United Arab Emirates

Licensing, Authorisation & Market Access

The Central Bank of the UAE's Retail Payment Services and Card Schemes licensing perimeter expanded materially under Federal Decree-Law No. 6 of 2025, bringing open finance services, payment services using virtual assets, and enabling-technology providers within scope for the first time. Entities newly captured by this expanded perimeter were required to obtain a CBUAE licence or regulatory approval by 16 September 2026, a deadline that had already passed by the time this run's research window closed. The practical effect is that activities which had previously sat in regulatory grey zones relative to the core RPSCS framework, particularly open-finance intermediation and virtual-asset-enabled payment services, are now unambiguously brought within the licensing perimeter, with no carve-out identified in the sourcing reviewed.

The enforcement dimension of this expansion is substantial. Operating a regulated retail payment service in the UAE without the requisite CBUAE licence is now a criminal offence under the 2025 Central Bank Law, carrying both imprisonment and fines of up to AED 500 million. This is a materially more severe deterrent structure than a purely administrative penalty regime, and its application to the newly expanded categories, open finance, virtual-asset payment services and enabling technology, means that firms operating in those categories without having secured a licence by the September 2026 deadline now face criminal, not civil, exposure. This is a notable escalation relative to how unlicensed payment-services provision has historically been treated in many other jurisdictions, where unlicensed provision more commonly triggers administrative sanctions or cease-and-desist orders rather than criminal liability with a nine-figure fine ceiling.

The underlying licence-category architecture that newly in-scope entities are being absorbed into remains structurally unchanged. CBUAE continues to operate four RPSCS licence categories, with Category I, covering all nine licensable payment services including payment-token services and cross-border money transfer, requiring initial capital of between AED 1.5 million and AED 3 million depending on anticipated transaction volume. A full Tier 1 payment service provider licence carries a standing AED 5 million capital requirement alongside an AED 150,000 annual regulatory fee. Firms newly captured by the open-finance or virtual-asset-payment perimeter expansion are not being placed into a bespoke lighter-touch licence tier; they are being required to meet the same capital and fee thresholds that have applied to other RPSCS licensees, which represents a meaningful compliance cost increase for firms that may have been operating on thinner capital bases prior to falling within scope.

Taken together, this is a licensing-perimeter tightening event rather than a change to the underlying licence-category structure itself: the categories and their capital thresholds are stable, but the population of firms required to hold a licence under those categories has expanded, and the consequence of failing to obtain one has moved from an administrative question to a criminal-liability question.

Outlook

The key open question following the 16 September 2026 compliance deadline is whether CBUAE pursues active enforcement against entities that did not obtain the required licence or approval in time, particularly among open-finance and virtual-asset-payment providers that may have assumed their activities fell outside the traditional payment-licensing perimeter prior to this expansion. Given that the unlicensed-provision offence is now criminal rather than administrative, any publicised enforcement action against a named entity in the coming cycles would signal that CBUAE intends to use the expanded criminal exposure as an active deterrent rather than a largely symbolic statutory ceiling. Firms operating open-finance, virtual-asset-payment, or enabling-technology services in the UAE without having secured a licence by the compliance deadline should be treated as carrying materially elevated market-access and enforcement risk going into the final quarter of 2026.

Licensing, Authorisation & Market Access

The CBUAE's Payment Token Services Regulation, established under Circular No. 2/2024, entered its operational phase on 16 June 2026 when the framework's transition period ended. This shift from a transitional to an operational regime is a material market-access development: entities that had been operating under transitional accommodations now face the full licensing and registration requirements of the framework. The regulation's central structural feature is a two-tier distinction between Dirham Payment Tokens, which are AED-denominated and require a full CBUAE licence, and Foreign Payment Tokens, which require only CBUAE registration, a materially lighter authorisation burden.

A separate market-access consideration applies to DIFC and ADGM-incorporated entities: these free-zone entities cannot obtain a PTSR licence directly from the CBUAE, but may instead apply for Foreign Payment Token Issuer registration, a distinct route reflecting the boundary between the UAE's federal onshore licensing track and its financial free zones. Additionally, payment service providers offering payment-token services, including issuance, conversion, custody or transfer, require a Category I licence under the CBUAE's RPSCS Regulation in addition to the standalone PTSR track, a dual-licensing structure that raises the market-access bar specifically for non-bank PSPs seeking to combine traditional payment services with payment-token offerings. This carries the bank-PSP versus non-bank-PI/EMI distinction directly: bank-affiliated issuers face a more streamlined path through existing banking licences, while non-bank PSPs face the additional RPSCS Category I overlay.

Outlook

Watch for further stablecoin licence and registration approvals moving through the now-operational PTSR pipeline, and for whether the dual-licensing requirement under RPSCS Category I produces observable consolidation pressure or market exit among smaller non-bank PSPs unable to absorb the combined compliance cost of both licensing tracks.

