authority.
No undisclosed fees: Logistics services and digital payment fees should not exceed what is specified in the digital contract or published terms. Imposing additional fees are direct violations of Articles 14 (3) and 15 (3) of the Decree Law and shall be penalized with fines ranging from AED 500 to AED 20,000.
Data handling: Consumer data and information is subject to UAE data protection legislation and may not be shared or disclosed without prior consent unless a separate legal justification applies.
Article 7 of the Decree Law grants consumers a clear right to return or exchange goods purchased through digital channels where the goods are defective, incomplete, damaged, or contrary to their description on delivery; where delivery delay has rendered the goods no longer useful to receive; or where the goods or services breach the terms of the digital contract. Merchants may not obstruct the exercise of this right.
That said, the right is not open-ended. It is lost where the consumer has used the goods other than to verify the absence of a defect, where the applicable return period has expired, where the goods are perishables with a shelf life of three weeks or less, or where the item is a book, film, or program that can only be used or accessed once .
Consumers also hold a statutory right to opt out of marketing communications and to access a neutral rating mechanism for their experience with the merchant, the goods, and the delivery and payment services used.
The Cabinet Decision is, in structure, a four-strike regime. Most violations begin with a written warning and a 15-day rectification window. Subsequent violations result in financial penalties ranging from AED 500 to AED 100,000 depending on the nature of the breach, with temporary or permanent closure available from the third offence onwards.
Furthermore, continuing a violation after the warning period expires is treated as a new and independent violation. Fines can accumulate quickly and the Ministry of Economy also retains full discretion to impose the maximum penalty immediately where a breach is considered sufficiently serious.
These penalties operate alongside sanctions available under other applicable legislation, including consumer protection laws. A party may file a grievance within 30 days of notification, which must be decided within 30 days. If no decision is issued within that period, the grievance is deemed rejected, while any decision issued on the grievance is final.
Under Article 9 the Decree Law gives UAE courts jurisdiction over disputes arising from its application. Arbitration is available where the parties have an arbitration agreement, but with a material restriction that a digital contract whose value is less than AED 50,000 may not contain a condition requiring arbitration.
The combined effect of Federal Decree-Law No. 14 of 2023 and Cabinet Decision No. 200 of 2025 is clear: e-commerce businesses in the UAE are now operating within a fully developed regulatory framework. The Decree Law sets out the standards merchants are expected to meet, while the Cabinet Decision gives regulators a practical enforcement mechanism to address non-compliance.
With penalties now in force and the Ministry empowered to take action in serious cases without following the usual escalation process, compliance is no longer something businesses can afford to postpone. The framework also sits alongside other applicable UAE laws, meaning a single breach may carry consequences beyond the e-commerce regime itself.
For businesses selling goods or services through digital channels, the focus should now be on ensuring that internal processes, customer-facing practices, and contractual arrangements align with the requirements of the law. In an increasingly regulated digital marketplace, proactive compliance will be far less costly than reacting to an enforcement action.
Note: This Legal Update / Newsletter is intended for general informational purposes only and should not be construed as legal advice. It is based on laws and legal interpretations in effect as of the date of publication. Laws and regulations may change over time, and their application can vary depending on individual circumstances. Readers are strongly encouraged to seek specific legal counsel before acting on any of the information provided herein.
The Cabinet Decision introduced a structured, four-strike penalty regime with fines of up to AED 100,000 and the prospect of permanent closure for repeat offenders. For businesses operating in the UAE’s digital marketplace, compliance has become mandatory now.
Who This Law Applies To
The Decree Law applies to any natural or legal person engaging in commercial activity through modern technological means within the UAE, or whose services are received from outside it. "Modern technological means" is defined broadly to include websites, platforms, smart applications, and any electronic, digital, AI-based, blockchain, or biometric tools used in the course of trade. It also extends to social commerce, meaning sales through Instagram, TikTok, WhatsApp, and similar platforms falls within its scope.Free zones are not exempt. The Decree Law applies to free zone entities where goods or services are sold or provided outside the geographic limits of the free zone, or where the relevant free zone has no e-commerce legislation of its own.
Article 2 excludes government procurement, non-commercial platforms and applications, digital currencies supervised by the Central Bank, and transactions undertaken by licensed financial institutions and insurance companies in connection with their regulated activities.
