CBUAE Payment Token Services Regulation 2024chapter by chapter

Part 1

Entities must determine whether their activities fall within the six statutory exclusions or the regulation's scope, since only in-scope payment token activities need a License, Registration or Non-Objection.

Article 2.1-2.2

Persons may not perform, or claim to perform, any payment token service in the UAE, or offer similar services under another name, without a CBUAE licence or registration.

Article 2.3

Firms must not issue or provide Payment Token Services for Algorithmic Stablecoins or Privacy Tokens, which are prohibited outright under the Payment Token Services Regulation.

Article 2.4-2.6

Payment Tokens are restricted: Dirham Payment Tokens only for lawful purposes and only issued to State residents, while Foreign Payment Tokens may only be used to purchase Virtual Assets.

Article 2.7-2.8

Firms must not accept or facilitate Payment Tokens for purposes outside those permitted, and banks must not issue Payment Tokens directly but must use a licensed subsidiary.

Article 2.9-2.13

Payment Token Services cannot be advertised without proper licensing and must adhere to specific promotional content limitations.

Article 3

Firms must monitor for CBUAE designation of any virtual asset as a permissible means of payment in the State, and respond to CBUAE information requests on designation decisions.

Article 4

Entities relying on exemptions must monitor eligibility for certain token schemes, as the CBUAE can revoke exemptions if conditions change.

Article 5

Firms must identify and obtain the correct license or registration category before starting business, such as payment token issuer, custodian and transferor, conversion provider, or foreign issuer registration.

Article 6.1-6.4

License applicants must meet licensing conditions before and after grant, including eligible legal form, minimum capital, complete application documents, ongoing compliance, and attending CBUAE meetings and inspections.

Article 6.5-6.7

Payment token applicants must obtain an independent assessment report on eight CBUAE-specified areas, valid up to six months, plus a legal opinion on White Paper and Reserve of Assets compliance.

Article 7

Follow CBUAE's licensing procedure, including application submission and responding to requests, before registering and displaying the License.

Article 8.1-8.5

Applicants seeking Non-Objection Registration for payment token conversion or foreign payment token custody and transfer must confirm category eligibility and prepare required application information.

Article 8.6-8.9

Non-Objection Registration applies the licensing procedure with modifications, and CBUAE must consult the SCA and/or relevant Local Licensing Authority before granting Non-Objection.

Article 8.10-8.12

Registered PT Conversion Providers must determine applicable provisions of the CBUAE Payment Token Services Regulation, with additional rules potentially applied at CBUAE's discretion.

Article 9.1-9.6

Foreign payment token issuers promoting tokens in the State must apply for Foreign Payment Token Issuer Registration, with a legal opinion on the white paper.

Article 9.7-9.8

Registered Foreign Payment Token Issuers must hold a reserve of assets, undergo audits, and comply with applicable AML/CFT laws.

Article 10

CBUAE may suspend, withdraw or revoke a payment token licence or registration for reasons such as non-compliance, insolvency or false information; licensees must complete wind-down, customer notification and asset-return duties.

Article 11

Licensees and Registrees must submit to CBUAE corrective-action powers, including rectification directions, appointment of an expert or manager, and penalties; supporting Local Licensing Authority coordination.

Article 12.1-12.3

Dirham Payment Tokens may be denominated only in AED and Foreign Payment Tokens only in their relevant foreign currency, and must not pay interest or any holding-period benefit.

Article 12.4-12.7

Payment token service providers must comply with CBUAE-imposed volume, value and customer-number limits, monitor and report compliance, including daily reporting when directed, and follow CBUAE rectification policies.

Article 13

Payment token issuers must maintain minimum regulatory capital of AED 15 million plus 0.5% or 2% of payment tokens in circulation, depending on reserve composition, monitored on an ongoing basis.

Article 14

Custodians, transferors and conversion providers must hold regulatory capital of AED 3 million or AED 1.5 million, set by average monthly transfer value, and reassess tiers when volumes change.

Article 15

Payment token service providers must meet supplementary capital requirements set by the CBUAE, including eligible capital composition, possible bank guarantees, deductions, and no double-counting of SCA capital.

Article 16

Payment token service providers must obtain CBUAE prior approval before appointing or changing Controllers or Senior Management, supported by fit-and-proper assessment, and must comply with approval conditions.

Article 17

Licensed entities must maintain the payment token service as their principal permitted business activity, subject to requirements differing by entity type, such as issuers and bank subsidiaries.

Article 18

Virtual asset payment token service providers must notify CBUAE of material business changes, regulation violations, listed trigger events and customer complaints, and submit virtual asset and other regular or ad-hoc reports.

