Central Bank of the UAEchapter by chapter

Article 2.1-2.3

Financial institutions must maintain governance frameworks with policies, controls and management oversight over SME customer product design, sales and review, with the Board and Senior Management setting fair treatment culture.

Article 3.1-3.3

SME customer disclosures must be proactive, accurate, consistent, comprehensive, non-misleading and plain-language, with prominent risk, fee and locked-term disclaimers, in English and Arabic across all channels.

Article 3.4(a)

Financial institutions must give SME customers required documents, full product information including risks and fees, and a Key Facts Statement acknowledged before contracting, with timely decisions.

Article 3.4(b)-(c)

Providers must give customers complete and final information on offer and terms before contract entry, and keep customers informed of developments and product performance during the contract term.

Article 3.5-3.6

Financial institutions must not make partial or biased disclosures, exaggerate product advantages, or conceal suitable lower-cost alternatives from SME customers.

Article 3.7

Financial Institutions must give Customers, within a reasonable time and throughout the relationship, copies of signed contracts and documents, including digitally accepted ones.

Article 3.8-3.9

Financial Institutions must disclose all fee components and frequency, provide a fee schedule copy, and disclose third-party fees or give estimates with a disclaimer.

Article 3.10

Financial Institutions must give customers at least sixty calendar days written notice before any change to terms and conditions, including fee changes, takes effect.

Article 3.11

Financial institutions must send customers a notice at least thirty calendar days before an annual automatic contract renewal, explaining how and when the renewal can be cancelled.

Article 3.12

Financial Institutions rejecting a SME customer application must give the reason in writing, except where the reason relates to financial crime risk or disclosure is prohibited by law.

Article 3.13-3.15

Financial Institutions must monitor disclosure effectiveness through complaint analysis and satisfaction surveys, apply disclosure rules across all communication channels, and maintain Board-overseen governance for approving disclosures.

Article 4.1-4.4

The Board is responsible for business conducted with due skill, care, diligence, integrity and fairness; institutions must have a staff code of conduct and prohibit abusive sales practices.

Article 4.5

Financial institutions must not make the sale of a product or service conditional on buying another product, prohibiting tied selling and bundling under SME customer protection rules.

Article 4.6-4.7

Financial institutions must assess product suitability for SME customers' needs and business scale, and tailor design, marketing and staff training by micro, small and medium category.

Article 4.8-4.9

Financial Institutions must ensure Authorized Agents comply with the SME regulation, maintain policies and controls to manage conflicts of interest, and fully disclose inherent conflicts to customers before agreements.

Article 4.10-4.13

Financial Institutions must ensure staff act responsibly, avoid abusive practices, and monitor customer interactions for misleading conduct.

Article 4.14

Financial Institutions must not profit from their errors, must correct errors without undue delay once identified, and must promptly inform affected SME customers in writing of the cause, impact and rectification.

Article 4.15-4.19

Customer-facing staff must have verified qualifications and product knowledge, supported by training and internal controls, with no prior fraud-related criminal record.

Article 4.20

Remuneration and staff appraisal policies must prevent mis-selling, unreasonable risk-taking and conflicts of interest, enable monitoring, avoid rewarding unethical conduct, and reward positive conduct.

Article 4.21-4.26

Financial institutions must proactively help SME customers facing payment irregularities or financial difficulty, offer restructuring and impartial credit counselling, and avoid excessive collection pressure.

Article 4.27

All customer communications regarding collections must be recorded and preserved for five years following debt resolution.

Article 4.28

A Financial Institution must disclose to the customer any appointed debt collection agent, their identity, the amount to be collected, and the authority granted, including authority to receive payments.

Article 4.29-4.32

Financial Institutions must avoid anti-competitive and discriminatory practices, must not collude on pricing, and must embed anti-discrimination principles in their code of conduct.

Article 4.33-4.37

Financial Institutions must not impose barriers to SME customers switching providers, and must transfer accounts, products and data on request without additional fees within prescribed time.

Article 4.38

Financial institutions must annually review their operations to identify and remove unreasonable barriers preventing SME customers from using products and services.

