First-step analysis: fintech regulation in United Arab Emirates

Financial regulation

Regulatory bodies

Which bodies regulate the provision of fintech products and services?

For banking and lending-related activities in onshore UAE, the financial services regulator is the UAE Central Bank, while for securities and capital markets-related matters, the UAE Securities and Commodities Authority (SCA) is the relevant regulator. Following the merger between the UAE Central Bank and the UAE Insurance Authority under Decretal Federal Law No. 25 of 2020, the UAE Central Bank is now also the Onshore UAE insurance sector regulator. In February 2022, Dubai Law No. 4/2022 Regulating Virtual Assets in the Emirate of Dubai (the Dubai Virtual Assets Law), creating the Dubai Virtual Assets Regulatory Authority (DVARA) was passed. DVARA is to regulate businesses relating to virtual assets, including crypto-assets and non-fungible tokens (NFTs) in the Emirate of Dubai including all special development zones and free zones in Dubai, other than the Dubai International Financial Centre (DIFC). For all regulated financial activities in the DIFC, the regulator is the Dubai Financial Services Authority (DFSA). For all regulated financial activities in the Abu Dhabi Global Market (ADGM), the regulator is the Financial Services Regulatory Authority (FSRA).

Regulated activities

Which activities trigger a licensing requirement in your jurisdiction?

The onshore UAE regulatory regime is separate and different from the regulatory regime found in the DIFC and the ADGM. So, when considering the UAE, it is important to first ask which specific jurisdiction and financial regulatory regime is applicable.

As financial free zones, both the DIFC and the ADGM have their own common law-based commercial and civil legal and financial services regulatory frameworks, as well as their own dedicated courts. The DFSA is the financial services regulator for activities conducted in or from the DIFC and the FSRA regulates financial services activities in or from the ADGM. The relevant federal onshore UAE (ie, in the UAE but outside the DIFC and ADGM) financial regulators are the SCA and the UAE Central Bank. The UAE Central Bank is the prudential regulator for onshore UAE and mainly regulates activities relating to banking and lending activities such as:

• deposit taking (including sweep deposit accounts);
• foreign exchange trading;
• guarantees and commitments;
• payment services (including the issuance of payment instruments and other means of payments);
• primary lending;
• factoring;
• invoice discounting;
• arranging primary loans;
• secondary market loan trading; and
• secondary market loan intermediation.

 

Outside the banking and lending context, the UAE Central Bank was historically the sole financial services regulator for onshore UAE prior to the establishment of the SCA (in 2001) and the UAE Insurance Authority (IA) (in 2007). However, the IA has now been absorbed by the UAE Central Bank following a merger between the two institutions in 2020. There are therefore some other areas of financial activity that the UAE Central Bank continues to regulate – such as, among other things, currency brokerage, money exchange and some activities that would be typically associated with investment banking.

Generally, the types of regulated activities in onshore UAE, the DIFC and the ADGM include, among other things:

• the marketing and sale of securities;
• providing investment advice;
• dealing in products and investments (either as principal or agent);
• underwriting and placing financial products;
• offering and providing discretionary investment management services;
• marketing or selling funds (including the provision of investment advice);
• accepting deposits;
• providing credit;
• providing money services;
• arranging deals in investments;
• managing assets;
• managing a collective investment fund;
• advising on financial products; and
• insurance intermediation.

 

Securities and financial products that are regulated by the respective financial services regulators across onshore UAE, the DIFC and the ADGM include, but are not limited to, equity securities, debt securities, linked products, derivatives, structured products, deposits, notes and warrants.

The Securities and Commodities Authority Decision No. 23/RM/2020 Concerning Crypto Assets Activities Regulation (the Crypto Assets Regulation) establishes a regime for crypto trading within the UAE. The Crypto Assets Regulation is applicable to exchanges, crowdfunding platforms and other related financial services based on leveraging crypto-assets. The following are considered to fall under the ambit of the Crypto Assets Regulation:

• promoting, offering or issuing crypto-assets in the UAE;
• providing crypto-asset custody services, operating an exchange for crypto-assets or operating a crypto fundraising platform in the UAE; and
• carrying on any other financial activities relating to crypto-assets such as promotion and marketing, issuance and distribution, advice, brokerage, custody and safekeeping, fundraising and operating an exchange.

Consumer lending

Is consumer lending regulated in your jurisdiction?

Yes. Article 65 of the UAE Decretal Federal Law No. 14 of 2018 Regarding the Central Bank and Organisation of Financial Institutions and Activities provides that the UAE Central Bank will regulate, among other things, the activities of ‘providing credit facilities of all types’, ‘providing stored values services, electronic retail payments and digital money services’ and ‘providing virtual banking services’.

