Central Bank of the UAEchapter by chapter

Article 2.1-2.6Article 2: Licensing

Retail payment services in the UAE require a prior Central Bank licence unless exempt; banks need a No Objection Letter for certain services, finance companies are exempt only for credit-card issuance, and the Central Bank may withdraw exemptions.

Article 3.1-3.5Article 3: License Categories

Applicants must apply for the CBUAE retail payment services licence category (I to IV) that matches the payment services they intend to provide, such as payment token services or payment initiation only.

Article 4.1-4.3Article 4: License Conditions

Licence applicants must meet legal form, initial capital and documentation requirements; Category I must list payment tokens with a legal opinion, Category IV must hold professional indemnity insurance.

Article 6.1-6.2Article 6: Initial Capital

Applicants must hold initial capital based on their License Category and disclose the sources of their funds.

Article 7.1-7.6Article 7: Aggregate Capital Funds

Payment Service Providers must keep aggregate capital funds at or above their category's initial capital requirement and report if monthly average transactions exceed AED 10m for three months.

Article 8.1-8.3Article 8: Control of Controllers

No person may become a Controller of a Payment Service Provider without prior Central Bank approval, which requires continued compliance and fit and proper status; conditions may apply.

Article 9.1-9.3Article 9: Principal Business

A payment service provider's principal business must be its licensed retail payment services, and it needs Central Bank prior approval before offering any ancillary service outside its licence scope.

Article 10.2-10.3Article 10: On-Going Requirements - Corporate Governance

Payment service providers must maintain robust, documented corporate governance proportionate to their business, including an organisation chart, named responsible individuals, conflict-of-interest and compliance controls, and regular audit.

Article 10.4-10.6Article 10: On-Going Requirements - Risk Management

Payment service providers must maintain robust risk management policies and internal controls, reviewed annually, and establish risk management, internal audit and compliance functions.

Article 10.7-10.9Article 10: On-Going Requirements - Accounting and Audit

PSPs must appoint an auditor for an annual audit of financial statements and retail payment systems and controls, and provide audit reports to the Central Bank on request.

Article 10.10Article 10: On-Going Requirements - Record Keeping

Payment service providers must keep all necessary Personal and Payment Data records for 5 years from receipt, unless other applicable laws or the Central Bank require a different period.

Article 10.11-10.13Article 10: On-Going Requirements - Notification Requirements

Payment service providers and applicants must immediately notify the Central Bank of material application changes, Major Regulatory Requirement breaches, and specified events such as operational disruption, legal action, insolvency, or disciplinary measures by another regulator.

Article 10.14-10.16Article 10: On-Going Requirements - Professional Indemnity Insurance

Payment initiation and payment account information service providers must hold professional indemnity insurance in a Central Bank-determined amount covering unauthorised transactions, execution failures, and unauthorised account access or use.

Article 11.5-11.7Article 11: Payment Token Services - AML and Security

Payment Token Services providers must treat them as high money laundering and terrorist financing risk, conduct security risk assessments per token, and test penetration and cyber-attack resilience when monthly transaction value reaches AED 10m.

Article 11.8-11.10Article 11: Payment Token Services - Reserve of Assets and Stabilisation

Payment token issuers must maintain a reserve of assets per token category at all times and keep a detailed stabilisation mechanism policy.

Article 11.11Article 11: Payment Token Services - Independent Audit of Reserve

Payment Token issuing PSPs must arrange an independent audit of their Reserve of Assets every six months, starting once the Central Bank approves the Payment Token White Paper.

Article 11.12-11.13Article 11: Payment Token Services - Custody

Payment token issuers must segregate, keep unencumbered and promptly accessible their reserve of assets, and place assets received for tokens in custody with a bank or custody PSP within five business days.

Article 11.14-11.18Article 11: Payment Token Services - Investment of Reserve, Pre/Post-Trade Transparency

PSPs must invest any reserve portion only in highly liquid, minimal-risk instruments capable of rapid liquidation, and must disclose continuous pre-trade and near-real-time post-trade information for payment token exchange.

Article 12.1-12.9Article 12: Anti-Money Laundering and Combating the Financing of Terrorism

Payment Service Providers must implement AML/CFT policies, conduct risk assessments, and adhere to regulations concerning user verification and sanctions.

Article 13.2-13.8Article 13: Technology Risk and Information Security - Framework and Governance

PSPs must establish a proportionate technology and cyber security risk framework with IT governance, major project management, UAE Information Assurance compliance, and Board oversight.

Article 13.9-13.14Article 13: Technology Risk and Information Security - Security and Access Controls

Payment service providers must set security requirements at system acquisition, secure Agile development and API safeguards, and tightly control privileged and emergency IDs.

Article 13.15-13.17Article 13: Technology Risk and Information Security - Cyber Security Risk

Payment service providers must manage cyber security risk with skilled staff, maintain a cyber incident response plan, and, where monthly transaction value reaches AED 10 million, assess penetration testing needs.

Article 13.18-13.24Article 13: Technology Risk and Information Security - Authentication and Session Management

Payment service providers must apply multi-factor authentication and two-factor re-authentication for high-risk transactions, encrypt passwords, limit login attempts, keep transaction audit trails, and verify identity for account changes.

