Source Code Escrow in Dubai: What Happens to Your Software If the Developer Disappears (2026)

Short answer: source code escrow is a three-party agreement — you, your software vendor and a neutral escrow agent — under which the agent releases the code to you if the vendor dies, defaults or disappears. It is worth having on a business-critical build, and it is also far weaker than most Dubai buyers assume: under the UAE’s Federal Decree-Law No. 51 of 2023 a release clause triggered purely by your vendor’s insolvency can be treated as void, and industry verification data has long shown that around two-thirds of escrow deposits arrive incomplete. For most Dubai SMEs the cheaper and stronger move is to own the repository from day one, so the escrow never has to work.

The risk nobody prices into a Dubai software contract

Dubai is the easiest place in the region to start a software company, which is exactly why it is also an easy place for one to vanish. Dubai’s Department of Economy and Tourism processed 231,989 commercial licence transactions in the first half of 2026 — 58,337 new licences across mainland and free zones, plus 173,652 renewals — after an 84% rise in licences issued between 2023 and 2025 versus 2020–2022. A market that opens that fast also churns.

Scale matters too. SMEs are roughly 95% of all Dubai businesses, employ about 42% of the workforce and contribute close to 40% of Dubai’s GDP; nationally they account for over 94% of UAE companies and more than 60% of non-oil GDP. The agency or product vendor holding your booking engine, your clinic portal or your logistics dashboard is statistically an SME itself — often smaller than you.

And vendor mortality is not theoretical right now. Carta logged 966 venture-backed startup shutdowns in 2024, up more than 25% on 769 in 2023, with three in four at pre-seed or seed; 2026 has been a record year for closures, concentrated in the 2019–2021 cohort that raised on cheap money and ran out. CB Insights still puts running out of capital at around 70% of venture-backed failures. If your SaaS supplier is one of those companies, your continuity plan is their bank balance.

Most Dubai businesses get this wrong in the same way: they negotiate hard on price and delivery dates, and spend zero minutes on what happens on the day the vendor stops answering email.

What source code escrow actually is

Three parties sign one agreement. The depositor (your vendor) lodges the source code and build materials with an escrow agent. You are the beneficiary. The agent holds the deposit, re-verifies it on an agreed cadence, and releases it to you only when a defined release event occurs. Typical release events:

Insolvency, liquidation or receivership of the vendor.
Ceasing to trade or abandoning the product line.
Material breach of the support or maintenance obligation, unremedied after notice.
Loss of a required licence or failure to renew the trade licence.

Alongside the release trigger you need a licence that actually lets you use what you receive. That is a UAE-specific trap. Under Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights, software is a protected work and handing over a copy does not hand over the economic rights — the author’s disposal of the original copy of a work does not, absent agreement, assign any economic right in it. Receiving a ZIP of code with no written assignment or licence gives you a folder you are not legally cleared to compile, modify and deploy. The written instrument is the whole protection.

The UAE clause that quietly breaks your escrow

Here is the myth-bust. Federal Decree-Law No. 51 of 2023 on Financial Restructuring and Bankruptcy was gazetted on 31 October 2023, came into force on 1 May 2024, and its executive regulations (Cabinet Resolution No. 94 of 2024) were published on 16 September 2024. Since 15 July 2025 cases have been heard by a dedicated Bankruptcy Court.

That law deliberately protects a distressed debtor’s contracts. Where preventive settlement proceedings are opened, the decision does not accelerate debts or suspend or terminate the debtor’s valid contracts — and any contractual provision to the contrary is treated as null and void. A debtor can also sit behind a moratorium of three to six months from acceptance of the petition, and for complex restructurings the court has flexibility to run longer. Termination at the counterparty’s request is a matter for the court, on a motion, where the debtor has actually breached.

Read that against the standard escrow template and the problem is obvious: the most common release trigger in circulation is “upon the depositor entering insolvency proceedings.” Onshore in the UAE that is precisely the kind of automatic, insolvency-triggered contractual right the statute is designed to neutralise. Your paper can be perfect and still produce a stand-off at the worst possible moment.

What to do instead, in order of value:

Trigger on performance, not on status. “Failure to deliver the contracted support service levels for 30 consecutive days” is a breach you can evidence. “The vendor is insolvent” is a status the court may protect.
Choose your forum deliberately. DIFC and ADGM are common-law jurisdictions with their own insolvency regimes and English-language courts. An escrow agreement governed by DIFC law with a DIFC agent behaves very differently from an Arabic-language onshore dispute.
Make the licence present, not future. Grant the beneficiary licence at signature, conditional only on the deposit being released — rather than agreeing to grant one later, when the vendor’s signature is unobtainable.

