TRW & Co · Banking and finance
Payment Services Licensing in the UAE
A payment service provider licence UAE businesses need onshore comes from the Central Bank, which licenses retail payment services in four categories with capital from AED 100,000 to AED 3 million. Wallets, card schemes and payment tokens need separate licences, and the DIFC and ADGM run their own regimes. This guide explains which licence fits and how to apply.
Key pointSettlement timing drives the licence: a platform that holds customer funds for more than 24 hours needs escrow, insurance or a bank guarantee, and one that holds value for later use may need a stored value licence instead of a retail payment licence.
At a glance
Four retail categories
The CBUAE's Retail Payment Services and Card Schemes Regulation licenses providers in Categories I to IV according to the payment services they offer.
Capital by volume
Initial capital ranges from AED 100,000 for Category IV to AED 3 million for Category I once monthly average transactions reach AED 10 million.
Wider perimeter since 2025
Federal Decree-Law No. 6 of 2025 confirms that technology or business model does not take an activity outside regulation and reaches platforms facilitating payments.
Funds in transit only
Providers may hold user funds only in transit; funds held beyond 24 hours need escrow, insurance or an unaffiliated bank guarantee.
Separate wallet and token regimes
Stored value facilities, card schemes and dirham payment tokens each require their own Central Bank licence or registration.
Swipe or scroll →
A payment service provider licence UAE businesses need onshore is issued by the Central Bank of the UAE (CBUAE) under its Retail Payment Services and Card Schemes Regulation, which sorts providers into four categories according to the services they offer. Wallets holding prepaid value need a separate stored value facility licence, dirham payment tokens have their own regime, and the DIFC and ADGM license money services separately. Choosing the right category is the first and most consequential decision.
This guide explains the licence categories and capital, safeguarding rules, how the 2025 Central Bank law widened the perimeter, the application process and the mistakes that delay approvals. It is written for payment start-ups, e-commerce and marketplace platforms, remittance businesses and international payment groups. As of October 2026, it reflects the end of the one-year alignment period under the new Central Bank law.
The short answer: which payment service provider licence UAE rules require
If your business moves money for others onshore, you will usually need one of the following.
- A retail payment services licence in Category I, II, III or IV, covering services such as payment accounts, payment instruments, merchant acquiring, payment aggregation, domestic and cross-border transfers, payment token services, payment initiation and account information.
- A stored value facility licence for wallets and prepaid products that hold value for customers.
- A card scheme licence for operating a card scheme.
- A payment token licence or registration for issuing, converting or holding dirham payment tokens, or registering foreign payment tokens.
- A DFSA or FSRA authorisation if the business is based in the DIFC or ADGM, which does not by itself permit serving onshore customers.
Under the 2025 Central Bank law, carrying on a licensed financial activity without a licence is a criminal offence carrying imprisonment and fines of up to AED 500 million.
The legal framework
The 2025 Central Bank law
Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025. Its list of licensed financial activities includes money transfer, stored value and digital money services, open finance and virtual-asset payment services. Crucially, it provides that using a particular technology or business model does not take an activity outside the perimeter, and it reaches platforms, decentralised applications and technology infrastructure that facilitate financial services. Persons already carrying on newly regulated activities had one year, to mid-September 2026, to align; any extension is at the Central Bank Board's discretion. See our article on CBUAE licensing under the new Central Bank law.
The payment regulations
Regulations issued under the previous law remain in force until replaced. The core instrument is the Retail Payment Services and Card Schemes Regulation (Circular No. 15 of 2021). Alongside it sit the Stored Value Facilities Regulation, the Payment Token Services Regulation (Circular No. 2 of 2024) and the Open Finance Regulation. All are published in the CBUAE Rulebook.
The financial free zones
In the DIFC, the DFSA authorises money services; in ADGM, the FSRA regulates Providing Money Services, a framework it expanded in 2020 to cover payment accounts and stored value. There is no automatic recognition between these regimes and the CBUAE.