Licensing, Authorisation & Market Access

Federal Decree-Law No. 6 of 2025, the reconstituted Central Bank Law, is the defining development in this module for the UAE this cycle. Issued 8 September 2025 and published 15 September 2025, it consolidates banking, insurance, fintech and payments licensing under a single federal authority, the Central Bank of the UAE, replacing the prior 2018 Central Bank Law and 2023 insurance law with one instrument. Its most consequential feature for market-access purposes is the explicit extension of CBUAE's regulatory perimeter to activities that previously sat in grey space or under lighter-touch oversight: open finance, virtual-asset payment services, and enabling-technology providers are now captured within CBUAE's licensing remit. A one-year transition period runs to 16 September 2026, during which newly-captured entities must regularise their licensing or approvals; in the interim, the existing Retail Payment Services and Card Schemes Regulation, Circular No. 15/2021, continues to govern licensing for the nine categories of licensable retail payment service it defines, and the Stored Value Facilities Regulation likewise remains operative. This means the market-access picture for the remainder of this cycle is genuinely two-track: incumbent payment institutions and e-money issuers continue under known, unchanged licensing categories, while a distinct population, open-finance participants, virtual-asset payment-service providers, and enabling-technology firms, works against a hard deadline to obtain CBUAE authorisation for the first time. Both the bank and non-bank population are captured by this consolidation; the Central Bank Law does not carve out a lighter regime for non-bank payment institutions or e-money issuers relative to banks in what has been evidenced this cycle.

Outlook

The 16 September 2026 deadline is the operative marker for this module going forward. Whether CBUAE issues replacement regulations specific to the newly-consolidated perimeter, rather than continuing to rely on the pre-existing RPSCS and Stored Value Facilities regulations by extension, is the clearest open question, and general industry readiness among the newly-captured population is not yet confirmed on the evidence available this cycle.

Licensing, Authorisation & Market Access

The New CBUAE Law repeals and replaces Decretal Federal Law No. 14 of 2018, the prior CBUAE law governing licensed financial activity in the UAE. Article 62 of the new law requires licensing or regulation of any person who carries on, offers, issues or facilitates a Licensed Financial Activity regardless of the medium, technology or form employed, a bank-and-nonbank-neutral standard that applies equally to banks and to non-bank payment institutions and technology facilitators. Existing Stored Value Facility and Retail Payment Services regulations remain in force pending replacement instruments issued under the new law, so firms currently licensed under those regimes continue to operate under existing rules for now.

CBUAE's AML/CFT/CPF thematic review of Stored Value Facility providers, Retail Payment Service Providers and Payment Token Service Providers found that these tech-enabled sub-sectors are growing rapidly and becoming more complex, a T1 assessment that reinforces the case for the Article 62 perimeter expansion across both bank-affiliated and non-bank payment channels.

Outlook

With implementing regulations for the New CBUAE Law still pending and the compliance runway narrowing, technology vendors, facilitators and other non-bank participants that fall within the Article 62 definition should expect closer CBUAE scrutiny than under the 2018 regime, while banks and existing SVF/RPS licensees continue operating under current rules until the replacement instruments are issued.

Stablecoins & Digital Money

The UAE's stablecoin and digital-money regulatory perimeter underwent a material structural change this cycle. The Capital Market Authority's Decision No. 4/R.M/2026 replaces the former Securities and Commodities Authority virtual-asset regime, SCA Decision No. 26/RM of 2023, with a new eight-activity federal framework and an asset 'Green List' registration gate governing which virtual assets may be traded onshore at all. This new federal regime does not operate in a vacuum: it sits alongside the existing CBUAE Payment Token Services Regulation, which governs fiat-referenced payment tokens, and VARA's Dubai-specific virtual-asset regime. The result is an overlapping, multi-regulator perimeter for stablecoin and digital-money activity in which the applicable regulator, and the applicable rulebook, depends on the precise nature of the instrument and the emirate in which the activity takes place.

Compounding this picture, CBUAE's Resolution 16 of 2026 opens an in-principle route for CBUAE licensees, meaning licensed banks and payment-service providers, to undertake virtual-asset activities that would otherwise fall under CMA regulation. This is a transitional bridging mechanism between the banking and payments sector on one hand and the CMA's virtual-asset regime on the other, but the authorisation mechanics for how a CBUAE licensee would actually be authorised to conduct CMA-regulated activity under this route remain unresolved as of this cycle's research. This is assessed at an uncertain confidence level given the thinness of primary-source detail available on the mechanics.

