TRW & Co · Banking and fintech
Open Finance in the UAE: What the Central Bank Regulation Requires
Open finance UAE rules come from the Central Bank’s Open Finance Regulation. Supervised banks, insurers and payment firms must share customer data and allow transactions to be initiated through a central API hub, with express customer consent, while third-party providers need Central Bank authorisation. This guide explains scope, licensing, consent, contracts and the mistakes that cause problems.
Key pointThe Central Bank law now looks at what a business does, so a fintech that runs the consent journey and initiates services for customers may need its own authorisation even if a licensed bank holds the money.
At a glance
Mandatory for supervised firms
The Central Bank has made participation mandatory for the financial institutions it supervises, for in-scope products, with obligations applying in phases it notifies.
Central API hub model
Participants connect once to a Central Bank-owned hub with a trust framework and shared services, rather than building bilateral integrations with every counterparty.
Two kinds of service
The framework covers sharing customer financial data and initiating services or payments on customer accounts, each requiring express, recorded and revocable consent.
Licensing for providers
Third-party providers need Central Bank authorisation, and the new Central Bank law can catch businesses that merely facilitate a licensed financial activity.
Onshore regime only
The DIFC and ADGM keep their own regulators and data laws, but free-zone firms serving onshore customers must still consider the Central Bank perimeter.
Swipe or scroll →
Open finance UAE: the short answer
Open finance UAE rules are set by the Central Bank of the UAE (CBUAE) through its Open Finance Regulation. They require licensed financial institutions to share customer data and allow transactions to be initiated on customer accounts, through a central API hub, but only with the customer’s express consent. Third parties that want to use that access must be licensed by, or have clearance from, the Central Bank.
As of October 2026, the Regulation is listed as in force in the CBUAE Rulebook, following an updated circular issued in July 2025. It applies in phases notified by the Central Bank, so whether a particular product or institution is “live” depends on the phase it falls in, not only on the text.
For a bank, insurer or payment firm, the practical question is not whether to participate but how quickly to connect, what to build, and how to allocate liability when something goes wrong between a data holder and a third-party provider.
The legal framework behind open finance
The core instrument is the CBUAE Open Finance Regulation, which sits in the Rulebook’s enabling technologies section alongside the joint guidelines on APIs, cloud, AI and distributed ledger technology. When the Central Bank first announced the Regulation, it described participation as mandatory for all financial institutions it supervises for in-scope products and services.
Above it sits the new Central Bank law, Federal Decree-Law No. 6 of 2025, which came into force in September 2025. It brings open finance services expressly within the Central Bank’s regulatory scope and adopts a technology-neutral perimeter: offering or facilitating a licensed financial activity by any means can bring a business within the law. Firms were given a transition period to regularise their position, and that window has now run its course unless the Central Bank has extended it for a particular firm.
The Regulation also links to the wider consumer framework. Open finance providers must comply with applicable consumer protection laws and regulations, and breaches can lead to administrative and financial sanctions. Our separate guide to CBUAE licensing under the new Central Bank law explains the perimeter in more detail.
Supervision and enforcement
The Central Bank supervises open finance participants in the same way as its other licensees. Breaches of the Regulation, the Central Bank law or other applicable laws can lead to administrative and financial sanctions against the provider or the licensee, and the Central Bank law gives it wide powers to fine, settle and publish penalty decisions.
In practice, supervisory attention tends to focus on consent quality, security incidents, complaint volumes and whether a firm is carrying on activities outside its authorisation. Keeping a clear map of activities against licence conditions is the simplest protection.
Three building blocks
The Central Bank describes the framework as resting on three components: a trust framework that identifies and certifies participants, an API hub that standardises how they connect, and common infrastructure services such as consent management, onboarding, reporting and dispute handling.
The hub is operated by a Central Bank-owned entity, Nebras, and the customer-facing consent and authentication experience is branded Al Tareq, which several UAE banks now promote to their customers. The practical effect is that participants connect once to the hub rather than building bilateral integrations with every counterparty.
