UAE Central Bank Law Transition Ended on September 16: What Banks, Insurers and Fintechs Now Face

The United Arab Emirates has moved from preparation to enforcement under its new central bank law. This article was first published in August, when financial institutions were counting down to a compliance deadline, and has been updated on October 13, 2026 now that the deadline has passed. Federal Decree-Law No. 6 of 2025, issued on September 8, 2025 and published in the Official Gazette on September 15, 2025, repeals the 2018 central bank law and the 2023 decree-law on insurance activities and replaces them with one framework covering banking, insurance, other licensed financial institutions and financial market infrastructure. According to law firm Ashurst, affected entities had until September 16, 2026 to comply, and the Central Bank of the UAE could extend the period.

The key question after September 16 is whether any relief was granted. A newsletter from the UAE firm CMI & Co dated October 2 says the one-year transitional period closed on that date, that the law became fully enforceable with no transitional relief, and that the central bank confirmed no blanket extension had been granted. The same newsletter says enforcement against non-compliant entities began immediately. This is a single secondary source, so firms should verify their own position directly with the central bank or its published circulars rather than relying on a law firm's summary.

The penalties explain why firms took the deadline seriously. Ashurst and Hadef & Partners both report maximum administrative fines of AED 1 billion for licensed financial institutions and up to AED 5 million for authorised individuals. CMI & Co adds that the previous maximum for institutions was AED 200 million, which would make the new cap five times larger, but that comparison comes from one source. Fines can be collected by debiting accounts held with the central bank or with any licensed institution, and the central bank may publish its enforcement decisions, including the name of the violator. Conducting licensed financial activity without a licence is a criminal offence carrying imprisonment and substantial fines, and Hadef notes that marketing or promoting licensed services without authorisation is itself a regulated activity.

The law also redraws the perimeter of regulation. It extends beyond open banking to regulated data sharing across products such as wealth management, insurance, pensions and credit scoring. Payment services that use virtual assets are licensable, although the law carves out investment holdings and certain swaps. Technology providers whose platforms, applications, protocols or infrastructure facilitate financial services may fall under the central bank's oversight even if they have no direct dealings with customers. CMI & Co says that under Article 62 fintech platforms, API providers, payment infrastructure operators, open finance providers and decentralised platforms must either be licensed or hold a documented central bank opinion confirming that they are out of scope, and warns of criminal liability risk for operating without that clarity.

For insurers, the stakes are specific. CMI & Co says the transitional alignment period for insurers has closed and that insurers must now comply fully with Articles 78 to 106 and the implementing instruments, which cover capital adequacy, governance including board composition, independent actuarial functions and internal audit, claims-handling service levels, fraud prevention and outsourcing. It adds that insurance compliance gaps are now assessed within the same supervisory and enforcement framework as banking breaches. Separately, in May the central bank issued a remuneration regulation for banks and insurers, which, according to Pinsent Masons, applies to insurance and reinsurance companies for the first time and requires independent review of pay frameworks at least every three years.

Consumers gain new protections. The law requires licensed institutions to run anti-fraud systems, including strong authentication and transaction monitoring, and to disclose products transparently. It creates a unified, independent complaints authority covering banking and insurance, and specialised judicial committees to resolve financial disputes of up to AED 100,000, with decisions in disputes of that size not open to challenge. Compound interest on customer credit facilities is prohibited. The law also gives the central bank early-intervention powers over distressed institutions, from remedial capital or liquidity measures to replacing management, facilitating mergers, imposing moratoria and liquidation. Other provisions recognise the Digital Dirham as legal tender and make environmental, social and governance principles part of the central bank's statutory functions.

What should firms do? The practical steps suggested by law firms are to assess licensing status and regulatory classification, update governance, risk management and consumer protection frameworks, review technology and fintech models, align operations with the digital asset and ESG provisions, and engage with the central bank early. Fintech and technology providers should check whether they sit within the perimeter, because the cost of getting that wrong has risen sharply. Firms operating through free zones or without proper authorisation face particular scrutiny, according to legal advisers.

For customers and policyholders in the UAE, the change should be gradual rather than dramatic. If you have a complaint with a bank or insurer, you should expect a more unified process in time, but you should check the central bank's current guidance for how to file one. If you use a fintech app or payment service, check that it is licensed. The law is a long text, and details such as implementing circulars continue to emerge, so this article should be read as a summary of reported provisions rather than legal advice. Firms and individuals with specific obligations should read the decree-law itself and take advice from a qualified UAE lawyer.