The combined effect of these two developments is that the UAE now has a genuinely three-way overlapping stablecoin and virtual-asset perimeter: CMA for the newly reorganised virtual-asset activities and Green List-gated tokens, VARA for Dubai-licensed virtual-asset service providers, and CBUAE for payment tokens and, potentially, for CBUAE licensees seeking to bridge into CMA-regulated territory under Resolution 16. This creates licensing complexity for market participants without, on the evidence available this cycle, constituting an access-restricting change in itself; no firm has been reported as excluded from the market as a result of this reorganisation.

Outlook

The principal open question for the UAE's stablecoin and digital-money perimeter is whether the CBUAE Resolution 16 transitional route resolves into clear, workable authorisation mechanics allowing CBUAE licensees to operate in CMA-regulated virtual-asset territory, or whether it remains a stated policy intention without practical effect. Firms currently operating under the former SCA regime face a migration process to the new CMA framework, and the degree to which CMA, VARA and CBUAE requirements are harmonised, rather than simply layered, will determine whether this cycle's reorganisation ultimately reduces or increases the compliance burden for stablecoin and payment-token issuers operating in the UAE.

Payment Corridor Dynamics

Aani, the UAE's national instant-payments platform, has surpassed 12.5 million registered users and is now connected to 74 licensed financial institutions, comprising roughly 85% of banks, 10% of exchange houses and 5% of digital wallets and finance companies. Transfer volumes on the platform are up sixfold year-on-year, and approximately 774,000 merchants now use Aani as a primary payment solution, evidence of a bank-and-nonbank-inclusive instant-payments rail scaling across the full range of licensed participant types.

Cabinet Resolution No. 176M/4M of 2026 authorises the UAE Ministry of Finance to accept Aani and Jaywan for federal service fees and fines, the first federal entity to adopt either rail for this purpose; Aani settles up to AED 50,000 per transaction in under 10 seconds, embedding the domestic instant-payments rail directly into federal revenue collection.

Jaywan, the UAE's national domestic card scheme established in 2024 and operated by Al Etihad Payments, began live card issuance in July 2026, with First Abu Dhabi Bank and Commercial Bank of Dubai as its first issuing banks, reducing reliance on international card schemes for domestic transactions.

Outlook

With Aani now embedded in federal fee and fine collection and continuing to grow at a sixfold year-on-year pace, and with Jaywan's card issuance now live across at least two major issuing banks, the corridor mix for domestic UAE payments is shifting further toward homegrown instant-payment and card rails and away from exclusive reliance on international card-scheme processing for domestic transactions.

Payment Corridor Dynamics

Aani, the instant-payments platform operated by Al Etihad Payments, has crossed 12.5 million users according to Q1 2026 reporting, continuing a scaling trajectory for the UAE's domestic real-time-payments rail. Al Etihad Payments also operates Jaywan, the UAE's domestic card scheme, UAESWITCH, and the Wages Protection System, giving the operator a broad footprint across retail instant payments, card-scheme infrastructure and payroll-compliance rails. This breadth is relevant to corridor dynamics because it concentrates several distinct payment functions within a single operator's infrastructure, which shapes how payment corridors into and out of the UAE interact with domestic rails at the point of settlement.

The more structurally significant development this cycle is Cabinet Resolution No. 176M/4M of 2026, which authorises Aani and Jaywan as payment channels for federal government service fees and fines, with the Ministry of Finance announced as the first implementing federal entity on 3 August 2026. This is a mandatory-adoption milestone rather than a voluntary-uptake one: it commits a federal government body to routing fee and fine payments through the domestic instant-payments rail rather than through card-scheme or legacy bank-transfer channels, a meaningful signal of the rail's perceived reliability and government-side confidence in its operational maturity.

Read together, the 12.5 million user milestone and the federal mandate describe a rail that has moved past an early-adoption phase into standing infrastructure status, a maturity marker that should inform any assessment of the UAE's domestic payment corridor as a channel increasingly capable of absorbing volume that might otherwise route through card schemes or cross-border payment rails.

Outlook

The marker to watch is whether other federal government entities beyond the Ministry of Finance adopt Aani and Jaywan for fee and fine collection following the Ministry's implementation, and whether Aani's user count continues its growth trajectory beyond the 12.5 million figure reported for Q1 2026, both of which would confirm the rail's transition from consumer-adoption success to comprehensive government-side infrastructure.

Product Innovation & Market Development

The CBUAE's Open Finance Regulation has moved from framework into live implementation this cycle via Nebras Open Finance LLC, which operates the regulation's API hub and trust framework. Nebras has launched a consumer-facing brand, Al Tareq, covering account aggregation, lending, insurance comparison and onboarding use cases, and the regulation's role definitions for Payment Account, PSP and TSP participants cross-reference the Stored Value Facilities Regulation, tying the open-finance build-out directly to the UAE's existing nonbank e-money licensing architecture rather than treating it as a separate regulatory track.