Who is in scope of open finance UAE rules
There are two broad groups. The first is the data holders: licensed financial institutions (LFIs) supervised by the Central Bank, such as banks, finance companies, insurers and payment firms, which must expose in-scope account and product data and allow transactions to be initiated through the hub.
The second is the users of that access: third-party providers that want to aggregate data or initiate services for customers. They need Central Bank authorisation for the relevant open finance activity. Some institutions that already hold a Central Bank licence can be treated differently, but they still need Central Bank clearance before offering open finance services, so a bank cannot simply launch an aggregation product on the strength of its banking licence.
The open finance UAE regime is an onshore, federal framework. The DIFC and ADGM have their own regulators, the DFSA and the FSRA, and their own data protection laws. A free-zone fintech that wants to serve onshore customers through the hub, however, has to look at the Central Bank perimeter as well as its home regulator.
| Role | Typical participant | Core obligation | Key risk |
|---|---|---|---|
| Data holder | Bank, finance company, insurer, payment or stored value firm | Connect to the API hub; share in-scope data and allow initiation with consent | Late connection, poor API performance, consent errors |
| Data sharing provider | Aggregator, budgeting or accounting app, credit decision tool | Hold the right authorisation; use data only for the consented purpose | Purpose creep, onward sharing, weak security |
| Service initiation provider | Embedded finance platform, merchant payment app, lending marketplace | Initiate payments or products on the customer’s instruction | Unauthorised or mistaken transactions, fraud allocation |
| Hub operator | Central Bank-owned infrastructure entity | Run the trust framework, API hub and common services | Service availability, onboarding timelines |
| Supervisor | Central Bank of the UAE | License, supervise and sanction participants | Enforcement action, licence conditions |
Data sharing and service initiation
Open finance in the UAE goes beyond classic open banking. The Regulation covers two families of activity: sharing customer financial data with authorised parties, and initiating transactions or services on a customer’s accounts and products, including payments.
Product scope is broad, spanning banking, insurance and other financial products held with Central Bank-supervised firms. That is what makes open finance UAE rules strategically important for insurers and finance companies, not only for retail banks.
Service initiation is where most commercial opportunity sits. A marketplace can let a customer move from comparing a product to applying for it inside the same app. It is also where most legal risk sits, because a mistaken or fraudulent instruction moves money, not just data. For payment-led models, see our page on payment services in the UAE.
Consent, data use and security
Consent is the gateway to everything. It must be express, informed and recorded, and customers must be able to see and revoke it. The common infrastructure includes a centralised consent and authentication layer, so the customer journey is standardised across participants.
Data received through the hub may be used only for the purpose the customer authorised. The framework is built around secure API access rather than screen scraping, and participants should assume that selling or onward-trading data received from another participant is not permitted.
Data protection law sits alongside the sector rules. The federal personal data protection framework has carve-outs where sector legislation already regulates banking and credit data, so the Central Bank’s own consumer protection and data rules carry much of the weight. In the DIFC and ADGM, the free-zone data protection laws apply instead. Our guide to the UAE Personal Data Protection Law covers the overlap.
Treat consent records as evidence, not as a user-interface feature. In any dispute about an unauthorised payment or misuse of data, the first question will be what the customer agreed to, when, and through which screen. Keep that record complete, time-stamped and retrievable for the period your record-keeping rules require.
How participants get ready
The path differs for incumbents and new entrants, but the core steps are similar. A typical programme runs as follows.
- Map your status. Decide whether you are a data holder, a third-party provider or both, and which in-scope products and phases apply to you. Record the analysis for your board.
- Secure authorisation or clearance. Third-party providers apply to the Central Bank for the relevant open finance licence; existing licensees obtain the clearance the Central Bank requires before launching services.
- Connect to the hub. Complete onboarding with the hub operator, obtain certificates under the trust framework, and test against the published standards and business rules.
- Build consent and authentication. Integrate the central consent flow, design clear purpose statements and build revocation and dashboard features.
