TRW & Co · Banking, Finance & Capital Markets
Payment Services Licensing in the UAE
Payment services licensing in the UAE is activity-based. The Central Bank licenses retail payment services in four categories, with separate regimes for stored value, payment tokens, open finance and card schemes, while the DIFC and ADGM run their own. The 2025 Central Bank law now reaches platforms that facilitate payments. This guide explains the categories, capital, safeguarding and process.
Key pointUnder Article 62 of the 2025 Central Bank law, technology or business model alone does not take an activity outside the licensing perimeter, so platforms that facilitate payments can no longer assume a partner's licence covers them.
At a glance
Four payment categories
The CBUAE licenses nine retail payment services in Categories I to IV, with initial capital from AED 100,000 to AED 3 million depending on services and volume.
Safeguarding within 24 hours
Providers may hold user funds only in transit; funds held beyond 24 hours need a bank escrow account, insurance or an independent bank guarantee.
Separate SVF and tokens
Wallets holding prepaid value need an SVF licence, and dirham payment tokens need a licence under the 2024 Payment Token Services Regulation.
2025 law widens perimeter
Federal Decree-Law No. (6) of 2025, in force since 16 September 2025, covers open finance, virtual-asset payments and platforms that facilitate financial services.
Free zones are separate
DIFC and ADGM firms are licensed by the DFSA and FSRA for money services, with no mutual recognition for serving onshore UAE customers.
Swipe or scroll →
What payment services licensing in the UAE covers
Payment services licensing in the UAE decides who may move money for others, issue wallets and payment instruments, acquire card transactions for merchants, aggregate payments, initiate payments from a customer's account, or issue and transfer payment tokens. It affects payment start-ups, e-commerce and marketplace platforms, remittance businesses, card schemes, banks partnering with fintechs and international payment groups entering the Gulf.
The UAE has built a detailed, activity-based framework. Onshore, the Central Bank of the UAE (CBUAE) licenses retail payment services in four categories, separately licenses stored value facilities and card schemes, and regulates payment tokens and open finance. The DIFC and ADGM run their own regimes. The September 2025 Central Bank law then widened the perimeter to catch platforms and technology that facilitate payments.
The legal question usually arrives early. Holding customer funds even briefly, settling to merchants, offering a wallet, embedding payments in a marketplace or accepting stablecoins can each be a licensed activity. Getting the classification right determines capital, timing, the regulator and whether the business model works at all.
The legal and regulatory framework
The 2025 Central Bank law
Federal Decree-Law No. (6) of 2025 regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business came into force on 16 September 2025, replacing the 2018 Central Bank law. Its list of licensed financial activities includes money transfer, open finance, virtual-asset payment services, and stored value and digital money services. Under Article 62, using a particular technology or business model does not by itself take an activity outside the licensing perimeter, and the provision expressly reaches platforms, decentralised applications and technology infrastructure that facilitate financial services.
Persons already carrying on newly regulated activities had a one-year period, to mid-September 2026, to align with the law unless the Central Bank's Board extended it. Unlicensed financial activity is a criminal offence, with imprisonment and fines from AED 50,000 up to AED 500 million. Existing payment regulations issued under the 2018 law remain in force until replaced.
The Retail Payment Services and Card Schemes Regulation
The Retail Payment Services and Card Schemes Regulation (Circular No. 15/2021) came into force on 15 July 2021. It defines nine retail payment services: payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic fund transfer, cross-border fund transfer, payment token services, payment initiation and payment account information. A provider must hold a licence in the category that covers its services, and payment services must be its principal business; ancillary activities need CBUAE approval and may have to sit in a separate entity. Card schemes need a separate card scheme licence.
Stored value, payment tokens and open finance
Wallets that hold prepaid value are governed by the Stored Value Facilities Regulation, which has a single licence and a much higher capital requirement (AED 15 million) than the retail payment categories. The Payment Token Services Regulation (Circular No. 2/2024) requires a licence to issue dirham payment tokens and registration for foreign payment tokens, and governs conversion, custody and transfer of payment tokens; its transitional period has ended. The Open Finance Regulation, published in April 2024, licenses data-sharing and service-initiation services and requires banks, insurers and payment providers to participate, subject to customer consent, in a phased rollout.