Article 19

Payment token service providers must obtain CBUAE approval, supported by an assessment report, before engaging any agent, disclose agent relationships, and reassess agents annually.

Article 20

Payment token service providers outsourcing any function must comply with the CBUAE Outsourcing Regulation that applies to banks, as if they were themselves banks.

Article 21.1-21.3

Payment Tokens must be issued immediately upon payment receipt and redeemed at par value upon customer request without delay.

Article 21.4-21.5

Payment token issuers must disclose redemption conditions and applicable fees in the customer agreement, and any redemption fee must be proportionate to actual costs incurred.

Article 21.6

Payment token issuers must maintain a DLT copy for redemption resilience and establish policies for handling duplicate tokens.

Article 22.1

Payment token issuers must establish and maintain a general system to protect the reserve of assets backing issued payment tokens.

Article 22.2-22.4

Assets must be held in a segregated escrow account matching the Payment Token currency, or as directed by the CBUAE.

Article 22.5-22.7

Protect the Reserve of Assets through contractual arrangements ensuring priority claims, obtain legal opinions on protection, and segregate assets by Token type.

Article 22.8

Daily reconciliation of the Reserve of Assets is required, along with a monthly external audit and maintenance of internal controls to prevent asset misappropriation.

Article 23

Custodians of Customer Payment Tokens must hold them in a separate designated wallet, prevent any other person acquiring interest in them, and keep accurate custody records.

Article 24.1-24.4

Payment token service providers, as AML obligors, must comply with AML/CFT obligations, implement comprehensive internal AML/CFT policies, and cannot invoke bank secrecy to refuse cooperation with authorities.

Article 24.5-24.9

Payment token service providers must treat their business as high-risk for AML/CFT, conduct risk assessments, re-profile customers, and avoid shell banks and anonymous accounts.

Article 24.10-24.13

Payment token service providers must apply risk-proportionate customer due diligence, refuse or end relationships where CDD cannot be completed, screen wire transfers, comply with UN sanctions freezing, and align with FATF standards.

Article 24.14-24.17

Payment token service providers must incorporate specified ML/FT risk factors and corresponding mitigating measures, such as anonymity, cross-border exposure and non-face-to-face onboarding, into customer and product risk rating methodology.

Article 24.18-24.19

Firms must appoint a Compliance Officer and MLRO with defined responsibilities and Senior Management oversight, and maintain comprehensive AML/CFT policies covering the full customer lifecycle.

Article 24.20-24.23

Perform a pre-launch risk assessment for AML/CFT purposes and apply enhanced customer due diligence for higher-risk relationships when using technology for compliance.

Article 25.1

Payment Token Service providers must operate prudently and competently and comply with the Consumer Protection Regulation, which prevails over the Payment Token Services Regulation in any conflict.

Article 25.2-25.3

Licensed entities must maintain a DLT copy, apply their fork-treatment policy to protect customers, and deal with customers responsibly, honestly and professionally.

Article 25.4-25.5

Licensees must take responsibility for staff and agents, provide adequate training, and review promotional material and merchant links, with restrictions on hyperlinks.

Article 26.1

Issuers must produce, submit to CBUAE for acceptance, and publish a White Paper before issuing any Payment Token.

Article 26.2

Entities must ensure Payment Token White Papers include specific disclosures, are clear and bilingual, feature Board attestation, a disclaimer, publication date, and are provided to Customers prior to agreements.

Article 26.3-26.4

Payment token issuers must update the White Paper without delay after any material change and have an External Auditor audit the White Paper.

Article 26.5-26.7

Payment token issuers must submit White Papers to CBUAE for acceptance, publishing them only after approval, at least 7 days before sale or 14 days before amendments.

Article 26.8

Responsible parties must compensate Tokenholders for losses caused by material misstatements or omissions in a payment token White Paper, within 28 days.

Article 27

Payment token service providers must disclose terms before contracting, provide bilingual customer agreements on request, give 30 days' notice of changes, and let customers terminate if they object.

Article 28

Payment token service providers must include all required pre-contractual disclosures in customer materials, covering fees, contact details, transfer consent, safeguarding of customer assets, unauthorized-transfer procedures, liability, termination, service levels, and complaints.

Article 29

Payment token service providers must give customers a free monthly statement, payer receipts and payee statements, process transfer instructions accurately, and maintain procedures to detect and correct missing or inaccurate transfer information.

Article 30.1-30.4

Payment token service providers must maintain data protection policies covering breach handling and controls, and disclose customer data only where permitted, such as with consent or court order.

Article 30.5-30.6

Organizations must securely store Personal Data in the UAE with a backup, retain it for 5 years, and follow data minimization standards.

