CBUAE Stored Value Facilities (SVF) Regulationchapter by chapter

Transition Period

Licensees already holding an SVF licence had one year from the regulation's effective date to fully implement its measures and submit an independent compliance assessment report.

Article 2.1-2.2

Anyone issuing or operating a Stored Value Facility in the State must obtain a prior License from the Central Bank, unless the facility is a single-purpose Stored Value Facility.

Article 2.3-2.5

The Central Bank may exempt low-risk stored value facilities from licensing, may request information from exempted issuers, and may withdraw exemptions at any time.

Article 2.6-2.12

Unlicensed stored value facilities are prohibited from publicly advertising or soliciting SVF issuance in the State; the Central Bank uses a multi-factor test to decide whether overseas SVF schemes target the State.

Article 3.1-3.4

Companies applying for Stored Value Facilities licenses must meet ongoing requirements and ensure board and management are approved as fit and proper.

Article 3.5-3.7

SVF applicants must submit an independent assessment report by a competent, conflict-free assessor covering seven key areas, though licensed banks deemed licensed for SVF are exempt unless the Central Bank requires it.

Article 4.1

Licensed banks planning stored value facility business must notify the Central Bank in writing and obtain a 'No Objection' letter before starting SVF business, even if deemed authorised.

Article 4.2-4.4

An interested company may obtain the application form from the Central Bank's Licensing Division; Senior Management is strongly encouraged to discuss the business plan beforehand.

Article 4.5-4.7

Stored value facility applications must be lodged with the completed form and documents, incomplete applications become draft and then suspended if information is overdue.

Article 4.8-4.11

The Central Bank may grant a stored value facility licence with or without conditions, assigns a unique reference number and effective date, and the licensee must display that reference on its website and promotional materials.

Article 5.1-5.3

The Central Bank can suspend, withdraw, or revoke a License to ensure payment system stability, and Licensees must cease customer transactions immediately upon such actions.

Article 6.1.1-6.1.4

Where a material violation of the Stored Value Facilities Regulation occurs, the Central Bank may require rectification, appoint an expert or employee to advise or oversee operations, appoint a manager to control management, or impose penalties.

Article 7.1, 7.3

A stored value facility licensee, other than a licensed bank, must principally issue stored value facilities, may not conduct other licensed financial activities without a licence, and needs Central Bank approval for any secondary or ancillary business.

Article 7.4-7.10

Stored value facility licensees, excluding banks, must hold at least AED 15,000,000 paid-up capital and aggregate capital funds of 5% of float, and show adequate resources for orderly wind-down.

Article 8.1, 8.3-8.8

Licensees must implement risk management policies and sound governance arrangements, excluding licensed banks, to ensure accountability and organizational structure.

Article 8.9-8.11

A person must not become chief executive or director of a Licensee; Central Bank approval is needed for Controlling Shareholders, based on fitness and propriety tests.

Article 8.12-8.17

A Stored Value Facility licensee must obtain prior Central Bank approval before outsourcing, stay ultimately responsible for outsourced activities, and conduct risk assessment, provider due diligence, and ongoing monitoring.

Article 8.18

Stored value facility licensees' chief executive and alternate should ordinarily be UAE residents, and key personnel for scheme operation, risk and compliance must be based in the State unless the Central Bank approves otherwise.

Article 9.1, 9.3-9.4

Licensees, including banks conducting SVF business, must maintain a board-approved risk management framework, dedicated personnel, effective liquidity risk management, and a documented business strategy.

Article 9.5, 9.7-9.8

Licensees must maintain robust internal controls safeguarding assets and ensuring reliable reporting, and keep separate, effective compliance and internal audit functions.

Article 9.9-9.13

Stored value facility licensees must submit requested data accurately and on time, conduct at least annual risk assessments with board-approved reports to the Central Bank, and immediately report inability to meet obligations or regulatory breaches.

Article 10.2-10.4

Stored value facility licensees, other than licensed banks, must maintain robust information and accounting systems, audit trails, and record-keeping policies covering books, accounts, management decisions and customer transactions.

Article 10.5-10.6

Licensees must protect information systems and customer data from unauthorized access and tampering, store customer data in the UAE, and retain it for five years.

Article 11.1-11.3

A Stored Value Facilities Licensee must maintain a robust system protecting and managing the Float for prescribed usage only, shielded from other creditors' claims and operational risks; licensed banks comply only with specified paragraphs.

