Financial Services Licensing in the UAE: CBUAE, DFSA, FSRA

Financial Services Licensing in the UAE: Regulatory Compliance and Market Entry

The United Arab Emirates is the leading financial hub of the Middle East, where global capital, technology and enterprise meet. Dubai and Abu Dhabi are not merely regional centres but global players, attracting financial institutions, fintech companies and investment firms from around the world. This growth requires a robust, sophisticated and transparent regulatory framework to protect investors, maintain market stability and combat financial crime. For any business planning to operate in this market, understanding financial services licensing in the UAE is not just a legal requirement. It is the first step towards sustainable success.

Related: Explore our Crypto Regulation Compliance Advisory services for businesses in the UAE.

The UAE operates a dual regulatory system: the federal mainland jurisdiction and two Financial Free Zones (FFZs), each with its own independent regulator, rulebook and licensing process. A one-size-fits-all approach is therefore impossible. Securing a licence, whether a DFSA licence in the DIFC or an authorisation from the CBUAE, requires careful planning, legal expertise and a clear understanding of the financial regulations that govern the intended activities. This guide from the lawyers at Nour Attorneys sets out a clear roadmap for market entry and compliance across the UAE's financial sector.

The UAE's Dual Regulatory Landscape

Regulatory authority over the UAE financial sector is divided between a federally governed system and internationally aligned free zones. This structure gives financial institutions flexibility and choice, but it also makes the choice of jurisdiction an important early decision.

The Federal Mainland Regulator: The Central Bank of the UAE (CBUAE)

The Central Bank of the UAE (CBUAE) is the primary federal regulator. It oversees all financial institutions and activities conducted in the mainland UAE and in all non-financial free zones. Its mandate is broad and covers monetary policy, banking supervision and the regulation of various financial activities.

Related: Explore our Real Estate Law Advisory services in the UAE.

The CBUAE's jurisdiction covers:

• Commercial banks: both local and foreign banks operating in the mainland.
• Finance companies: entities providing credit, loans and other financial facilities.
• Payment Service Providers (PSPs): a rapidly expanding sector, now firmly under CBUAE supervision, particularly following recent legislative updates.
• Money changers and hawala providers.

The CBUAE's regulatory framework is anchored by Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. This law significantly expanded the CBUAE's supervisory scope, bringing a wider range of financial activities, including many in the growing fintech space, under its direct authority. The aim is to harmonise financial regulations across the mainland and strengthen the UAE's position against financial crime.

The Financial Free Zones: DIFC and ADGM

The UAE hosts two globally recognised Financial Free Zones. Each operates under a common law framework and has its own independent regulator.

The Dubai Financial Services Authority (DFSA) in the DIFC

The Dubai International Financial Centre (DIFC) is a leading global financial centre in the Middle East, Africa and South Asia (MEASA) region. The DFSA is the independent regulator of all financial and ancillary services conducted in or from the DIFC.

The DFSA's regulatory framework is based on internationally accepted standards and draws primarily on English common law. This makes the DIFC an attractive jurisdiction for international firms seeking a familiar legal environment.

Obtaining a DFSA licence is a rigorous process. Applicants must demonstrate compliance with rules covering capital adequacy, corporate governance, systems and controls, and conduct of business. The DFSA licenses a wide range of activities, from banking and asset management to insurance and Islamic finance.

The Financial Services Regulatory Authority (FSRA) in the ADGM

The Abu Dhabi Global Market (ADGM), located on Al Maryah Island in Abu Dhabi, is the second major Financial Free Zone. The FSRA is its independent regulator and operates under a common law jurisdiction based on the principles of English common law.

The FSRA is known for its progressive approach, particularly in fintech and virtual assets. It offers a comprehensive range of licences and has a reputation for regulatory innovation, including a regulatory sandbox (RegLab) for testing new financial technologies. Its framework is equally stringent: applicants must meet high standards of integrity, competence and financial soundness.

Activities That Require a Financial Services Licence

A licence is required when a firm engages in a "Licensed Financial Activity" or "Financial Service" as defined by the relevant regulator. The terminology varies, but the core activities generally fall into the following categories.