Article 4.39-4.45

Financial institutions must charge fair, reasonable and proportionate fees, provide a written fee schedule, avoid fees for legally required updates or paper statements, and not impose closing fees on accounts open six months or more.

Article 4.46

Financial institutions must have systems to open customer bank accounts within three business days for low-risk SME applicants with satisfactory customer due diligence, with any exemption for financial crime compliance documented and reported to senior management.

Article 4.47-4.50

Financial institutions must apply anti-discrimination and risk-based principles to SME account applications, disclose minimum documentary requirements, and bar any transactions until full customer due diligence is completed.

Article 4.48

Financial Institutions delaying account opening for reasons other than financial crime compliance must explain and document the delay, which may not exceed two weeks.

Article 4.51

Account-opening funds received during onboarding must be blocked until opening requirements, including financial crime compliance, are met, and customers must be informed in writing and confirm receipt.

Article 4.52

Financial Institutions must record SME account-opening requests across all channels and share the report with Senior Management and the Board at least quarterly.

Article 5.1-5.5

Financial Institutions must not extend Credit beyond a Customer's repayment ability or without the Customer's prior written request, and must examine, document and monitor credit records and sales representatives.

Article 5.6

Financial institutions are encouraged to engage with federal or emirate-level SME support schemes such as credit guarantees, movable collateral registries, and SME credit scoring.

Article 6.1-6.4

Financial institutions must run an accessible, free complaints process with an independent complaints function reporting to Senior Management, and must inform customers of their rights and the process.

Article 6.5-6.6

Financial Institutions must acknowledge customer complaints in writing within two business days and assign each complaint a unique reference number for tracking, as part of complaint management.

Article 6.7-6.8

Financial Institutions must accept and investigate customer complaints about Authorized Agents and their products, and must train staff and Authorized Agents in complaint handling procedures.

Article 6.9-6.10

Financial institutions must issue a final written response with detailed reasons within thirty business days of receiving a customer complaint, and inform customers of escalation to the Ombudsman Unit (Sanadak).

Article 6.11-6.13

Financial institutions must verify the fairness and adequacy of complaint handling, monitor staff complaint-handling quality against service-level KPIs, and analyse complaint data for risks, root causes and new controls.

Article 6.14

Senior Management must receive regular reports on Complaints and the Complaints management system at least quarterly, with documented decisions and actions.

Article 6.15

Financial Institutions must record and retain registered customer complaint details for at least five years from resolution or closure, whichever is later.

Article 6.16

Financial Institutions must participate in, fully cooperate with, and inform customers about any external complaints resolution function, including the Ombudsman Unit (Sanadak).

Article 7.1-7.2

Financial Institutions must collect only the minimum customer data needed for licensed activities and maintain a data protection function guarding against misuse and unauthorized access.

Article 7.3

Requires the data management and protection function to immediately report significant data violations and breaches to Senior Management and the Board, and Senior Management to take proactive remediation measures.

Article 7.4-7.5

Financial institutions must retain all customer data, documents, records and files for at least five years, with security monitoring to detect unauthorised internal access and recording any breach.

Article 7.6

Financial institutions must notify the Central Bank of significant customer data breaches, notify affected customers without undue delay, and reimburse their direct verifiable costs.

Article 7.7

Financial Institutions must ensure customers can make informed choices when giving express consent to collection, use and sharing of their data.

Article 8.1-8.5

Islamic Financial Institutions must adhere to Shari’ah principles in customer dealings and integrate Shari’ah compliance into their culture.

Article 9.1-9.2

Financial institutions must report to the central bank on customer protection, including an up-to-date fee schedule, list of products and services offered in the State, and complaint data, in the form the central bank requires.

Article 4.27-ret

CBUAE regulations require retention of credit collection communications with customers for a minimum of five years from the settlement or write-off date.

Article 6.15-ret

Registered complaint records and details must be retained for at least five years, counted from the later of complaint resolution or closure date.

Article 7.4-ret

Licensees must retain all customer data, documents, records and files for a minimum of five years under SME customer protection record retention requirements, subject to applicable laws.