New Regulatory Framework for Digital Platforms and Services in Iraq
Banking & Finance / Iraq
The FDP marks the first comprehensive legal regime in Iraq dedicated to the oversight of digital platforms and services.
Law Update: Issue 379 – Saudi Arabia
Aro Latif OmarSenior Associate,Corporate Commercial
Nawar Al-AmeriAssociate,Banking & Finance
On 17 February 2025, the Communications and Media Commission (“CMC”) of Iraq formally issued the Framework Regulations for Digital Platforms and Services (“FDP”). The CMC is the regulatory authority for the media, telecommunications, and information technology sectors in Iraq. The FDP introduces a comprehensive regulatory mechanism for digital platforms operating within Iraq, establishing licensing, registration, and notification obligations, as well as compliance standards across multiple digital sectors. Below is a summary of a few key provisions and what they mean for service providers.
The FDP applies to all digital platforms and service providers that operate, distribute, or provide access to digital services or content to users within Iraq (herein referred to as “Service Providers”). The FDP defines “Digital Services” as the “provision of digital access to users in Iraq, either free of charge or for a fee, to the digital platform” This includes both local and international Service Providers that either:
Have a direct physical presence in Iraq;
Provide services to users within Iraq, regardless of whether the platform has a physical presence in the country; and/or
Generate revenue from users in Iraq.
The types of services covered include, but are not limited to:
Video platforms;
Audio platforms;
Social media platforms;
Online gaming platforms and e-sports participation platforms;
E-commerce platforms;
Digital application store platforms;
On-Demand services platforms;
Fintech services platforms;
Online advertising platforms;
Artificial-Intelligence platforms;
Any additional platforms as may be designated by the CMC Chairman.
The FDP provides formal definitions for each of the service categories listed above. Service Providers can refer to such definitions to understand whether their services are regulated under the new framework.
As also indicated above, we note with importance that FDP’s scope is not limited to audiovisual digital platforms, social media platforms, or other ancillary digital platforms or applications. It also extends to fintech platforms and applications—both onshore and offshore—that provide fintech banking services to customers within Iraq. The FDP defines Fintech Service Platforms as “digital platforms that offer technology-driven financial services, such as mobile payments, stock market transactions, currency transactions, digital banking, or online lending, to improve and automate financial transactions”. Although the FDP does not provide greater detail or dedicated licensing or regulatory rules for such services, it generally requires that Fintech Service Platforms be either licensed or registered, depending on specific circumstances. The CMC or Central Bank of Iraq may issue further implementing instructions in this regard.
Depending on the nature and location of the Service Provider, providers must obtain one of three regulatory tools before offering their services in Iraq:
License – generally required for domestically based service with significant user bases.
Registration – required for foreign-based service such as e-commerce and fintech providers serving Iraqi users.
Notification – applicable to certain foreign-based services (e.g., streaming audio/video platforms) where minimal operational footprint exists.
The regulatory tools for a Service Provider may change over time based on platform growth or operational expansion. According to Section 5.4, local startup platforms with fewer than 5,000 users may be conditionally exempt from licensing or registration, subject to written approval from the CMC, and subject to the exempted start-up complying with other general obligations under the FDP.
Service Providers falling within the scope of the FDP must comply with all applicable Iraqi laws and regulatory requirements established under the FDP. Key obligations include (this is a non-exhaustive summary and not for reliance purposes):
Content Regulation: Service Provider must implement moderation tools to address illegal or harmful content on their platform(s), establish content rating systems, provide user reporting channels, and maintain transparent take-down procedures.
User-Generated Content (UGC): Where a Service Provider permits user uploads on their platform(s), they must adopt transparent policies and offer an appeals process for content removal.
Data Protection: Service Providers must implement international best practices for the protection of personal data and comply with existing and forthcoming Iraqi data protection legislation.
Intellectual Property: Service Providers must implement international best practises for protection of intellectual property, and comply with existing and forthcoming Iraqi laws in this regard.
AI Regulation: Service Providers must apply international best practises and comply with forthcoming Iraqi legislation on artificial intelligence.
Cybersecurity Measures: Platforms must meet applicable legal, technical, and procedural cybersecurity international best practises and Iraqi laws in this regard.
Emerging Technologies: The FDP anticipates further regulation for cloud services and artificial intelligence. Platforms operating in these areas will be required to comply with subsequent CMC-issued instruments once in effect.
The FDP outlines provisions concerning applicable fees and taxation for service providers, including annual charges tied to the type of regulatory instrument obtained. The CMC also introduces a “Trusted Digital Platforms” category, which may be granted to platforms meeting elevated standards of compliance, transparency, and cooperation. Criteria and benefits of this designation are expected to be further defined by the CMC.
Detailed procedural rules are provided for licensing, registration, notification, renewals, suspensions, cancellations, and transfers of licenses or registrations.
As it relates to activities requiring licensing under the FDP, the CMC has outlined general requirements for obtaining a license where activities fall within the scope of regulation. Applicants are expected to submit a formal application to the CMC, providing detailed information about the platform’s operations, user base, business model, and compliance measures, as well as additional information. In some cases, the CMC may also require the establishment of a local entity.
The FDP also outlines specific protocols for scenarios in which a service provider is only required to register or notify the authorities, rather than obtain a license.
The FDP marks the first comprehensive legal regime in Iraq dedicated to the oversight of digital platforms and services. While implementation remains untested, the FDP imposes enforceable obligations across a wide spectrum of digital activity. Stakeholders should assess their compliance obligations and monitor the issuance of future CMC regulations. At Al Tamimi & Company, we are here to help clients navigate this evolving regulatory landscape and ensure they are well-positioned to meet emerging requirements.
For further information,please contact Aro Latif Omar and Nawar Al Ameri.
Published in August 2025
