The UAE regulatory system is structurally diverse, creating an avenue for different regulators and regulatory regimes to govern the payments sector. The Central Bank of UAE (CBUAE) is the monetary and financial services regulator at the federal level. The Decretal Federal Law No. (14)/2018 Regarding the Central Bank & Organization of Financial Institutions and Activities mandates a licensing regime for payment services that is overseen by the CBUAE. The payments sector is mainly regulated through four regulations that cover payment services and systems, including:

a) Retail Payment Services and Card Schemes Regulation 2021 (RPSCS Regulation): Regulates and provides guidelines for licensing retail payment service providers (PSPs), covering nine categories of payment services. It also mandates the licensing of card schemes operating within the state and regulates access to the Wages Protection System (WPS).

b) Stored Virtual Facilities Regulation 2020 (SVF Regulation): Regulates the supervision and licensing of stored virtual facilities (SVF) issuers like wallets under the SVF Regulation.

c) Retail Payment Systems Regulation 2021 (RPS Regulation): Regulates payment systems and systemically important retail payment systems (RPS) in the UAE, which are understood as fund transfer systems and related instruments, mechanisms, and arrangements that typically handle a large volume of relatively low-value payments in such forms as cheques, credit transfers, direct debit, card payment transactions or a regulated medium of exchange.

d) Large Value Payment Systems Regulation 2021 (LVPS Regulation): Regulates large-value Payment Systems (LPVS) in the UAE, which are understood as clearing and settlement systems that are designed primarily to process large-value and/or wholesale payments.

The UAE also provides an avenue for fintechs to operate in two financial free zones; the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC). The financial free zones operate under distinct financial, civil, and commercial laws. Financial services, including payment services within ADGM and DIFC, are regulated by the Financial Services Regulatory Authority (FSRA) and the Dubai Financial Service Authority (DFSA), respectively.

The regulatory framework for all financial services (including payment services) in ADGM is provided under, inter alia, the Financial Services and Market Regulations 2015 (FSMR), and the rulebooks issued thereunder. The rulebooks provide a single set of regulations for all payment services, with each rulebook covering a different regulatory aspect. Payment services fall under the ‘Providing Money Services’ license.

The DFSA’s regulatory framework for all types of financial services (including payment services) is provided under DIFC Law No.1/2004, and the rulebooks issued thereunder, akin to the FSRA’s framework. The provision of payment services is covered under the ‘Providing Money Services’ license.

Non-bank financial institutions can provide payment services within the mainland UAE or the financial free zones. Entities can apply for a license under the SVF or RPSCS Regulation on the mainland.

Additionally, PSPs can apply to offer services through the financial free zones of ADGM and DIFC. PSPs can apply to the FSRA or the DFSA under the ‘Providing Money Services’ license category under the respective regimes.

Card payments, particularly credit cards, dominate the payment landscape within the UAE. In 2023, card payments comprised 48% of online payments, followed by digital wallets at 23%. This trend aligns with figures from 2022, wherein credit cards dominated e-commerce payments with 41% of transaction value, followed by digital wallets (24%) and debit cards (11%). Cash on delivery only took up 7% of e-commerce transactions, while Buy Now Pay Later (BNPL) took up 2%. Credit cards are also the most popular payment method for point-of-sale (POS) transactions, with 40% of transaction value, followed by cash at 18%. Debit card (17%), digital wallet (16%), prepaid cards (7%), and POS financing (2%) payments made up the remaining transaction values. Visa and Mastercard dominate card spending in UAE at 59% and 37% market share, respectively.

Open banking is a regulated service in the UAE, with licensing provided by three regulators. The CBUAE regulates Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs) under the RPSCS Regulation. The regulation stipulates the requirement for establishing proper contractual arrangements between banks and AISPs/PISPs, providing the minimum requirements under the contractual agreement for entities that opt to participate in open banking. Additionally, the RPSCS Regulation stipulates guidance on various service-specific risks and obligations towards retail users.

Under the DFSA, AISPs and PISPs can obtain a license under the ‘Arranging or Advising on Money Services’ license. The DFSA stipulates the conduct of business requirements related to various user protection measures and risk mitigation. The FSRA provides a licensing regime for Third-Party Providers (TPP) that engage in accessing, processing, and transferring specified information. AISPs and PISPs can obtain a license to become TPPs. The FSRA stipulates the operational requirements for TPPs, including the need to establish a governing contract with users, implement strong customer authentication features, and comply with technical requirements.

