Enterprise blockchain, from concept to production

Blockchain and Web3 development in the UAE

Blockchain projects in this region rarely fail on the technology. They fail because the build starts before anyone has settled which regulator the product answers to, and that answer changes what you are allowed to hold, issue and settle.

The UAE runs parallel regimes. Dubai’s Virtual Assets Regulatory Authority was established under Law No. 4 of 2022 and issued the Virtual Assets and Related Activities Regulations in February 2023, covering the emirate and its free zones but excluding the DIFC. Abu Dhabi Global Market operates its own virtual asset framework through the Financial Services Regulatory Authority. The Central Bank of the UAE issued the Payment Token Services Regulation on 7 June 2024, in force from 6 July 2024, under which dirham payment tokens require a full CBUAE licence and foreign payment tokens require registration, with the DIFC and ADGM carved out.

We are engineers, not licensing advisers. What we do is build systems that fit the regime your counsel has already selected. Custody boundaries, reserve reporting, transfer restrictions and audit trails get designed in from the first sprint instead of retrofitted the week a regulator asks for evidence.

What we build

Smart contracts and token systems

Solidity contracts on EVM chains, written against an explicit threat model and tested with Foundry and Hardhat before any third-party audit begins. We use ERC-20, ERC-721 and ERC-1155 where the standard genuinely fits and custom logic where it does not. Upgrade paths, pause controls and key rotation are part of the first design conversation, because a production contract outlives the team that wrote it.

Permissioned enterprise ledgers

Hyperledger Fabric and comparable permissioned networks for consortium cases where participants are known and the data cannot be public: trade documentation, supply chain provenance, multi-party reconciliation between banks, insurers or logistics operators. The engineering question here is governance and membership, not throughput.

Tokenization and real-world assets

Representing funds, receivables, real estate interests or commodity positions on-chain, with the parts that actually decide the outcome: whitelisting and transfer restrictions enforced at contract level, an off-chain register that reconciles to the chain, redemption and corporate action handling, and a reporting feed your auditor can read without a blockchain explorer.

Wallets, custody and key management

Multi-party computation and HSM-backed signing, multi-signature approval flows, hot and cold segregation, and withdrawal policy engines. Most incidents in this space are key management failures rather than contract exploits, so this is where we spend disproportionate design time.

Web3 application layer

The interface people actually touch: wallet connection, gasless and sponsored transactions through account abstraction, transaction status that stays honest during chain congestion, and fallbacks for users who will never manage a seed phrase. Indexing and event pipelines so the product is not waiting on a public RPC endpoint at peak load.

Integration with the systems you already run

A chain is only useful when it reconciles to the ledger of record. We connect on-chain events into SAP and Oracle environments, treasury and core banking systems, and the reporting stack, so finance sees one position rather than two. That integration work is usually where a proof of concept becomes a system the business can operate. See our ERP implementation and integration practice for how that side is handled.

How a blockchain engagement runs

Discovery and regime fit. Two to three weeks. We map the use case against the regulatory position your legal team has taken, decide public versus permissioned, and produce a reference architecture with the custody and compliance boundaries drawn.

Prototype. Four to six weeks. A working slice on testnet, covering the hardest path rather than the easiest one, with a threat model and a test suite already in place.

Hardening and audit. Internal review, fuzzing and invariant testing, then an independent audit. We handle remediation and re-audit as part of the engagement rather than as a change request.

Production and operations. Deployment, monitoring, key ceremony, incident runbooks, and an upgrade process the team can execute without us in the room.

Our stack

Solidity, Rust, Foundry, Hardhat, OpenZeppelin, Ethereum and EVM-compatible chains, Hyperledger Fabric, IPFS, The Graph, ethers.js and viem, MPC and HSM custody providers, Chainlink oracles, and the CI, observability and cloud tooling described on our cloud and DevOps page.

Frequently asked questions

Do you help with Web3 company setup or licensing in Dubai?

No. Company formation and virtual asset licensing are legal and corporate services, and you should use a licensed adviser for both. We build the software, and we build it to fit the licence you hold or intend to apply for.

Public chain or private ledger?

It depends on who needs to verify what. If the value comes from participants who do not trust each other being able to verify independently, a public or consortium chain earns its complexity. If every participant is known and contracted, a permissioned ledger or a well-designed database with strong audit properties is usually the cheaper and more maintainable answer. We will say so when that is the case.

How long does a blockchain project take?

A production-ready prototype typically lands in six to ten weeks. A full launch including independent audit, custody setup and integration into existing finance systems generally runs three to six months, and the integration work is almost always the longer half.

What does it cost?

There is no list price, because scope varies by an order of magnitude between a single token contract and a custody-bearing tokenization platform. We work through fixed-scope phases, dedicated teams, or managed services once you are live. Tell us the use case and we will give you a shaped estimate rather than a range that means nothing.

Do you get contracts audited?

Yes. We test internally first, then bring in an independent auditor, then fix and re-audit. We do not treat our own review as a substitute for a third party, and we will not deploy value-bearing contracts that have not been audited.

Can you work with our existing contracts or a half-finished project?

Often, yes. We start with a code and architecture review so both sides know what is salvageable before anyone commits to a plan. If the honest answer is that a rebuild costs less than the repair, we will tell you that in the review rather than six weeks into a contract.

Do you work outside the UAE?

Yes. We deliver across the GCC, with Saudi Arabia the most common second market. Regulatory grounding changes by jurisdiction, so the architecture conversation restarts for each market rather than being copied across.

If you are scoping a blockchain or Web3 build in the UAE and want an engineering view before committing budget, talk to our team. You can also see how we approach delivery across our case studies.