Code alone will not save you

The second failure mode is purely technical, and it is worse than the legal one. Escrow verification data from Iron Mountain’s technology escrow practice — the business NCC Group acquired for USD 220 million in 2021 and sold on to TDR Capital affiliates for about USD 369 million in 2026 — has for years reported that roughly 66% of deposits are incomplete and around 92% require additional input from the original programmers before they can be built. Broader industry estimates put incomplete deposits at 80–90%. Those figures predate the cloud era, and nothing about modern delivery has made them better.

Because what you need in 2026 is not “the code.” It is the ability to run the thing. A deposit that is genuinely useful contains:

Source, with full history — not a snapshot, so you can see what changed and why.
Build and dependency manifests plus a working lockfile, so the build is reproducible.
Infrastructure as code — the Terraform, Docker and pipeline definitions that stand the environment up.
Third-party inventory: every SaaS dependency, API key scope, payment-gateway account and licence the app calls, with renewal dates.
Secrets handling and data: how credentials are injected, and for SaaS, a current export of your data in a documented schema.
A runbook written for a competent stranger, not for the person who wrote it.
Domain, DNS and store accounts in your own name — the part that strands more Dubai projects than code ever does. See our note on website and domain ownership handover.

Verification is the only part that proves anything

Agents sell verification in tiers, and the cheapest tier proves almost nothing. A Level 1 service confirms a file listing exists. The level that matters is a full build-and-run test: the agent compiles the deposit in a clean environment from the documentation supplied and confirms the application starts. If your escrow has no build verification, you have bought a receipt for an envelope nobody has opened.

What it costs in Dubai

List prices are published in USD or GBP; the AED column below converts at USD 1 = AED 3.6725 (the UAE’s pegged rate), rounded. Treat these as the floor — verification, extra beneficiaries and release handling are charged on top.

Option	List price	Approx. AED / year	What you actually get
Codekeeper, single beneficiary	USD 139/mo billed annually + USD 249 setup	~AED 6,130 + AED 915 once	1 agreement, 1 TB, unlimited deposits; basic verification free, deeper tiers priced
Codekeeper, multi (up to 5)	USD 259/mo billed annually + USD 249 setup	~AED 11,420 + AED 915 once	Up to 5 agreements, 2 TB
EscrowTech, single beneficiary	USD 1,595/yr + USD 995 setup	~AED 5,860 + AED 3,655 once	Fees locked 3 years; Level 1 verification from USD 295 (~AED 1,085), Levels 2–5 quoted
Escode (ex-NCC / Iron Mountain)	from ~GBP 1,600/yr, scope-quoted	roughly AED 7,500–8,000	Enterprise paper and verification depth; price only firms up after a scoping call
Release processing	USD 199/hour (Codekeeper, 24/7)	~AED 730/hour	Billed when you actually invoke the release — budget for it
Own the repo from day one	AED 0 ongoing	AED 0	Requires it be written into the build contract; see below

So a verified single-beneficiary escrow on one business-critical system realistically lands around AED 7,000–15,000 in year one and AED 6,000–12,000 a year after that, before release costs. Against a mid-market Dubai custom build in the AED 150,000–600,000 range that is cheap insurance — and still the wrong first purchase for most buyers, for the reason two sections down.

Who in the UAE is actually required to have an exit plan

If you are a licensed financial institution, this stopped being optional years ago. CBUAE Circular No. 14/2021 and the accompanying Outsourcing Standards for Banks took effect on 15 July 2021: outsourcing a material business activity requires a CBUAE non-objection, a board-approved policy, an outsourcing register, audit and exit rights, and a written exit strategy capable of bringing the function back in-house or moving it to another provider with data returned in usable form.

It tightened again this year. The Operational Risk Management Regulation, Circular No. 1/2026, was issued on 3 February 2026 and became effective on 14 September 2026. It requires licensed financial institutions to retain enough in-house expertise and oversight rather than relying excessively on outsourcing, lets the CBUAE require termination of third-party arrangements that critical operations are overly dependent on, mandates a strategy and timeline for replacing obsolete and unsupported software, and requires the institution’s Master System of Record to be maintained inside the UAE — including where the function is outsourced. Significant changes to critical operations need 30 calendar days’ notice, an external expert’s report and a written no-objection before implementation.