The Federal Decree-Law No.45/2021 regarding the Protection of Personal Data (UAE-PDPL) governs personal data within the UAE.

However, the UAE-PDPL excludes its application to banking and credit data. This enables the CBUAE to provide service-specific data protection requirements under its fintech regulations. For instance, the SVF Regulation requires licensees to establish data protection measures, policies, and procedures. Strong methods must be used to store, transmit, or process data. Adequate data protection is also necessary when making outsourcing arrangements.

The RPSCS Regulation also stipulates the obligation for PSPs to protect payment and personal data. Additionally, open banking service providers are required by the RPSCS Regulation to clearly define liability for data breaches under their contractual agreement with payment account issuers, not to request sensitive payment data, and not to use, access, or store data for purposes other than the provision of their services.

Payment system providers under the RPS Regulation are required to maintain secure networks, monitor breaches, and safeguard customer data. Additionally, they must implement measures for recovering transaction data and periodically review their security policies.

The UAE-PDPL also excludes its jurisdictional application to free zones with special legislation for personal data protection. The financial free zones have their own personal data protection frameworks, which establish the rights of data subjects, obligations on data controllers and processors, and stipulations for data exportation. The DIFC Law 5 of 2020 Data Protection Law and the Data Protection Regulations 2020 regulate personal data in the DIFC, while the Data Protection Regulations 2021 provides the framework for data protection in ADGM. The ADGM and DIFC frameworks apply to financial service providers and fintechs.

There are several initiatives within the UAE towards promoting fintech services and activities within the state, which are endorsed through individual regulators and collaborative programs.

The CBUAE has established a FinTech Office to support the growth of fintechs. In 2023, the FinTech Office launched the Financial Infrastructure Transformation Programme, comprising nine initiatives to enhance the UAE’s competitiveness as a financial and digital payment hub. Additionally, the CBUAE has been involved in collaborative initiatives, including establishing a co-sandbox regime with the DIFC and ADGM and issuing guidelines on the adoption of enabling technology with the DFSA, FSRA, and Securities and Commodities Authority (SCA). The CBUAE has also participated in several CBDC testing projects.

The ADGM and DIFC support fintechs through various programs, events, education, and inclusivity initiatives. These initiatives span from education and talent development through the ADGM and DIFC Academies, to corporate innovation under HUB71 and the DIFC Launchpad.

The regulatory and market conditions are supportive of the fintech sector, although certain factors can be viewed as barriers to the market.

a) Money Laundering (ML)/ Terrorism Financing (TF): The UAE has recently been subject to ML/TF cautions, raising concerns about the safety and integrity of the market for financial service providers. In March 2022, the UAE was placed on FATF’s ‘grey’ list. However, the country committed to addressing the issues, and its efforts have yielded positive outcomes, as highlighted in FATF’s July 2023 report.

b) Licensing requirements: All three regulators, CBUAE, FSRA, and DFSA, require the key managerial personnel to be based in the country. Additionally, an SVF or RPSCS license requires entities to incorporate a distinct entity to offer their fintech services. These requirements make the UAE more exclusive as a jurisdiction.

c) Labour requirements: The UAE imposes a nationalisation requirement enforced by the Ministry of Human Resource and Emiratisation (MoHRE). Providently, these requirements are limited to onshore companies and not applicable within the financial free zones. Alternatively, access to international talent incurs initial set-up costs such as visa fees and health insurance coverage. The MoHRE and financial free zones also impose a visa quota, mainly calculated based on office space. To increase visa allocations, companies can expand their office space or request an increase in visa quotas, thus incurring additional costs.

d) Overlapping regulations: The sector sometimes faces the challenge of overlapping regulations from the various regulators. This can increase compliance costs and create confusion for businesses. To address these challenges, UAE regulators constantly liaise with each other and market participants to streamline and clarify regulations.

No special tax incentives are available for fintechs in the UAE, but general tax incentives apply to fintech entities. In 2023, the UAE instituted Federal Decree-Law No.47/2022 on the Taxation of Corporations and Businesses, introducing a corporate tax regime to the state.

Fintech entities can seek tax relief under the Free Zone Corporate Tax (FZCT) regime. The FZCT offers a 0% Corporate Tax rate to free zone companies and branches engaged in qualifying activities and transactions. To obtain the benefits under the FZCT regime, a business is required to be a Qualifying Free Zone Person (QFZP) performing qualifying activities.