Licence categories and capital
The category structure is the heart of payment services licensing in the UAE. Initial capital depends on the category and on whether monthly average payment transactions, measured on a three-month moving average, reach AED 10 million. The CBUAE may require more capital where risk or complexity justifies it.
| Category | Services permitted | Initial capital (below AED 10m monthly average) | Initial capital (AED 10m or more) |
|---|---|---|---|
| Category I | All nine retail payment services, including payment token services | AED 1.5 million | AED 3 million |
| Category II | Account and instrument issuance, acquiring, aggregation, domestic and cross-border transfers | AED 1 million | AED 2 million |
| Category III | As Category II but without cross-border transfers | AED 500,000 | AED 1 million |
| Category IV | Payment initiation and payment account information only | AED 100,000 regardless of volume | AED 100,000 |
Banks do not need a separate payments licence for account issuance, instrument issuance or fund transfers, but need CBUAE non-objection for other retail payment services. Applicants should choose the category that matches their actual services; applying for a broader or narrower category than the business plan supports invites questions and delay.
Safeguarding customer funds
Safeguarding is where payment business models most often collide with regulation, and it is a central focus of payment services licensing in the UAE. Under Article 14 of the regulation, a retail payment provider may hold users' funds only as funds in transit. Where funds are settled within 24 hours, they must not be commingled with anyone else's funds and must be insulated from the provider's other creditors, particularly on insolvency.
Where settlement takes longer than 24 hours, the provider must protect the funds through a separate escrow account with a bank, restricted to transferring the funds to the beneficiary, or through an insurance policy or bank guarantee from an institution outside its group. Marketplaces and platforms that collect from buyers and pay sellers later should map their money flows carefully: a delay built into the settlement cycle can change the safeguarding method needed, and holding funds beyond transit can push the business into stored value or deposit-taking territory.
Most payment licensing problems start with a flow-of-funds diagram nobody drew: who holds the money, for how long and on whose behalf.
Choosing a route: licence, partnership or free zone
Own CBUAE licence
A business that will hold customer relationships, control funds and build a regional platform usually needs its own licence. It brings control and credibility with banks and merchants, but requires capital, a UAE-based management team, full governance and compliance functions, and a regulatory process with no published statutory timeline.
Investors should factor this into valuation and runway. Capital must be injected and maintained in the licensed entity, senior hires need to be in place before launch, and revenue typically starts only after the licence, bank accounts and scheme or network connections are all live. A realistic plan treats the first year as a build phase rather than a growth phase.
Partnering with a licensed provider
Many businesses start by partnering with a bank or licensed payment provider that holds the funds and the regulatory relationship, while the business provides the customer experience. This can be faster, but contracts must allocate responsibility clearly, and under the 2025 law the technology partner must be careful not to carry on a licensed activity itself. Outsourcing rules also apply to the licensed partner; see our page on financial services outsourcing.
DIFC or ADGM
In the DIFC, the DFSA authorises firms to provide money services, and in ADGM the FSRA regulates Providing Money Services, a framework it expanded in 2020 to cover payment accounts and stored value. Free zone licences are well suited to wholesale, cross-border and institutional models. They do not automatically allow a firm to serve onshore UAE customers, and there is no mutual recognition between the CBUAE and the free zone regulators for payment licences. See our pages on DIFC financial regulation and ADGM financial regulation.
The licensing process
- Map services and fund flows. Identify each service under the regulation, who holds funds and for how long, and whether any element involves stored value, payment tokens, open finance or credit.
- Select the regime and category. Decide between a CBUAE category, an SVF licence, a free zone authorisation or a partnership model, and confirm the capital requirement.
- Build the entity and team. Incorporate the applicant, appoint directors and senior managers who will pass fit and proper review, and plan for compliance, risk, AML and information security functions.
- Prepare the application. Assemble the business plan with volume projections, capital and source-of-funds evidence, governance, risk and AML frameworks, safeguarding arrangements, technology and security documentation, and outsourcing details.
- Regulatory review. Respond to CBUAE questions, attend meetings and address due diligence on shareholders and controllers. Timing depends on the quality of the file and the regulator's workload.
- Pre-launch conditions. Satisfy any conditions in the in-principle approval, such as capital injection, safeguarding accounts, systems testing and audits.
- Launch and ongoing compliance. Maintain capital, report to the CBUAE, register with goAML for suspicious transaction reporting and monitor volumes that trigger higher capital.
After the licence: ongoing obligations
Payment services licensing in the UAE is not a one-off event. A licensed provider must hold capital at or above its category minimum at all times and move to the higher tier when volumes require it. It must report periodically to the CBUAE, appoint an external auditor and, depending on its size, maintain an independent internal audit function. Changes in controllers, directors, services or key outsourcing arrangements generally need prior CBUAE approval or notification.
Conduct obligations also apply. Providers must disclose fees transparently, handle unauthorised transactions and disputes under the regulation's rules, and treat customers fairly under the CBUAE's consumer protection framework, covered on our consumer finance page. The 2025 Central Bank law adds mandatory fraud prevention and detection, strong customer authentication, transaction monitoring and breach notification.