Article 11.4-11.5, 11.10

Licensees must give customers a priority legal claim over the float on insolvency, holding it in segregated accounts with licensed banks, separate from the licensee's own funds.

Article 11.6-11.7

Licenses must ensure proper procedures for customer float redemption and maintain sufficient funds for all customer redemptions and distribution costs.

Article 11.8-11.9, 11.11

A payment provider must ensure timely, accurate Float records, reconcile system records against actual Float balances at least daily, maintain accurate customer ledgers, and protect the Float from theft and fraud.

Article 11.12-11.15

Licensees must manage float primarily for liquidity, avoid treating float returns as significant income, and obtain Central Bank consent before holding non-cash low-risk assets.

Article 11.16

Material non-compliance issues regarding Float protection and unresolved discrepancies must be reported to the Central Bank immediately, alongside rectification measures.

Article 12.1-12.4 (Framework & Incident Management)

Licensees must maintain a technology and cyber risk management framework and incident management framework, reporting confirmed technology fraud, major cyber-attacks and prolonged disruptions to the Central Bank.

Article 12.6-12.7 (IT Governance)

Licensees must establish an IT governance framework with defined IT functions, Senior Management-approved IT control policies, compliance verification, dispensation approval processes, and consequences for non-adherence.

Article 12.8-12.10 (Risk Management Process)

Stored value facility licensees must maintain an effective technology risk management system, continuously evaluate and control technology risks from changes, and apply a project management methodology to major technology projects.

Article 12.11-12.13 (Project Life Cycle & Software Acquisition)

Stored value facilities should adopt a full project life cycle for major payment systems, manage software acquisition risks, and commission independent quality assurance reviews of major technology projects.

Article 12.14-12.17 (Secure Development, Testing and Deployment)

Organizations must define security requirements early, apply secure development guidelines, conduct thorough testing, and ensure proper environments are used for development and production.

Article 12.18-12.19 (Segregation of Duties & End-User Computing)

Institutions must maintain segregation of duties among IT teams, barring developers from production access, and keep an inventory of end-user developed applications with governing controls.

Article 12.20-12.21 (Problem & Change Management)

Stored value facility providers must run problem management to identify, classify and resolve IT incidents with trend analysis, and formal change management with emergency-change record-keeping.

Article 12.22-12.23 (Security Baseline & Job Scheduling)

Stored value facility operators must document baseline security configurations for systems and networks with periodic compliance reviews, and authorize initial and changed job schedules with procedures for approving departures.

Article 12.24-12.26 (Vulnerability and Patch Management)

Stored value facility licensees must run regular automated and manual vulnerability assessments, apply patches within severity-based timeframes, retain logs, and monitor critical configuration changes in real time.

Article 12.27-12.28 (IT Facilities Maintenance & Mobile Computing)

Stored value facilities must maintain IT equipment per industry practice and supplier service intervals, and establish mobile device policies covering security, encryption, backup and retention.

Article 12.29-12.30 (Network and Database Management)

Network management must be assigned to qualified individuals with documented, reviewed network standards, and stored value facilities must segregate databases with access controls protecting customer and merchant personal data.

Article 12.31-12.33 (Access Control and Privileged/Emergency IDs)

Licensees must restrict system access via role-based access control on a need-to-have basis, and tightly control privileged and emergency IDs including password changes, remote access, senior approval and activity monitoring.

Article 12.34-12.35 (Cyber Risk Assessment & Threat Intelligence)

Licensees relying heavily on internet and mobile technologies must manage cyber security risk, committing resources to identify risks, protect critical services, contain incidents and restore services.

Article 12.36-12.37 (Penetration Testing & Connected Devices)

Stored value facility licensees must regularly assess and perform penetration and cyber-attack simulation testing based on their cyber risk profile, and address risks from internet-connected devices.

Article 12.38-12.39 (Payment Security Management Framework)

Stored value facility licensees must maintain a payment security management framework to monitor, evaluate and mitigate risks, with policies protecting confidentiality and integrity of customer data.

Article 12.40-12.41 (Information Ownership and Classification)

An information owner must be assigned for each information category, responsible for classification, authorization, and protection according to sensitivity.

Article 12.42-12.44 (Information Storage and Transmission Security)

Stored value facility providers must secure sensitive payment, personal and authentication data on devices and backend systems with strong encryption, and protect transmitted data with strong end-to-end encryption and limited channel access.