- Write the contracts. Put in place participation terms, commercial arrangements, outsourcing and cloud contracts, and customer terms that reflect open finance liability.
- Stand up controls. Fraud monitoring, incident response, complaint handling and reporting lines aligned with Central Bank consumer protection and technology risk expectations.
- Launch in phases and monitor. Go live for the products in your phase, track API performance and complaints, and report issues to the Central Bank where required.
Contracts and liability allocation
The Regulation sets the public-law rules, but money and blame still flow through contracts. Three layers matter: the participation terms with the hub operator, the commercial arrangements between participants, and the customer terms each participant presents.
Key points to negotiate include who refunds the customer first after an unauthorised initiation, how quickly, and on what evidence the other participant must reimburse. Contracts should also cover service levels for API availability, security incident notification, audit rights and what happens when a participant’s authorisation is suspended.
Remember that UAE civil law limits how far liability can be excluded, and the new Civil Transactions Law gives courts control over agreed compensation. Our guide to limitation of liability, indemnities and warranties under UAE law explains what a cap can and cannot do, and our fintech regulation team covers the regulatory side.
Illustrative scenario: an embedded lending app
This scenario is illustrative only and does not describe a real client or case.
A Dubai-based software company runs an accounting app for small businesses. It wants to pull customers’ bank transaction data to produce cash-flow forecasts, and then let them apply for working-capital finance from a partner finance company inside the app.
The company first maps its activities: data aggregation is one open finance activity; offering the finance company’s product inside its app looks like service initiation and may also be a marketing or promotion of a licensed activity. It concludes it needs Central Bank authorisation rather than relying on the finance company’s licence.
It then designs two separate consents, one for data sharing and one for each loan application, with clear purpose statements. Its contract with the finance company allocates responsibility for affordability assessment, disclosures and complaints, and requires the finance company to handle credit decisions. Before launch it tests a scenario in which a customer disputes an application they say they never made, and confirms the consent logs answer the question.
Risks and common mistakes
Assuming a bank partner’s licence covers the fintech
Under the new Central Bank law the perimeter turns on what a business does, including facilitating a licensed activity, not on who holds the customer’s money. A fintech that designs the customer journey, collects consent and initiates services may need its own authorisation even if a licensed bank sits behind it. Relying on the partner’s licence without analysis is the most common structural error we see in open finance UAE projects, and the consequences of unlicensed activity are serious, including criminal exposure under the Central Bank law.
Treating open finance as an IT project
Connecting to the hub is a technical exercise, but the obligations are legal and supervisory. Boards remain accountable for consumer outcomes, outsourcing, technology risk and complaint handling. Programmes run only by technology teams often miss licensing conditions, customer disclosures in Arabic and English, record-keeping and incident reporting. Put legal, compliance and risk owners on the steering group from day one, and keep a regulatory requirements log that maps every obligation to a control.
Purpose creep in data use
Data obtained for one consented purpose, such as a budgeting tool, cannot simply be repurposed for marketing, credit scoring or sale to partners. Firms that build data lakes without purpose tags find it hard to prove compliance. Design data architecture so each record carries its consent reference and permitted uses, and so revocation actually stops processing rather than merely hiding the data from the customer view.
Ignoring the customer complaint path
Customers who are unhappy with a bank or insurer can escalate to Sanadak, the independent complaints unit, after first complaining to the institution. Open finance creates multi-party complaints in which each firm points at another. Agree upfront who acknowledges the complaint, who investigates and who pays, so you can meet consumer protection timelines.
Under-documenting fraud allocation
Authorised push payment fraud and account takeover are predictable risks in service initiation. If contracts are silent, participants end up arguing over fault after the customer has already escalated. Write clear refund and reimbursement rules, evidence standards and time limits into the participant arrangements.
Cross-border angle
Many open finance UAE participants are groups with technology or data operations abroad, often in India, the UK, Singapore or Bangladesh. Hosting, support and analytics outside the UAE raise outsourcing, data transfer and supervisory access questions under Central Bank rules and data protection law.
