Digital Lending in UAE: CBUAE Licensing and Tech Stack
Digital Lending in the UAE: Licensing, CBUAE Rules and Tech Stack for Finance Companies
Last reviewed: November 2026
Digital lending in the UAE means extending credit through apps and online journeys under the supervision of the Central Bank of the UAE (CBUAE), or of the DFSA or FSRA in the financial free zones. Onshore, any provider that lends must hold a CBUAE licence or partner with a licensed bank or finance company.
This guide is for CEOs and Chief Compliance Officers of UAE finance companies and fintechs. It covers the licensing routes, the 2025 central bank law, short-term credit rules, consumer protection, data obligations and the technology stack that supports them.
Key Takeaways
- Federal Decree-Law 6 of 2025 came into force on 16 September 2025, and its one-year alignment period ended in September 2026.
- Credit and funding is a licensed activity whatever the technology, so app-based models need a licence or a licensed partner.
- Restricted licence finance companies can offer short-term credit up to the lower of AED 20,000 or three months' income, with no interest and fees capped at 30%.
- From 14 September 2026, the master system of record must be kept in the UAE under the CBUAE's operational risk rules.
What Is the Legal Framework for Digital Lending in the UAE?
The core law is Federal Decree-Law 6 of 2025, which replaced the 2018 central bank law and the 2023 insurance law. Existing CBUAE regulations remain in force until replaced.
| Instrument | What It Does for Lenders |
|---|---|
| Federal Decree-Law No. 6 of 2025 | Defines licensed activities, including credit, and the CBUAE's powers |
| Finance Companies Regulation (amended by Circular 3/2023) | Licensing of finance companies and restricted licence finance companies |
| Consumer Protection Regulation (Circular 8/2020) and Standards | Disclosure, fair treatment, complaints and data protection |
| Operational Risk Management Regulation (Circular 1/2026) | Operational resilience, outsourcing, data location and incident reporting |
| Telemarketing Regulation (Circular 3/2026) | Consent, calling hours and records for marketing calls |
The new law is technology-neutral. According to law-firm analysis, Article 62 means that using a particular platform or model does not take an activity outside the CBUAE's perimeter, and promoting a licensed activity is itself licensable.
Penalties are significant. Gibson Dunn's summary reports that unlicensed financial activity can bring imprisonment and fines between AED 50,000 and AED 500 million.
Which Licence Does a Digital Lender Need?
The licence depends on your product, tenor and customers. Most fintechs choose one of three routes.
| Route | Best For | Key Constraints |
|---|---|---|
| Finance company licence | Full-range consumer or SME lending | Higher capital, ownership and governance requirements |
| Restricted licence finance company | Short-term credit and BNPL under 12 months | Loan caps, no interest, fee cap, cannot contract agents |
| Partnership with a licensed bank or finance company | Faster market entry for technology or distribution firms | The licensed partner owns the credit and compliance |
| DIFC or ADGM authorisation | Business-focused or free-zone models | Separate regulators and rules from onshore CBUAE |
Published summaries of the 2023 amendments describe restricted licence capital as the higher of AED 20 million or 5% of outstanding lending. Standard finance company capital and ownership rules are higher, so confirm current figures directly with the CBUAE.
What Are the Short-Term Credit Rules?
The CBUAE's short-term credit framework, announced in December 2023, covers credit of up to 12 months, including BNPL. It applies to restricted licence finance companies and to licensed banks and finance companies offering such products.
- Amount: The lower of AED 20,000 or three months' verified net income per borrower, informed by an affordability assessment.
- Interest: Not permitted on short-term credit.
- Fees: Total fees, including late fees, capped at 30% of the original credit amount.
- Credit checks: Credit information must be obtained before extending credit above AED 5,000.
- Collateral: Borrowers' movable and immovable assets cannot secure short-term credit.
Each rule should be a system control, not a policy line. Fee engines should stop at the cap, and limit engines should take the lower of the two amount tests automatically.
How Do Consumer Protection and Data Rules Apply?
The Consumer Protection Regulation, Circular 8/2020 dated 25 November 2020, and its Standards apply to all licensed financial institutions. They require clear disclosure, including a Key Facts Statement, with information available in both Arabic and English, fair treatment and effective complaint handling.
The data provisions are specific. Institutions must have a data management and protection function, record and report significant breaches to the CBUAE, notify affected consumers without undue delay, and obtain express consent for collecting and sharing data.
