Banking Law in UAE: Central Bank Regulatory Framework

A banking licence in the UAE is not a document you obtain once and file away. The conditions it was granted on are tested again every reporting period. Capital adequacy, liquidity and risk exposures go to the Central Bank of the UAE (CBUAE) on a schedule, and inspectors examine the books, the risk management systems and the governance policies behind them. Failure to maintain licensing conditions can result in revocation or penalties.

Where the Central Bank's powers come from

The CBUAE holds the apex regulatory authority over banking operations across the federation. Its jurisdiction and supervisory mandate come from federal law. It was established under Federal Law No. (14) of 2018 concerning the Central Bank and the Organization of Financial Institutions and Activities, and its role extends to regulating, supervising and overseeing banks, to maintain financial stability and protect depositors.

That role carries defined powers. The CBUAE issues banking licences, formulates capital adequacy requirements, oversees liquidity management, and enforces anti-money laundering (AML) regulations. It also operates a structured enforcement regime to address non-compliance, with sanctions and corrective actions where an institution departs from the established legal framework. The regime is continuously calibrated to respond to evolving financial threats, including those posed by global economic shifts.

Two channels feed the same supervisory picture

Supervision is arranged in layers: on-site inspections, off-site surveillance and regulatory reporting. On-site inspections are periodic and targeted examinations of a bank's books, its risk management systems and its governance policies. They are meant to uncover latent vulnerabilities that could grow into systemic issues if left unaddressed.

Off-site surveillance works on what the bank files. The CBUAE analyses financial statements, liquidity positions, capital ratios and operational metrics submitted at regular intervals. The dual mechanism gives the regulator a view of a bank between inspections as well as during them.

The CBUAE also coordinates with international regulatory bodies and takes part in global financial forums, bringing international regulatory standards into the domestic framework. That alignment matters most where cross-border banking operations and correspondent banking relationships are involved.

What an applicant has to show before a licence is granted

Obtaining a banking licence in the UAE requires banks to meet stringent criteria set by the CBUAE, so that only financially sound and operationally capable entities enter the banking sector. The process is governed primarily by the Central Bank Law and associated regulations.

Applicants must demonstrate rigorous capital adequacy, sound governance structures, and business plans that detail their operational strategies. The CBUAE closely examines the applicant's financial health, its ownership structure and its compliance mechanisms. Explore our corporate governance advisory service for practical support in this area.

The licensing framework mandates that banks maintain a minimum capital threshold, which may vary depending on the type of banking licence sought, be it commercial, investment or specialised banking. The CBUAE also requires evidence of qualified management teams and internal control systems that can meet ongoing prudential regulations. The licensing authority retains discretionary power to approve a licence, to reject it, or to impose conditions on it.

An application typically begins with a detailed submission to the CBUAE, including documentation such as audited financial statements, business plans, organisational charts and proof of capital adequacy. The CBUAE then runs an extensive due diligence exercise, which may involve interviews with proposed management and site visits. Applicants must also demonstrate their capacity to address operational risks, such as fraud or money laundering. A bank planning digital banking services must illustrate its cybersecurity frameworks and data protection measures. Banks seeking to enter the UAE market must also align with operational mandates on establishing branches or subsidiaries.

Once the licence is granted, the obligations become continuous. Licensed banks must submit periodic reports detailing capital adequacy, liquidity and risk exposures.

Basel III, as the Central Bank applies it

Prudential regulation carries most of a bank's day-to-day obligations, and is what maintains depositor confidence. The CBUAE imposes a set of prudential requirements that banks must adhere to, including capital adequacy, liquidity ratios, asset quality and risk concentration limits.

Capital adequacy standards are aligned with the Basel III framework, which the CBUAE has adapted to local conditions. Banks must maintain minimum capital ratios measured against their risk-weighted assets, so that they hold sufficient capital buffers to absorb potential losses. Where Basel III recommends a minimum Common Equity Tier 1 (CET1) ratio of 4.5%, the CBUAE imposes a higher threshold, reflecting the UAE's goal of absorbing shocks stemming from volatile commodity markets and regional geopolitical risks.

Liquidity requirements further constrain banks to maintain adequate high-quality liquid assets to meet short-term obligations. The liquidity coverage ratio (LCR) compels banks to hold sufficient high-quality liquid assets (HQLA) to cover net cash outflows over a 30-day stress period. That mitigates the risk of a liquidity mismatch during market stress.

Concentration risk limits prevent a bank from overexposing itself to a single borrower or sector. Legal provisions mandate detailed reporting and justification for exposures exceeding preset thresholds, which allows regulatory intervention before risks grow. Asset quality is assessed separately, with non-performing loans and credit risk concentrations carefully monitored.

