Exactly one year ago — on 15 September 2025 — the UAE Official Gazette published Federal Decree-Law No. (6) of 2025 'Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business'. The law came into force the following day, 16 September 2025, replacing the entire 2018 framework. Article 184 gave 'persons subject to the Law' exactly one year to reconcile their position. According to Hadef & Partners, the current deadline for that reconciliation is 15 September 2026. The CBUAE Board has announced no general extension.
Federal Decree-Law No. (6) of 2025 was issued by the UAE President on 8 September 2025 and published in the Official Gazette on 15 September 2025. For the first time it consolidates banking, insurance, payments and financial-market infrastructure into a single regulatory framework. It repeals Federal Decree-Law No. (14) of 2018 (the previous CB Law and law on the regulation of financial activities) and the 2023 Insurance Decree-Law, merging what were two separate supervision streams — the Central Bank and the insurance sector — under one regulator.
What has been pulled into the new CBUAE perimeter
The key novelty is the expanded definition of Licensed Financial Activities. It explicitly includes Open Finance Services (open APIs to customer data and accounts), payment services using virtual assets and the activities of technology providers facilitating financial services. Firms that were previously outside the traditional banking or payments box, but that in fact move value through crypto rails, stablecoins or payment SDKs, now sit inside the CBUAE licensing perimeter.
At the same time the law hardens the supervisory toolkit: early intervention and resolution powers, immediate recovery, publication of decisions against non-compliant firms, substantially higher administrative penalties and — for the first time — the direct criminalisation of unlicensed financial activities.
What the expiry of the one-year reconciliation actually means
Article 184 gives 'persons subject to the Law' — firms and professionals pulled into the new perimeter — one calendar year to align licensing, governance, prudential standards, operational processes and consumer protection with the new rules and CBUAE's implementing instruments. Calculated from the effective date (16 September 2025), the window closes on 16 September 2026, but law firms including Hadef & Partners quote 15 September 2026 as the operative deadline in their current client alerts.
Who exactly is caught
Three broad groups:
- Existing CBUAE licensees — banks, insurers and reinsurers, payment companies and other financial institutions. They must align internal policies, board documents, risk appetite, reporting and outsourcing contracts with the new standards.
- Previously unlicensed players pulled into the new perimeter — open-finance operators, providers of payment services using virtual assets and a subset of technology providers of critical financial services. They must either secure a CBUAE licence or restructure so the activity does not meet the definition of a Licensed Financial Activity.
- Insurance entities that were previously regulated separately — they now sit under unified CBUAE supervision and must move to the single-regulator template.
Consequences of missing the deadline
Across advisory notes from Hadef & Partners, Ashurst, Chambers and Partners, Paul Hastings and CMS Law-Now, the consequences of non-compliance by 15 September 2026 include:
- suspension or withdrawal of the existing licence;
- criminalisation of unlicensed financial activity — the new law directly treats it as a criminal, not merely administrative, offence for the first time;
- substantially higher administrative penalties;
- elevated CBUAE powers of immediate recovery, early intervention and formal resolution for distressed institutions;
- publication of the regulator's decisions, with the obvious reputational fallout for the firm involved.
Extension mechanics and how realistic they are
Article 184 expressly allows the CBUAE Board to extend the reconciliation period 'where appropriate'. No general extension has been issued as of 15 September 2026. Individual decisions are theoretically available on a motivated request supported by a credible transition plan; in practice this happens through correspondence with the CBUAE on the licensee's or applicant's official channel. Anyone contemplating such a request should already have a written rationale and a timeline for coming into compliance.
What to do today and in the coming working days
- Confirm your status with a UAE-qualified lawyer: are you inside the new definition of Licensed Financial Activity — allowing for the expansion into open finance, virtual-asset payments and technology providers?
- Separate your activities: if part of your operations is licence-critical and part is not, work out whether the licensed part can be spun into a separate entity or structurally isolated.
- Review operational processes: governance, risk appetite, consumer-protection standards, CBUAE reporting. For the wider context of UAE's 2026 regulatory shift see our overview of business regulation in the UAE in 2026.
- Refresh your banking arrangements: service agreements, KYC/EDD, payment handling. Under the new CB Law, opening and running a corporate account attracts additional scrutiny — we cover the practical mechanics in our note on the UAE corporate bank account.
- If reconciliation cannot realistically be completed, file a case-by-case extension request with the CBUAE Board, supported by a rationale and plan. Waiting until the regulator's first enquiry is risky — the CBUAE now has immediate recovery powers.
Bottom line
The first year of the new CB Law ends today. For some firms it is just a calendar date — the paperwork has been aligned with the new standards well in advance. For others it is a hard cut-off, after which any activity outside proper CBUAE licensing can now be treated as unlicensed financial activity, with a criminal (not just administrative) dimension. There is no general extension; an individual one is only available on a motivated request. If there is any doubt about your status, the sensible step is an express review with a UAE lawyer in the coming working days — well before the regulator's first enquiry.
Prepared from official UAE legislation (uaelegislation.gov.ae — Federal Decree-Law No. (6) of 2025) and advisory analysis by Hadef & Partners (September 2026), Ashurst, Chambers and Partners, CMS Law-Now, Paul Hastings and Databird Business Journal. Not individual legal advice — check your specific position with a UAE-qualified lawyer.