Unresolved complaints can go to Sanadak, the CBUAE-established ombudsman unit for financial and insurance disputes, which began operating in 2024. Complaint data should therefore be tracked end to end, and a complaints regulatory reporting AI agent shows how that reporting can be automated.
Where Must Lending Data Sit?
The Operational Risk Management Regulation, Circular 1/2026, took effect on 14 September 2026. It requires a licensed financial institution's master system of record to be maintained within the UAE, including where functions are outsourced.
It also introduces tiered incident reporting to the CBUAE: within 4 hours, 24 hours and 72 hours depending on the stage and severity. Cloud architecture and vendor contracts should be designed around these rules, as explained in Digiqt's guide to data residency architecture in banking.
Is your lending stack's system of record, and every vendor that touches it, inside the UAE?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending platforms with data residency and compliance controls built in.
What Does a UAE Lending Tech Stack Need?
A compliant UAE stack maps each rule to a system component. The table below shows the core layers.
| Layer | What It Must Do | Rule It Supports |
|---|---|---|
| Digital onboarding and KYC | Emirates ID verification, sanctions screening, consent capture | AML and consumer protection |
| Credit decisioning | Bureau checks, affordability and income verification | Short-term credit limits and responsible lending |
| Pricing and fee engine | Profit or fee calculation with hard caps | 30% fee cap, no interest on short-term credit |
| Disclosure engine | Key Facts Statement and contract generation in Arabic and English | Consumer Protection Standards |
| Servicing and collections | Repayments, reminders, hardship handling | Fair treatment and collections conduct |
| Marketing controls | Consent, do-not-call checks, 9 AM to 6 PM calling window | Telemarketing Regulation |
| Data and resilience | UAE-hosted system of record, incident workflows | Operational Risk Management Regulation |
Identity checks are often the slowest step. A KYC document verification AI agent shows how document checks can be automated with human review for exceptions.
Illustrative Example: Testing a BNPL Offer Against the Rules
This example is illustrative. A restricted licence finance company receives a BNPL application from a customer with verified net income of AED 6,000 a month.
Three months' income is AED 18,000, which is lower than AED 20,000, so the maximum is AED 18,000 before affordability. If the customer requests AED 10,000, a credit information check is required because the amount exceeds AED 5,000.
| Check | Calculation | Result |
|---|---|---|
| Income cap | 3 × AED 6,000 | AED 18,000 |
| Absolute cap | AED 20,000 | Income cap applies |
| Requested amount | AED 10,000 | Within cap |
| Credit information required | AED 10,000 is above AED 5,000 | Yes |
| Maximum total fees | 30% × AED 10,000 | AED 3,000 |
If late fees would push total charges above AED 3,000, the system must stop charging. The lesson for leadership: encode the caps in the engine so that no collections script or partner integration can breach them.
Which Mistakes Do UAE Digital Lenders Make?
These mistakes usually appear during licensing reviews or the first CBUAE inspection.
- Assuming technology firms sit outside the perimeter. The new law captures platforms that facilitate licensed activity.
- Hosting the core offshore. The master system of record must now be in the UAE.
- Treating the fee cap as a target. Late fees count toward the 30% cap on short-term credit.
- Marketing without consent records. Telemarketing now needs prior consent, do-not-call checks and five-year logs.
What Is Changing Next?
On 4 November 2026, the CBUAE outlined its 2027 regulatory priorities at a supervisory roundtable. Topics included operational and cyber resilience, fraud prevention through its anti-fraud operations centre, and thematic reviews of digital assets and artificial intelligence.
Lenders using AI in credit decisions should expect closer supervisory interest. For a wider view of automation across the lending lifecycle, see AI agents in digital lending.
Ready to launch UAE lending journeys that meet CBUAE rules from day one?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build onboarding, disbursal and repayment journeys for UAE lenders.
Sources
- Gibson Dunn: UAE Central Bank Issues New Central Bank Law Consolidating Financial Sector Regulation
- CBUAE: Consumer Protection Regulation, Circular 8/2020 (PDF)
- The National: UAE Central Bank Introduces Rules to Regulate Short-Term Credit Services
- Trowers & Hamlins: UAE Central Bank Raises the Bar on Operational Risk
- CBUAE: 2027 Regulatory Priorities Press Release, 4 November 2026 (PDF)
Note: The CBUAE Rulebook blocked automated access during review, so Finance Companies Regulation details were confirmed through search listings of the Rulebook and published summaries. Confirm current clause wording directly in the Rulebook.