Read as a procurement rule, that is a mandate: if a UAE bank, insurer, exchange house or payment firm depends on your software, it needs demonstrable continuity — code, data and runbook — not a vendor’s assurance. DIFC and ADGM firms sit under their own regulators’ outsourcing rules with the same shape. If you sell into any of those buyers, a verified escrow is a sales asset, not a cost: it closes a procurement objection that otherwise stalls deals for months.

The cheaper move most Dubai SMEs should make instead

Escrow is a mitigation for a problem you can usually avoid creating. If you commission custom software, the default should be that you own the repository, the cloud accounts and the domains from the first commit — the vendor works inside your GitHub organisation and your AWS or Azure tenant, under your billing. Then there is no release event to litigate, no deposit to verify, no agent to pay and no three-to-six-month moratorium to sit behind. The code is simply yours, continuously, and a second agency can pick it up in a week.

Get these five lines into the contract before you sign — they cost nothing at negotiation and are near-impossible to retrofit:

Written assignment of economic rights in all deliverables to you on payment, expressly under Federal Decree-Law No. 38 of 2021, with third-party and open-source components listed and their licences disclosed.
Repository and cloud accounts in your name, vendor added as a collaborator — not the reverse.
Reproducible build obligation: a documented clean-machine build, tested at each milestone, not at the end.
A credential and third-party register maintained as a living document and handed over at every milestone.
Performance-based termination and handover triggers, with a 30-day handover duty and a defined deliverable list — drafted to work alongside, not against, Decree-Law 51/2023.

Escrow is then reserved for the cases where it is genuinely the only option: licensed third-party products you did not commission, and SaaS platforms where the vendor will never hand over the repository. In that situation, insist on verification and a data export, not just a deposit.

How Aquarius does it

We build inside your accounts by default. Repository, cloud tenant, domain and app-store entries are created in your name on day one; every deliverable ships with a reproducible build, an infrastructure-as-code definition and a runbook written for someone who has never met us. At handover you get a continuity pack, not a tarball. If you have inherited a project where none of that is true, our technical due diligence and code audit establishes what you actually hold before you spend another dirham on it — and our note on fixed-price versus time and materials contracts covers the commercial half of the same problem. Transparent ranges are on our pricing page.

FAQ

Is source code escrow legally enforceable in the UAE?

The agreement itself is enforceable as a contract. The weak point is the trigger: under Federal Decree-Law No. 51 of 2023, opening preventive settlement proceedings does not suspend or terminate the debtor’s valid contracts and a contrary contractual provision can be void, so an insolvency-triggered release may not operate as drafted onshore. Draft performance-based triggers and consider DIFC or ADGM law with a DIFC-based agent. Take UAE legal advice on the specific wording — this is an engineering view, not a legal opinion.

Can I get escrow for a SaaS product rather than installed software?

Yes, and it is a different product. SaaS escrow has to cover the running environment and your data, not just the code: infrastructure definitions, container images, configuration, third-party service inventory and a scheduled export of your own records. Code-only SaaS escrow is close to worthless because you cannot stand the service up from it.

Are there escrow agents in Dubai, or do I have to use one abroad?

Both exist. DIFC hosts DFSA-regulated escrow and fundholding firms, and several specialist software-escrow providers write UAE and GCC-jurisdiction agreements, including ones aimed specifically at UAE financial institutions under DIFC and ADGM frameworks. Cloud-based international agents are cheaper and faster to set up; a local or DIFC-governed agent is easier to enforce against and usually what a regulated buyer wants to see.

How often should the deposit be updated?

Tie it to your release cadence, not the calendar. If you deploy weekly, an annual deposit means your fallback is up to a year stale — a year of schema migrations you cannot replay. Continuous or per-release deposits straight from the repository, with periodic build verification, are the only version that survives contact with reality.

We already pay for escrow. How do we know it works?

Ask the agent for the verification report and check which level it covers. If it only confirms that files were received, commission a build-and-run verification against the current deposit. The honest test is simpler still: give a competent engineer who has never seen the system the deposit and the runbook, and a deadline. Whatever they cannot start, you do not own in any useful sense.

The decision, in one line

Buy escrow when you cannot own the code; own the code whenever you can. The cost of getting this wrong is not the escrow fee — it is a frozen business-critical system, a vendor protected by a statutory moratorium, and a rebuild priced at a large share of the original AED 150,000–600,000 build while revenue stops. The cost of getting it right is a handful of clauses in a contract you are signing anyway.

Commissioning a build in Dubai this quarter, or inherited one you are not sure you own? Send us the contract and the repo link — we will tell you in one call what you actually control and what it would take to recover it.