From 13 September 2026 the UAE will operate under a new Central Bank rulebook for SME customer protection — Regulation C 2/2026. It replaces the SME Market Conduct Regulation of 2021 and forces every UAE bank and finance company to open a low-risk SME account within three business days, respond to complaints within thirty and drop closing fees on accounts older than six months. Here is what the regulator has actually changed and what it means for SMEs and their banks.
The rulebook and its go-live date
On 17 February 2026 the Central Bank of the UAE (CBUAE) issued Regulation C 2/2026 — the SME Customer Protection Regulation. Legal briefings from Pinsent Masons and CMS Law confirm that publication in the Official Gazette followed in March, and six months after that publication — 13 September 2026 — the regulation goes live. That runway is twice as long as the 30-day window the previous SME Market Conduct Regulation (Circular 1/2021 of 26 January 2021) allowed. The new document fully replaces the old one.
The scope covers all banks and finance companies licensed by the CBUAE, both conventional and Islamic institutions that offer products and services to SMEs. The rulebook groups them under a single term — 'financial institutions'. It codifies conduct standards across every part of the relationship with an SME client: disclosure, pricing, compliance, complaints handling, personal data, support for customers in financial difficulty, account mobility, and reporting to the CBUAE.
Account opening: three business days for a clean SME
The key operational shift for SMEs is a fixed timeline for opening a bank account. Pinsent Masons highlights the new three-business-day timeline for low-risk SME accounts. The bank either opens the account or has to document and explain any delay or rejection — no more leaving the customer suspended for weeks without an answer.
Alongside that, the regulation introduces a mandatory 'Key Facts Statement' — a short document the bank must provide before contract execution, explaining the product's key features and risks. It must be issued in both Arabic and English, in plain language, with full disclosure of fees and pricing. Any material change to terms (including fee levels) requires at least 60 calendar days' written notice; automatic annual renewal requires at least 30 calendar days' notice.
In practice, an SME client gets a full picture of the cost of the account before opening it, and the bank loses the ability to slip in 'silent' changes later. For a segment where dense multi-page contracts were the norm, that is a real shift in the regulatory standard.
Complaints: 2 days to acknowledge, 30 to answer
The second hard block is how banks handle SME complaints. Per the CMS Law analysis, the bank must:
- send a written acknowledgement of receipt within 2 business days;
- issue a final written response on the merits within 30 business days of receipt;
- retain complaint records for at least 5 years.
The regulation explicitly points to Sanadak, the UAE's independent banking and insurance ombudsman, as the escalation route. If the bank's answer does not satisfy the SME, or the bank misses the deadline, the case can be escalated to Sanadak; the regulator also expects data-driven monitoring of complaint trends — the bank should look at what SMEs keep complaining about and fix it at the product level, not in one-off correspondence.
Fees: what has been banned outright
The regulator has closed a set of practices SMEs have complained about for years. Per CMS Law, the regulation introduces the following direct bans:
- no closing or early-termination fee where the account has been open for more than 6 months;
- no fee for the customer's original paper statement;
- fees must remain consistent throughout a customer's lifecycle — the bank cannot quietly raise pricing on an existing SME;
- tied selling / bundling is prohibited — the bank cannot condition the sale of one product or service on the purchase of another (for instance, 'credit only if you also take the premium current-account package').
Alongside that, the regulation requires banks to assess affordability and product suitability before extending credit, and to avoid abusive contract terms. Where an SME hits financial difficulty, the bank must offer a structured support framework — restructuring, product modification, adjusted payment plans — rather than defaulting straight to enforcement.
Customer data and account mobility
A separate layer covers protection of personal and corporate customer data. The regulation obliges each financial institution to establish a dedicated function for data management and protection. On a 'major' customer-data breach, the bank must notify both the CBUAE and the affected customer 'without undue delay'. There is a direct economic consequence: the bank is liable for direct and verifiable costs the customer incurs as a result of the breach. All customer data must be retained for a minimum of 5 years.
Account mobility is written into the regulation as a stand-alone right. The financial institution must facilitate transfers of customer accounts, products and financial data without additional fees; it cannot require the SME to explain why it is switching or to disclose competing offers. In effect, the regulation lifts the SME's switching rights to the level long enjoyed by retail customers in mature markets.
What banks need to finish before 13 September
Law firms recommend banks not to delay. Per CMS Law, the six-month runway should at a minimum be used to:
- run a full gap analysis of current products, fee schedules, forms and procedures;
- segment the SME client base and adapt product lines and risk approaches accordingly;
- establish a dedicated customer-data protection function with a working incident-notification procedure;
- rework standard-form contracts and fee schedules — particularly around account-closure penalties and auto-renewal clauses;
- build a complaints-management function with binding response deadlines and a clear link to Sanadak.
Reporting is a separate track. The regulation requires banks to file regular reports to the CBUAE on customer-protection matters: an up-to-date fee schedule, the list of products and services offered in the UAE, and complaint data. Frequency and exact deadlines will be set by the Central Bank separately. Administrative, financial and enforcement sanctions apply for non-compliance — the exact levels sit with the supervisory function. On governance, the regulation is specific: boards and senior management are on the hook for 'appropriate governance, oversight and internal controls'.
What it changes for the SME customer
For the SME customer the new regulation is, above all, about shorter and predictable timelines. Account opening used to take anything from a few weeks to a couple of months, and complaint-response deadlines were essentially unregulated; from 13 September the bank has a hard 3-business-day window for a low-risk account, 2 business days to acknowledge a complaint and 30 business days to answer on the merits. Walking away is easier: no closing fee after 6 months, no transfer fee to move products and data. And a transparent Key Facts Statement before the contract, not after.
For the market this is another step toward maturity in the banking segment: SME conduct rules are converging with those that have long applied to retail customers and with international consumer-protection practice. A practical tip for any SME planning to open or switch a bank close to 13 September: do not rush to close before the new rules take effect — from that date there will be more leverage and more transparency on fees and contract terms.
How to choose a bank for an SME today and which UAE banks work faster in practice — see our breakdown of the UAE corporate bank account in 2026. Broader context of the shifts in the UAE regulatory perimeter — UAE business regulation 2026: what has actually changed.
Prepared by the garant.consulting editorial team based on the primary source — the CBUAE Rulebook (rulebook.centralbank.ae) — and legal briefings from Pinsent Masons and CMS Law. Publisher — Garant Business Consultancy DMCC, Dubai.
