Regulatory AlertsUnited Arab Emirates: fintech & payments regulation
RegulatedUAE fintech: CBUEAE federal licensing for payments; VARA/FSRA/DFSA for virtual assets
- Lead regulator
- Central Bank of the UAE
- Also involved
- VARA (Dubai virtual assets) · FSRA (ADGM financial services) · DFSA (DIFC financial services) · NFIU (AML reporting)
- Core law
- Federal Decree-Law No. 6 of 2025
- Entry capital
- AED 500,000 (Restricted Licence Finance Company)
- Approval timeline
- 3-6 months for CBUAE payment licenses; 2-4 months for VARA/FSRA virtual asset licenses
- Customer assets
- Segregated in licensed custodian or trust account
- Data protection
- Federal Decree-Law No. 45 of 2021 (PDPL) · NESA/ICP
- Sandbox
- Yes - CBUAE Regulatory Sandbox
The UAE operates a dual-track regulatory system for fintech. Traditional payments, e-money, and remittances are federally regulated by the Central Bank of the UAE (CBUAE) under Federal Decree-Law No. 6 of 2025 and specific regulations like the Payment Token Services Regulation. Virtual assets and crypto-related activities are regulated by specialized emirate-level authorities: the Virtual Assets Regulatory Authority (VARA) in Dubai, the Financial Services Regulatory Authority (FSRA) in Abu Dhabi (ADGM), and the Dubai Financial Services Authority (DFSA) in the DIFC. The regulatory direction is toward comprehensive licensing, strict AML compliance, and the formalization of open finance frameworks.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Payment processing / gateway | LicencePayment Token Services License[1] Requires CBUAE license under Payment Token Services Regulation | — | — | Central Bank of the UAE |
| E-money & wallet issuance | LicencePayment Token Services License (Issuance)[1] Issuance of digital payment tokens requires CBUAE authorization | — | — | Central Bank of the UAE |
| Domestic money transfer | LicenceExchange Business License[2] Domestic money transfer falls under Exchange Business Regulation | — | — | Central Bank of the UAE |
| Cross-border remittance | LicenceExchange Business License[2] Cross-border remittance requires CBUAE Exchange Business License | — | — | Central Bank of the UAE |
| Agent network | LicenceExchange Business License (Agent Network)[2] Agent networks must be registered under the Exchange Business License | — | — | Central Bank of the UAE |
| Open banking / account information | LicenceOpen Finance API Hub License[3] Participation in the Open Finance ecosystem requires API Hub licensing | — | — | Central Bank of the UAE |
| Foreign-exchange services | LicenceExchange Business License[2] Currency exchange services require CBUAE Exchange Business License | — | — | Central Bank of the UAE |
New — what changed recently
- 2025-09-16Federal Decree-Law No. 6 of 2025 — Established the Central Bank of the UAE as an independent federal public institution with expanded regulatory powers over financial institutions and activities.[4]
- 2025-06-26Exchange Business Regulation — Issued a comprehensive licensing and supervisory framework for entities conducting currency exchange and money transfer activities.[2]
- 2025-07-22Open Finance Regulation — Established the licensing and operational framework for the Open Finance ecosystem, including the API Hub and licensed financial institutions.[3]
- 2024-08-31Payment Token Services Regulation — Established the licensing and registration framework for digital payment token services, defining issuance, conversion, and custody categories.[1]
Market-entry checklist
- 1Secure CBUAE Payment LicenseApply for a Payment Token Services or Exchange Business License under Federal Decree-Law No. 6 of 2025.
- 2Establish AML Compliance FrameworkImplement robust AML/CFT policies aligned with CBUAE and NFIU requirements for all financial activities.
- 3Register with VARA (if Dubai-based)If dealing with virtual assets, obtain a VARA license and comply with the Virtual Assets and Related Activities Regulations 2023.
- 4Meet Capital RequirementsEnsure minimum capital adequacy as specified in the relevant CBUAE regulation (e.g., Finance Companies or Payment Token Services).
- 5Apply for Regulatory SandboxConsider the CBUAE Regulatory Sandbox to test innovative products before full licensing.
- 6Comply with Data Protection LawsEnsure adherence to the Federal Decree-Law No. 45 of 2021 on Personal Data Protection.