Most digital products in the UAE are built to reduce friction. A small number are built to add it deliberately, because a regulator requires it, and the most instructive recent example is Play971, the UAE’s federally licensed sport and entertainment platform, which launched publicly on 5 June 2026. Its product decisions are the opposite of growth-hacking orthodoxy: identity before money, geofencing by emirate, a single currency, no crypto, mandatory limits, and an age floor above the international norm. For UAE businesses building anything that touches money, age restrictions or personal data, the Play971 launch is a case study worth reading.
This article is about product and compliance design. It takes no position on the platform itself, which many residents will have no interest in.
The regulatory setting
Play971 is operated by Coin Technology Projects LLC, an Emirati company registered in Abu Dhabi and part of the Momentum group, under licences from the GCGRA, a federal regulatory authority of the UAE government established in 2023. The regulator’s framework is two-tiered: federal standards, with each emirate’s leadership deciding whether the licensed activity is permitted within its borders. The operator ran a supervised trial from November 2025 before public launch and is the only online operator of its kind on the federal register. Every product decision below flows from a licence condition.
Lesson 1: verification before value
The platform requires a valid Emirates ID captured front and back, a live face check, a UAE mobile number confirmed by one-time code and a residential address, and it completes Play971 verification before any money can be added. This is the reverse of the pattern most products use, where onboarding is light and checks come later. The reasoning is that under the UAE’s anti-money-laundering rules the operator must know precisely who its customer is before a transaction occurs, and that front-loading the checks protects the customer later: withdrawals are not held up by sudden document demands because identity was settled at the start.
The lesson for UAE product teams is that the Emirates ID and the UAE Pass ecosystem make high-assurance onboarding feasible in minutes, and that regulators increasingly expect it. Products that handle money or are restricted to adults should assume this will be the standard.
Lesson 2: geofence by emirate, not by country
Play971 geofencing is the feature residents notice most. The platform works in Abu Dhabi, Ras Al Khaimah and Sharjah and not in Dubai, because Dubai has not opted into the federal framework. Location is verified on the device at every session, VPNs and proxies are detected and blocked, and the app declines rather than guesses when location is uncertain.
Country-level geofencing is routine; emirate-level geofencing is unusual, and the UAE’s federal structure makes it a requirement for any activity the emirates regulate individually. Product teams should note that the platform separates identity from location, so a Dubai resident can register from home and use the platform in Sharjah, which is the correct design when the two tests have different legal bases.
Lesson 3: one currency, own-name payments, no crypto
Accounts run in dirhams only. Cryptocurrency is not accepted. Every payment method must be in the account holder’s own name, and withdrawals go only to the holder’s own instruments. These constraints cost the operator conversion and were adopted anyway, because they make money traceable and accounts attributable, which is what the regulator requires. For UAE fintech and marketplace products the parallel is the Central Bank’s expectations on payment attribution, and the lesson is that a narrower payment surface is often the compliant one.
Lesson 4: build the brakes into the product
The licence requires spending limits the account holder sets in advance, session reminders, temporary pauses and a permanent exclusion tied to the Emirates ID so it cannot be bypassed by re-registering. Lowering a limit takes effect at once; raising one is deliberately delayed. The operator must also monitor accounts for patterns of heavy use and intervene. The product, in other words, is designed to let customers use it less, which is unusual and, for regulated products, increasingly expected.
Lesson 5: an age floor above the norm
The minimum age is 21, set by the regulator above the 18 used for most adult services and enforced automatically against the Emirates ID’s date of birth. The lesson is that in the UAE the regulator’s threshold, not the international one, governs, and that automated enforcement against a national ID is more defensible than a self-declared checkbox.
Lesson 6: keep the data in the country
The operator’s licence, accounts, customer records and production studio sit inside the UAE. Customer data is held under the federal Personal Data Protection Law and the regulator’s own licence conditions on security and retention. For any UAE business handling identity data the direction of travel is the same: local hosting, documented retention, and a regulator with the power to audit.
Lesson 7: accountability is the product
The clearest lesson is the one that explains the others. Before 2026, foreign websites reached UAE residents offering similar services with no licence, accepting anyone with an email, taking crypto, ignoring emirate boundaries and answering to nobody here. The licensed platform’s advantage is not features; it is that an Emirati company and a federal regulator are answerable for it, and a complaint the operator will not resolve can be escalated to the GCGRA. A regulated digital platform UAE residents can verify on a public register is a different category of product from one they cannot, and the launch demonstrates that residents can tell the difference.
Lesson 8: a supervised trial before launch
The platform ran a supervised trial in Abu Dhabi and Ras Al Khaimah for seven months before public launch, with the regulator watching verification, geofencing, payments and the account controls under real conditions. The lesson is that for a regulated product the launch is not the beginning; the trial is, and a regulator that has seen the product work in the field is a regulator that will defend the licence afterwards. UAE product teams that expect to be regulated should plan for a sandbox or trial phase as part of the roadmap, not as an obstacle to it.
Lesson 9: licensed suppliers, not just a licensed operator
The regulator licenses the operator’s suppliers as well, and the platform’s data supplier and its Abu Dhabi studio are on the register alongside it. The lesson for businesses is that a regulated product is only as compliant as its supply chain, and that choosing suppliers already known to the regulator shortens the path to launch considerably.
The product, in plain terms
For readers who want the plain description: Play971 is the UAE’s first licensed online sportsbook and online casino. The sports betting side covers the UAE Pro League, the Premier League, the Champions League and horse racing; the casino side streams live dealer games from the Abu Dhabi studio. Before June 2026 there was no legal online betting in the UAE at all; today there is one licensed betting site, and the product lessons above are the reason it was allowed to exist.
What Play971 compliance looks like from the outside
For a business evaluating whether a partner or a competitor is operating within the framework, the tells are simple: the operator’s legal name on the regulator’s public register; Emirates ID verification before any transaction; a dirham-only account; a geofence that excludes Dubai; and a named regulator with a complaints route. A platform missing any of these is outside the framework, whatever its marketing says.
Lesson 10: say plainly where you do not work
The platform’s own notice states that it is accessible within the UAE except Dubai. Most products would bury that. Stating it plainly costs the operator nothing with the regulator and builds trust with residents, who can tell the difference between a service that admits its limits and one that pretends not to have them.
Applying the lessons
For a UAE business building a regulated product, the practical takeaways are to design onboarding around the Emirates ID from the start, to treat emirate-level geofencing as a first-class requirement where an activity is regulated by emirate, to narrow the payment surface to attributable instruments, to build customer-protection controls into the product rather than bolting them on, to host identity data in the country, and to treat the regulator’s register as a marketing asset rather than a compliance burden. Residents who want to see the reference implementation can read the platform’s own terms and eligibility page at play971.ae, which state its rules in a few hundred words.
Frequently asked questions
What is Play971? The UAE’s federally licensed sport and entertainment platform, operated by Coin Technology Projects LLC in Abu Dhabi under a GCGRA licence, launched publicly on 5 June 2026.
How does Play971 verification work? Emirates ID capture, live face check, UAE mobile confirmation and address, completed before any money can be added.
Why does Play971 not work in Dubai? Dubai has not opted into the federal framework; the licence requires the operator to geofence non-participating emirates.
Who can use it? UAE residents aged 21 and over with a valid Emirates ID, in Abu Dhabi, Ras Al Khaimah or Sharjah.
What makes it different from foreign websites? An Emirati operator, a federal regulator, data and accounts held in the UAE, and a complaints route that ends at the regulator.
Play971 is restricted in the UAE to adults aged 21 and over in participating emirates. Residents should set spending limits before adding money and keep their use occasional.