Licence categories and capital
The category structure is the heart of the retail regime. Initial capital depends on the category and on whether monthly average payment transactions reach AED 10 million. The Central Bank may require more where risk or complexity justifies it.
| Category | Services covered | Initial capital below AED 10m monthly average | Initial capital at AED 10m or more |
|---|---|---|---|
| Category I | Account and instrument issuance, merchant acquiring, aggregation, domestic and cross-border transfers, and payment token services | AED 1.5 million | AED 3 million |
| Category II | As Category I but without payment token services | AED 1 million | AED 2 million |
| Category III | As Category II but without cross-border transfers | AED 500,000 | AED 1 million |
| Category IV | Payment initiation and payment account information only | AED 100,000 | AED 100,000 |
Choosing a category
Pick the category that matches the business plan rather than the widest one available. A domestic merchant acquirer or aggregator usually fits Category III; adding international remittances moves it to Category II; adding payment token services moves it to Category I. An open banking start-up that only initiates payments or aggregates account data can apply for Category IV. Applying for more than the plan supports invites questions about capability; applying for less forces a variation later.
Principal business
Retail payment services must be the provider's principal business. Ancillary activities outside the licence need Central Bank approval, and the Central Bank may require them to sit in a separate entity. Groups combining payments with lending, marketplaces or software should plan the corporate structure accordingly.
Safeguarding customer funds
A retail payment provider may hold users' funds only as funds in transit. Where funds are settled within 24 hours, they must be kept separate from other persons' funds and insulated from the provider's creditors, particularly on insolvency. Where settlement takes longer than 24 hours, they must be protected through a segregated escrow account with a bank, used only to pass funds to the beneficiary, or by an insurance policy or bank guarantee from an unaffiliated institution.
Draw the flow-of-funds diagram before choosing a licence. Who receives the money, how long it is held and for whom decides the safeguarding method, and holding value beyond transit can push the model into stored value or even deposit-taking territory, which requires a different licence entirely.
The application process for a payment service provider licence UAE regulators grant
- Map services and fund flows. List each service against the regulation's definitions and record who holds funds, for how long and on whose behalf. Identify any stored value, payment token, open finance or credit element.
- Select the regime and category. Decide between a CBUAE retail category, a stored value facility licence, a payment token licence, a free zone authorisation or a partnership model.
- Establish the applicant. Incorporate the UAE entity, appoint directors and senior managers who will pass fit and proper review, and plan compliance, risk, AML and information security functions with real people on the ground.
- Prepare the application file. Assemble the business plan with volume projections, capital and source-of-funds evidence, governance and risk frameworks, safeguarding arrangements, technology and cyber documentation, and outsourcing details.
- Engage with the Central Bank. Respond to questions, attend meetings and support due diligence on shareholders and controllers. There is no published statutory timeline, so file quality drives timing.
- Satisfy pre-launch conditions. Inject capital, open safeguarding accounts, complete systems testing and audits, and register for suspicious transaction reporting.
- Launch and maintain compliance. Hold capital at the right tier, report to the Central Bank, seek approval for changes in control or services, and track volumes that trigger higher capital.
What a strong application file contains
Applications for a payment service provider licence UAE regulators approve smoothly tend to share the same features: a coherent story told consistently across every document. Inconsistencies between the business plan, the financial model and the risk framework are the most common source of follow-up questions.
- Business plan and financial projections showing services, target customers, corridors, volumes and the point at which the AED 10 million capital trigger is expected to be reached.
- Ownership and control information for every controller, with source-of-funds and source-of-wealth evidence and structure charts up to the ultimate beneficial owners.
- Governance documents: board composition, committee terms of reference, and CVs of senior managers and key function holders.
- Risk, compliance and AML frameworks, including customer due diligence, sanctions screening, transaction monitoring and suspicious transaction reporting procedures.
- Safeguarding arrangements, with draft escrow, insurance or guarantee documents and reconciliation procedures.
- Technology and security documentation: architecture, data hosting, cyber controls, business continuity and incident response.
- Outsourcing and partner agreements for processors, banks, schemes and cloud providers.
