Oman: technology regulation at a glance

Framework: Financial Services Authority (FSA) Decision No. E/35/2023, Instructions on VASP Registration and AML/CFT Compliance; proposed comprehensive Virtual Assets Regulatory Framework (consultation stage, not yet enacted)

Oman's Financial Services Authority (formerly the Capital Market Authority) introduced mandatory registration for virtual asset service providers under Decision E/35/2023 in June 2023, covering exchange, transfer, and safekeeping activities with AML/CFT obligations. A full licensing, supervision, and market-integrity framework for all virtual-asset activities, including stablecoins, token offerings, and custody, was published for public consultation and remained in the proposed stage as of 2025-2026. The Central Bank of Oman does not recognise crypto as legal tender and has cautioned that such assets are unprotected under national banking laws, but personal ownership is not prohibited.

Framework: Ministry of Transport, Communications and Information Technology (MTCIT) / Information Technology Authority (ITA), National Artificial Intelligence Policy (August 2024) and General Policy for the Safe and Ethical Use of Artificial Intelligence Systems (2025), under the National Program for AI and Advanced Digital Technologies 2024-2026

Oman governs AI through policy frameworks rather than dedicated legislation. The Information Technology Authority published the National Artificial Intelligence Policy in August 2024, establishing guiding principles for AI across public and private sectors, followed by MTCIT's General Policy for the Safe and Ethical Use of AI Systems (2025), which sets a risk-based lifecycle governance framework. No comprehensive AI statute has been enacted; a new Telecommunications and IT Regulatory Law, expected to include AI provisions, was anticipated for finalisation in 2026.

Framework: Personal Data Protection Law (Royal Decree No. 6/2022) and its Executive Regulations (Ministerial Decision No. 34/2024); supervised and enforced by the Ministry of Transport, Communications and Information Technology (MTCIT)

Oman enacted a comprehensive Personal Data Protection Law (PDPL) via Royal Decree No. 6/2022, published in Official Gazette Issue No. 1429 on 13 February 2022, which entered into force on 13 February 2023. Executive Regulations were issued in 2024 (Ministerial Decision No. 34/2024) to operationalise the law. Full enforcement by MTCIT commenced on 5 February 2026 upon conclusion of the extended transition period.

Framework: National Payment Systems Law (Royal Decree 8/2018) & Executive Regulation (CBO Decision 1/2019); Banking Law (Royal Decree 2/2025); supervised by the Central Bank of Oman (CBO)

Oman operates a mature, multi-layered licensing regime for digital payments and fintech governed primarily by the National Payment Systems Law 2018 and its 2019 Executive Regulation, with the CBO as sole regulator. The 2025 Banking Law overhaul added formal digital-bank licensing, while a December 2024 Open Banking Regulatory Framework and an active Fintech Regulatory Sandbox extend coverage to third-party providers and innovators. Instant payment volumes grew 78% year-on-year in 2025, underpinned by the CBO-operated Instant Payment System (IPS) and Mobile Payment Clearing and Switching System (MPCSS).

Framework: Foreigners' Residence and Affairs Law (Royal Oman Police); Labour Law Royal Decree No. 53/2021 (Ministry of Labour); Golden Residency Programme (Royal Decree, launched 31 August 2025, administered via omanresidence.gov.om / Invest Oman)

Oman has no officially listed dedicated digital-nomad visa on the Royal Oman Police eVisa portal. Remote workers and freelancers can pursue legal residency through a Ministry of Labour freelance/self-employment permit, which acts as self-sponsorship, or through the investor-oriented Golden Visa (10-year, OMR 500,000+) or Silver Visa (5-year, OMR 250,000+) programmes launched in August 2025. A property-owner residence visa is also available to real-estate investors.

Framework: Cybercrime Combat Law (Royal Decree 12/2011); Media Law (Royal Decree 58/2024); Personal Data Protection Law (Royal Decree 6/2022); Telecommunications Regulatory Authority (TRA) content-filtering regime; Ministry of Information licensing

Oman regulates online content and safety through overlapping instruments: the 2011 Cybercrime Combat Law criminalising harmful online speech and system intrusions; the 2024 Media Law (in force 18 November 2024) imposing mandatory Ministry of Information licensing on all digital media activities including social-media news accounts; and TRA-enforced ISP-level filtering blocking pornography, anti-Islamic content, and certain political speech. No single comprehensive online-safety statute equivalent to the EU Digital Services Act or UK Online Safety Act is in force or formally proposed; the regime is therefore characterised by partial, overlapping rules rather than a unified framework.

Framework: Royal Decree No. 52/2017 (Cybersecurity Law) and Royal Decree No. 64/2020 (Cyber Defence Centre), administered by the Ministry of Transport, Communications and Information Technology (MTCIT) and the Cyber Defence Centre (CDC) under the Internal Security Service

Oman operates a multi-layer cybersecurity regime anchored by the Cybersecurity Law (RD 52/2017) and the Cyber Defence Centre established under RD 64/2020, which together impose cross-sector security obligations and mandatory incident reporting on public and private entities. The Personal Data Protection Law (RD 6/2022), which entered full enforcement on 5 February 2026, adds a 72-hour breach notification duty, while the Cybercrime Law (RD 12/2011) criminalises digital offences. MTCIT issues binding governance guidelines and sector-specific standards supplement these foundational laws.

Framework: Foreign Capital Investment Law (Royal Decree 50/2019) and Commercial Companies Law (Royal Decree 18/2019), administered by the Ministry of Commerce, Industry and Investment Promotion (MOCIIP) via the Invest Easy e-portal (business.gov.om)

Oman permits up to 100% foreign equity in most commercial sectors following the Foreign Capital Investment Law (Royal Decree 50/2019), which removed the previous Omani-partner requirement. Company formation is handled digitally through the MOCIIP Invest Easy portal with a typical end-to-end timeline of 2-4 weeks. A ministerial negative list (Ministerial Decision 209/2020, since expanded to 123 activities) reserves specific sectors, primarily traditional crafts, small retail, and local services, exclusively for Omani nationals, and a minimum share-capital obligation applies to mainland LLCs.