Article 13.25-13.35Article 13: Technology Risk and Information Security - Business Continuity

PSPs must maintain business continuity management covering impact analysis, recovery strategies and plans, restore lost records, notify users, test plans annually, and maintain distanced alternate sites.

Article 14.2-14.4Article 14: Obligations Towards Retail Payment Service Users - Safeguarding of Funds

Prohibits PSPs from holding user funds except in transit, and requires safeguarding through segregation, escrow, insurance or guarantee cover depending on settlement timing; banks use separate named accounts.

Article 14.5-14.8Article 14: Obligations Towards Retail Payment Service Users - Transparency of Terms

Payment Service Providers must provide clear contractual terms in Arabic and English prior to contracting and inform users of changes 30 days in advance.

Article 14.9-14.13Article 14: Obligations Towards Retail Payment Service Users - Pre-Contract and Framework Information

Payment service providers must disclose fees, consent processes, safeguarding methods, and complaints procedures to users before or immediately after entering into retail payment agreements.

Article 14.14-14.17Article 14: Obligations Towards Retail Payment Service Users - Transaction Information

The Payer's PSP must immediately issue a receipt with transaction status, tracking reference, amounts, fees and conversion rates; the Payee's PSP must immediately issue a statement with credit date.

Article 14.18-14.23Article 14: Obligations Towards Retail Payment Service Users - Data Protection

Payment service providers must protect payment and personal data, disclose it only on defined lawful bases, store it in the UAE with secure separate backup for five years, and collect only necessary data with explicit consent.

Article 14.24-14.30Article 14: Obligations Towards Retail Payment Service Users - Liability and Refunds

Payment service providers are fully liable for unauthorised payment transactions and must refund customers by the next Business Day unless reasonable fraud suspicion is notified to the Central Bank; other refunds are due within seven calendar days.

Article 15.1-15.3Article 15: Use of Agents and Branches

Payment service providers using agents or branches must report them annually to the Central Bank, ensure agents disclose agency status to users, and immediately notify Central Bank of changes.

Article 16.1-16.4Article 16: Outsourcing

Requires payment service providers outsourcing services to ensure third-party compliance, obtain prior Central Bank approval, report all outsourcing annually, remain fully liable, and ensure agent training and qualifications.

Article 17.1-17.6Article 17: Contractual Arrangements (Open Banking Access)

Banks and account-issuing providers must ensure open banking contracts are enforceable, allocate liability clearly, and define grounds for denying access, while third-party providers act only on explicit user consent.

Article 18.1-18.7Article 18: Card Schemes - Licensing

Card schemes need a Central Bank licence before UAE operations; the Central Bank decides within 90 calendar days, and requires fit and proper management.

Article 18.8Article 18: Card Schemes - Reporting Requirements

Licensed card schemes must report Annex III information quarterly, provide extra information on request, and immediately disclose material changes to business model, financial viability or transaction volumes.

Article 18.9-18.14Article 18: Card Schemes - Governance and Compliance Function

Card Scheme boards must maintain an internal control framework using three lines of defense, and an independent permanent compliance function with a board-approved policy and suspicious-transaction reporting procedures.

Article 18.15-18.19Article 18: Card Schemes - Internal Audit and Risk Management

The Board must ensure an independent permanent internal audit function with an audit-committee-approved charter; card schemes must maintain a resourced risk management function headed by a CRO and an annually reviewed risk appetite and culture.

Article 18.20-18.22Article 18: Card Schemes - Information Security

Card Schemes must meet PCI DSS and UAE Information Assurance Standards, submit an annual compliance report to the Board and Central Bank, and notify data breaches within 72 hours.

Article 18.23-18.29Article 18: Card Schemes - Business Continuity and Risk Monitoring

Card Schemes must maintain business continuity and disaster recovery plans, regularly identify, mitigate and monitor risks with annual reviews, and obtain internal or external audit assurance.

Article 18.30-18.33Article 18: Card Schemes - Winding Down and Supervisory Examination

A card scheme terminating UAE operations must obtain Central Bank approval, give three months' notice with a wind-down plan, and grant the Central Bank unrestricted access for examinations.

Article 19.1-19.7Article 19: Access to the Wages Protection System

PSPs approved for WPS must provide education, execute timely payments, ensure user support, and report transaction statistics to the Central Bank.

Article 21: Transition Period

During a one-year transition period, the Central Bank can halt Retail Payment Services if licenses are not obtained, with possible extensions.

Article 10.10-retRecord Retention — Personal and Payment Data records (all Retail Payment Service Users)

Retail Payment Service Users must keep personal and payment data records for at least five years from receipt, unless other laws or the Central Bank require a longer period.

Article 14.18-14.23-retRecord Retention — Personal and Payment Data stored/backed up within the UAE (data protection)

Personal and payment data must be retained for at least five years from collection, with a secure backup kept in a separate location for the same period, and stored or backed up within the UAE.

Article 4 / Annex application documents-retRecord Retention — Licence application file (Legal Form evidence, initial capital documentation, so

Applicants for a retail payment services licence must keep the licence application file for at least the life of the licence, including legal form evidence, initial capital documentation, and source-of-funds disclosure.

Article 18.7 / Annex III-retRecord Retention — Card Scheme Licence application file and quarterly Annex III reports

Records related to Card Scheme Licence applications and quarterly reports must be retained for at least the life of the Licence.