UAE Central Bank Law: Compliance Mandatory as Grace Period Ends

Introduction

The grace period for compliance with the UAE's seminal Federal Decree-Law No. 6 of 2025, also referred to as the new Central Bank Law, officially ended on September 16, 2026. This landmark legislation fundamentally reshapes the regulatory landscape for financial and technology companies operating across the Emirates. With the deadline now passed, all affected entities are fully subject to a more stringent licensing, oversight, and enforcement framework, facing potential penalties, including fines up to AED 1 billion, for non-compliance.

This pivotal development demands immediate and comprehensive attention from businesses in both the traditional financial sector and emerging technology spaces. The implications are far-reaching, requiring a thorough review of existing operations and strategic plans to ensure complete alignment with the updated regulatory requirements and avoid severe legal and financial repercussions. This article outlines the key provisions of the new law, identifies affected entities, and provides practical steps for achieving and maintaining compliance.

What is Federal Decree-Law No. 6 of 2025?

Federal Decree-Law No. 6 of 2025 represents a comprehensive modernization of the UAE's financial regulatory architecture. Enacted to strengthen the nation's financial stability, promote responsible innovation, and enhance consumer protection, the law grants the Central Bank of the UAE (CBUAE) significantly broader powers and a unified mandate.

The core objectives of this legislation include:

• Strengthening Financial Stability: By establishing a robust framework for supervision across an expanded range of financial activities, the law aims to mitigate systemic risks and reinforce the resilience of the UAE's financial system.
• Fostering Responsible Innovation: Recognizing the rapid evolution of financial technology, the law creates a regulatory environment that encourages innovation while ensuring new technologies are integrated safely and securely into the economy.
• Enhancing Consumer Protection: With a unified approach to oversight, the CBUAE can more effectively safeguard the interests of consumers across all financial sectors, including those engaging with novel digital services.

Key Changes Introduced by the Law

The new Central Bank Law introduces several critical changes that redefine the scope and nature of financial regulation in the UAE:

• Unified Regulatory Oversight: The CBUAE now exercises a unified and comprehensive regulatory authority over both the banking and insurance sectors. This consolidation aims to streamline supervision, harmonize standards, and promote a consistent regulatory approach across traditional financial services.
• Expanded Authority to Emerging Areas: A significant aspect of the law is the CBUAE's broadened regulatory reach into previously less-regulated or nascent fields. This includes explicit oversight of:
  • Open finance initiatives: Frameworks for secure data sharing and API-driven financial services.
  • Virtual asset payment services: Regulation of services related to cryptocurrencies and other digital assets used for payments.
  • Digital money: Oversight of the issuance and management of digital currencies, including stablecoins.
• Enhanced Licensing and Enforcement Framework: The law establishes a more rigorous process for obtaining and maintaining licenses. This involves increased scrutiny of business models, governance structures, risk management practices, and technological infrastructure. Concurrently, the CBUAE's powers to enforce compliance have been significantly enhanced, allowing for the imposition of stricter measures and substantially higher fines for breaches.

This expansion of authority highlights the UAE's proactive stance in embracing financial innovation while simultaneously ensuring regulatory clarity and stability. It underscores a commitment to integrating new technologies safely and effectively into the national economy.

Who Must Comply with the New Central Bank Law?

While Federal Decree-Law No. 6 of 2025 has broad implications for the entire financial ecosystem, several sectors and entity types are particularly impacted due to the CBUAE's expanded mandate. Understanding whether your business falls within this scope is the first critical step toward compliance.