Concerning financial services, fund management, and wealth management have been identified as qualifying activities, thus they fall within the tax exemption provided the entity can satisfy the QFZP criteria. Banking, insurance, finance, and leasing activities have been excluded from qualifying activities.

Alternatively, fintech businesses falling within the category of excluded activities may seek relief under the ‘De Minimis Rule’ to obtain the 0% tax benefits under the FZCT regime. An entity will be eligible under the De Minimis Rule, where its revenues from non-qualifying transactions and activities within a tax period do not exceed 5% of the total revenue or AED 5,000,000 (∼USD 1,361,285), whichever is lower. This can be beneficial to small fintech companies.

The UAE has established itself as a frontrunner in the fintech innovation space, boasting a market currently valued at $ 39.3 billion in transaction value. Fintech in the UAE saw total investment soar to 92% in 2023. Angel to Series A has been the most dominant trend in fintech funding within the UAE. The focus areas for fintech investment in the UAE include BNPL, Open banking, Blockchain and cryptocurrency, Payments, and Digital Banking.

The UAE is a major fintech hub regionally and globally, hosting up to 60% of fintechs based within the GCC region and ranked 6th globally in fintech funding by the end of 2023. The UAE fintech market is successful due to various factors that provide incentives for young entrepreneurs and ensure sustained business growth.

a) Greenfield market: The UAE is a promising greenfield market, having increased project announcements by 28% in 2023 and ranked second globally for greenfield foreign direct investment. Moreover, the fintech sector is projected to grow at a 15% CAGR between 2024 to 2029.

b) Regulatory clarity: UAE financial regulators update and provide clear regulatory frameworks to match the pace of fintech innovation. They also collaborate with industry players to develop regulations through consultation papers and discussions.

c) Sandboxes, incubators, and accelerator programmes: The UAE offers an array of sandboxes, incubators, and accelerator programs that guide market participants on the regulatory regime, market dynamics, networking, and investment opportunities. Examples include the DIFC’s Innovation Testing License, ADGM’s RegLab, and the co-sandbox programmes run by the CBUAE. Incubators and accelerator programmes include DIFC Fintech Hive, ADGM Fintech Digital Lab, and Hub71.

d) Access to funding: Funding avenues within the UAE are offered through investment funds such as the Abu Dhabi Investment Authority and the Dubai Future District Fund. Additionally, sandbox and accelerator programs coupled with networking events also provide an opportunity for entrepreneurs to meet with potential investors.

e) On-going support: UAE regulators make a continued effort to support businesses and entrepreneurs in the long run through programmes such as the DIFC Launchpad and Hub71. Such support ensures the long-term existence of businesses and entrepreneurs within the market.

UAE has one of the most diverse demographics and welcomes people from over 200 nationalities, an accomplishment achieved through supportive regulation. The UAE has two key visa schemes that help to attract talent and reduce costs for businesses. The UAE’s Golden Visa scheme offers exclusive benefits and long-term residency to foreign talent without requiring a local sponsor. This helps to attract global fintech talent. The UAE’s Green Visa scheme allows individuals to sponsor themselves for five years, eliminating the need for a UAE national or employer to sponsor their visa. Further, each company can sponsor visas for any nationality, provided the same is commensurate with the applicable quotas. This can help to reduce costs for fintechs.

The UAE has implemented strategies to address talent shortages, such as removing the requirement for a no-objection certificate to switch employers and implementing the UAE Strategy for Talent Attraction and Retention. The government is also investing in digital education and training programs to address the digital skills gap. The ADGM and DIFC free zones offer programs to nurture talent within the fintech sector, offered through the DIFC and ADGM Academies. Moreover, the DIFC hosts an annual DIFC Talent Week focused on preparing new talent for the future of work. DIFC also launched the National Digital Talent Incubator Program in collaboration with Emirates NBD to nurture young talent, specifically within the fintech ecosystem.

As an emerging business and fintech hub, Intellectual Property (IP) rights are becoming a crucial factor for businesses within the UAE, especially those with new and innovative ideas. The UAE provides a comprehensive legal framework for protecting various IPs through patents, copyrights, trademarks, and trade secrets. These rights are also enforceable under the judiciary and customs authorities. As a signatory of international treaties on IP protection, the UAE takes a modern approach to IP rights protection, shaped by international best standards.

The DIFC also provides a distinct regulatory framework for IP rights under the DIFC-IP Law No. 4 of 2019. The rights thereunder are enforceable within the Common Law DIFC Courts. The creation of a distinct IP framework by the DIFC is highly beneficial for global fintechs, particularly those originating from Common Law jurisdictions, as it provides them with a relatable foundation to operate. The IP frameworks within the UAE and DIFC are imperative for sustaining progress and excellence within the UAE’s fintech sector.

