The New CBUAE Law consolidates regulation of banks, payment providers and insurers under a single framework, introduces new licensing requirements for enabling technology providers and imposes higher penalty provisions.
On 8 September 2025, Federal Decree Law No. 6 of 2025 Regarding the Central Bank Regulation of Financial Institutions and Activities and Insurance Business (the "New CBUAE Law") was issued.
The New CBUAE Law repeals and replaces Federal Decree Law No. 14 of 2018 Regarding the Central Bank and Organization of Financial Institutions and Activities and its amendments (the "2018 Law") and Federal Decree Law No. 48 of 2023 Regulating Insurance Activities.
The New CBUAE Law came into effect on 16 September 2025, following its publication in the Official Gazette on 15 September 2025. Persons whose activities are now captured under the New CBUAE Law have one year from the date of its entry into force to ensure compliance.
Key takeaways – what the New CBUAE Law means in practice:
- Wider perimeter: The scope of "Licensed Financial Activities" has been expanded to expressly include Open Finance Services, Providing Payment Services using Virtual Assets and insurance and related professions carried on in or from the UAE.
- Technology-enablement now within scope (Article 62): Platforms, decentralised applications, protocols and other infrastructure that facilitate or enable financial services (payments, credit, deposits, exchange, remittances or investments) now require licensing and fall within CBUAE supervision, even if the provider is not itself a bank, insurer or payment service provider.
- Enhanced enforcement: Maximum administrative fines increase to AED 1 billion, with new minimum penalties for unlicensed or promotional activity and higher maximum sanctions for Authorised Individuals.
- Transition: Entities newly in scope or entities required to make changes in accordance with the New CBUAE Law have until 16 September 2026 to regularise licensing and compliance.
We set out below some of the key changes introduced by the New CBUAE Law compared to the 2018 Law:
Increased Scope
The New CBUAE Law broadens the range of Licensed Financial Activities that fall within the CBUAE's licensing and supervisory perimeter. Licensed Financial Activities now expressly captures "Open Finance Services" and "Providing Insurance, Reinsurance and Insurance-Related Professions, Business and Services, including Takaful and Re-Takaful Insurance Business and Services".
Article 62
Article 62 of the New CBUAE Law introduces a broad requirement for any person who carries on, offers, issues, or facilitates any Licensed Financial Activity (regardless of the medium, technology or form employed) to be licensed and regulated by the CBUAE. This represents a significant expansion of the CBUAE's regulatory perimeter, as it applies not only to traditional financial institutions but also to technology firms and service providers whose activities enable or facilitate financial services.
Article 62 explicitly includes:
- "Virtual Assets payment tokens, decentralised finance (DeFi), other emerging technology, or other digital or physical instruments used in connection with the Licensed Financial Activities; and
- Offering or operation of platforms, decentralised applications (dApps), protocols, or technological infrastructure that facilitate, intermediate, or enable the provision of financial services, such as payments, credit, deposits, money exchange, remittances, or investment services".
Article 62 is drafted broadly and appears to be intended to capture technology-based intermediaries that enable or support the provision of financial services. This may include fintech providers offering APIs or aggregation tools that connect customers to banks, payment service providers or insurers and payment gateways. In essence, if the technology or platform facilitates a Licensed Financial Activity, it is likely to fall within scope of Article 62 even if the entity itself is not a bank, insurer, or a payment institution. Further clarity is expected once the implementing regulations are issued, which should elaborate on the specific activities that fall within scope.
Insurance Companies and Related Professions
A major change introduced by the New CBUAE Law is the integration of detailed insurance requirements into the New CBUAE Law. While the 2018 Law made limited reference to insurance, the New CBUAE Law (Articles 78–106) now sets out detailed requirements governing insurance, reinsurance, and insurance-related professions, including brokers, agents, actuaries and third-party administrators.
By bringing these activities squarely under the New CBUAE Law, the New CBUAE Law consolidates and harmonises the regulation of the banking and insurance sectors. We understand that this approach is an attempt to bring consistency in licensing, supervision, and consumer protection standards, and marks a shift toward a more integrated and unified regulatory framework by the CBUAE.
Fraud Prevention Provisions
Unlike the 2018 Law, the New CBUAE Law introduces specific obligations on Licensed Financial Institutions to implement robust fraud-prevention and detection systems to protect customers from unauthorised transactions and identity theft. The New CBUAE Law empowers the CBUAE to establish minimum security standards for digital and traditional banking services, including authentication, transaction monitoring, and reporting obligations. Licensed Financial Institutions are also required to promptly notify customers of breaches, cooperate with CBUAE investigations, and, where necessary, share limited information with other Licensed Financial Institutions to verify suspicious activity.
Penalties
One of the most notable changes introduced by the New CBUAE Law is the substantial expansion of the CBUAE's enforcement and penalty powers. The New CBUAE Law introduces a much broader and more stringent framework of administrative and criminal sanctions which signals a clear shift towards stronger deterrence and heightened enforcement appetite.
Key updates include:
- Criminal Offences – Persons that engage in a Licensed Financial Activity without a licence may face imprisonment and/or a fine between AED 50,000 and AED 500 million which is an increase on the 2018 Law.
- Increased Financial Penalties – The maximum administrative fine has been increased from AED 200 million to AED 1 billion under the New CBUAE Law.
- Fines for Authorised Individuals – The maximum fine for a violating Authorised Individual has increased from AED 2 million under the 2018 Law to AED 5 million under the New CBUAE Law.
- Unlicensed Activities – The New CBUAE Law introduces a minimum fine of AED 1 million for any person carrying on or promoting Licensed Financial Activities without authorisation.
Grace Period
The New CBUAE Law provides a one-year transitional period from its effective date for entities whose activities now fall within its scope to regularise their position and obtain the necessary licences or approvals. In practice, we understand that affected firms have until 16 September 2026 to assess whether their activities require licensing and to bring their operations into compliance.
Repeal of Existing Laws
The New CBUAE Law expressly repeals any UAE legislation that conflicts with its provisions, including the 2018 Law and Federal Decree Law No. 48 of 2023 Regulating Insurance Activities. However, the New CBUAE Law provides that all existing regulations issued under the 2018 Law (including the Stored Value Facilities Regulations and the Retail Payment Services and Card Schemes Regulations) will remain in force until they are replaced by new regulations, decisions and circulars under the New CBUAE Law.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2025 White & Case LLP