UK-headquartered fintechs will recognise the concepts from UK open banking, but the UAE model differs: it is centrally run, covers a wider product range and makes participation mandatory for supervised institutions. Do not assume that a UK permission, contract set or consent journey can be reused without adaptation. Our page on cross-border data transfers and data localisation explains the transfer rules.
What to do next
- Confirm whether your business is a data holder, a third-party provider or both, and which phase applies to you.
- Check your licensing position under the new Central Bank law, including any activities that merely facilitate a licensed service.
- Review consent flows, purpose statements and revocation in Arabic and English.
- Update outsourcing, cloud and partner contracts for liability, incident notification and audit rights.
- Build a joint complaint-handling protocol with each counterparty.
- Brief your board on open finance UAE obligations and the sanctions regime.
TRW & Co advises banks, insurers, payment firms and fintechs on open finance structuring, licensing applications and contracts, working with technical teams and, where needed, local advisers. To discuss your project, contact our Dubai team.
Frequently asked questions
01Is open finance mandatory for UAE banks?
Yes for in-scope products. The Central Bank has said participation is mandatory for the financial institutions it supervises, which includes banks and also other licensed institutions such as finance companies, insurers and payment firms. Obligations take effect in phases notified by the Central Bank, so the timing for a specific product or institution depends on its phase. Institutions should confirm their phase, connect to the API hub, and be ready to share data and allow service initiation on customer instruction once their phase applies.
02Do fintechs need a licence to use open finance in the UAE?
A third-party provider that wants to access customer data or initiate services through the hub needs Central Bank authorisation for the relevant open finance activity. Firms that already hold certain Central Bank licences may follow a different route but still need Central Bank clearance before launching open finance services. Because the new Central Bank law is technology-neutral and covers facilitating licensed activities, a fintech should not rely on a bank partner’s licence without a documented analysis of its own role.
03What is Al Tareq?
Al Tareq is the consumer-facing brand of the UAE’s open finance platform. It provides a standard consent and authentication experience, so customers see a consistent journey when they share data or authorise a service through a participating app. UAE banks have begun promoting it to customers. Behind it sits the Central Bank-owned infrastructure entity that runs the API hub and trust framework. For participants, the practical point is that consent screens and authentication follow the central model rather than each firm’s own design.
04Does open finance apply in the DIFC and ADGM?
The Central Bank’s Open Finance Regulation is an onshore federal framework. The DIFC and ADGM have their own financial regulators, the DFSA and the FSRA, and their own data protection laws. A firm licensed only in a financial free zone should check its home regulator’s rules first. If it wants to serve onshore customers or connect to the onshore hub, it must also consider whether its activities fall within the Central Bank perimeter.
05Who is liable if an open finance payment goes wrong?
The Regulation sets supervisory duties, but the allocation of losses between participants largely depends on the participation terms and the contracts between firms. Customers will usually complain to the institution they deal with and can escalate to Sanadak. Participants should agree in advance who refunds the customer, on what evidence, and how quickly the other party reimburses. UAE civil law also limits exclusions of liability and allows courts to adjust agreed compensation, so caps need careful drafting.
06Can open finance data be used for marketing?
Only if the customer has consented to that specific purpose. Data received through the hub may be used for the purpose the customer authorised, and participants should assume that selling or onward-sharing data received from another participant is not permitted. Firms should tag data with its consent reference and permitted uses, and make sure revocation stops processing. Marketing financial products can also be a regulated activity in its own right under the Central Bank law.
Sources and official materials
- CBUAE Rulebook: Enabling Technologies, including the Open Finance Regulation — Open Finance Regulation status and joint guidelines on APIs, cloud and AI
- Federal Decree-Law No. 6 of 2025 on the Central Bank and financial institutions — Official announcement of the new Central Bank law
- CBUAE issues the Open Finance Regulation (press release) — Mandatory participation and framework components
- UAE Government portal: data protection laws — Federal, DIFC and ADGM data protection overview
- Sanadak — Independent complaints unit for banking and insurance customers
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
