- Further to our previous article on the introduction of the UAE’s new Central Bank Law, almost one year after the legislation came into force, a growing body of implementing regulations is giving greater substance to the new regulatory framework. With the transition period due to expire in September 2026, licensed financial institutions should be reviewing their compliance position now.
- Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business (the “Central Bank Law”) came into force on 16 September 2025, replacing the previous Central Bank legislation. It represents a significant modernisation of the UAE’s framework for the regulation and supervision of financial institutions and activities. Since its introduction, a number of implementing regulations and related measures have begun to give greater practical substance to the new framework, making this an appropriate time for licensed financial institutions to revisit the implications for their businesses and compliance arrangements.
A developing regulatory framework - The Central Bank has continued to develop the framework during 2026, with a number of important regulations issued under the new Law.
- These include the Operational Risk and Operational Resilience Regulation (C1/2026), issued in February 2026, which requires licensed financial institutions (“LFIs”) to establish comprehensive frameworks for operational risk and operational resilience.
- The Remuneration Regulation for Banks and Insurance Companies (C5/2026), effective from April 2026, establishes minimum requirements for responsible remuneration frameworks, including consideration of performance and risk outcomes and mechanisms addressing inappropriate remuneration practices.
- The Central Bank has also issued the Telemarketing Regulation (C3/2026), effective from 31 March 2026, strengthening requirements around the marketing of financial products and services and customer protection.
- For the insurance sector, the Insurance Company Licensing Regulation (C4/2026) was issued in February 2026 and establishes a new framework for licensing insurance companies, including branches of foreign insurers and the opening of branches and subsidiaries.
- The Central Bank has also issued guidance in 2026 on the responsible adoption and use of artificial intelligence and machine learning by LFIs, reflecting the increasingly technology-focused nature of the regulatory agenda.
September 2026: an important deadline
Article 184 of the Central Bank Law provides a one-year period for persons subject to the Law to reconcile their positions with its provisions. Accordingly, the current deadline for this reconciliation period is 15 September 2026. The Law permits the Central Bank’s Board to extend the reconciliation period where appropriate, although no general extension has been announced to date.
The expiry of this period should not, however, be regarded as a general “sunset” date for existing banking and finance arrangements.
In particular, Article 132 provides that regulations, decisions and circulars issued by the Central Bank under the new Law do not have retroactive effect and do not prevent the implementation of agreements entered into between LFIs and their customers before the relevant regulations were issued.
This distinction is important. The September deadline principally relates to an institution’s regulatory compliance and the requirement to bring its position into conformity with the new Law. It does not, of itself, render existing loan, security or other finance documents invalid or require them to be re-executed.
Broader regulatory perimeter - One of the more interesting features of the new Law is the breadth of the activities brought within the Central Bank's licensing framework. Article 61 includes, among other things, deposit-taking, credit and funding, open finance, money transfer, virtual-asset payment services, stored-value and digital money services, and certain activities relating to the promotion or marketing of licensed financial activities.
- The Law also expressly addresses financial activities conducted through emerging technologies. Article 62 makes clear that the use of a particular technology or business model does not, by itself, take an activity outside the Central Bank's regulatory perimeter. The provision expressly captures certain virtual-asset payment tokens, decentralised finance (“DeFi”), platforms, decentralised applications and technological infrastructure facilitating financial services.
- This will be particularly relevant to fintechs, technology providers and businesses whose activities sit at the boundary between technology and regulated financial services.
What should institutions be doing now? - With the September deadline approaching, LFIs should consider whether they have:
- completed a gap analysis against the Central Bank Law and regulations issued under it;
- identified which existing policies, governance arrangements, licences and procedures require updating;
- assessed the impact of the new regulations and their respective implementation dates;
- reviewed their activities against the potentially broader licensing perimeter, including technology-enabled activities; and
- considered whether existing contractual arrangements require amendment for regulatory compliance, while recognising the protection afforded by Article 132 in relation to the non-retroactive application of subsequent Central Bank regulations.
- The Central Bank Law also strengthens the supervisory and enforcement framework. The Central Bank has broad examination powers, including powers to inspect LFIs and, in appropriate circumstances, persons suspected of carrying on licensed financial activities without a licence. Penalties for carrying on licensed financial activities without the required licence or authorisation can be substantial, including imprisonment and fines of between AED 50,000 and AED 500 million. In addition, under Article 181, responsible management personnel may face personal consequences where their knowledge, negligence or failure to perform their duties is established.
- The September 2026 deadline therefore provides a useful prompt for UAE financial institutions and businesses operating in or around the regulated financial sector to take stock of their regulatory position. As the Central Bank continues to issue implementing regulations and guidance, the practical impact of the new Law will increasingly be determined by the interaction between the primary legislation, the evolving Rulebook and the specific activities undertaken by each institution.