Preparing these documents properly is also the best preparation for running a licensed business, because the same frameworks will be tested by auditors and supervisors once operations begin.
Licence, partnership or free zone?
Not every business needs its own payment service provider licence UAE-wide from day one. Three routes are common.
Own CBUAE licence
Holding your own payment service provider licence UAE-wide is best for businesses that will own customer relationships, control funds and scale regionally. It brings credibility with banks, schemes and merchants, but requires capital, local management and full compliance infrastructure. Investors should treat the first year as a build phase.
Partnering with a licensed institution
A bank or licensed provider holds the funds and the regulatory relationship while the business provides the customer experience. This can be faster, but the 2025 law's focus on platforms means the technology partner must be careful not to carry on a licensed activity itself. Outsourcing rules also bind the licensed partner.
DIFC or ADGM
Free zone authorisations suit wholesale, cross-border and institutional models. They do not on their own permit serving onshore consumers or merchants, so businesses targeting the onshore market usually need a CBUAE licence or partner as well. Our page on fintech licensing and regulatory sandboxes compares the options.
An illustrative scenario
Illustrative only; generic parties. An online marketplace collects payments from buyers and pays sellers seven days after delivery, net of commission. It also wants to offer sellers an in-app wallet and, later, cross-border payouts to suppliers in Asia.
Collecting and paying out on behalf of sellers is likely to be payment aggregation, and the seven-day hold means funds are not settled within 24 hours, so escrow, insurance or a bank guarantee is needed. A wallet that holds seller balances for later use may be a stored value facility rather than a retail payment service. Cross-border payouts point to Category II. The marketplace's options are to obtain the right licences, to restructure so a licensed partner collects and holds funds, or to shorten settlement and drop the wallet.
Whichever route it chooses, whether a payment service provider licence UAE-wide or a partnership, the marketplace must also review its commercial terms with sellers so that they match the regulated flow of funds.
Common mistakes
Assuming a technology platform is outside the perimeter
Many platforms describe themselves as software providers that never touch money. Under the 2025 law, using a particular technology or business model does not take an activity outside regulation, and platforms that facilitate financial services are expressly in view. If the platform directs, controls or benefits from the movement of funds, test it against the licensed activities rather than relying on the label.
Underestimating the substance requirements
The Central Bank expects a real UAE operation: senior management based locally, a functioning compliance and risk team, AML systems, cyber controls and governance proportionate to the business. Applications built around group functions abroad, with a thin local presence, tend to stall. Budget for local hires before the licence is granted.
Getting safeguarding wrong
Safeguarding failures are among the most serious regulatory concerns because they put customer money at risk on insolvency. Commingling customer funds with operating cash, holding funds beyond transit without the required protection, or relying on an affiliate's guarantee can each breach the regulation. Reconcile daily, document the method and have it reviewed by auditors.
Ignoring the AED 10 million capital trigger
Capital requirements double for most categories once monthly average payment transactions reach AED 10 million, measured on a moving average. Fast-growing providers can cross the line within months of launch. Build the trigger into financial planning, monitor volumes and arrange capital before it is needed, not after the Central Bank asks.
Treating crypto and stablecoin payments as a separate world
Accepting or paying out stablecoins onshore engages the Payment Token Services Regulation, which licenses dirham token issuance, conversion and custody, restricts how foreign payment tokens may be used and limits licences to UAE-incorporated entities outside the DIFC and ADGM. See our article on stablecoins and payment tokens.
Cross-border and group structures
International payment groups from the UK, Singapore, India or China often hold licences at home and want to serve UAE merchants or senders. A foreign licence carries no weight onshore, and the payment token regime limits licences to UAE-incorporated entities, excluding the DIFC and ADGM. Most groups therefore set up a UAE subsidiary, sometimes alongside a free zone entity for wholesale or treasury activity.
Remittance corridors to Bangladesh, India and Pakistan are a major part of the UAE market. Cross-border transfer services require at least Category II, and AML obligations are demanding: customer due diligence, sanctions screening, transaction monitoring and suspicious transaction reporting. Our AML compliance practice covers the framework, and the payment services practice page covers ongoing obligations after licensing.