Finally, the regulatory map keeps moving. New implementing regulations under the 2025 law are expected to replace the 2021 payment regulations over time, and the CBUAE issued an Operational Risk and Operational Resilience Regulation in 2026. A licensed provider should keep a regulatory change log and review its permissions whenever it adds a product, a corridor or a partner.
Documents and evidence regulators expect
Strong applications for payment services licensing in the UAE share the same features: a coherent business plan, a realistic budget and a team that understands UAE rules. Assemble:
- A business plan with 12 to 24 months of projected volumes, revenues and costs, and a clear description of each service.
- Flow-of-funds and data-flow diagrams showing safeguarding and settlement.
- Shareholder and controller information, including ultimate beneficial owners and source of funds.
- Curricula vitae and fit and proper declarations for directors and senior managers.
- Governance, risk management, compliance and internal audit frameworks.
- AML and sanctions policies, customer due diligence procedures and transaction monitoring design; see our AML compliance page.
- Information security, business continuity and outsourcing policies, with key vendor contracts.
- Customer terms, fee disclosures and complaints procedures.
Bank accounts are often the real bottleneck. A payment licence is of limited use without a UAE bank willing to hold safeguarded funds and provide settlement. Start bank discussions in parallel with the application and make sure your AML framework will satisfy the bank's due diligence as well as the regulator's.
Risks and common mistakes
Assuming a technology platform is outside the perimeter
Marketplaces, software platforms and embedded-finance providers often take the view that they merely provide technology while a partner moves the money. The 2025 Central Bank law makes that harder to sustain: Article 62 states that technology or business model alone does not exempt an activity and reaches platforms that facilitate financial services. Analyse what the platform actually does, including whether it controls funds, sets terms or presents itself as the provider. If the analysis is close, consider a licence or restructure the partnership so the licensed party clearly provides the service.
Holding funds beyond transit
Collecting payments from customers and releasing them later, for example after delivery or a dispute window, can mean the provider holds funds beyond transit. That triggers safeguarding requirements and, depending on the model, may move the business into stored value or deposit-taking territory with far higher capital. Design settlement cycles deliberately, document the safeguarding method and review it whenever the product changes.
Applying for the wrong category
Choosing Category III to save capital and then adding cross-border transfers, or applying for Category I without a payment token business, causes delay and rework. The category should match the services in the business plan and the next phase of growth. Monitor transaction volumes, because exceeding the AED 10 million monthly average for three consecutive months moves the provider to the higher capital tier.
Treating stablecoins as a crypto matter only
Accepting or settling in stablecoins can engage the CBUAE's Payment Token Services Regulation as well as virtual asset regimes. VARA or CMA (formerly SCA) licensing does not automatically cover payment token conversion or custody, and the free zones are excluded from the onshore payment token licence. Map token flows against both regimes before launch; our pages on virtual assets and stablecoins and payment tokens explain the overlap.
Under-building compliance for launch
Applicants sometimes plan to hire compliance and risk staff after approval. Regulators expect these functions to be designed, staffed or credibly planned before licensing, and banks will not onboard a provider whose AML controls are not working. Budget for experienced UAE-based compliance leadership, transaction monitoring systems and goAML registration from the start.
Cross-border payments and remittance corridors
The UAE is one of the world's major remittance markets, with large flows to South Asia, including Bangladesh and India. Cross-border fund transfers require at least Category II, and remittance businesses must also consider the rules in the receiving country, correspondent banking, foreign exchange controls and sanctions screening. A UK, Singapore, Saudi or Chinese payment group entering the UAE will usually need a local entity and licence for onshore retail activity, even if it is licensed at home, because no passporting applies.
Cross-border questions are among the most frequent issues in payment services licensing in the UAE. For businesses connected to Bangladesh, payment models linking UAE senders with Bangladeshi recipients require coordinated advice on both ends, including Bangladesh Bank's foreign exchange and mobile financial services rules. TRW & Co's offices in Dhaka, Chattogram and Sylhet allow us to coordinate that analysis directly. For broader fintech structuring, see fintech regulation in the UAE and our note on open finance.
How TRW & Co helps
We advise payment firms, platforms, banks and investors on payment services licensing in the UAE, from perimeter analysis to post-licence compliance.
Perimeter and structuring
We map services and fund flows against the CBUAE, DFSA and FSRA regimes and the 2025 law, and recommend the licence, partnership or free zone route that fits the business plan.
