UAE

New CBUAE Law 6/2025: 12 days left for banks, PSPs and VASPs

The one-year transition period of Federal Decree-Law No 6 of 2025 — the new consolidated UAE Central Bank Law — ends on 16 September 2026. In the 12 months since it was published in the Official Gazette (15 September 2025), the law brought banks, payment service providers, insurers, virtual asset service providers and foreign firms marketing financial services to UAE residents under a single supervisory framework. Every in-scope entity has 12 days left to align its operations. Here is what to check and what missing the deadline actually means — with links to the CBUAE Rulebook and international legal analysis.

Marsel ShadmanovCEO & Partner, Garant Business Consultancy · UAE banking, structuring & tax

4 September 20267 min read

The one-year transition period of the new consolidated UAE Central Bank Law — Federal Decree-Law No (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business — ends on 16 September 2026. The law was signed by the UAE President on 8 September 2025 and published in the Official Gazette on 15 September 2025; under Article 184 all in-scope entities were given one year to reconcile their operations. Scope covers banks, payment service providers (PSPs), insurers, virtual asset service providers (VASPs including DeFi platforms), financial market infrastructure and foreign firms marketing financial services to UAE residents. The law repeals Federal Law No (14) of 2018 (former Central Bank Law) and Federal Decree-Law No (48) of 2023 (former Insurance Law), consolidating supervision into a single federal act. Five compliance areas critical to review before the deadline: licensing (Article 60), the prohibition on unlicensed marketing of financial services to UAE residents (Article 61), corporate governance, consumer protection (Articles 148–152) and the CBUAE's early intervention, recovery and resolution powers over troubled institutions (Articles 142–146). Illustration for the deadline explainer and practical checklist for UAE banks, PSPs, insurers and crypto/digital-asset businesses.

Common questions on this topic

Who is affected by the 16 September 2026 deadline?

Federal Decree-Law No 6 of 2025 consolidates Central Bank of the UAE (CBUAE) supervision across a wide perimeter: UAE banks and branches of foreign banks, payment service providers (PSPs), insurers and insurance brokers, virtual asset service providers (VASPs) and DeFi platforms, financial market infrastructure — and, under Article 61, foreign firms marketing or promoting financial services to UAE residents without a local licence. Every in-scope entity was given one year under Article 184 to reconcile operations with the new law; the period expires on 16 September 2026. The CBUAE retains discretion to extend, but relying on a possible extension as a plan is a risky posture.

What did the new law consolidate?

The law repeals two prior acts — Federal Law No (14) of 2018 (former Central Bank Law and Regulation of Financial Institutions and Activities) and Federal Decree-Law No (48) of 2023 (former Insurance Law) — and unifies the supervision of banks, payments, insurance and virtual asset activities into a single federal act. The practical result: groups operating across several segments (e.g. a bank with an insurance brokerage arm and a PSP subsidiary) no longer face separate supervisory statutes for each segment — a single CBUAE framework applies. That is why the transition runs for a full year: many groups need to rebuild their licence matrix, internal policies and reporting.

Which five compliance areas are critical before the deadline?

Based on the detailed analysis by international law firms (Ashurst, Norton Rose Fulbright, Chambers and Partners, Hadef & Partners): (1) licensing — Article 60 sets the unified licensing requirements and general conditions of activity; (2) unlicensed marketing — Article 61 explicitly prohibits offering or promoting financial services to UAE residents without a CBUAE licence or other applicable permission; (3) corporate governance — strengthened board, committee and internal-control requirements; (4) consumer protection — Articles 148–152 expand duties around disclosure, complaint handling and fair treatment of customers; (5) recovery & resolution — Articles 142–146 give the CBUAE early intervention powers, recovery plans and orderly resolution tools for troubled institutions. Running a five-point self-check is the fastest way to see whether you carry real deadline risk.

Does the law also apply to DIFC and ADGM entities?