1. Banking and Deposit-Taking

This includes commercial banking, investment banking and accepting deposits from the public. Under the CBUAE, this is the most heavily regulated activity and often requires the highest minimum capital. The CBUAE's new law, Federal Decree-Law No. 6 of 2025, has clarified the scope of these activities, so that all entities engaging in deposit-taking or similar functions are appropriately licensed.

2. Investment and Asset Management

This category covers a wide range of activities, including:

• Managing assets: managing discretionary or non-discretionary portfolios for clients.
• Providing investment advice: advising clients on financial products.
• Arranging deals in investments: brokering transactions between parties.
• Operating Collective Investment Funds (CIFs): managing and promoting funds, such as mutual funds or private equity funds.

Firms seeking a DFSA licence or FSRA authorisation for these activities must define their scope clearly, because the regulatory requirements, including capital, vary significantly with the risk profile of the service offered.

3. Credit and Finance

This covers credit facilities such as personal loans, corporate lending and mortgage financing. In the mainland, finance companies are regulated by the CBUAE. The CBUAE has specific regulations for finance companies, including those operating under a Restricted Licence, which are subject to detailed application and ongoing compliance requirements.

4. Fintech, Payments and Virtual Assets

This is the fastest-changing area of financial regulations in the UAE.

• Payment services: the CBUAE has significantly expanded its oversight of Payment Service Providers (PSPs), including mobile wallets and payment gateways, to strengthen consumer protection and systemic stability.
• Virtual assets: the Virtual Assets Regulatory Authority (VARA) in Dubai regulates virtual asset activities outside the DIFC and ADGM. The CBUAE's new law also touches on digital finance, signalling a coordinated effort to regulate the entire digital financial ecosystem. The FSRA in the ADGM has also been a pioneer in regulating virtual asset exchanges and custodians.

For professional legal guidance, see our Crypto Regulation Compliance Advisory and Contract Drafting Services pages.

The Financial Services Licensing Process: Key Stages

The licensing process is deliberately rigorous and designed to filter out non-serious or non-compliant applicants. The details differ between the CBUAE, DFSA and FSRA, but the core stages remain consistent.

Stage 1: Pre-Application and Scoping

The critical first step is determining the correct jurisdiction and licence category. This involves:

• Jurisdictional analysis: deciding between the mainland (CBUAE) and an FFZ (DIFC/ADGM) based on target market, preferred legal structure and operational needs.
• Activity mapping: precisely defining the financial services to be conducted, which determines the licence category (e.g. Category 4 for an advisory firm in the DIFC).
• Initial consultation: engaging with the regulator (e.g. the DFSA or FSRA) for an initial discussion of the proposed business model.

Stage 2: Formal Application Submission

The formal application is a comprehensive package that typically includes:

• Detailed business plan: the strategy, target market, financial projections (usually for 3-5 years) and risk management framework.
• Operational manuals: internal controls, compliance procedures (especially AML/CFT) and IT systems.
• Legal documentation: corporate structure, constitutional documents and proof of capital.

Stage 3: Fit and Proper Assessment

All regulators place great importance on the integrity and competence of a firm's key personnel. The Fit and Proper Assessment is mandatory for directors, senior executive officers, compliance officers and money laundering reporting officers.

The regulator will scrutinise their qualifications, experience, financial soundness and track record to ensure they are suitable to perform their roles and uphold the integrity of the financial system.

Stage 4: Capital Requirements and Final Approval

Once the regulator is satisfied with the business plan and personnel, the applicant must demonstrate that it meets the minimum capital requirements (MCR). This capital must be injected into the UAE entity's bank account.

The regulator then issues an In-Principle Approval (IPA), which allows the firm to finalise its setup (e.g. office lease, IT infrastructure). The final licence is granted once the regulator verifies that all pre-conditions have been met.

Minimum Capital Requirements: A Comparison

Minimum Capital Requirements (MCRs) are a cornerstone of financial regulations. They ensure that licensed firms have sufficient financial resources to operate safely and meet their obligations. The MCR varies widely depending on the regulator, the licence category and the scope of the activities.