The law applies to a wide range of entities, including but not limited to:

• Traditional Financial Institutions: This category includes banks, insurance companies, finance companies, money exchangers, and other licensed financial entities. These institutions continue to operate under the CBUAE's purview, now governed by the unified and enhanced framework.
• Fintech Businesses: Companies developing and offering innovative financial technology solutions are squarely within the CBUAE's expanded scope. This specifically includes entities involved in payment services, lending platforms, remittances, crowdfunding, and other digital financial platforms. These businesses must carefully review their operations against the new licensing and operational requirements.
• Virtual Asset Service Providers (VASPs): Businesses dealing with virtual asset payment services, cryptocurrency exchanges, virtual asset custody services, and other related activities are now explicitly regulated by the CBUAE. This is a critical development for firms in the burgeoning crypto space in the UAE, formalizing the oversight and demanding adherence to specific guidelines to combat financial crime and protect investors.
• Open Finance Participants: Entities engaged in data sharing and Application Programming Interface (API)-driven financial services, which are foundational to the open finance movement, must ensure their activities align with forthcoming CBUAE guidelines. This includes third-party providers offering aggregated financial data services or payment initiation services.
• Digital Money Issuers: Companies involved in the issuance, management, or facilitation of digital currencies, including stablecoins or central bank digital currencies (CBDCs), that fall under the law's definition of 'digital money,' are now subject to the CBUAE's regulatory framework.

Essentially, any company engaging in activities that touch upon financial services, especially those using new technologies, needs to assess their position under this comprehensive law. The emphasis is on the activity performed rather than just the traditional classification of the entity. For deeper insights into who must comply, refer to our related articles: UAE Central Bank Law: Key Compliance Changes for Financial Institutions by September 2026 and UAE Fintechs: Critical Central Bank Licensing Deadline Looms (Sept 2026).

CBUAE's Expanded Regulatory Powers and Enforcement

The new Central Bank Law significantly bolsters the CBUAE's ability to supervise and enforce compliance across the financial sector. This expansion of powers is not merely administrative; it introduces a more proactive and interventionist approach to regulation, particularly in the realm of digital and innovative financial services.

Oversight of Digital Assets and Innovative Finance

The law grants the CBUAE explicit authority over critical emerging areas:

• Virtual Asset Payment Services: The CBUAE now regulates entities providing services for using virtual assets in payments, including intermediaries, wallet providers, and exchanges facilitating such transactions. This aims to bring clarity and security to a previously unregulated space, aligning the UAE with international standards for combating money laundering and terrorist financing.
• Open Finance Initiatives: The CBUAE will set the framework for open finance, which involves the secure sharing of customer financial data with third-party providers (with customer consent). This enables the development of innovative new products and services, but also necessitates robust data governance, cybersecurity, and consumer protection protocols.
• Digital Money Issuance: Any entity involved in issuing digital representations of fiat currency or other assets that qualify as "digital money" under the law will be subject to CBUAE licensing and oversight. This includes stablecoins and potential future Central Bank Digital Currencies (CBDCs).

This enhanced oversight is designed to foster an environment where innovation can thrive responsibly, preventing regulatory arbitrage and protecting both consumers and the integrity of the financial system.

Enhanced Enforcement Capabilities and Penalties

A key aspect of the new law is the CBUAE's significantly strengthened enforcement powers. These powers allow the CBUAE to take swift and decisive action against non-compliant entities.

• Wide Range of Sanctions: The CBUAE can impose a variety of administrative sanctions, including warnings, directives to cease specific activities, restrictions on operations, and ultimately, revocation of licenses.
• Financial Penalties: The law introduces substantial financial penalties for breaches. Non-compliant firms face fines up to AED 1 billion, reflecting the seriousness with which the UAE regards financial regulatory adherence. These fines are designed to be a significant deterrent, ensuring that the cost of non-compliance far outweighs any perceived benefits.
• Increased Scrutiny: The CBUAE will conduct more rigorous inspections, audits, and ongoing monitoring of licensed entities. This proactive approach aims to identify and address compliance deficiencies before they escalate into major issues.

For a comprehensive overview of the CBUAE's transformed regulatory scope, consult our article: UAE Financial Regulation Transformed: Navigating CBUAE's Expanded Scope and Digital Asset Oversight.