The DIFC (Dubai) and ADGM (Abu Dhabi) financial free zones have historically operated with their own financial regulators — Dubai Financial Services Authority (DFSA) and Financial Services Regulatory Authority (FSRA). Federal Decree-Law No 6 of 2025 is a federal act of the CBUAE, primarily operating at the UAE onshore level. Whether specific provisions reach entities licensed in DFSA or FSRA requires a case-by-case legal assessment. However, the core rule of Article 61 — the prohibition on unlicensed marketing of financial services to UAE residents — often captures cross-border activity, including that of free-zone structures, when it is directed at onshore clients. The prudent stance for any group with DIFC or ADGM entities and a UAE client base is to run its own applicability analysis rather than assume free-zone status makes the law irrelevant.

What should business do in the remaining 12 days?

A short-horizon plan: (1) map your licences and actual activities — bank, PSP, insurance broker, VASP, foreign firm with UAE-facing marketing — and reconcile with the new Article 60; (2) audit every marketing channel (site, socials, lead forms, ad accounts, partner content) for Article 61 exposure, especially if you operate from abroad into a UAE audience; (3) refresh corporate governance documentation — charter, board composition, committees, compliance policies; (4) review consumer-facing processes against Articles 148–152 — disclosure, complaints handling, fair-practice duties; (5) confirm you have a recovery plan and readiness for the CBUAE early-intervention framework under Articles 142–146. If you cannot close every point in 12 days, writing down a documented gap-analysis and remediation plan beats a rushed patchwork. The regulator treats good-faith, documented adaptation differently from silence at the deadline.

The one-year transition period of Federal Decree-Law No 6 of 2025 — the new consolidated UAE Central Bank Law — ends on 16 September 2026. UAE banks, payment service providers, insurers, virtual asset service providers and foreign firms marketing financial services to UAE residents have 12 days left to align their operations.

What happened

On 8 September 2025 the President of the UAE signed Federal Decree-Law No (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business — the new consolidated Central Bank Law. It was published in the Official Gazette on 15 September 2025. Under Article 184, every in-scope entity was granted one year to reconcile operations with the new law — the window closes on 16 September 2026. The Central Bank of the UAE (CBUAE) retains discretion to extend the transition, but there is no public extension announcement 12 days out — betting on one is not a plan.

The defining feature of the new act is consolidation. It repeals Federal Law No (14) of 2018 (former Central Bank Law and Regulation of Financial Institutions and Activities) and Federal Decree-Law No (48) of 2023 (former Insurance Law). Supervision of banks, payment service providers (PSPs), insurers, virtual asset service providers (VASPs and DeFi platforms) and financial market infrastructure is now unified in a single federal framework.

Who is in scope

The perimeter is broader than "banks and insurers":

Banks — UAE banks and branches of foreign banks operating in the country.
Payment service providers — PSPs, e-money issuers, retail payment operators licensed by CBUAE.
Insurers and insurance brokers — the previous perimeter of Federal Decree-Law 48/2023 rolls into the new act.
Virtual asset service providers — VASPs, DeFi platforms and digital-asset infrastructure. One of the more notable features of the consolidation: crypto infrastructure is explicitly brought within CBUAE supervision.
Financial market infrastructure — settlement, custody and clearing entities.
Foreign firms that market or promote financial services to UAE residents without a local licence. Article 61 explicitly captures cross-border activity.

Five compliance areas to check

Based on analysis by international law firms (Ashurst, Norton Rose Fulbright, Chambers and Partners, Hadef & Partners), five areas concentrate the substantive change and warrant a fresh gap-analysis before the deadline.

1. Licensing — Article 60

A unified framework for licensing requirements and the general conditions of activity. Organisations that currently hold licences across multiple segments should reconcile their setup against the new definitions and verify whether any activity now requires an additional or re-issued licence.

2. Unlicensed marketing — Article 61

An express prohibition on offering or promoting financial services to UAE residents without a CBUAE licence or other applicable permission. The rule reaches cross-border activity — social media, lead forms, partner content, international brokerage and investment platforms targeting UAE clients. A practical test: if your marketing funnel lands a UAE resident on the purchase of a financial product without a licence in the chain, you are in a high-risk zone.

3. Corporate governance

Reinforced requirements around board composition, audit and risk committees, internal control and segregation of duties. For many financial institutions this triggers a review of the charter, internal policies and, where needed, board composition.