With regard to the provision and booking of these services ‘in or from’ either the DIFC or the ADGM, these activities are likely to be considered as ‘providing credit’, which will require a licence from either the DFSA or FSRA respectively. To the extent that these services are only ‘advised’ on or ‘arranged’ from the same jurisdictions, an appropriate licence would also be required from either the DFSA or FSRA. If these services are merely promoted (with no ‘advising’ or ‘arranging’) ‘in or from’ either financial free zone, unless an exemption applies, a Representative Office licence would be required from either the DFSA or the FSRA respectively.

In November 2020, the UAE Central Bank issued the Consumer Protection Regulations 2020 to ensure the protection of consumers’ interests in their use of any financial product, service or relationship with licensed financial institutions. This ensures that ensure that the licensed financial institutions’ approach to consumer protection is in line with international standards. Along with the objective of promoting a culture within licensed financial institutions of respecting and acting in the best interest of consumers, it specifically aims to protect consumers by defining the institutional obligations for the protection of consumers.

Secondary market loan trading

Are there restrictions on trading loans in the secondary market in your jurisdiction?

Secondary market loan trading is an activity regulated by the UAE Central Bank. It constitutes primary lending and is regulated whether or not the loan has been fully drawn. The trading of loans would also constitute a regulated financial services activity in the DIFC and the ADGM.

Collective investment schemes

Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

In onshore UAE, there is a general prohibition on marketing unregistered collective investment schemes (ie, funds) unless they have been registered with the SCA accordingly (either for private or public promotion). However, the onshore UAE marketing prohibition does not apply to the promotion of foreign funds to a non-natural ‘qualified investor’. A non-natural qualified investor is defined in the SCA rules and includes the federal government, among others.

There is a private placement regime under the SCA rules, where if the potential investor is a natural person, foreign funds can be registered for private placement by an SCA-licensed promoter subject to several conditions.

With regard to the DIFC, there is a prohibition on marketing unregistered funds in the DIFC except through a DFSA-licensed intermediary with the appropriate type of licence, unless an exemption applies. The prohibition on the offer or sale of a fund only applies where this activity is carried out ‘in or from’ the DIFC. It is not possible to register a foreign fund for distribution in the DIFC. Funds need only be registered with the DFSA if they are domiciled in the DIFC. There are currently relatively few funds domiciled in the DIFC and so most funds marketed in the DIFC are foreign (ie, non-DIFC-domiciled) and, therefore, unregistered. However, all funds and collective investment schemes promoted ‘in or from’ the DIFC need to meet a fund eligibility criteria.

Once a marketing entity holds the appropriate licence it may market foreign domiciled funds or DIFC-domiciled funds, provided it markets only to investors within the scope of its licence, and in the case of any foreign fund:

• the fund qualifies as a ‘designated’ or ‘non-designated fund’;
• the marketing entity has a reasonable basis for recommending a fund as suitable to a particular client; or
• the fund offered discreetly to persons who are professional clients and the minimum subscription per investor is US$50,000.

 

Similar provisions exist with regard to the ADGM.

Following public consultation, with effect from 31 August 2017, the DFSA updated its rules to include ‘operating a crowdfunding platform’ as a regulated activity.

With regard to onshore UAE, Circular No. 7/2020, the Loan-Based Crowdfunding Activities Regulation, was published in October 2020 by the UAE Central Bank. This regulates the operation of crowdfunding companies, platforms, borrowers, lending and controls over client money. The regulation sets out rules on the requirements for entities that can be involved in such regulated activities and the segregation of crowdfunding money to be held within UAE banks with such accounts being required to be audited regularly.

However, depending on the specific activities undertaken (ie, where the platform merely introduces two independently contracting parties or if the platform is actively establishing a fund or offering securities), the activity may potentially fall under existing UAE Central Bank or SCA regulation.

Alternative investment funds

Are managers of alternative investment funds regulated?

Yes, managers of alternative investment funds are regulated in onshore UAE, the DIFC and the ADGM.

Peer-to-peer and marketplace lending

Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

Lending is a regulated activity whereby intermediary platforms are required to obtain approvals to operate from the UAE Central Bank, which would trigger compliance requirements on the platform including the proper vetting of borrowers and anti-money laundering checks.

While interest is prohibited under articles 409 to 412 of the Penal Code and is void under articles 204 and 714 of the Civil Code, interest is permitted under articles 77 and 90 of the Commercial Code, provided it does not exceed 12 per cent. In any case, UAE Federal Supreme Court Decision No. 14/9 of 28 June 1981 permits the charging of simple interest (presumably as opposed to compound interest) in connection with banking operations.

