CBUAE updates guidance for technology firms after regulation shift

Last year the CBUAE published Federal Decree-Law 6 of 2025 (the Banking Law) which brought oversight of banking and insurance services together, and clarified the bank’s licencing scope to include new technologies as part of strengthening consumer protection around cybersecurity and fraud procedures.

Now the CBUAE has provided clarification for those impacted by the changes through a new FAQ, which looks to clear up issues of uncertainty generated through the Banking Law.

Notably, the FAQ confirms that Article 62 of the Banking Law does not introduce new categories of financial activities - rather the licenced activities listed in the decree remain under the CBUAE’s regulatory framework regardless of when performed through alternative technology methods including through decentralised systems or Web3-based delivery channels.

The FAQs confirm that a technology service provider offering services exclusively to a CBUAE licensed financial institution does not directly amount to carrying out or facilitating a licensed financial activity unless the provider itself engages in, or presents itself as engaging in, a licensed financial activity. The CBUAE is not looking to regulate or prohibit technology service providers whose services are purely technical, such as software or technology infrastructure service providers.

Marie Chowdhry, a financial regulation expert with Pinsent Masons in Dubai, said the clarification is welcomed by the market.

“While not legally binding, the FAQ confirms that the intention behind Article 62 is to ensure regulatory neutrality regardless of the delivery channel rather than expanding the licensing perimeter to capture standalone technology service providers,” she explained.

She added that technology service providers operating in the region should use the one-year implementation period for the new laws to determine whether they fall into the scope of the new laws and how that would impact their activities.

Elsewhere, the FAQ also clarifies the scope of the CBUAE when it comes to early intervention, such as if a licenced financial institution enters liquidation or a restructuring process, and how it will ensure continuity of critical functions.

This now includes early intervention if an institution is likely to breach its capital requirements, to ensure less impact on customers and shareholders.

The FAQ also clarify the position that no existing CBUAE decisions, standards, guidelines, or circulars have been repealed, and that they remain in full force and effect until formally replaced, thereby ensuring continuity and consistency across the existing regulatory framework.

Under the Banking Law, a one-year implementation period has been set, ending on 16 September 2026, for individuals and entities whose activities fall within the scope of the CBUAE’s regulatory framework to adjust their activities and regulatory status where required.

This applies to anyone engaging in activities listed under Article 61, as well as technology service providers that may need to assess whether any of their activities go beyond the scope of pure technical support.