Licence applications
We prepare and review applications, business plans and policies, coordinate with technology and compliance teams, and manage regulator questions through to approval.
Safeguarding and banking
We design safeguarding arrangements, negotiate escrow and settlement agreements, and help prepare for bank due diligence.
Partnership and merchant contracts
We draft bank, sponsor, platform and merchant agreements that allocate regulatory responsibility and protect the licensed party.
Tokens and open finance
We advise on payment token registration and licensing, the interaction with virtual asset regimes, and open finance participation.
Ongoing compliance
We support capital and reporting compliance, AML reviews, inspections and remediation. Where representation before UAE onshore courts or the DIFC/ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners.
See our wider banking and finance practice and all our practices.
Checklist for decision-makers
- Have we mapped every service against the nine retail payment services, stored value, payment tokens and open finance?
- Do we know who holds customer funds, for how long and how they are safeguarded?
- Have we chosen the right regulator and licence category, with capital for projected volumes?
- Has our platform or partnership model been tested against Article 62 of the 2025 law?
- Do we have a UAE bank lined up for safeguarding and settlement?
- Are our directors and senior managers ready for fit and proper review, and are compliance and AML functions in place?
- Do stablecoin or token features require CBUAE licensing or registration in addition to any virtual asset licence?
- Are cross-border corridors covered by the right category and by advice in the receiving countries?
Payment services licensing in the UAE rewards early, careful structuring. Contact TRW & Co to discuss your payments model.
Frequently asked questions
01Which payment activities need a licence in the UAE?
Onshore, the Retail Payment Services and Card Schemes Regulation covers nine services: payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic and cross-border fund transfers, payment token services, payment initiation and payment account information. Stored value facilities, card schemes, payment tokens and open finance have their own instruments. The 2025 Central Bank law adds that platforms facilitating these activities can also be caught.
02How much capital does a UAE payment licence require?
Initial capital depends on the category and volumes. Category I requires AED 1.5 million, rising to AED 3 million once monthly average transactions reach AED 10 million; Category II requires AED 1 million or AED 2 million; Category III AED 500,000 or AED 1 million; Category IV AED 100,000 regardless of volume. Stored value facilities require AED 15 million. The CBUAE can require more where risk justifies it.
03What is the difference between a payment account and a stored value facility?
A payment account under the retail payment regulation is used to execute payment transactions, with funds held only in transit and safeguarded. A stored value facility holds prepaid value that customers can use later, which carries greater risk and a much higher capital requirement under the separate SVF Regulation. Wallet products should be analysed carefully at the design stage, because the classification drives capital, safeguarding and timing.
04Can a DIFC or ADGM payment firm serve onshore UAE customers?
Not automatically. The DFSA and FSRA authorise money services within their free zones, and there is no mutual recognition between them and the CBUAE for payment licences. A free zone firm wanting to serve onshore retail customers generally needs a CBUAE licence or a partnership with an onshore licensed provider. Free zone licences remain well suited to wholesale, institutional and cross-border models.
05Do stablecoin payments need Central Bank approval?
Often, yes. The CBUAE Payment Token Services Regulation requires a licence to issue dirham payment tokens and registration for foreign payment tokens, and regulates conversion, custody and transfer of payment tokens onshore. Virtual asset service providers licensed by VARA or the CMA (formerly the SCA) need separate CBUAE clearance for certain payment token activities. The financial free zones are excluded from the onshore payment token licence and apply their own rules.
06How long does a UAE payment licence take?
There is no published statutory timeline. Timing depends on the completeness of the application, the complexity of the business, the fit and proper review of shareholders and managers, and the regulator's workload. Applicants that present a coherent business plan, clear fund flows, safeguarding arrangements and a credible compliance team typically move faster. Securing a bank relationship in parallel avoids delays after approval.
07What happens to businesses that were unlicensed before the 2025 law?
The 2025 Central Bank law gave persons already carrying on newly regulated activities a one-year period, to mid-September 2026, to align, which the Central Bank's Board could extend. That period has now ended unless a specific extension applies. Unlicensed financial activity is a criminal offence with fines of up to AED 500 million. Businesses that are unsure of their position should take advice and engage with the regulator promptly.
Sources and official materials
- Federal Decree-Law No. (6) of 2025 (announcement) — New Central Bank law and licensed activities
- CBUAE Retail Payment Services and Card Schemes Regulation — Categories, capital and safeguarding
- CBUAE Rulebook — SVF, payment token and related regulations
- CBUAE: Open Finance Regulation press release — Open finance licensing
- Dubai Financial Services Authority — DIFC money services regime
- FSRA enhancements to Providing Money Services — ADGM payments and stored value framework
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