Compliance Deadlines and Penalties

The conclusion of the grace period on September 16, 2026, for Federal Decree-Law No. 6 of 2025 marks a critical juncture for all entities operating within the UAE's financial and technology sectors. From this date, full adherence to the law's provisions and associated CBUAE regulations is mandatory, with no further extensions.

Grace Period End: A Hard Deadline

The specified grace period was provided to allow businesses sufficient time to reconcile their operations, obtain necessary new licenses, and update their internal policies and procedures to align with the sweeping changes introduced by the new Central Bank Law. This period is now over.

Severe Consequences of Non-Compliance

The CBUAE's enhanced enforcement powers mean that non-compliance is no longer a minor issue. The consequences are designed to be a significant deterrent:

• Monetary Fines: The most prominent penalty is the potential for substantial fines, which can reach up to AED 1 billion. The actual amount of the fine will depend on the severity, duration, and impact of the breach, as well as the CBUAE's discretion.
• Operational Restrictions: Non-compliant entities may face directives to suspend or cease certain business activities, restrictions on expanding operations, or limitations on offering new products and services.
• License Suspension or Revocation: For serious or repeated breaches, the CBUAE has the power to suspend or, ultimately, revoke a business's license to operate in the UAE financial sector. This would effectively terminate the entity's ability to conduct regulated activities.
• Reputational Damage: Regulatory enforcement actions and public disclosure of breaches can severely damage a company's reputation, eroding client trust and impacting future business prospects.
• Legal and Personal Liabilities: In certain cases, individuals responsible for governance and compliance within the organization may face personal legal liabilities.

The scale of these penalties underscores the CBUAE's commitment to maintaining a robust and trustworthy financial ecosystem. Businesses must act with urgency and precision to ensure their compliance frameworks are impeccable.

Immediate Actions for Businesses: A Compliance Checklist

With the grace period concluded, immediate and proactive steps are not just advisable, but essential. Businesses must ensure ongoing compliance to avoid significant penalties and secure their operational future in the UAE. Ignoring these requirements is no longer an option.

1. Conduct a Comprehensive Operational and Licensing Review

• Internal Audit: Perform a thorough audit of all current financial and technology-related activities. This includes reviewing all products, services, platforms, and customer interactions.
• License Validation: Confirm whether existing licenses (if any) adequately cover the full scope of your current and planned activities under the new law. Identify any new activities that now require specific licenses or authorizations from the CBUAE.
• Jurisdictional Scope: Confirm how the law applies to your specific operating model, including any activities conducted in or from financial free zones, which may have distinct but often parallel regulatory requirements.

2. Assess Impact on New Ventures and Digital Initiatives

• Future-Proofing: If your business is involved in, or planning to enter, areas such as open finance, virtual asset payment services, or digital money, understand the specific regulatory pathways and requirements that apply. Proactive engagement with the CBUAE or expert advisors can prevent costly missteps.
• Technology Stack Review: Evaluate your technological infrastructure to ensure it meets CBUAE standards for security, data privacy, and operational resilience, especially for digital services.

3. Strengthen Internal Compliance Frameworks

• Policy and Procedure Updates: Ensure your internal policies, procedures, and governance structures are fully updated and robust enough to meet the heightened regulatory expectations. This includes:
  • Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF): Enhance due diligence, suspicious transaction reporting, and sanctions screening.
  • Customer Protection: Implement strong measures for fair treatment, transparency, and complaint handling.
  • Risk Management: Develop or refine frameworks for operational risk, cybersecurity risk, and strategic risk assessment tailored to the new regulatory environment.
  • Data Governance: Ensure compliance with data protection laws and CBUAE guidelines for data handling, particularly in open finance contexts.
• Training and Awareness: Implement comprehensive training programs for all relevant staff, from front-line employees to senior management, on the requirements of the new law and internal compliance protocols.

