Financial regulation

Regulatory bodies

Which bodies regulate the provision of fintech products and services?

For banking and lending-related activities in onshore UAE, the financial services regulator is the UAE Central Bank, while for securities and capital markets-related matters, the UAE Securities and Commodities Authority (SCA) is the relevant regulator. Onshore UAE also has an insurance-sector regulator, which is the UAE Insurance Authority (IA). For all regulated financial activities in the Dubai International Financial Centre (DIFC), the regulator is the Dubai Financial Services Authority (DFSA). For all regulated financial activities in the Abu Dhabi Global Market (ADGM), the regulator is the Financial Services Regulatory Authority (FSRA).

Regulated activities

Which activities trigger a licensing requirement in your jurisdiction?

The onshore UAE regulatory regime is separate and different from the regulatory regime found in the DIFC and the ADGM. So, when considering the UAE, it is important to first ask which specific jurisdiction and financial regulatory regime is applicable.

As financial free zones, both the DIFC and the ADGM have their own common law-based commercial and civil legal and financial services regulatory frameworks, as well as their own dedicated courts. The DFSA is the financial services regulator for activities conducted in or from the DIFC and the FSRA regulates financial services activities in or from the ADGM. The relevant federal onshore UAE (ie, in the UAE but outside the DIFC and ADGM) financial regulators are the SCA, the UAE Central Bank and the IA. The UAE Central Bank is the prudential regulator for onshore UAE and mainly regulates activities relating to banking and lending activities such as:

  • deposit taking (including sweep deposit accounts);
  • foreign exchange trading;
  • guarantees and commitments;
  • payment services (including the issuance of payment instruments and other means of payments);
  • primary lending;
  • factoring;
  • invoice discounting;
  • arranging primary loans;
  • secondary market loan trading; and
  • secondary market loan intermediation.


Outside the banking and lending context, the UAE Central Bank was historically the sole financial services regulator for onshore UAE prior to the establishment of the SCA (in 2001) and the IA (in 2007). There are therefore some other areas of financial activity that the UAE Central Bank continues to regulate – such as, among other things, currency brokerage, money exchange and some activities that would be typically associated with investment banking.

Generally, the types of regulated activities in onshore UAE, the DIFC and the ADGM include, among other things:

  • the marketing and sale of securities;
  • providing investment advice;
  • dealing in products and investments (either as principal or agent);
  • underwriting and placing financial products;
  • offering and providing discretionary investment management services;
  • marketing or selling funds (including the provision of investment advice);
  • accepting deposits;
  • providing credit;
  • providing money services;
  • arranging deals in investments;
  • managing assets;
  • managing a collective investment fund;
  • advising on financial products; and
  • insurance intermediation.


Securities and financial products that are regulated by the respective financial services regulators across onshore UAE, the DIFC and the ADGM include, but are not limited to, equity securities, debt securities, linked products, derivatives, structured products, deposits, notes and warrants.

Consumer lending

Is consumer lending regulated in your jurisdiction?

Yes. Article 65 of UAE Decretal Federal Law No. 14 of 2018 Regarding the Central Bank and Organisation of Financial Institutions and Activities provides that the UAE Central Bank will regulate, among other things, the activities of ‘providing credit facilities of all types’, ‘providing stored values services, electronic retail payments and digital money services’ and ‘providing virtual banking services’.

With regard to the provision and booking of these services ‘in or from’ either the DIFC or the ADGM, these activities are likely to be considered as ‘providing credit’, which will require a licence from either the DFSA or FSRA respectively. To the extent that these services are only ‘advised’ on or ‘arranged’ from the same jurisdictions, an appropriate licence would also be required from either the DFSA or FSRA. If these services are merely promoted (with no ‘advising’ or ‘arranging’) ‘in or from’ either financial free zone, unless an exemption applies, a Representative Office licence would be required from either the DFSA or the FSRA respectively.

Secondary market loan trading

Are there restrictions on trading loans in the secondary market in your jurisdiction?

Secondary market loan trading is an activity regulated by the UAE Central Bank. It constitutes primary lending and is regulated whether or not the loan has been fully drawn. The trading of loans would also constitute a regulated financial services activity in the DIFC and the ADGM.

Collective investment schemes

Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

In onshore UAE, there is a general prohibition on marketing unregistered collective investment schemes (ie, funds) unless they have been registered with the SCA accordingly (either for private or public promotion). However, the onshore UAE marketing prohibition does not apply to the promotion of foreign funds to a non-natural ‘qualified investor’. A non-natural qualified investor is defined in the SCA rules and includes the federal government, among others.

There is a private placement regime under the SCA rules, where if the potential investor is a natural person, foreign funds can be registered for private placement by an SCA-licensed promoter subject to several conditions.