The UAE has strong regulatory support for cryptocurrencies through comprehensive frameworks issued by various bodies. These frameworks aim to create a transparent regulatory environment, ensuring business certainty, compliance, and effective risk management.

At the federal level, cryptocurrency regulation is overseen by the CBUAE and SCA. The CBUAE regulates payment token services under the RPSCS Regulation. Additionally, the CBUAE is responsible for implementing the UAE’s CBDC, the ‘Digital Dirham.’

In December 2022, the SCA issued Cabinet Resolution No.111/2022 on the regulation of Virtual Assets and Service Providers (VA Resolution). The VA Resolution designates the SCA as the administering authority across the UAE except for the financial free zones, and the Dubai Emirate, which is regulated by the Dubai Virtual Asset Regulatory Authority (VARA) pursuant to Cabinet Decision No. 112/2022 on Delegating Certain Competencies related to the Regulation of Virtual Assets. The VA Resolution mandates that certain Virtual Asset (VA) activities require prior approval and licensing from the SCA or the pertinent local licensing authority.

The VA Resolution has been supplemented by SCA Decision No. (26/RM) of 2023 in relation to Virtual Assets Platform Operators and SCA Decision No. (27/RM) of 2023 amending SCA Decision No. (13/RM) of 2021 in relation to the SCA Rulebook; thus, repealing SCA Decision No. 23/2020 concerning Crypto Assets Activities Regulation’. Only one category of cryptocurrencies (VAs) is recognised under the SCA’s VA framework.

VARA Law No. (4)/2022 on Regulating Virtual Assets in the Emirate of Dubai (DVAL) serves as the primary law for regulating VA and Virtual Asset Service Providers (VASPs) within the Dubai Emirate, covering all free zones therein, except for the DIFC. The DVAL is supplemented by the Virtual Assets and Related Activities Regulations 2023, and a set of rulebooks. Additionally, VARA has established marketing regulations under Administrative Order No 01/2022 and Administrative Order No 02/2022. The VARA VA framework establishes a comprehensive regulatory framework for VA activities. VARA is keen to constantly update its framework to accommodate market developments, such as the introduction of Fiat-Referenced Virtual Assets Issuance Rules under the VA Issuance Rulebook in September 2023. VARA’s VA framework identifies five categories of cryptocurrencies.

The financial free zones also provide distinct regulatory frameworks for VA and VASPs within their jurisdictions. The FSRA established a pioneering regulatory framework for digital asset activities in 2018. FSRA’s regulatory framework for digital assets is specified under the FSMR, the rulebooks issued thereunder, and additional guidance books. The FSRA has taken a technology-agnostic approach to its regulatory framework. Under its VA framework, FSRA has classified cryptocurrencies into six categories.

DFSA’s regulatory framework for digital assets is outlined in the Regulatory Law 2004, its associated rulebooks, and Consultation Paper No. 143 Regulation of Crypto Tokens. The DFSA’s crypto framework promotes responsible and transparent innovation, aligning with regulatory objectives through a balanced approach that is clear and adaptable to evolving industry practices and international standards. Under its crypto framework, DFSA has identified seven categories of cryptocurrencies.

The UAE has recently been on the radar for poor AML/CTF compliance in accordance with international standards, requiring regulators to become increasingly stringent with AML/CTF enforcement. Accordingly, the CBUAE, ADGM, and Executive Office for Control & Non-Proliferation (EOCN) have recently taken steps to improve AML/CTF compliance, specifically within the VA space. These efforts have positively impacted the UAE’s international standing, with reports from late 2023 stating that the FATF is poised to remove the UAE from its ‘grey’ list.

There are several regulatory authorities within the UAE covering cryptocurrencies, and they have each identified different categories of cryptocurrencies. Each regulator provides their own framework for Initial Coin Offerings (ICOs) within their jurisdictions. They approach ICOs with a multifaceted strategy incorporating risk-based assessments, consumer protection measures, and AML/CTF risk considerations. Recognising the dynamic nature of the cryptocurrency market, UAE regulators prioritize risk-based evaluations to assess the potential threats associated with ICOs. This approach allows for tailored regulatory responses, balancing the need for innovation with the imperative of safeguarding investors and the financial system.