The DFSA issued a consultation paper in early 2017 called ‘Crowdfunding: SME Financing through Lending’, which proposed a regulatory framework to operate loan-based crowdfunding platforms in the DIFC. In summary, the DFSA proposed a regime whereby loan-based crowdfunding platforms in the DIFC:

• benefit from a new financial activity and licence for operating such a platform;
• apply appropriate prudential and conduct of business requirements for these platforms;
• disseminate appropriate risk warnings and disclosures to lenders and borrowers;
• conduct suitable due diligence on the borrowers as well as checks on lenders;
• deploy a business cessation plan in the event that it ceases operations; and
• follow rules in relation to transfer of rights and obligations between lenders.

 

On 1 August 2017, changes to the DFSA rules came into force that introduced rules relevant to crowdfunding. Additional rules, which included investment limits and property valuation requirements in the context of property crowdfunding, came into force on 1 July 2019.

In September 2018, the ADGM launched the Guidance on the Regulatory Framework for Private Financing Platforms after holding a consultation on the matter. This framework intends to regulate operators of private financing platforms (PFPs) serving equity investment, debt financing and trade receivables funding needs of start-ups, private enterprises and SMEs. It contains rules on loan-based or investment-based crowdfunding, which affects private financing platform operators that seek to connect clients or investors to their stakeholders.

Crowdfunding

Describe any specific regulation of crowdfunding in your jurisdiction.

Financial services in the UAE are regulated either by the UAE Central Bank or the SCA depending on the nature of the activity. In respect of financial free zones in the UAE, such activities are regulated by the DFSA in the DIFC, and the FSRA in the ADGM. In particular, issues of securities by UAE companies are regulated under the UAE Companies Law (Federal Law No. 2 of 2015) (as amended by Federal Decree-Law No. 26/2020 on the amendment of certain provisions of Federal Law No. 2/2015 on Commercial Companies) and regulations issued by the SCA. As such, under the UAE Companies Law, only public joint-stock companies may offer securities by way of a public subscription through a prospectus. Other companies, whether incorporated in the UAE (onshore or in a free zone) or in a foreign jurisdiction, are prohibited from advertising including the invitation to a public subscription without the approval of the SCA. In practice, private joint-stock companies are entitled to issue securities to sophisticated investors by way of a private placement. Accordingly, this regulatory limitation restricts the ability of limited liability companies, the legal form adopted by most SMEs in the UAE, from raising funds through equity-based crowdfunding.

On 1 August 2017, changes to the DFSA rules came into force that introduced rules relevant to crowdfunding. Additional rules, which included investment limits and property valuation requirements in the context of property crowdfunding, came into force on 1 July 2019.

On 10 September 2018, the FSRA issued the Guidance on Regulatory Framework for Private Financing Platforms, which seeks to regulate crowdfunding activities aimed at private companies (start-ups to SMEs) to source alternative financing from private and institutional investors. Regulatory requirements include capital requirements, risk analysis, due diligence, marketing restrictions and limits on exit options.

In October 2020, the UAE Central Bank published Circular No. 7 of 2020 Loan-Based Crowd Funding Activities Regulations to introduce a framework for licensing, regulating and monitoring load-based crowdfunding platforms (CFPs), safeguard the financial system from the risks posed by such platforms, assist in administering the loans resulting from CFP operations as well as to safeguard the interests of the consumers in the UAE.

Invoice trading

Describe any specific regulation of invoice trading in your jurisdiction.

Invoice trading currently falls within the activity of ‘arranging credit’ within the DIFC and is regulated as such by the DFSA. Similar provisions exist in the ADGM. With regard to onshore UAE, invoice trading will require a form of regulatory licence either from the UAE Central Bank (if its activities fall under Federal Decree-Law No. 16/2021 on Factoring and Transfer of Civil Accounts Receivable) or the SCA (if invoices were to be considered as a financial product falling within the SCA’s Promoting and Introducing Regulations – Regulation 3/RM of 2017). To the extent that services are merely promoted within onshore UAE, the DIFC or the ADGM, a Representative Office licence in the respective jurisdiction would be required.

Payment services

Are payment services regulated in your jurisdiction?

Yes. In 2017, the UAE Central Bank had published its Regulatory Framework for Stored Values and Electronic Payment Systems, which covered digital payment services. This has since been replaced by the UAE Central Bank’s Stored Value Facilities Regulation (the SVF Regulation), issued on 30 September 2020. In addition, the UAE Central Bank issued the Retail Payment Systems Regulation (the RPS Regulation) and Large Value Payment Systems Regulations (the LVPS Regulation) in January 2021. Further, the Retail Payment Services and Card Schemes Regulation (the RPSCS Regulation) was issued in July 2021. Together, the four regulations cover the regulatory framework for payment system providers in the UAE (the Payment Services Regulations).

The SVF Regulation covers the licensing, enforcement and supervision of SVF in the UAE as well as non-UAE entities that promote SVF on a cross-border basis.