With regard to the DIFC, there is a prohibition on marketing unregistered funds in the DIFC except through a DFSA-licensed intermediary with the appropriate type of licence, unless an exemption applies. The prohibition on the offer or sale of a fund only applies where this activity is carried out ‘in or from’ the DIFC. It is not possible to register a foreign fund for distribution in the DIFC. Funds need only be registered with the DFSA if they are domiciled in the DIFC. There are currently relatively few funds domiciled in the DIFC and so most funds marketed in the DIFC are foreign (ie, non-DIFC-domiciled) and, therefore, unregistered. However, all funds and collective investment schemes promoted ‘in or from’ the DIFC need to meet a fund eligibility criteria.

Once a marketing entity holds the appropriate licence it may market foreign domiciled funds or DIFC-domiciled funds, provided it markets only to investors within the scope of its licence, and in the case of any foreign fund:

  • the fund qualifies as a ‘designated’ or ‘non-designated fund’;
  • the marketing entity has a reasonable basis for recommending a fund as suitable to a particular client; or
  • the fund offered discreetly to persons who are professional clients and the minimum subscription per investor is US$50,000.


Similar provisions exist with regard to the ADGM.

Following public consultation, with effect from 31 August 2017, the DFSA updated its rules to include ‘operating a crowdfunding platform’ as a regulated activity.

With regard to onshore UAE, while the UAE Central Bank is reported to be in the process of drafting regulations relevant to crowdfunding, no specific regulatory regime has been introduced. However, depending on the specific activities undertaken (ie, where the platform merely introduces two independently contracting parties or if the platform is actively establishing a fund or offering securities), the activity may potentially fall under existing UAE Central Bank or SCA regulation.

Alternative investment funds

Are managers of alternative investment funds regulated?

Yes, managers of alternative investment funds are regulated in onshore UAE, the DIFC and the ADGM.

Peer-to-peer and marketplace lending

Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

Lending is a regulated activity whereby intermediary platforms are required to obtain approvals to operate from the UAE Central Bank, which would trigger compliance requirements on the platform including the proper vetting of borrowers and anti-money laundering checks.

While interest is prohibited under articles 409 to 412 of the Penal Code and is void under articles 204 and 714 of the Civil Code, interest is permitted under articles 77 and 90 of the Commercial Code, provided it does not exceed 12 per cent. In any case, UAE Federal Supreme Court Decision No. 14/9 of 28 June 1981 permits the charging of simple interest (presumably as opposed to compound interest) in connection with banking operations.

The DFSA issued a consultation paper in early 2017 called ‘Crowdfunding: SME Financing through Lending’, which proposed a regulatory framework to operate loan-based crowdfunding platforms in the DIFC. In summary, the DFSA proposed a regime whereby loan-based crowdfunding platforms in the DIFC:

  • benefit from a new financial activity and licence for operating such a platform;
  • apply appropriate prudential and conduct of business requirements for these platforms;
  • disseminate appropriate risk warnings and disclosures to lenders and borrowers;
  • conduct suitable due diligence on the borrowers as well as checks on lenders;
  • deploy a business cessation plan in the event that it ceases operations; and
  • follow rules in relation to transfer of rights and obligations between lenders.


On 1 August 2017, changes to the DFSA rules came into force that introduced rules relevant to crowdfunding. Additional rules, which included investment limits and property valuation requirements in the context of property crowdfunding, came into force on 1 July 2019.


Describe any specific regulation of crowdfunding in your jurisdiction.

Financial services in the UAE are regulated either by the UAE Central Bank, the IA or the SCA depending on the nature of the activity. In respect of financial free zones in the UAE, such activities are regulated by the DFSA in the DIFC, and the FSRA in the ADGM. In particular, issues of securities by UAE companies are regulated under the UAE Companies Law (Federal Law No. 2 of 2015) and regulations issued by the SCA. As such, under the UAE Companies Law, only public joint-stock companies may offer securities by way of a public subscription through a prospectus. Other companies, whether incorporated in the UAE (onshore or in a free zone) or in a foreign jurisdiction, are prohibited from advertising including the invitation to a public subscription without the approval of the SCA. In practice, private joint-stock companies are entitled to issue securities to sophisticated investors by way of a private placement. Accordingly, this regulatory limitation restricts the ability of limited liability companies, the legal form adopted by most SMEs in the UAE, from raising funds through equity-based crowdfunding.

On 1 August 2017, changes to the DFSA rules came into force that introduced rules relevant to crowdfunding. Additional rules, which included investment limits and property valuation requirements in the context of property crowdfunding, came into force on 1 July 2019.

Invoice trading

Describe any specific regulation of invoice trading in your jurisdiction.

Invoice trading currently falls within the activity of ‘arranging credit’ within the DIFC and is regulated as such by the DFSA. Similar provisions exist in the ADGM. With regard to onshore UAE, invoice trading will require a form of regulatory licence either from the UAE Central Bank (if providing credit) or the SCA (if invoices were to be considered as a financial product falling within the SCA’s Promoting and Introducing Regulations – Regulation 3/RM of 2017). To the extent that services are merely promoted within onshore UAE, the DIFC or the ADGM, a Representative Office licence in the respective jurisdiction would be required.