Examples by regulator (licence category, illustrative activity scope and MCR):

• CBUAE (Mainland), Commercial Bank: deposit-taking, full-service banking. MCR: AED 2 Billion.
• CBUAE (Mainland), Open Finance Provider: providing open finance services. MCR: AED 1 Million.
• DFSA (DIFC), Category 1: Dealing in Investments as Principal (Full Scope). MCR: USD 10 Million.
• DFSA (DIFC), Category 4: Arranging Credit, Advising on Financial Products. MCR: USD 10,000 to USD 140,000 (Variable).
• FSRA (ADGM), Category 1: Dealing in Investments as Principal (Full Scope). MCR: USD 10 Million (or equivalent).
• FSRA (ADGM), Category 4: Arranging Deals, Advising on Investments. MCR: USD 10,000 to USD 100,000 (Variable).

Note: The figures above are illustrative and subject to change. The actual MCR for a firm is determined by the regulator based on the specific licence category, the firm's risk profile and the scope of its permissions.

The MCR is not the only capital requirement. Licensed firms must also maintain adequate regulatory capital throughout their operations, calculated on the basis of their risk exposure (e.g. credit risk, market risk, operational risk). This is a key component of ongoing compliance with financial regulations.

Regulatory Change: Federal Decree-Law No. 6 of 2025

The introduction of Federal Decree-Law No. (6) of 2025 marks a significant milestone in the development of financial regulations in the UAE. The legislation modernises the CBUAE's mandate and keeps the regulatory framework in step with rapid changes in the global financial sector.

Key impacts of the new law:

1. Expanded scope: the law broadens the definition of "Licensed Financial Activities", so that emerging services, particularly in fintech, are captured and regulated. This includes activities such as operating payment systems and providing stored value services.
2. Stronger enforcement: the law introduces severe penalties, including imprisonment and substantial fines (up to AED 500,000), for engaging in Licensed Financial Activities without the requisite licence or authorisation. This underlines the UAE's zero-tolerance policy towards unlicensed financial operations.
3. Consolidated authority: by bringing the regulation of financial institutions and activities under a single federal law, the CBUAE strengthens its supervisory role and the overall stability of the mainland financial system.

For any firm seeking a licence in the mainland, a thorough review of this law is essential. It sets the compliance framework, the scope of regulated activities and the legal consequences of non-compliance.

Conclusion: Licensing and Compliance Support

The UAE offers significant opportunities for financial institutions, but market entry involves complex financial regulations and rigorous licensing requirements. Whether you are a global bank seeking CBUAE authorisation, an asset manager pursuing a DFSA licence in the DIFC, or a fintech start-up targeting the ADGM, the licensing process is a thorough test of your business model, governance and commitment to compliance.

Nour Attorneys guides international and local firms through the entire licensing process. Our work covers the CBUAE, DFSA and FSRA frameworks. We prepare applications carefully, check that your business model complies with the latest financial regulations, and support your key personnel through the Fit and Proper assessment. Contact Nour Attorneys to discuss financial services licensing in the UAE and how regulatory compliance can support your long-term position in the market.

Sources

• Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. CBUAE Rulebook.
• Finance Companies Regulation in the UAE. Lexology.
• Credit FAQ: What Does The UAE's New Financial Law Mean For Banks. S&P Global.
• Capital Requirements of Financial Services License in UAE. Jumeira Consultants.
• Article (6) Minimum Capital. CBUAE Rulebook.
• DIFC Licensing Categories. Cavenwell Group.
• CBUAE New 2025 Law - What you need to know. Addleshaw Goddard.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Additional Resources

Explore more of our insights on related topics:

• The New Era of Financial Oversight: Navigating the UAE's Regulatory Framework for Accounting and Auditing Firms in 2025
• A Guide to Compliance for Investment Advisors in the UAE
• Crypto Regulation in the UAE: Your 2025 Guide to Licensing and Compliance
• The Legal Horizon of 5G in the UAE: Regulatory Compliance and Data Privacy in 2025