Capital tiers, and the buffers that sit above the minimum

Capital adequacy is enforced as a minimum ratio of regulatory capital to risk-weighted assets, reflecting the institution's capacity to absorb losses. Regulatory capital is divided into tiers: Tier 1, the core capital, consists of equity capital and disclosed reserves, and Tier 2 is supplementary capital. Adherence to Basel III principles brings with it a minimum CET1 ratio, Tier 1 capital ratio and total capital ratio.

The central bank also requires banks to maintain capital buffers such as the capital conservation buffer and the countercyclical buffer, which function as additional layers of protection during periods of heightened financial stress. The capital conservation buffer, set at 2.5% of risk-weighted assets, is an additional capital reserve a bank can draw on to absorb losses without breaching minimum capital requirements. The countercyclical buffer may be adjusted based on macroeconomic indicators, and can be increased to compel banks to hold extra capital during periods of rapid credit growth.

The buffers carry consequences of their own. Failure to maintain them could trigger regulatory sanctions, or restrictions on dividend payments and bonus distributions, affecting the bank's financial and market standing.

Stress testing exercises mandated by the CBUAE help identify vulnerabilities in a bank's capital position, enabling anticipatory measures. Banks are also subject to detailed disclosures about their capital adequacy and risk exposures, which supports transparency and market discipline.

Risk management sits inside the governance structure

The CBUAE requires banks to maintain a risk management framework that encompasses credit risk, market risk, operational risk and reputational risk. The framework must be embedded in the bank's governance structures, with clear delegation of responsibilities to risk committees and senior management. Explore our corporate governance advisory service for practical support in this area.

Risk assessment models must be regularly validated and stress-tested. Credit risk models must account for default probabilities, loss given default and exposure at default, tailored to the UAE's economic environment. Operational risk frameworks must include incident reporting systems and contingency plans.

Compliance with prudential standards is continuously overseen through supervisory inspections, reporting requirements and stress testing exercises. The central bank also expects banks to implement rigorous AML and counter-terrorism financing (CTF) controls, through customer due diligence, transaction monitoring and suspicious activity reporting, all of which are subject to stringent supervisory reviews.

A compliance function that tracks the circulars

Banks must build internal policies that align with regulatory expectations. One fundamental approach is a risk-based compliance framework that prioritises key regulatory requirements such as AML, CTF and prudential norms. Building these elements into daily operations can prevent regulatory breaches and the penalties that follow them.

Banks must also invest in continuous monitoring and reporting systems that provide real-time data for regulatory submissions and internal risk assessments. Regulatory enforcement demands that banks maintain rigorous documentation and audit trails to demonstrate compliance.

Compliance teams need to stay abreast of regulatory amendments issued by the CBUAE, including circulars and guidelines that often update or clarify existing requirements. Automated alert mechanisms and regulatory change management systems can support a prompt response to those updates.

Legal counsel has a part in this: interpreting regulations as they evolve, advising on structural changes, and representing banks in regulatory interactions. FinTech banks and digital-only banks carry both sets of obligations, the traditional banking regulations and the technology-specific risks, and must have cybersecurity protocols that protect customer data and prevent cyberattacks.

AML and CFT: the controls, and what non-compliance costs

The CBUAE has built an extensive AML and combating the financing of terrorism (CFT) framework aligned with the Financial Action Task Force (FATF) recommendations. It mandates banks to implement stringent controls to detect and prevent illicit financial flows. Banks must apply customer due diligence (CDD) measures, enhanced due diligence for high-risk customers, and continuous transaction monitoring.

Banks are required to have reporting mechanisms for suspicious transactions, and to submit those reports to the Financial Intelligence Unit (FIU) in time. Non-compliance with AML and CFT regulations invites severe penalties, including licence suspension or revocation. Failure to comply with AML regulations can also lead to hefty fines, reputational damage and even criminal investigations.

To address these risks, banks must have compliance programmes that include employee training, rigorous internal controls, and technology-enabled transaction monitoring systems. Those systems should be capable of detecting unusual patterns that may indicate money laundering or terrorist financing activities.

Consumer protection and data privacy

Alongside the prudential regulations, the CBUAE enforces consumer protection norms that require banks to provide transparent information on products and services, fair treatment of customers, and mechanisms for dispute resolution.

Data privacy is increasingly becoming a critical regulatory consideration, especially with the rise of digital banking. Banks must have policies that comply with the UAE's Personal Data Protection Law (PDPL) and other relevant regulations, so that customer data is collected, processed and stored lawfully and securely.

Nour Attorneys advises banks and financial institutions on licensing, regulatory compliance and the structuring of capital frameworks in the UAE.

Disclaimer: this article is for informational purposes only and does not constitute legal advice.

Further reading

• The UAE central bank digital currency framework
• Private banking and wealth management regulation in the UAE
• Fund management regulation in the DIFC and ADGM
• The regulatory framework for M&A transactions in ADGM