Checklist before you apply
Before committing to a payment service provider licence UAE application, confirm the following.
- A flow-of-funds diagram showing who holds money, for how long and for whom.
- A mapping of each service to the regulation's definitions, including stored value, token and open finance elements.
- A category choice that matches the business plan and the capital tier you expect to reach.
- Local senior management, compliance, risk and AML functions with named candidates.
- A safeguarding method agreed with a bank or insurer.
- A corporate structure that keeps payments as the principal business.
- A plan for onshore access if you are based in the DIFC or ADGM.
For licensing strategy, application preparation or a perimeter review of your platform, contact TRW & Co.
Frequently asked questions
01Who issues payment service provider licences in the UAE?
Onshore, the Central Bank of the UAE licenses retail payment service providers, stored value facilities, card schemes and payment token services under regulations published in its Rulebook. In the DIFC, the DFSA authorises money services, and in ADGM the FSRA regulates Providing Money Services. A free zone authorisation does not automatically permit serving onshore customers, and a CBUAE licence does not authorise activity inside the financial free zones, so the location of customers determines which regulator applies.
02How much capital does a UAE payment licence require?
Under the Retail Payment Services and Card Schemes Regulation, initial capital depends on category and volume. Category I requires AED 1.5 million, rising to AED 3 million once monthly average payment transactions reach AED 10 million; Category II requires AED 1 million or AED 2 million; Category III AED 500,000 or AED 1 million; and Category IV AED 100,000 regardless of volume. The Central Bank may require more. Stored value facilities are subject to a separate, higher requirement.
03Do I need a licence to run a marketplace that collects payments?
Often, yes. Collecting funds from buyers and paying sellers can amount to payment aggregation or another retail payment service, and the 2025 Central Bank law confirms that platforms facilitating financial services are within the perimeter regardless of the technology used. Holding funds for more than 24 hours triggers enhanced safeguarding, and holding balances for later use may be a stored value facility. Many marketplaces instead partner with a licensed provider that collects and holds funds.
04What is the difference between a retail payment licence and a stored value licence?
A retail payment licence covers services such as payment accounts, payment instruments, merchant acquiring, aggregation and fund transfers, where funds are held only in transit. A stored value facility licence covers products that hold prepaid value for customers to use later, such as wallets with balances. Stored value licensing has its own regulation and higher capital. Products that combine both features need careful analysis to decide which licence, or both, applies.
05How long does it take to get a payment licence in the UAE?
There is no published statutory timeline for Central Bank licensing. Timing depends on the completeness of the application, the complexity of the business model, the readiness of local management and compliance teams, shareholder due diligence and the regulator's workload. After an in-principle approval, applicants must usually satisfy conditions such as capital injection, safeguarding accounts and systems testing before launch. Applicants should plan for a substantial build phase and avoid committing to launch dates before approval.
06Can a DIFC or ADGM payment firm serve customers in Dubai or Abu Dhabi?
Not on the strength of its free zone authorisation alone. DFSA and FSRA authorisations cover activity in or from those centres, and there is no automatic recognition by the Central Bank. Serving onshore consumers or merchants generally requires a CBUAE licence, a partnership with a CBUAE-licensed institution, or a structure that keeps the regulated activity within the free zone. The payment token regime also limits licences to UAE-incorporated entities outside the DIFC and ADGM.
Sources and official materials
- CBUAE Retail Payment Services and Card Schemes Regulation — Payment services, categories, capital and safeguarding
- CBUAE Rulebook — Stored value, payment token and open finance regulations
- Federal Decree-Law No. 6 of 2025 (announcement) — New Central Bank law and licensed financial activities
- FSRA enhancements to Providing Money Services — ADGM payment accounts and stored value framework
- Dubai Financial Services Authority — DIFC money services authorisation
- Central Bank of the UAE — Licensing authority for onshore payment providers
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
