The UAE has enacted a new central bank law that fundamentally reshapes the country’s financial regulatory landscape. Federal Decree Law No. 6 of 2025 Regarding the Central Bank Regulation of Financial Institutions and Activities and Insurance Business (the New CBUAE Law) came into effect on 16 September 2025, replacing both the 2018 Central Bank Law and the 2023 Insurance Law.

Firms that now fall within its expanded regulatory perimeter have one year—until 16 September 2026—to ensure compliance.

1. Unified Framework for Banking, Insurance and Payments

The new law consolidates the regulation of banks, payment providers, insurers, and related professions under a single framework, aiming for consistent licensing, oversight, and consumer protection. Detailed provisions (Articles 78–106) cover insurance, reinsurance, and related professions, which were previously regulated separately.

2. Broader Regulatory Scope — Article 62

Article 62 requires licensing for any entity that conducts, facilitates, or enables financial services, including:

• Open Finance platforms and API aggregators connecting customers to banks or insurers.
• DeFi and virtual asset payment providers, including payment tokens.
• Technology infrastructure supporting payments, credit, deposits, exchange, or remittances.

This significantly expands CBUAE supervision to technology enablers, even if they are not directly offering regulated financial products.

3. Fraud Prevention and Security Obligations

Licensed entities must implement robust fraud-prevention systems to protect customers from identity theft and unauthorised transactions. The CBUAE may issue minimum security standards covering authentication, transaction monitoring, breach reporting, and inter-institution information sharing.

4. Stronger Enforcement and Higher Penalties

The law substantially increases penalties and enforcement powers:

5. Transitional Arrangements and Repeal

Entities affected have until 16 September 2026 to regularise licensing. Existing regulations under the 2018 Law (e.g., Stored Value Facilities, Retail Payment Services) remain valid until replaced. The new law expressly repeals conflicting legislation, including the 2018 and 2023 laws.

6. Implications for Market Participants

• Fintech and platform operators should assess whether their technology falls under Article 62.
• Insurance firms and intermediaries must prepare for direct CBUAE supervision.
• Banks and payment providers should strengthen fraud and cybersecurity frameworks.
• Multinational financial groups may need to review UAE entity structures and compliance reporting obligations.

The New CBUAE Law marks a step toward a unified, technology-inclusive regulatory regime, balancing innovation with strong consumer and market safeguards.

Disclaimer: This article is prepared for general informational purposes only and does not constitute legal advice. It is not comprehensive, and readers should consult professional legal counsel regarding the specific implications of the New CBUAE Law for their operations or compliance obligations.