CBUAE

Overview

The Central Bank is the federal financial regulator. Its mandate covers monetary policy, the supervision of banks and other licensed financial institutions, payment systems, AML/CFT supervision of those institutions, and consumer protection.

For a virtual-asset business it matters in three ways: it regulates payment tokens, it regulates the payment rails the business wants to use, and it stands behind every bank that will decide whether to open the account.

What it regulates

Payment tokens. The Payment Token Services Regulation brings payment token issuance, conversion and custody or transfer inside the Central Bank perimeter, sets out how dirham-backed payment tokens work, provides for registration of foreign payment tokens, and restricts the use of non-dirham tokens for domestic payments.

Payment services and stored value. The Retail Payment Services and Card Schemes Regulation and the Stored Value Facilities Regulation apply wherever a crypto business touches fiat wallets, on and off-ramps, or payment initiation. A firm that describes itself as an exchange but holds client fiat balances should read these before it reads anything else.

Financial institutions. Banks, finance companies, exchange houses and insurers, including their AML/CFT obligations.

Who needs a licence

Any person issuing a payment token, converting one, or holding or transferring one on behalf of others. Any person providing retail payment services or operating a stored value facility. The test is functional: what the arrangement does with client money, not what the product is called.

The perimeter question that matters most in practice is where the Central Bank ends and VARA, the CMA or a financial free-zone regulator begins. Payment activity, investment activity and virtual-asset activity are separate characterisations, and one arrangement can attract more than one.

Requirements

Legal form and minimum capital set by activity. Fit-and-proper assessment of controllers and senior management. Local presence and governance that demonstrably operates in the UAE. Outsourcing rules for anything material. IT and cyber standards. Safeguarding of client funds, which is a structural requirement and not a policy document. Compliance with the Consumer Protection Regulation and Standards, including disclosure and complaints handling.

Banking and legalisation of the business

Opening and keeping a UAE bank account is the step most businesses underestimate. Banks apply enhanced due diligence to virtual-asset clients as a matter of course. They will want the operating licence, the ownership chain to natural persons, credible source-of-funds evidence, a transaction-monitoring design they can understand, and a named compliance contact.

An operating licence is a precondition, not a decision. Where a bank declines, regulated electronic money institutions and payment service providers are sometimes a workable alternative, with their own limits that should be understood before they are relied on.

Protection and enforcement

Depositor and consumer protection, complaints escalation to the financial ombudsman, confidentiality and data protection obligations, and sanctions screening against the lists maintained by the UAE Executive Office for Control and Non-Proliferation.

The Central Bank imposes administrative sanctions, can revoke a licence, and publishes penalties. Enforcement is visible and should be treated as a live risk, not a remote one.

How we help

We characterise the flow of funds before anyone builds it, so the perimeter question is answered on paper rather than discovered in an application. We prepare payment token and payment services applications, draft the safeguarding and consumer-protection arrangements, and prepare the banking file — including the parts a bank will ask for that no regulator requires.