The UAE’s New Central Bank Law and the 2026 Compliance Window for Fintech and Digital Finance Firms

The UAE’s updated Central Bank framework is now in its transition phase. Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025 and replaced the previous 2018 Central Bank law while also repealing the 2023 insurance law. Under Article 184, entities and persons subject to the law have one year from the date of entry into force to reconcile their positions, which points to a 16 September 2026 deadline unless the Central Bank extends that period.

For firms already operating in regulated parts of the market, that turns the law into a practical compliance issue rather than a distant policy change. The main question is no longer whether the framework is broader. It is whether a business model, service flow, or product structure now falls within the Central Bank’s licensing and supervisory perimeter.

What changed under the new law

The law brings banking, payments, digital money, insurance, and related financial activities under one updated framework. Article 61 lists the financial activities that require a Central Bank license. These include taking deposits, providing credit and funding facilities, offering open finance services, providing currency exchange and money transfer services, providing payment services using virtual assets, and providing stored value, retail payments, and digital money services.

That matters because the law is clearly activity-based. A business does not avoid regulation simply because it uses newer infrastructure, distributed systems, or digital tools. If the underlying service is a licensed financial activity, the Central Bank can still treat it as such.

Why fintech and digital platforms should pay attention

Article 62 is one of the most important parts of the new law for fintech and digital-finance businesses. It says that any person carrying on, offering, issuing, or facilitating a licensed financial activity, whether directly or indirectly and regardless of the technology or form used, is subject to the Central Bank’s licensing, regulatory, and oversight jurisdiction.

The text specifically refers to virtual-asset payment tokens, DeFi, and platforms, dApps, protocols, or technological infrastructure that facilitate or enable services such as payments, credit, deposits, remittances, money exchange, or investment services.

At the same time, the Central Bank’s published FAQ adds an important qualification. It says Article 62 does not automatically pull every software or infrastructure provider into licensing. A purely technical provider that supplies software, infrastructure, or technological solutions only for the benefit of a licensed financial institution is not treated as carrying on a regulated activity unless it is itself offering, issuing, carrying on, or facilitating that financial service on a professional basis.

That distinction is important. It suggests the real issue is not whether a company is “a tech company” or “a financial company” in branding terms. The real issue is what function it performs in practice and whether it is materially involved in delivering a licensed financial activity.

How this interacts with virtual assets and the wider UAE framework

The law also makes the payment-versus-investment distinction clearer. Article 187 says virtual assets are not considered currency under the decree-law. It also says that where virtual assets or digital currencies are used as a means or instrument of payment, the Central Bank’s regulations and standards in that area apply. By contrast, virtual assets used for investment purposes, for exchange of one virtual asset for another, or for swap operations for trading purposes are not covered by this decree-law and remain subject to other legislation in force in the UAE.

That means businesses linked to digital assets need to be careful about how their activity is classified. A firm involved in payment functions or payment-token services may face a different regulatory position from a firm operating in investment or trading-related virtual-asset activity.

It is also important to note that the decree-law itself does not apply to financial free zones or to financial institutions supervised by the authorities of those zones. The Central Bank’s FAQ confirms that point. Even so, businesses serving the wider UAE market still need to assess whether any onshore activity, customer base, or operating structure creates a Central Bank licensing issue.

What the 2026 deadline means in practice

The one-year reconciliation window gives affected firms time to review their position, but it is not a sign that the issue can be left until the last minute. In practice, many firms may need to revisit their regulatory mapping, product structure, outsourcing model, governance arrangements, and third-party relationships before the deadline arrives.

For fintech and digital-finance businesses, the practical compliance questions are likely to include:

• whether any product or service falls within Article 61
• whether the business is only supplying technical tools or is actually facilitating a licensed activity
• whether any virtual-asset-related service functions as a payment service rather than an investment activity
• whether the business serves the onshore UAE market, a financial free zone, or both
• whether governance, controls, and risk management are strong enough for the activity being carried on

The enforcement side also raises the stakes. Article 168 gives the Central Bank a wide range of administrative measures. These include rectification orders, activity restrictions, license conditions, licence revocation, and significant fines. The law allows a fine of up to AED 1 billion for a violating licensed financial institution, and it also provides for penalties for carrying on or promoting financial activities without a license.

The broader message is that the UAE has moved toward a more explicit and technology-aware regulatory perimeter. The law does not outlaw innovation, and it does not say every technology provider needs a license. But it does make it harder for businesses to rely on technical structure alone to argue that a regulated financial activity sits outside the Central Bank’s reach.

For firms operating in fintech, payments, digital finance, and virtual-asset-linked payment services, the period running to 16 September 2026 is best understood as a classification and compliance window. The closer a business sits to the actual delivery of regulated financial services, the more important that review becomes.

Key Takeaways

• Federal Decree-Law No. 6 of 2025 took effect on 16 September 2025 and gives affected entities one year to reconcile their positions, pointing to a 16 September 2026 compliance deadline unless extended.
• Article 61 broadens and clarifies the list of licensed financial activities, including open finance services, payment services using virtual assets, stored value services, retail payments, and digital money services.
• Article 62 confirms that licensed financial activities remain regulated even when delivered through emerging technologies such as DeFi, payment tokens, platforms, dApps, or protocols, but the Central Bank says purely technical service providers are not automatically captured if they do not themselves carry on or facilitate the regulated activity on a professional basis.
• The law distinguishes between virtual assets used for payment functions and virtual assets used for investment or trading purposes, which may place similar-looking businesses under different regulatory frameworks.
• Enforcement risk is materially higher under the new framework, including the possibility of strong administrative action and fines that can reach up to AED 1 billion for violating licensed financial institutions.

Sources: Central Bank of the UAE, UAE Legislation.

Disclaimer: This content is for educational and informational purposes only. It is not legal, financial, investment, cybersecurity, medical, business, career, or other professional advice. Verify important information with official sources or qualified professionals before acting.