On 13 September 2026 the UAE Central Bank's SME Customer Protection Regulation (Regulation C 2/2026) came into force. It replaces the 2021 SME Market Conduct Regulation and shifts the regulatory frame from generic market conduct to protecting the SME as a customer: a mandatory Key Facts Statement before sale, a three-business-day window for opening low-risk accounts, the right to switch banks without penalties, five-year complaint records and independent escalation to the Sanadak banking ombudsman. Masarif estimates SMEs represent roughly 94% of all UAE companies — hundreds of thousands of businesses now sit inside this new protective perimeter.
Regulation C 2/2026 was signed by the Central Bank of the UAE on 17 February 2026 and published in the Official Gazette. The transition period ran for six months from publication — versus 30 days under the previous SME MCR — which is what allowed CBUAE to load a much broader set of prudential and protective requirements into the new document. Legal commentary frames it as a move «from market conduct to consumer protection»: the emphasis shifts from formally policing bank behaviour to requiring banks to run measurable customer-protection processes.
Who is covered
The regulation applies to all banks and finance companies licensed by CBUAE, including institutions operating under Islamic Shari'ah provisions. Protection extends to SMEs as defined by the CBUAE classification. Precise thresholds — by turnover or headcount — are referenced to that separate classification; you can confirm a specific company's status with your bank or a UAE banking lawyer.
CBUAE explicitly flagged the areas where banks now have hard duties: transparency and disclosure, fair pricing, responsible financing, complaint handling, data protection, SME account mobility and access to banking services.
Eight core bank duties to SMEs
Drawing on legal analysis from CMS Legal, Pinsent Masons and Masarif, the regulation's key requirements are:
- Board-level accountability (Article 2). The bank's board approves strategy for the design, sale and distribution of SME products, with personal responsibility at board level for breaches of customer-protection rules.
- Transparent disclosure (Article 3). Mandatory Key Facts Statement — a concise, standardised summary of terms, fees and key risks — before the product is executed, not after. Any change to terms is notified at least 60 days in advance; renewal notices come at least 30 days ahead. Documentation is bilingual (English and Arabic).
- Anti-abuse (Article 4). Prohibition on collusion between banks and related parties, mandatory disclosure of conflicts of interest, and remuneration rules designed to remove staff incentives for mis-selling.
- Responsible lending. Before extending credit to an SME the bank must run an affordability assessment. Tied selling — conditioning one product on buying another — is prohibited.
- Account opening on a clock. For complete low-risk SME applications the bank must open the account within three business days. Previously there was no regulator-set deadline; SMEs now have a measurable right to speed. The applied mechanics of opening a corporate account are covered in our guide to the UAE corporate tax regime and banking realities.
- Complaint handling (Articles 3 and 11). Acknowledgement within two business days, final response within 30 days, five-year retention of the full complaint file. Unresolved complaints escalate to the independent Sanadak banking ombudsman.
- Data protection (Article 7). A dedicated SME data-protection function inside the bank, immediate breach notification to CBUAE and a restricted internal access perimeter for customer information.
- Mobility and distress support. The right to switch banks without artificial barriers or exit penalties, with the originating bank required to hand over information needed for migration. For SMEs in financial distress the bank must offer structured restructuring (rescheduled payments, deferral) before pushing debt into hard collections.
What changes in practice for an SME
- Transparency before signing. Fees can no longer be «buried» in schedules — the Key Facts Statement with the material terms and price must land before the product does.
- Guaranteed timeframes. Three business days for a low-risk account; 30 days for a final complaint response; 60 days' advance notice on T&C changes.
- Right to switch. Unhappy with your bank? Mobility is now a right, not a favour.
- Independent escalation. A rejected or slow response goes to Sanadak, an ombudsman purpose-built for banking disputes.
- Right to restructure. Distress must be addressed with a plan before it becomes a collections case.
How Sanadak works
Sanadak is the UAE's independent banking ombudsman — a venue separate from both CBUAE and the banks that resolves disputes in the financial sector. Under Regulation C 2/2026 the SME must first complain to the bank; the bank has two business days to acknowledge and 30 days to issue a final response. If that response is unsatisfactory or missed, the SME escalates to Sanadak. Banks retain the full complaint file for five years, giving both Sanadak and later CBUAE audits an evidence trail.
What to do in the next few working days
- Refresh the banking relationship. Ask the bank for updated Key Facts Statements on every live product — under the new regulation they must be available to SMEs on request.
- Confirm SME status. Work with the bank or a UAE lawyer to check whether your company falls inside the CBUAE SME classification — that is what unlocks the C 2/2026 rights.
- Review the bank's complaint procedure. If the bank did not previously publish a clear complaint path, it must now — including how to reach Sanadak.
- Assess mobility. If competitor terms are materially better, mobility is now a codified right; the bank must facilitate the move.
- Keep the wider regulatory picture in view. Payment infrastructure is being reshaped in parallel — see our take on Jaywan, the UAE's national payment card for business for context on how SMEs interact with domestic payments.
Bottom line
As of 13 September 2026 SMEs in the UAE have legally moved from being a bank's commercial clients to being protected banking customers. That is not a slogan — it is a bundle of measurable rights: account-opening timelines, complaint-response deadlines, mandatory price transparency, the right to switch banks and independent escalation to Sanadak. For banks the operational lift is real: policy updates, new Key Facts Statement templates, redesigned complaint and data workflows. For SMEs it is the first UAE regulation to codify bank obligations to a business customer with measurable deadlines.
Based on legal analysis from Pinsent Masons («UAE Central Bank enhances SME customer protection framework», 17 February 2026), CMS Legal («New SME Customer Protection Regulation marks a shift in UAE Central Bank Approach»), Masarif («Central Bank Introduces New SME Customer Protection Regulations», September 2026), and the CBUAE Rulebook — Regulation C 2/2026 (SME Customer Protection Regulation), effective 13 September 2026. Not individual legal advice — verify your situation with a UAE banking-law specialist.