Article 31.1-31.4

Payment token service providers bear full liability for unauthorized transfers unless customer fraud or gross negligence applies, must refund customers and restore wallets by the next Business Day, subject to CBUAE notification.

Article 31.5

Licensees must investigate customer complaints and transfer errors, issue refunds within 7 days, and keep customers updated on delays.

Article 32

Payment token service providers must perform due diligence on the underlying DLT, state in the White Paper when transfers become final, and give required transfer risk and timing warnings.

Article 33

Licensees must maintain governance arrangements including a clear organisational structure, conflicts-of-interest controls, compliance controls, confidentiality methods, and monitoring and audit procedures.

Article 34.2-34.4

Licensees must maintain proportionate risk management policies reviewed annually, and establish risk management, internal audit and compliance functions.

Article 34.5-34.6

Payment token service providers must maintain capital adequacy and liquidity risk management processes suited to their business and their reserve and capital structure.

Article 34.7-34.8

A payment token services provider must maintain internal controls and a documented business strategy or plan as part of its general risk management and internal control systems.

Article 34.9-34.11

Appoint an external auditor for annual financial statements and systems, technology and smart contract audits, and give CBUAE access to audit reports and power to extend audit scope.

Article 34.12

Firms must ensure compliance and internal audit functions have sound governance, staff knowledge, functional independence, direct Board access, adequate coverage, and a defined corrective-action process.

Article 34.13-34.15

Entities must perform an annual risk assessment, secure Board approval, submit it with an executive summary to CBUAE, and report inability to meet obligations immediately.

Article 34.16

Payment token service providers must maintain a reputation risk management process as part of their general risk management and internal control systems.

Article 34.17

Payment token service providers must retain Personal Data and Payment Data records for at least 5 years from receipt, unless other applicable laws or the CBUAE require a different retention period.

Article 35.2-35.5

Payment token service providers must establish a fit-for-purpose technology risk and information security framework compliant with UAE Information Assurance Standards.

Article 35.6-35.7

Firms must maintain a policy for responding to DLT forks or adverse governance actions affecting the underlying network, plus a security policy for safeguarding self-held Payment Tokens.

Article 35.8-35.9

Payment token service providers must adopt a three-function IT governance framework, with the Board holding overall responsibility for technology risk management.

Article 35.10-35.11

Payment token service providers must embed security requirements throughout the system development lifecycle and safeguard the APIs used in the service.

Article 35.12-35.14

Payment token service providers must maintain network and infrastructure controls, a dedicated security administration function, and controls over privileged and emergency IDs, including approval, logging, periodic review and timely revocation.

Article 35.15-35.17

Payment token service providers must manage cyber security risk through adequate resourcing, a documented incident response plan, and periodic penetration testing.

Article 35.18-35.19

Payment token service providers must require multi-factor customer authentication and encrypt passwords and credentials end-to-end.

Article 35.20-35.22

Regulated entities must implement login and session management controls, maintain transaction audit-trail logging, and operate fraud-detection and transaction-monitoring capability.

Article 35.23-35.24

Firms must provide customers with security advice and maintain phishing and fraud risk management measures as part of technology risk and information security obligations.

Article 35.25

Payment token service providers must report security incidents to the Central Bank of the UAE under the Regulation's incident-reporting requirements.

Article 36.2-36.4

Payment token service providers must maintain a business continuity management programme with a business impact analysis, a continuity plan, alternate sites, and notify customers and the central bank of disruptions.

Article 36.5-36.7

Payment token service providers must ensure their business continuity plan covers five required elements, is tested annually, reviewed yearly for risks and assumptions, and includes post-mortems after invocation.

Article 36.8-36.10

Payment token service providers must maintain a business exit plan covering five required elements and review it annually.

Article 37

Payment token service providers must prepare for CBUAE enforcement actions and sanctions for non-compliance, and maintain an internal escalation process for potential violations.

Article 38

Respond to CBUAE information requests made under its additional information-gathering powers, which may extend to unlicensed virtual asset service providers, and note CBUAE information-sharing arrangements with SCA, licensing authorities and other regulators.

Article 39

Post-transition, existing licensing for retail payment services and stored value facilities must align with Payment Token Services regulations.

Article 40

Entities conducting Payment Token activities must fully comply with regulations within a one-year transition period, subject to extension or cessation orders for non-compliance.

Annex

Payment token service applicants must compile the full 22-item checklist of application documents, such as business plans, governance and AML/CFT policies, and White Paper drafts.

Article 30.5-ret

Payment token service providers must retain Personal Data for at least five years from storage or creation, kept in the UAE with a separate secure backup.

Article 34.17-ret

Payment token service providers must retain Personal Data and Payment Data records for a minimum of five years from the date of receipt, unless other laws or the CBUAE require a longer period.