If you are building anything that touches payments in the UAE, this is the question to answer before you build it. The Central Bank of the UAE regulates retail payment services under its Retail Payment Services and Card Schemes Regulation, and the perimeter is wider than most founders assume.
The nine regulated service categories
The regulation covers payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic fund transfers, cross-border fund transfers, payment token services, payment initiation services, and payment account information services. If your business provides any of these, you need a licence unless you are an exempted person — principally a CBUAE-licensed bank, which must still notify the Central Bank before providing retail payment services.
The regulation groups these into four licence categories, each carrying its own capital requirement and ongoing compliance obligations. Which category applies depends on the specific combination of services you provide, so this is a question to settle with counsel rather than by reading a summary.
The word most people miss
The regulation applies to providing or promoting regulated retail payment services. Promotion is inside the perimeter, not outside it. That is directly relevant to comparison sites, affiliates, introducers, referral platforms and anyone marketing a third-party processor to UAE merchants. If your revenue depends on routing merchants to acquirers, do not assume you sit outside the framework because you never touch funds.
What changed in 2025
Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025 and broadened the regulatory perimeter to bring in open finance services, payment services using virtual assets, and enabling technology providers. Entities newly caught by that expansion have until 16 September 2026 to obtain the necessary licence or approval. Operating without one is now a criminal offence under the 2025 law, carrying imprisonment and fines reported at up to AED 500 million. These are not administrative penalties.
Free zone, mainland, and why it does not solve the problem
Entities regulated exclusively by the DFSA in the DIFC or the FSRA in ADGM sit outside the RPSCS framework for the financial services they are licensed to conduct there. That is a genuine structural option, and it is why so many payments businesses sit in those jurisdictions. But it is not a way around the perimeter: providing or promoting regulated retail payment services to mainland UAE customers can still bring you within CBUAE scope regardless of where you are incorporated. The relevant test is where the activity is directed, not where the trade licence was issued.
What to do with this
Get a written perimeter opinion from UAE-qualified counsel covering exactly what your business does, who it markets to, and how it is paid. Do it before launch rather than after, because retrofitting a licensed structure onto a live business is significantly harder and more expensive than designing for it. If you are already trading and unsure, the September 2026 deadline for newly in-scope entities makes this urgent rather than theoretical.
Compare licensed and partner-backed payment providers serving the UAE
This guide is general information about payment processing and does not constitute legal or regulatory advice. Requirements change and vary by jurisdiction and by licence type. Confirm anything material with UAE-qualified counsel or the relevant authority before acting on it.