Payment services

Are payment services regulated in your jurisdiction?

Yes. On 1 January 2017, the UAE Central Bank published its Regulatory Framework for Stored Values and Electronic Payment Systems (the Digital Payment Regulation), which covers the following digital payment services:

  • cash-in services: enabling cash to be placed in a payment account;
  • cash-out services: enabling cash withdrawals from a payment account;
  • retail credit and debit digital payment transactions;
  • government credit and debit digital payment transactions;
  • peer-to-peer digital payment transactions; and
  • money remittances.


The Digital Payment Regulation does not apply to the following payment services or providers, although it states that the list below may be subject to other Central Bank laws and regulations:

  • payment transactions in cash without any involvement from an intermediary;
  • payment transactions using a credit or debit card;
  • payment transactions using paper cheques;
  • payment instruments accepted as a means of payment only to make purchases of goods or services provided from the issuer or any of its subsidiaries (ie, closed-loop payment instruments);
  • payment transactions within a payment or settlement system between settlement institutions, clearinghouses, central banks and payment service providers (PSPs);
  • payment transactions related to transfer of securities or assets (including dividends, income and investment services);
  • payment transactions carried out between PSPs (including their agents and branches) for their own accounts; and
  • technical services providers.


The Digital Payment Regulation specifies four categories of PSPs: retail PSPs, micropayment PSPs, government PSPs and non-issuing PSPs.

In November 2019, the DFSA published Consultation Paper No.125 on Proposals for Money Services.

In the paper, the DFSA set out its proposal to allow certain activities relating to money services that have emerged owing to rapid advancements in technology, with the DFSA recognising that these activities could promote the growth of regulated financial services activities in the DIFC and provide greater protection and choices to users of money services. One of the activities it proposed to allow was the provision of money services (as defined in the DFSA Rulebook Conduct of Business Module (COB)) in respect of electronic currency. The consultation has since closed and amendments to the DFSA Rulebook COB Module came into force on 1 April 2020, introducing requirements for the provision of money services in relation to electronic money in the DIFC.

Open banking

Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?

Other than in the context of a regulatory or official investigation, there is no specific obligation in UAE legislation requiring the disclosure of data to third parties. However, the Digital Payment Regulation maintains the UAE Central Bank’s rights to impose access regimes and interoperability obligations on PSPs.

The general position is that financial institutions that are in a position to collect and store data from the public are bound by a duty of confidentiality. A breach of this duty of confidentiality could attract criminal liability under article 379 of the UAE Penal Code. Further, article 106 of the Banking Law requires the UAE Central Bank to keep confidential all banking data that it receives.

Insurance products

Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

Nothing in current UAE legislation (whether onshore UAE, DIFC or ADGM) specifically regulates fintech companies that wish to sell or market insurance products, and, therefore, the general regulation around the sale and marketing of insurance products in the relevant jurisdictions applies.

The IA was established under Federal Law No. 6 of 2007 (the Insurance Law). The IA, through the powers given to it under the Insurance Law, regulates insurance and reinsurance operations in onshore UAE. Insurance operations include insurance activities such as life assurance and funds accumulation operations, properties insurance and life liability insurance.

Detailed financial regulations around insurance companies were published at the end of 2014. The IA has issued various guidance and circulars that affect the scope of regulation around the insurance industry in the UAE. Insurtech businesses looking at the UAE market will need to observe additional guidance from the IA.

Credit references

Are there any restrictions on providing credit references or credit information services in your jurisdiction?

On 15 April 2018, the SCA issued Chairman of the SCA Board of Directors’ Decision No. 18/RM of 2018 Concerning the Regulations as to Licensing Credit Rating Agencies. Under these regulations, a credit rating is ‘a periodic measure to determine and assess the ability of the rated entity to meet its financial liabilities, and potential risks that may affect it, and to evaluate the financial products and potential risks of acquiring them by the investor’ and credit rating activities are regulated. To be eligible for a licence to carry on credit rating activities, an entity must have, among other things, a minimum of 2 million UAE dirhams in capital and consent from the UAE Central Bank or the IA (should the licence application be subject to their mandate).

In the DIFC, ‘operating a credit rating agency’ is a regulated activity that would require a DFSA licence. Similar provisions exist in the ADGM.

However, individual credit reference and information services are possible in the UAE through the Al Etihad Credit Bureau (AECB), which is a public joint stock company wholly owned by the UAE federal government. According to UAE Federal Law No. 6 of 2010 concerning Credit Information, the AECB is mandated to regularly collect credit information from financial and non-financial institutions in the UAE. The AECB aggregates and analyses this data to calculate credit scores and produce credit reports that are made available to individuals and companies in the UAE. The AECB collects information on individuals and companies from banks, finance companies and telecoms companies. Additional information from other sources such as utilities, real estate, government and other entities are planned to be added in the future. Financial institutions in the UAE are mandated by law to supply the AECB with all credit information on a monthly basis.

Law stated date

Correct on:

Give the date on which the above content is accurate.

3 June 2020.