Core Obligations on Digital Merchants
Article 5 of the Decree Law sets out the baseline obligations that apply to all those trading through modern technological means. They are : Transparency of terms and pricing: All terms, conditions, prices, logistics fees, and digital payment charges must be disclosed clearly before any transaction takes place. The act of purchase is treated as the consumer’s consent to those terms, but anything not disclosed upfront cannot be imposed later.
Itemised invoicing: A detailed invoice must be provided for every purchase.
Complaints infrastructure: Businesses must maintain an accessible complaints system, including dedicated contact numbers, complaint tracking, and publicly available licensing, address, contact, and website details.
Digital security: Merchants must provide a secure digital environment that complies with cybersecurity and e-security standards prescribed by the Competent Authority.
No undisclosed fees: Logistics services and digital payment fees should not exceed what is specified in the digital contract or published terms. Imposing additional fees are direct violations of Articles 14 (3) and 15 (3) of the Decree Law and shall be penalized with fines ranging from AED 500 to AED 20,000.
Data handling: Consumer data and information is subject to UAE data protection legislation and may not be shared or disclosed without prior consent unless a separate legal justification applies.
Consumer Rights and Return Obligations
Article 7 of the Decree Law grants consumers a clear right to return or exchange goods purchased through digital channels where the goods are defective, incomplete, damaged, or contrary to their description on delivery; where delivery delay has rendered the goods no longer useful to receive; or where the goods or services breach the terms of the digital contract. Merchants may not obstruct the exercise of this right.That said, the right is not open-ended. It is lost where the consumer has used the goods other than to verify the absence of a defect, where the applicable return period has expired, where the goods are perishables with a shelf life of three weeks or less, or where the item is a book, film, or program that can only be used or accessed once .
Consumers also hold a statutory right to opt out of marketing communications and to access a neutral rating mechanism for their experience with the merchant, the goods, and the delivery and payment services used.
The Enforcement Regime: Cabinet Decision No. 200/2025
The Cabinet Decision is, in structure, a four-strike regime. Most violations begin with a written warning and a 15-day rectification window. Subsequent violations result in financial penalties ranging from AED 500 to AED 100,000 depending on the nature of the breach, with temporary or permanent closure available from the third offence onwards.Furthermore, continuing a violation after the warning period expires is treated as a new and independent violation. Fines can accumulate quickly and the Ministry of Economy also retains full discretion to impose the maximum penalty immediately where a breach is considered sufficiently serious.
These penalties operate alongside sanctions available under other applicable legislation, including consumer protection laws. A party may file a grievance within 30 days of notification, which must be decided within 30 days. If no decision is issued within that period, the grievance is deemed rejected, while any decision issued on the grievance is final.
Dispute Resolution: A Note on Arbitration
Under Article 9 the Decree Law gives UAE courts jurisdiction over disputes arising from its application. Arbitration is available where the parties have an arbitration agreement, but with a material restriction that a digital contract whose value is less than AED 50,000 may not contain a condition requiring arbitration.
Conclusion
The combined effect of Federal Decree-Law No. 14 of 2023 and Cabinet Decision No. 200 of 2025 is clear: e-commerce businesses in the UAE are now operating within a fully developed regulatory framework. The Decree Law sets out the standards merchants are expected to meet, while the Cabinet Decision gives regulators a practical enforcement mechanism to address non-compliance.With penalties now in force and the Ministry empowered to take action in serious cases without following the usual escalation process, compliance is no longer something businesses can afford to postpone. The framework also sits alongside other applicable UAE laws, meaning a single breach may carry consequences beyond the e-commerce regime itself.
For businesses selling goods or services through digital channels, the focus should now be on ensuring that internal processes, customer-facing practices, and contractual arrangements align with the requirements of the law. In an increasingly regulated digital marketplace, proactive compliance will be far less costly than reacting to an enforcement action.
Note: This Legal Update / Newsletter is intended for general informational purposes only and should not be construed as legal advice. It is based on laws and legal interpretations in effect as of the date of publication. Laws and regulations may change over time, and their application can vary depending on individual circumstances. Readers are strongly encouraged to seek specific legal counsel before acting on any of the information provided herein.