4. Consumer protection — Articles 148–152

Expanded duties around disclosure, complaint handling and fair commercial practices. Retail financial products must be sold with transparent documentation; complaint channels and processing timelines are formalised.

5. Recovery & resolution — Articles 142–146

The CBUAE gains expanded early-intervention powers, formal recovery plans, orderly resolution and, where necessary, wind-down of troubled institutions. Systemically important banks and large financial groups should expect requirements around documented recovery plans, stress scenarios and internal escalation procedures.

DIFC and ADGM: what changes

The DIFC (Dubai) and ADGM (Abu Dhabi) financial free zones have historically operated with their own financial regulators — Dubai Financial Services Authority (DFSA) and Financial Services Regulatory Authority (FSRA). Federal Decree-Law No 6 of 2025 is a federal CBUAE act, primarily operating at the UAE onshore level. Whether specific provisions reach entities licensed in DFSA or FSRA requires a case-by-case legal assessment. However, the core rule of Article 61 — the prohibition on unlicensed marketing of financial services to UAE residents — will typically capture cross-border activity, including that of free-zone structures, when it is directed at onshore clients. The prudent stance for any group with DIFC or ADGM entities and a UAE client base is to run its own applicability analysis for the actual operating model, rather than default to "we are in the free zone, this does not apply to us". A broader look at free zones is in our overview of how to pick a UAE free zone.

The 12-day playbook

A short and very practical plan:

Map your licences and activities. What is licensed, by whom, in which segment, what services you actually deliver. Reconcile against the new Article 60 and the updated legal definitions.
Audit every marketing channel. Website, socials, lead forms, ad accounts, partner content, distributors, international brokerage and investment platforms. Every touchpoint where a UAE resident can buy or subscribe to a financial product — measured against Article 61.
Refresh corporate governance documentation. Charter, board composition, audit and risk committees, compliance and internal-control policies — reconciled with the new requirements.
Review consumer-facing processes. Product disclosures, complaint channels, resolution timelines, fair commercial practices — against Articles 148–152.
Confirm your recovery plan. Especially for systemically important institutions and large financial groups — a formal recovery plan, stress scenarios, internal escalation procedures under Articles 142–146.

If 12 days are not enough to close every point, prioritise writing down a documented gap-analysis with a dated remediation plan over trying to fix everything at once. Regulators treat good-faith, documented adaptation very differently from silence at the deadline.

What this changes for Garant clients

For clients running a regulated financial business in the UAE — a bank, PSP, insurer, VASP or an onshore vehicle of a foreign financial firm — the new law means running compliance through a single framework rather than piecing it together from the repealed laws 14/2018 and 48/2023.

For non-financial businesses that carry embedded financial services (intra-group payments, in-group lending, captive insurance), it is worth confirming that these activities still sit within the new law's exemptions and do not require a CBUAE licence. Financial slices often hide inside treasury and HR policies — and consolidation makes the law easier to apply to edge cases.

A separate area to watch is banking service. Article 60 and the corporate governance rules also change how UAE banks assess client risk. Companies with active cross-border activity — especially anything touching virtual assets — should proactively discuss with their bank how the consolidated law affects KYC and AML practice. A hands-on view of that dynamic is in our piece on the UAE corporate bank account.

Primary source and how to verify

Primary source — Federal Decree-Law No (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business, published in the CBUAE Rulebook (rulebook.centralbank.ae), with the UAE Legislation Portal (uaelegislation.gov.ae) announcing the UAE President's signature on 8 September 2025 and Official Gazette publication on 15 September 2025. Repealed acts — Federal Law No (14) of 2018 and Federal Decree-Law No (48) of 2023. Article 184 (transition), Article 60 (licensing), Article 61 (unlicensed marketing), Articles 142–146 (recovery & resolution) and Articles 148–152 (consumer protection) — cross-checked against Ashurst, Norton Rose Fulbright, Chambers and Partners, and Hadef & Partners analysis.

This article is for information only and is not legal or financial advice. The precise scope of the new law for your organisation, specific requirements and any updates should be verified with the Central Bank of the UAE (centralbank.ae) or a qualified legal adviser.

Topics:UAECBUAERegulationBankingPSPInsuranceCryptoComplianceDeadline