UAE banks, insurers, payment providers and technology firms enabling financial services have about three weeks left to align their business models with the new Central Bank Law — Federal Decree-Law No. 6 of 2025. Issued on 8 September 2025, published in the Official Gazette on 15 September and effective the following day, it repealed Federal Law No. 14 of 2018 and Federal Decree-Law No. 48 of 2023 on insurance activities, consolidating regulation of banks, insurance, payments and financial market infrastructure under CBUAE. The one-year transition ends on 16 September 2026.
What the law is and when it took effect
Federal Decree-Law No. 6 of 2025 is the UAE's new law on the Central Bank, regulation of financial institutions and activities, and insurance business. Per the CBUAE Rulebook and legal analyses by international firms (Norton Rose Fulbright, Gibson Dunn, Ashurst, Chambers and Partners), the law was issued on 8 September 2025, published in the UAE Official Gazette on 15 September 2025 and became effective on 16 September 2025 (Article 188). It repealed Federal Law No. 14 of 2018 (the previous Central Bank Law) and Federal Decree-Law No. 48 of 2023 on insurance activities, bringing banking, insurance, payments and financial market infrastructure under a single framework for the first time. Regulations, circulars and decisions issued under the earlier frameworks remain in force until expressly replaced — so the secondary rulebook is not wiped clean, it simply migrates under the new law.
The deadline: 16 September 2026
Affected firms have a one-year transition period — until 16 September 2026 — to bring their business models, licensing status and operations into line with the new law. CBUAE has discretion to extend the window, but this cannot be relied on. Given regulator processing times, filing anything material after the summer months is a risky tactic.
Who is in scope: banks, insurers, payments, tech providers
The regulated perimeter has been broadened materially. It now covers banks (as before); insurance companies, previously regulated under a standalone 2023 law; payment service providers; virtual asset payment service providers; open finance service providers; and, expressly for the first time, enabling technology providers whose platforms, dApps or protocols facilitate, intermediate or enable licensed financial activities (Article 62). Requirements around marketing and promotional communications about financial services in the UAE (Article 61(1)(h)) have been tightened — including for online channels and communications directed at UAE residents from foreign firms.
Enabling technology providers: who is really captured
The "enabling technology providers" category is the most-discussed addition. It is not about generic CRM vendors: the law targets firms whose technology makes regulated financial activity possible. That means API and middleware providers, platforms and marketplaces serving banks and fintechs, and developers of protocols and decentralised applications used for payments, credit, deposits or investment services. The practical risk: a company may not itself sell a regulated product to clients, yet still fall within CBUAE's licensing perimeter. For tech businesses and fintech start-ups this means a legal audit — and, where captured, registration with CBUAE before September 2026. Overlaps with VARA's virtual asset jurisdiction in Dubai need a separate look: some players may end up under two regulators at once.
Penalties: up to AED 1 billion and criminal liability
The penalty ceiling has been raised sharply. Maximum administrative fines on institutions are now AED 1 billion (up from AED 200 million — a fivefold rise). Financial market infrastructure violations attract fines up to AED 20 million. Personal fines on authorised individuals (senior management, board members) reach up to AED 5 million. The law also provides for licence revocation and the appointment of administrators in serious cases. Article 170 introduces criminal sanctions — imprisonment and/or fines from AED 50,000 up to AED 500 million — for carrying on licensed financial activities without a licence. Numbers of this order were not in the previous law; liability now sits in line with major financial jurisdictions.
What to do before 16 September 2026
Advisors reviewing the law converge on the same checklist. First — a gap analysis on current licensing and classification: check whether the perimeter has expanded to reach your business (especially tech companies, platforms and marketplaces). Second — separately map any virtual asset and open finance activity, both newly in explicit CBUAE scope. Third — strengthen governance, including personal accountability for senior management and the board, and refresh internal policies and procedures. Fourth — upgrade consumer protection frameworks: customer disclosures, anti-fraud (including social engineering and identity theft), complaints handling, and prompt notification to customers of security incidents. Fifth — tighten data governance and confidentiality. Sixth — obtain board approval for an implementation plan with milestones through 16 September 2026.
Ripple effects for ordinary UAE businesses
Even for firms that are neither banks nor fintechs, the changes have practical knock-ons. Working with payment services becomes stricter: banks and payment operators (including the infrastructure around the national payment card Jaywan) are baking new compliance standards into contract terms and KYC procedures. Disclosure and anti-fraud requirements are tightening — expect faster notifications on suspicious activity and more confirmations and signatures. Marketing of financial services from foreign websites to UAE residents is now within the perimeter — important for international fintech projects selling into the UAE via digital channels.
This article is for information only. The authoritative text of Federal Decree-Law No. 6 of 2025 is available in the CBUAE Rulebook (rulebook.centralbank.ae) and the UAE Official Gazette. Before taking business decisions, verify requirements against the latest CBUAE circulars and obtain legal advice tailored to your specific activity.