4. Seek Expert Regulatory Guidance

• Specialized Interpretation: The nuances of Federal Decree-Law No. 6 of 2025, especially concerning emerging technologies, can be complex. Partnering with regulatory experts is crucial for accurate interpretation of the law, identification of compliance gaps, and development of a clear, actionable strategy for full adherence.
• Engagement with CBUAE: Expert advisors can facilitate effective communication with the CBUAE, whether for license applications, clarifications, or addressing specific compliance challenges.

Navigating the Evolving Regulatory Landscape

The new Central Bank Law is more than just a set of rules; it represents the UAE's strategic vision for its financial sector. It signals a maturing regulatory environment that is committed to balancing innovation with robust oversight, ensuring the nation remains a leading global financial hub.

Implications for Innovation and Growth

The CBUAE's expanded scope, particularly into digital money, virtual assets, and open finance, indicates a clear intent to embrace technological advancements while mitigating associated risks. This creates both challenges and opportunities for businesses:

• Regulatory Clarity: By formalizing oversight, the law provides much-needed regulatory clarity for innovators, allowing them to develop new products and services within a defined legal framework. This certainty can attract further investment and talent into the UAE's fintech and digital asset sectors.
• Market Confidence: A well-regulated environment fosters greater public and investor confidence in innovative financial services, accelerating adoption and growth.
• International Alignment: The law helps align the UAE's regulatory framework with international best practices and standards, particularly those related to anti-money laundering and consumer protection in digital finance.

Strategic Imperatives for Businesses

For businesses in the financial and technology sectors, understanding and acting upon these changes is not merely a legal obligation, but a strategic imperative for sustainable growth and competitive advantage. Proactive engagement with the regulatory framework offers several benefits:

• Risk Mitigation: Early and complete compliance minimizes the risk of significant fines, operational disruptions, and reputational damage.
• Market Access: Obtaining the necessary CBUAE licenses and adhering to regulations provides legitimate access to the vast and growing UAE financial market, including opportunities in rapidly expanding digital segments.
• Investor Confidence: A strong compliance posture enhances credibility with investors, partners, and customers, signaling responsible and sustainable business practices.
• Innovation within Bounds: Understanding regulatory boundaries allows businesses to innovate confidently, channeling their efforts into compliant and viable solutions, rather than developing products that may later face regulatory hurdles.

The journey towards full compliance is ongoing, extending beyond the grace period. It requires continuous monitoring of regulatory updates, proactive adaptation of business models, and a culture of compliance embedded throughout the organization. For more insights on the deadlines and what financial firms need to know, read CBUAE Reconciliation Deadline: What UAE Financial Firms Need to Know About Federal Decree-Law No. 6.

Conclusion

The expiration of the grace period for Federal Decree-Law No. 6 of 2025 marks a new chapter in the UAE's financial regulatory journey. This comprehensive legislation has cemented the Central Bank of the UAE's position as a robust, unified, and forward-looking regulator, with expanded authority over both traditional finance and the rapidly evolving digital economy. For businesses, this translates into a clear mandate: full and continuous compliance is now non-negotiable.

The law's emphasis on unified oversight, responsible innovation in areas like virtual assets and open finance, and stringent enforcement mechanisms underscores the UAE's commitment to fostering a stable, secure, and globally competitive financial ecosystem. Entities that embrace these changes proactively will not only mitigate significant risks, including fines up to AED 1 billion, but also position themselves for sustainable growth and enhanced trust within this dynamic market.

Navigating the complexities of this new regulatory era requires specialized expertise and a nuanced understanding of its practical implications. Partnering with experienced advisory firms can provide the clarity and strategic guidance necessary to ensure smooth compliance, allowing businesses to focus on innovation and capitalize on the opportunities presented by the UAE's progressive financial landscape.

Source & References

• [centralbank.ae, https://www.uaelegislation.gov.ae](centralbank.ae, uaelegislation.gov.ae)
• financefeeds.com

---

This article is for general information only and does not constitute professional, legal, tax, or financial advice. Speak to AURNE for guidance specific to your situation.