Article 12.45-12.47 (Information Processing, Retention and Minimization)

Merchant acquiring Licensees must require merchants to protect payment sensitive data, maintain data integrity controls, and apply a retention and disposal policy with information minimization as a core design principle.

Article 12.48-12.50 (Payment Channel and Customer Device Security)

Licensees must secure each payment channel against material vulnerabilities and attacks, assume customer devices are exposed, and add safeguards for card data and merchant mobile payment acceptance.

Article 12.51-12.53 (Customer Authentication and Session Management)

Stored value facility providers must use reliable authentication, with two-factor authentication normally expected for high-risk transactions, and limit login attempts, apply timeouts and minimise one-time-password validity.

Article 12.54-12.59 (Activities Logging and Fraud Detection)

Stored value facility providers must log all transactions in audit trails, restrict tool access, and run fraud monitoring that blocks suspicious payments, including card-binding and direct-debit checks.

Article 12.60-12.63 (Customer Account Administration and High-Risk Transaction Controls)

Stored value facilities must apply reliable identity authentication to online account opening and effective controls such as two-factor re-authentication before high-risk transactions.

Article 12.64-12.79 (Business Continuity Management)

Licensees must maintain a business continuity management program covering business impact analysis, recovery strategies, continuity plans, alternate sites, senior management oversight with annual sign-off, and annual tested and documented testing.

Article 12.80-12.82 (Reputation Risk Management)

Licensees must establish an effective reputation risk management process proportionate to their size and complexity, including due diligence, proactive containment, swift response and surveillance.

Article 13.1-13.5

SVF licensees, including banks offering SVF schemes, must operate prudently and honestly, treat customers and merchants equitably, remain liable for agents and providers, and ensure staff training and due diligence on promotional material.

Article 13.6-13.9

Stored value facility licensees must conduct due diligence before engaging business partners such as merchant acquirers, with enforceable contracts and data privacy compliance, and promptly credit customer funds.

Article 13.10-13.11

Licensees must set justified storage limits per account type, clearly disclose risks and fees, and bear full loss of stored value where customers are not at fault.

Article 13.12

Stored value facility licensees must implement an anti-fraud framework covering CEO and Compliance Committee duties, fraud reporting and follow-up, and documented anti-fraud training for all employees.

Article 13.13-13.14

Licensees must provide clear, prominent, regularly reviewed security advice to customers through multiple channels and manage the risk of fraudulent emails, websites and apps seeking sensitive information.

Article 13.15-13.16

Stored value facility Licensees must maintain a viable business exit plan covering exit scenarios, risk indicators, action steps, and resources to protect customers, reviewed annually.

Article 13.17-13.19

Stored value facility licensees should ensure system interoperability with major State payment systems and apply risk-based customer risk assessment to avoid financial exclusion rather than a one-size-fits-all approach.

Article 14.1-14.2

Licensees must meet AML/CFT requirements, assess risks, detect suspicious transactions, and report to the Financial Intelligence Unit.

Article 14.3

Stored value facility licensees assessing product money laundering and terrorist financing risk must consider transaction limits, funding methods, cross-border use, person-to-person transfers, cash withdrawals and multiple cards.

Article 14.4-14.6

Licensees must implement AML/CFT measures to mitigate risks, assess customer relationships, and apply appropriate customer due diligence models.

Article 14.7-14.8

Licensees must establish AML/CFT compliance management with Senior Management oversight, appoint a Compliance Officer and Money Laundering Reporting Officer, and implement comprehensive policies.

Article 14.9-14.10

Licensees must assess risks before introducing new products, services or technologies, and eKYC used by licensed banks for digital onboarding is generally acceptable for SVF account opening if digital verification meets Central Bank requirements.

Article 14.11-14.12

Licensees may apply enhanced customer due diligence to Virtual Asset Service Providers, and should conduct a money laundering and terrorist financing risk assessment with mitigation before offering new virtual asset products.

Article 15.1-15.2

Violations may face sanctions including supervisory action, fines, restrictions on senior management or board powers, interim management, or bans on individuals from the UAE financial sector.

Article 17

This regulation repeals and replaces the 2016 Regulatory Framework for Stored Value and Electronic Payment Systems, which is no longer in effect.

Annex

License applicants for stored value facilities must submit a broad package including audited financials, controlling shareholder forms, a three-year business plan, AML policies and notarized articles.

Article 10.6-ret

Stored value facilities must retain customer identification and transaction data, including all customer and transaction records, for at least five years from the date the customer data was created.