The practical significance of this development is that open finance in the UAE is being built on top of an already-licensed SVF/e-money base rather than requiring a wholly new participant category, which should lower the operational barrier for existing licensed payment institutions to participate in account-aggregation and lending-adjacent open-finance use cases relative to a jurisdiction building open finance from a blank regulatory slate.

Outlook

The marker to watch is uptake of the Al Tareq brand and the API hub by banks and licensed payment institutions beyond Nebras itself, which would indicate whether the CBUAE's open-finance infrastructure investment is translating into a genuinely multi-participant ecosystem rather than a single-operator implementation.

Commercial Intelligence & Fintech

The UAE payments market saw two discrete commercial events of note this cycle. The headline transaction is NEOPAY's signed agreement, reported in October 2026, to acquire a 65 percent controlling stake in noon payments. The deal is structured as an acquisition of a controlling, rather than full, stake, and is accompanied by stated ambitions on the part of the acquirer to use the enlarged platform as a base for expansion into Saudi Arabia and Egypt. As is common for private market-infrastructure transactions in the region, the financial terms of the deal were not publicly disclosed, and this absence of disclosed value should be read as a feature of the deal's reporting rather than as an indication of its materiality.

Separately, Comfi, a UAE-headquartered B2B embedded-finance and buy-now-pay-later platform serving small and medium enterprises, completed a $65 million Pre-Series A funding round in April 2026, combining equity and debt or mezzanine financing instruments. The round was led by Iliad Partners, and the company's own stated rationale for the raise was to strengthen its underwriting and risk capabilities, broaden its product suite, and drive expansion into key markets across the wider MENA region. This is a disclosed-value transaction, in contrast to the NEOPAY-noon payments deal, giving a more complete picture of its scale: a $65 million round at the pre-Series A stage is a substantial raise for a B2B embedded-finance platform, suggesting continued investor appetite for UAE-based fintech infrastructure plays serving the broader regional small and medium enterprise segment.

Taken together, these two events point to a UAE payments and fintech market that remains commercially active on both the consolidation and the early-stage funding fronts simultaneously. The NEOPAY-noon payments transaction represents industry consolidation among more established payment-infrastructure players, while the Comfi round represents continued capital formation at the earlier end of the embedded-finance market, and the two together suggest a market maturing on multiple fronts at once rather than concentrating activity exclusively in either consolidation or early-stage financing.

Outlook

Both the NEOPAY-noon payments transaction and the Comfi funding round point toward continued regional expansion ambition as a defining feature of UAE-based payments and fintech companies, with Saudi Arabia, Egypt and the wider MENA region cited as target markets. Whether the undisclosed terms of the NEOPAY transaction become public, and whether Comfi's expansion plans materialise into further disclosed activity in the region, are the two concrete developments to watch arising from this cycle's commercial intelligence.

Commercial Intelligence & Fintech

Jaywan, the UAE's national domestic card scheme established in 2024 and operated by Al Etihad Payments, began live card issuance in July 2026, with First Abu Dhabi Bank and Commercial Bank of Dubai as its first issuers. A national card-scheme launch of this kind reduces reliance on international card schemes for domestic transactions.

CBUAE issued Revolut a payment licence in June 2026, clearing the way for a full retail launch in the UAE; the European neobank's entry signals continued fintech-licensing momentum in the market, though onshore retail rollout specifics were not detailed in the licensing announcement.

Outlook

Jaywan's issuer roster and transaction volumes, and the pace and shape of Revolut's UAE retail rollout following its June 2026 licence, are the two concrete commercial-intelligence threads to track next, alongside any further international fintech licensing decisions CBUAE takes as it implements the broadened Article 62 perimeter.

Commercial Intelligence & Fintech

The Dubai International Financial Centre added 775 companies in Q1 2026, a company-formation growth figure that reinforces Dubai's continued role as a financial gateway for banks, payment firms and fintechs operating in or through the UAE. This is a market-growth signal rather than a discrete transaction event: no specific merger, acquisition, investment round or product launch with the full set of required commercial-event details was identified this cycle, so no standalone commercial-event entry is recorded here, consistent with the drop-if-incomplete convention for this module.

The growth figure is nonetheless commercially relevant context for the other developments recorded elsewhere this cycle: a jurisdiction adding companies at this rate, combined with the open-finance implementation and dual-track virtual-asset licensing activity recorded under other modules, describes a fintech and payments ecosystem still in active expansion rather than one that has plateaued.

Outlook

The marker to watch is whether a discrete, fully-disclosed commercial event, a named acquisition, funding round or product launch, emerges from within this growing DIFC company base in a future cycle, which would allow this module to move from aggregate growth reporting to event-level commercial intelligence.