Fintech Licensing in the UAE: Why the September Deadline Is a Governance Signal

With eight weeks remaining before 16 September 2026, many firms in this market still approach fintech licensing in the UAE as a documentation exercise — assemble the policies, submit the pack, await the letter. That approach has always carried risk. The transition now underway makes the cost of it considerably more visible.

The deadline matters because entities whose activities were newly brought into scope under the updated Central Bank law have a fixed window in which to regularise their position. Regularisation is not a filing. It is a demonstration that the business operates a control environment capable of that justifies the licence it seeks

Blaze Meridian Group advises firms navigating this process. The difference between applicants who clear authorisation and those who do not, is rarely the paperwork.

What the Regulator Reads

A licence application is read as a claim: that the firm can hold client money, move it, or issue an instrument against it, without breaches or issues arising.

Every element of the pack is assessed against that claim. Policies are not evidence of a control environment — they are evidence that one has been described. Supervisors test whether the description matches how the business actually runs. Is a named individual accountable for each control? Does that individual have the ‘authority’ to halt a launch? Has the board reviewed the risk register, and are there minutes recording the decisions?

Paperwork is rarely the problem. Applications fail because the pack describes a governance structure that does not yet exist in practice and the interview exposes that gap very quickly.

The Jurisdictional Decision

The first and most consequential decision is defining which regulator applies.

The Central Bank of the UAE governs the onshore federal perimeter: national payment infrastructure, retail banking, stored value facilities, retail payment services and the newer payment token regime. The Dubai International Financial Centre and the Abu Dhabi Global Market operate as separate common-law jurisdictions under the DFSA and FSRA respectively. Dubai’s Virtual Assets Regulatory Authority supervises virtual asset service providers within the Emirate of Dubai, excluding the DIFC.

These are not tiers of a single system – they are distinct perimeters. CBUAE authorisation does not extend into the DIFC, and a DFSA permission does not permit onshore operation. There is no mutual recognition framework between the regulatory jurisdictions for payment services.

This is important because commercial and licensing plans must be aligned from the start. A firm that intends to serve onshore merchants alongside DIFC-based institutional clients, for example, will discover at the structuring stage that this represents two applications, two capital positions, two compliance functions and two reporting regimes. That discovery belongs at the outset.

Category and Timelines

Within the onshore perimeter, the retail payment services regime is divided across licence categories. Capital requirements are determined by category and transaction volume. The range is material.

Stored value facilities, where a customer float is held, sit considerably higher – carrying a substantially larger paid-up capital requirement, an ongoing buffer calculated against the float, and a bank guarantee.

A VARA licence follows a different structure, organised around virtual asset activity rather than payment activity.

Firms conducting both will manage two supervisory relationships with different reporting rhythms.

Applicants tend to focus on the capital requirement. The timeline, however, is rarely determined by capital. It is determined by whether the firm can evidence that client money is segregated, reconciled daily and reportable on demand – and that someone independent of the commercial line is conducting the validation.

Regulatory Engagement

In this market, it does not serve firms well to not engage with the regulator before, during and after the application.

A regulatory engagement strategy means deciding deliberately what to raise with the supervisor, and when. It means presenting the genuinely novel elements of a model early rather than hoping they pass unnoticed. It means that when an issue arises, and one will,  the supervisor already understands the business and has a basis for crediting the firm’s account of it.

Applicants who clear authorisation quickly have almost always held  conversations before filing. Not a lobbying exercise, but a technical discussion of how a specific feature would be classified. That conversation can cost weeks. A rejection would cost considerably more.

The licensing process establishes a relationship, not just a permission. Supervisors carry institutional memory, and a firm’s conduct during authorisation shapes how it is read – for years afterwards.

Four Actions. Eight Weeks

For firms in scope and not yet through authorisation, we recommend prioritising these four actions.

1. Confirm scope with certainty, and confirm it for the right activity. Scope is determined by how an activity is classified, not by how the firm describes its product. Any doubt is a question for counsel, then for the supervisor.

2. Map Accountability. For every control in the pack, ensure there is a named individual, confirm ownership is accepted, and confirm the authority to act is held. A control without an owner is a finding. So is a control that cannot be evidenced.

3. Evidence board oversight. Board minutes recording a documented decision on risk carry more weight than an expanded policy suite.

4. Initiate the supervisory conversation. Genuinely novel features should be raised now. Eight weeks accommodates a technical exchange. It does not accommodate recovery from a rejection.

Fintech licensing in the UAE is not primarily a legal exercise. It is a demonstration that a firm can be trusted with the permission it seeks. The application is where that case is made, and the standard is not what has been written down –  it is what can be evidenced.

FAQ:

Blaze Meridian Group builds compliance frameworks for firms entering and scaling across the UAE and wider GCC — including licensing strategy, control environment design and regulatory engagement. If the September deadline applies to you and you are not certain you are ready, that is a conversation worth having this month.

Farah Flisher · Co-Founder, Blaze Meridian Group