On 8 September 2025, the UAE issued Federal Decree-Law No. 6 of 2025 Regarding the Central Bank Regulation of Financial Institutions and Activities and Insurance Business — the “New CBUAE Law” — repealing and replacing Federal Decree-Law No. 14 of 2018 on the Central Bank and the Organisation of Financial Institutions and Activities, and repealing Federal Decree-Law No. 48 of 2023 Regulating Insurance Activities. The law took effect on 16 September 2025 following its publication in the Official Gazette, and granted entities newly captured by its provisions a one-year transitional period to regularise their position and obtain the required licences. That grace period expires on 16 September 2026 — only weeks away — with administrative fines under the law reaching AED 1 billion.

A wider regulatory perimeter: from banks to open finance and insurance

The New CBUAE Law expands the range of “Licensed Financial Activities” falling within the Central Bank’s licensing and supervisory perimeter. The definition now expressly captures “Open Finance Services” and “Providing Payment Services using Virtual Assets”. In a notable legislative shift, the law also integrates the regulation of insurance, reinsurance and insurance-related professions into its provisions (Articles 78–106) — including takaful and re-takaful, brokers, agents, actuaries and third-party administrators — which were previously governed by a standalone decree-law. Licensing, supervision and consumer-protection standards for the banking and insurance sectors are now consolidated under a single, unified framework.

Article 62: fintech and DeFi brought within the licensing net

Article 62 is the most significant innovation of the New CBUAE Law. It requires any person who carries on, offers, issues or facilitates any Licensed Financial Activity — regardless of the medium, technology or form employed — to be licensed and regulated by the Central Bank. The article expressly covers virtual-asset payment tokens, decentralised finance (DeFi), and the offering or operation of platforms, decentralised applications (dApps), protocols and technological infrastructure that facilitate, intermediate or enable the provision of financial services such as payments, credit, deposits, money exchange, remittances or investment services. The regulatory perimeter therefore no longer stops at banks, insurers and payment service providers: it extends to technology firms and service providers whose products enable financial services, even where those firms are not themselves financial institutions. Forthcoming implementing regulations are expected to clarify the precise scope of the activities captured.

New fraud-prevention and customer-protection obligations

Unlike the 2018 law, the New CBUAE Law imposes specific obligations on licensed financial institutions to implement robust fraud-prevention and detection systems, protecting customers from unauthorised transactions and identity theft. The Central Bank is empowered to set minimum security standards for digital and traditional banking services — covering authentication, transaction monitoring and reporting obligations — while institutions must promptly notify customers of breaches, cooperate with Central Bank investigations and, where necessary, share limited information with other licensed institutions to verify suspicious activity.

What does this mean for businesses operating in the UAE?

Every business active in fintech, virtual assets, open finance, or insurance and insurance intermediation should assess — before 16 September 2026 — whether its activities have become licensable under the new law, and move promptly to regularise its position or file the necessary licence applications. Continuing to operate after the deadline without authorisation exposes both the entity and the individuals behind it to severe fines and criminal prosecution. We also recommend reviewing existing contracts and technology-outsourcing arrangements in light of Article 62, and documenting every compliance step taken in anticipation of future supervisory scrutiny.