Fintech & digital payments rules in UAE (2026)

UAE enacted a replacement Central Bank law consolidating regulation of banks, payment service providers, and insurers in a single statute. It introduced a new licensing category for enabling-technology providers that facilitate regulated financial activities and raised administrative penalties to up to ten times the violation value, significantly expanding the CBUAE's supervisory perimeter into the technology stack.

The transitional window granted under CBUAE Circular 2/2024 closed, meaning the Payment Token Services Regulation — covering stablecoin issuance, conversion, and custody/transfer on UAE mainland — became fully enforceable. Operators without a valid CBUAE licence or registration became immediately non-compliant, marking a hard enforcement phase for payment-token businesses.

The UAE Ministry of Finance and Dubai Finance completed the first live government payment using the Digital Dirham retail CBDC, settling in under two minutes under FIT Programme pilots. The milestone demonstrated the CBDC's readiness for government-to-entity settlement and advanced the CBUAE's cashless-economy objective.

The Central Bank published the PTSR, establishing the first comprehensive mainland licensing framework for payment tokens (stablecoins). It requires CBUAE authorisation for Dirham-pegged token issuers and registration for foreign payment token operators, with three regulated activities: issuance, conversion, and custody/transfer.

The Central Bank issued the Open Finance Regulation, mandating all CBUAE-licensed institutions to participate in an API-driven data-sharing ecosystem under customer consent controls. UAE became one of the first regional jurisdictions with a mandatory open finance regime, directly enabling third-party fintech access to banking and payment account data.

Al Etihad Payments (a CBUAE subsidiary) launched Aani, the UAE's national instant payment platform enabling 24/7 real-time transfers using only a phone number for consumers, businesses, and government. Aani is a flagship FIT Programme deliverable and forms the backbone of the UAE's interoperable domestic payments infrastructure.

Dubai's VARA adopted its full licensing rulebook — four compulsory and seven activity-specific rulebooks — covering advisory, broker-dealer, custody, exchange, lending, management, and transfer/settlement services. Existing VASPs were required to submit licence applications by November 2023, operationalising the world's most comprehensive bespoke crypto-licensing regime.

The Central Bank unveiled a nine-pillar digital transformation programme encompassing Aani instant payments, a domestic card scheme, open finance, Digital Dirham CBDC, and other infrastructure modernisation initiatives. FIT set the strategic roadmap for the UAE's payments and fintech ecosystem and drove the wave of regulations issued through 2025.

The CBUAE introduced the RPSCS Regulation, the first comprehensive mainland licensing framework for non-bank payment service providers, structured across four tiered categories (I–IV) with differentiated capital floors and supervisory intensity. It extended formal CBUAE oversight to e-money, card schemes, merchant acquiring, and payment processing for the first time.

The Central Bank issued a tightened SVF Regulation replacing the 2016 Electronic Payment Systems framework, imposing stricter licensing on digital wallets, prepaid cards, and crypto-backed stored-value instruments. It banned unlicensed overseas SVF providers from marketing in the UAE and set the conceptual foundation for subsequent payment-token rules.

This law replaced the original 1980 Central Bank statute and for the first time formally defined 'Financial Infrastructure Systems' — including retail payment systems — as objects of CBUAE licensing and oversight. It gave the Central Bank explicit authority to supervise non-bank payment operators and created the modern regulatory architecture on which all subsequent fintech regulation has been built.

The Dubai Financial Services Authority introduced the Innovation Testing Licence within the DIFC, the UAE's first formal regulatory sandbox, allowing fintech firms to test novel financial products for 6–12 months under a restricted licence with modified regulatory requirements. More than 200 firms applied in its first years of operation, establishing DIFC as the region's pre-eminent fintech testing ground.