Central Bank of the UAEchapter by chapter

Article 2.1-2.9Article 2: Licensing and Licensing Procedures

No juridical person may provide Open Finance Services without a licence, and the Central Bank must decide applications within 60 working days, with lapse counting as rejection.

Article 3.1-3.3Article 3: Persons Deemed Licensed

Banks, finance companies and other Persons Deemed Licensed must give the Central Bank prior written notice and obtain approval before providing Open Finance Services; silence after 60 working days means rejection.

Article 4.1-4.3Article 4: Limitations

Open Finance Providers may not hold user funds, give advice, accept fees from account or product providers, or process sensitive data without the additional Central Bank licence required for that activity.

Article 6.1-6.2, 7.1-7.3, 8.1-8.3Article 6-8: Minimum Capital and Capital Instruments

Open Finance Providers must maintain a minimum capital of AED 1,000,000 or higher, as mandated by the Central Bank, and ensure proper fund management.

Article 9.1-9.2Article 9: Professional Indemnity Insurance

Open Finance Providers must hold professional indemnity insurance with minimum per-claim and aggregate limits, covering unauthorised transactions, data breaches, cyber risks and delayed transactions.

Article 10.1-10.3Article 10: Control of Controllers

No person may become a controller of an Open Finance Provider without prior Central Bank authorisation, which requires fit and proper suitability and may carry conditions on shareholding or voting.

Article 11.1-11.4Article 11: Corporate Governance

Open Finance Providers must maintain robust corporate governance, including a Board-approved organisation structure, conflict-of-interest and compliance controls, and continuous fitness and propriety compliance.

Article 12.1-12.9Article 12: Risk Management, Compliance, Internal Audit, Wind-Down and Outsourcing

Open Finance Providers must maintain risk management, compliance, and internal audit functions reporting to the Board, a wind-down plan, and obtain Central Bank non-objection before outsourcing material activities.

Article 13.1-13.3Article 13: Record Keeping

Requires Open Finance Providers to keep records of user consents, received user data, initiated transactions and data destruction, stored securely, available to the Central Bank, and retained for at least five years.

Article 14.1-14.5Article 14: Notification and Reporting Requirements

Open Finance Providers must cooperate with the Central Bank, meet reporting requirements, and promptly notify it of material changes, violations, and specified adverse events.

Article 15.1-15.2Article 15: Obligations of Licensees (Data Holders and Service Owners)

Data Holders and Service Owners must maintain a secure API interface for Open Finance Providers, register under the Trust Framework within 14 days of approval, and bar data scraping.

Article 16.1-16.5Article 16: Obligations Relating to Data Sharing

Data holders and data sharing providers must handle open finance data requests securely, acting only on explicit user consent, never processing sensitive data, and protecting user security credentials.

Article 17.1-17.5Article 17: Obligations Relating to Service Initiation

Open Finance Service Owners must securely relay initiation information and show transaction status to Service Initiation Providers, which may act only on explicit user consent and protect security credentials.

Article 18.1-18.3Article 18: Authentication

Data Holders and Service Owners must apply reliable authentication requiring at least two-factor verification of user identity for data sharing or service initiation, with stronger checks for higher-risk cases.

Article 19.1-19.6Article 19: Secure Communication

Open Finance participants must use common secure communication standards, and licensees must offer an interface using ISO 20022 messaging for provider identification, data sharing and service initiation.

Article 20.1-20.5Article 20: Obligations Towards Users

Open Finance Providers must act prudently, provide clear written terms in advance including fees and complaints procedures, give 60 days' notice of changes, and allow free termination.

Article 21.1-21.5Article 21: Liability for Unauthorised Transactions, Defective Transactions and Data Breaches

Open Finance Providers are liable for losses from unauthorized access to user data and defective transactions, and security breaches may incur sanctions.

Article 22.1-22.6Article 22: Data Privacy and Consent - Consent Requirements

Open Finance Providers must not process personal data without specific, informed, freely given explicit user consent, capped at 12 months for recurring transactions and withdrawable at any time.

Article 22.7-22.10Article 22: Data Privacy and Consent - Data Protection Principles

Open Finance Providers must comply with personal data protection laws, process personal data lawfully and minimally, keep it accurate, destroy it once its purpose is fulfilled, and anonymise third-party data.

Article 22.11-22.12Article 22: Data Privacy and Consent - Data Residency

Open Finance Providers must store all Open Finance data in the UAE, copies abroad requiring Central Bank approval, prior written User consent, and written acknowledgement of foreign legal-access risk.

Article 23.1-23.11Article 23: API Hub - Licensing Requirements

Any Person operating an API Hub must obtain a Central Bank licence, submit a three-year business plan, and seek prior approval for ownership, name, or governance changes.

Article 24.1-24.9Article 24: API Hub - Licence Conditions

API Hubs must act only within licensed activities, process only consented user data, encrypt transmitted data, maintain business continuity programmes and keep data in the UAE.

Article 25.1-25.7Article 25: API Hub - Minimum Capital Requirements

The API Hub must keep at least AED 20 million fully paid-up standalone capital at all times, obtain Central Bank approval for capital changes, and get no-objection before proposing any profit or dividend distribution.

Article 26.1-26.12Article 26: API Hub - Corporate Governance

The API Hub must maintain Board-approved governance arrangements, require Central Bank authorisation for Authorized Individuals, and establish required committees including strategy, risk and compliance, audit, and nomination and remuneration committees.

Article 27.1-27.7Article 27: API Hub - Risk Management and Internal Control Mechanisms

The API Hub must establish independent risk management, compliance and internal audit functions, maintain risk, incident and software development life cycle practices, oversee outsourcing, and implement liquidity risk management.

Article 29.1-29.8Article 29: API Hub - Reporting and Record Keeping

The API Hub must keep activity records for at least five years, publish financial statements, and immediately report data breaches, major incidents and material violations to the Central Bank.

Article 30.1-30.2Article 30: Anti-Money Laundering and Combating the Financing of Terrorism and Illicit Organisations

Open Finance Providers and the API Hub must maintain effective internal AML/CFT policies, procedures and controls, plus robust fraud control systems including identification and access controls.

Article 31.1-31.8Article 31: Technology Risk and Information Security

Open Finance Providers and the API Hub must maintain a Board-overseen technology and cyber risk framework, IT governance functions, industry security standards, and a cybersecurity incident response plan.

Article 32.1-32.2Article 32: Supervision

The Central Bank may periodically examine Open Finance Providers and the API Hub, which must grant full unrestricted access to premises, senior management, records, and promptly supply required information.

Article 13.3-retRecord Retention — Open Finance Provider records (User consent, User Data received, Transactions In

Open Finance Providers must keep consent, received data, initiated transactions and destruction records for at least five years from creation, unless other laws require longer.

Article 22.10-retRecord Retention — User Data that is Personal Data allowing identification of the User

User Data identified as Personal Data must be destroyed once its purpose is fulfilled, maintaining a minimum five-year retention as per AML Law.

Article 29.3-retRecord Retention — API Hub activity records

Records of API Hub activity must be retained for at least five years from creation, unless other laws or the Central Bank require longer.

Article 2 / Article 23-retRecord Retention — Open Finance Licence and API Hub Licence application files (incl. API Hub 3-year

Open Finance Licence and API Hub Licence application files, including the three-year business and capital funding plans, must be retained for the life of the Licence at minimum.