The RPS Regulation sets out the licensing, designation and oversight framework that the Central Bank intends to follow with respect to the licensing and designation of RPS. It aims to ensure the safety and efficiency and smooth and efficient operation of the financial infrastructure system.

The LVPS Regulation applies to LVPS operating in the UAE or those that accept clearing or settlement of transfer orders denominated in the UAE dirham both within the UAE and outside. The LVPS Regulation requires compliance with the provisions of the Principle of Financial Market Infrastructures. It also covers the licensing obligations and requirements in relation to LVPS as well as the ongoing requirements for designated LVPS.

The RPSCS Regulation sets out the rules and conditions for acquiring and maintaining a licence for the provision of retail payment services and operating a card scheme. The term ‘retail payment services’ comprises nine defined categories of retail payments services: payment account issuance services, payment instrument issuance services, merchant acquiring services, payment aggregation services, domestic and cross-border fund transfer services, payment token services, payment initiation services and payment account information services.

Following the publication of the DFSA’s Consultation Paper No. 125 on Proposals for Money Services in November 2019, the DFSA Rulebook COB Module has been amended, with effect from 1 April 2020, to introduce requirements for the provision of money services in relation to electronic money in the DIFC.

The FSRA has issued enhancements to its Regulations and Rules concerning Providing Money Services (PMS) in November 2020.  The improvements includes amendments to the scope of PMS as well as the introduction of a new set of rules in the FSRA’s COB Rulebook for payment accounts and stored value services as well as more risk-sensitive capital requirements for such services.

Open banking

Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?

Other than in the context of a regulatory or official investigation, there is no specific obligation in UAE legislation requiring the disclosure of data to third parties.

The general position is that financial institutions that are in a position to collect and store data from the public are bound by a duty of confidentiality. A breach of this duty of confidentiality could attract criminal liability under article 379 of the UAE Penal Code. Further, article 106 of the Banking Law requires the UAE Central Bank to keep confidential all banking data that it receives.

Insurance products

Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

Nothing in current DIFC or ADGM legislation specifically regulates fintech companies that wish to sell or market insurance products, and, therefore, the general regulation around the sale and marketing of insurance products in the relevant jurisdictions applies.

Insurance operations in onshore UAE will be regulated by the UAE Central Bank following the merger between the Insurance Authority and the Central Bank under Federal Decree Law No. 25 of 2020. Under the law, the UAE Central Bank will assume regulatory, supervisory, licensing and enforcement functions for the insurance sector. On completion of the merger, the UAE Central Bank will ensure the implementation of best practices and standards in executing its mandate to supervise and regulate the insurance sector.

The Electronic Insurance Regulations 2020 (Insurance Authority Board of Directors’ Resolution No. 18 of 2020) was introduced to regulate insurance agents, actuaries, brokers, surveyors and insurance consultants carrying out insurance activities via electronic operations. Prior approval must be obtained to conduct insurance activity electronically and requires a raft of safeguards relating to electronic transactions including risk analysis and contingency plans for system disruptions.

The UAE Central Bank is committed to facilitating the advancements of new technologies across the financial sector as part of its fintech strategy. This includes adopting insurtech for insurance services.

Although the Insurance Authority and the UAE Central Bank have merged, the rules and regulations issued by the Insurance Authority under Federal Law No. 6 of 2007 will continue to apply to all licensed organisations until their replacement by the UAE Central Bank.

Credit references

Are there any restrictions on providing credit references or credit information services in your jurisdiction?

On 15 April 2018, the SCA issued Chairman of the SCA Board of Directors’ Decision No. 18/RM of 2018 Concerning the Regulations as to Licensing Credit Rating Agencies. Under these regulations, a credit rating is ‘a periodic measure to determine and assess the ability of the rated entity to meet its financial liabilities, and potential risks that may affect it, and to evaluate the financial products and potential risks of acquiring them by the investor’ and credit rating activities are regulated. To be eligible for a licence to carry on credit rating activities, an entity must have, among other things, a minimum of 2 million UAE dirhams in capital and consent from the UAE Central Bank (should the licence application be subject to their mandate).

In the DIFC, ‘operating a credit rating agency’ is a regulated activity that would require a DFSA licence. Similar provisions exist in the ADGM.

However, individual credit reference and information services are possible in the UAE through the Al Etihad Credit Bureau (AECB), which is a public joint stock company wholly owned by the UAE federal government. According to UAE Federal Law No. 6 of 2010 concerning Credit Information, the AECB is mandated to regularly collect credit information from financial and non-financial institutions in the UAE. The AECB aggregates and analyses this data to calculate credit scores and produce credit reports that are made available to individuals and companies in the UAE. The AECB collects information on individuals and companies from banks, finance companies and telecoms companies. Additional information from other sources such as utilities, real estate, government and other entities are planned to be added in the future. Financial institutions in the UAE are mandated by law to supply the AECB with all credit information on a monthly basis.