The new UAE Central Bank law: Expanding the regulatory perimeter for a digital era
On 16th September 2025, Federal Decree-Law No.6 of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business (the “New Banking Law”) came into effect, marking one of the most important legislative developments in the UAE’s financial regulatory sector in recent years. The New Banking Law repeals Federal Law No. 14 of 2018 (the “2018 Law”) and consolidates numerous regulatory changes introduced since its enactment.
The New Banking Law also signals a strategic shift by the Central Bank of the UAE (the “CBUAE”) by expanding its regulatory perimeter to capture technology service providers that facilitate financial services. In this article, we explore some of the key changes introduced under the New Banking Law which impacts financial institutions and fintech providers operating within the UAE.
Scope of Application
The New Banking Law applies to all financial institutions, insurance businesses, financial activities, and persons subject to its provisions. Specifically, it covers:
- Licensed Financial Institutions: This includes banks, (re)insurance companies, and other financial institutions licensed by the CBUAE, whether incorporated in the UAE or operating as branches or subsidiaries of foreign entities (including those Islamic financial institutions).
- Other Entities: The New Banking Law also extends to any person (natural or juridical) carrying out, or seeking to carry out, a licensed financial activity in or from the UAE.
- Exclusions: As with the 2018 Law, the New Banking Law does not apply within the UAE financial free zones.
Expansion of licensed financial activities
The New Banking Law expands the scope of licensed financial activities introduced within the 2018 Law, which the CBUAE considers as subject to its licensing framework. The New Banking Law includes the following two new activities:
- Providing open finance services; and
- Providing payment services using Virtual Assets.
These two licensed financial activities are to reflect the introduction of the CBUAE Open Financial Regulation and the Payment Token Services Regulation. The New Banking Law definition of Virtual Assets mirrors the definition introduced by the CBUAE in the Payment Token Services Regulation.
A defining feature of the New Banking Law is, however, the introduction of Article 62 which represents a key departure from the 2018 Law and brings technology service providers that facilitate licensed financial activities within the regulatory perimeter of the CBUAE.
Article 62 of the New Banking Law states that any person carrying on, offering, issuing, or facilitating a licensed financial activity - regardless of the medium, technology, or form employed - is subject to CBUAE licensing, regulation, and oversight. This includes:
- Virtual Assets Payment Tokens: The provision of payment services using virtual assets (including virtual asset payment tokens) requires CBUAE authorisation.
- Platforms, Technology Infrastructure and Decentralised Applications: Platforms, decentralised applications (dApps), protocols, or technological infrastructure that facilitate, intermediate, or enable financial services, such as payments, credit, deposits, money exchange, remittances, or investment services are brought within the regulatory perimeter.
Prior to the New Banking Law, technology service providers operating within the UAE that provided technology solutions that facilitated financial activities, such as making and/or receiving payments or permitting investors access to make investments with licensed third-parties largely fell outside of the regulatory licensing perimeter of the CBUAE. As such, Article 62 appears to be a shift in the position previously taken by the CBUAE. Through the introduction of Article 62, technology service providers will now need to assess whether their services fall within scope and therefore require a licence from the CBUAE. We anticipate that the CBUAE will, in due course, issue implementing regulations which sets out a licensing framework (and any such potential exemptions that may exist) for technology service providers whose activities fall within the scope.
Sanctions and Penalties: A Robust Enforcement Regime
The New Banking Law expands the administrative and financial penalties available to the CBUAE for violations committed by any licensed financial institution, authorised individual or persons who carry on any of the licensed financial activities without a license. Under the 2018 Law, the highest financial penalty which could be imposed by the CBUAE for violations of the law was two hundred million (200,000,000) Dirhams whereas under the New Banking Law this has increased to one billion (1,000,000,000) Dirhams. This increase in the level of financial penalty reflects not only the growth in size of the firms now operating within the UAE but also underscores the CBUAE’s commitment to upholding the integrity of the UAE’s financial system.
The New Banking Law also now unequivocally states that any person who engages in licensed financial activities without a license or authorisation shall be punished by imprisonment and a fine of not less than fifty thousand (50,000) Dirhams and not exceeding five hundred million (500,000,000) Dirhams. In addition to carrying on a licensed financial activity without a license, under the New Banking Law the CBUAE has introduced a specific financial sanction for any person(s) who promote licensed financial activities without a license of not less than one million (1,000,000) Dirhams.
Other key changes introduced by the new banking law
We have set out below some of the other key notable changes introduced by the New Banking Law:
- Objectives of the CBUAE: The New Banking Law introduces a new principle and objective for the CBUAE, specifically, the requirement for the CBUAE to foster sustainable finance in the UAE and integrate environmental, social, and governance principles into the CBUAE’s business and operations.
- Higher Shari’ah Authority: The law clarifies that the resolutions and fatwas of the Higher Shari’ah Authority shall be binding on the internal Shari’ah supervisory committees. The New Banking Law also expands the remit of the Higher Shari’ah Authority.
- Digital Dirham: The law provides the CBUAE with the power to issue and regulate the AED in digital form.
- Financial Inclusion: In line with the requirements set out within the CBUAE’s Consumer Protection Regulations and Standards, the CBUAE has included a mandate to ensure that every person shall have the right to access all or part of the banking and financial services and products from licensed financial institutions suited to their needs.
- Grievances & Appeals Committee: The New Banking Law introduces a new independent committee named 'Grievances and Appeals Committee' that shall have sole and exclusive jurisdiction to adjudicate on grievances and appeals against any decisions, procedures and measures issued by the CBUAE. Whilst an appeals process existed under the 2018 Law, the committee was not an independent committee nor had exclusive jurisdiction.
Transitional period
The New Banking Law was published in the Official Gazette on 15th September 2025 and came into effect the following day. Article 184 of the New Banking Law provides a “reconciliation” period of one (1) year from the date of entry into force of the law, for all agencies and persons subject to the provisions of the law to reconcile their positions. The CBUAE retains the discretion to extend the period of time as it deems appropriate.
Looking forward
The New Banking Law marks a pivotal development in the evolution of the UAE’s banking and financial regulatory landscape. Beyond consolidating changes introduced under the 2018 Law, it introduces a number of important reforms that will shape how financial, and technology driven services are supervised in the years ahead.
The inclusion of technology facilitators within the CBUAE’s supervisory perimeter reflects a regulatory shift towards overseeing the infrastructure that underpins financial services and not just the institutions themselves. Businesses operating in or supporting financial services should now assess how Article 62 may apply to their activities. Over the coming year, further implementing regulations and guidance from the CBUAE are expected to clarify the scope, licensing, and compliance expectations for technology service providers.