Several blockchain projects are active in the UAE market, serving different needs. Some notable projects include Jibrel Network for asset tokenization; Tracer for supply chain management and traceability; Holo.ae for data sharing and management; Menapay for blockchain-based payments; Fansday for a social app connecting fans and creators; and Codebase Technologies for digital identity and payment services. There are many other solutions, and the market will likely grow as new ideas continue to emerge.

Moreover, in November 2023, the FSRA introduced a regulatory framework for Distributed Ledger Technology (DLT) Foundations, and IOTA became the first entity to be licensed under the framework. The DLT Foundations framework illustrates the government’s support for increasing and enabling blockchain projects within the state, opening the door to more projects and ideas in the future.

Fintech players in the UAE are already using AI to improve services. Despite the absence of a dedicated AI framework, regulators continue to issue guidance notes to support the adoption of AI in fintech, such as the FSRA’s ‘Robo-Advisory Guidance’ and the joint paper issued by CBUAE, SCA, DFSA, and FSRA for financial institutions on the adoption of enabling technologies. Moreover, the DIFC recently updated its data protection framework in September 2023 to introduce new AI-related provisions, stipulating principles of ethics, fairness, transparency, and accountability. The Dubai Digital Authority and the UAE’s Minister for Artificial Intelligence, Digital Economy, and Remote Work Applications have also issued guidelines for AI principles and ethics.

Financial institutions in the UAE are using AI to streamline their processes and improve customer services. Emirates NBD and Abu Dhabi Islamic Bank recently announced their intentions to use generative AI to enhance their operations and improve customer services. Additionally, AI-powered chatbots are being used to offer the first line of customer care, such as those integrated within Mashreq Neo and Liv Digital Bank.

The UAE is taking the right steps by holding discussions with industry players and stakeholders before creating regulatory frameworks.

The insuretech market in UAE is booming, with several products offering various services. Some of the key players within the market include Yallacompare, Aqeed, and Bayzat.

The CBUAE governs the insurance market within the UAE. The CBUAE’s Electronic Insurance Regulations 2020 governs the online activity of insurance companies, brokers, and related insurance professionals. The regulations cover any business carried out by licensed firms through online, electronic, and smart systems, including the sale and marketing of insurance policies, the collection of premiums, and claims handling. The regulations prohibit insurance companies and professionals from offering price comparison websites, thus securing a portion of the insurtech market for fintechs.

The UAE’s fintech market is diverse and ever evolving. The fintech areas gaining popularity in the UAE include:

a) BNPL

b) Blockchain/cryptocurrency

c) Retail payment services

d) Stored value facilities

e) Robo-advisory

f) Digital banking

g) Open banking

h) Digital crowdfunding platforms

Despite the rapid expansion of fintech, incumbent financial institutions have exhibited resilience and sustained their prominence within the market. Statistical data from 2022 illustrates that banking-based payment alternatives retained a substantial share of the transaction value in the UAE market. Specifically, credit cards, debit cards, and account-to-account payments collectively accounted for 63% of the e-commerce market transaction value, surpassing the cumulative 26% covered by digital wallets and BNPL payments.

Traditional institutions have embraced fintech innovations and enabling technologies to enhance their services and efficiency. Through strategic partnerships and digital transformation initiatives, they have adapted to changing consumer preferences and the evolving financial landscape. These collaborations help banks leverage emerging technologies such as blockchain, AI, and data analytics, driving digital transformation across their operations. Some examples include First Abu Dhabi Bank’s partnership with Mastercard to offer ‘SlicePay,’ a BNPL card, Commercial Bank of Dubai’s collaboration with NOW Money to offer low-income consumers financial services, and Emirates NBD’s formation of a digital asset lab in partnership with Fireblocks.

The advent of open banking has played a pivotal role in exemplifying the potential collaborative opportunities between fintechs and incumbent institutions.

Neo-banks or digital banks have risen in popularity within the UAE’s payment sector, primarily driven by incumbent banks such as Liv Digital Bank, E20 by Emirates NBD, and Mashreq Neo by Mashreq Bank. Banks such as Emirates NBD and Abu Dhabi Islamic Bank are also adopting enabling technologies like generative AI to improve their operations and services.

The UAE has experienced notable fintech disruption. Robo-advisors such as those offered by Sarwa provide a unique service to those offered by traditional institutions. Peer-to-peer lending platforms like Beehive have disrupted traditional lending, along with crowdfunding platforms. BNPL is rapidly growing within the UAE market, offering a cheaper and more accessible alternative for credit in comparison to those offered by traditional institutions.