UAE introduces licensing regime for payment service providers

The CBUAE published the Retail Payment Services and Card Schemes (RPSCS) Regulation in July 2021, its fourth regulation governing payment systems. The RPSCS regulation sets out the rules and conditions established by the CBUAE for acquiring and maintaining a licence for the provision of retail payment services and operating a card scheme.

The regulation came into force on 15 July 2021, and a one-year transitional period has been given to existing payment service providers and card schemes to obtain the relevant licences.

Principal elements of the RPSCS regulation

The RPSCS regulation specifies that no entity can provide or promote any retail payment service listed in the regulation without a CBUAE licence, unless it is an exempted person. Exempted persons are primarily CBUAE-licensed banks, but they still have to notify the CBUAE if they intend to carry out retail payment services.

The regulation licenses nine categories of digital payment services in the UAE: payment account issuance services; payment instrument issuance services; merchant acquiring services; payment aggregation services; domestic fund transfer services; cross-border fund transfer services; payment token services; payment initiation services; and payment account information services.

The regime for payments licences under the RPSCS regulation will require a considerable amount of organisational planning, as the principal business of the payment services provider (PSP) must align with the retail payments service for which it was granted a payments licence.

If the PSP intends to provide ancillary services beyond the scope of its licence, it must obtain CBUAE's approval to do so. The CBUAE may require the PSP to create a separate entity for this purpose.

The RPSCS regulation does not deal with the regulation of stored value facilities (SVFs), commodity or security tokens, virtual asset tokens, remittances or currency exchange operations. It also does not cover payment transactions carried out between payment service providers and settlement agents, central counterparties, clearing houses and central banks, or payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking as long as no intermediary is involved in these payment transactions. Technical support operations related to digital payments are also excluded.

Categories of licence

The RPSCS regulation lists four distinct categories of licences. If an applicant wants to provide multiple services listed within a particular category, it must obtain that licence.

There are multiple overlaps in the services listed under the various licensing categories. Each of the four categories of payments licence will allow a PSP to provide a prescribed number of the nine retail payment services, with lower categories of payments licences permitting more regulated activities.

The regulation sets out the initial capital requirements for each type of licence, with the minimum levels set according to the average monthly value of payment transactions. The only exception to this is for payment initiation services and payment account information services, where an initial capital requirement of at least AED 100,000 is required regardless of the average monthly value of transactions.

It is noteworthy that although the prescribed initial capital requirements for the various payments licences are far more modest than those required to maintain a SVF licence, the CBUAE expressly reserves the right to impose higher aggregate capital fund requirements if it considers it essential to ensuring that the PSP can meet its regulatory obligations.

A PSP will be automatically subject to a higher aggregate capital fund requirement once the value of payment transactions exceed AED 10 million for three consecutive amounts. This new amount will be determined by the CBUAE.

The RPSCS regulation also seeks to regulate card schemes and requires them to obtain a licence from the CBUAE. It sets out the conditions for these licences, and the ongoing obligations of licensed card schemes.

The high level of discretion the CBUAE has over the issuance of card scheme licences is perhaps driven by an expectation that there will be only a handful of licences issued for major payment card networks in the UAE.

Payment token services

The RPSCS regulation includes within its definition of payment token services: payment token issuing; payment token buying; payment token selling; facilitating the exchange of payment tokens; enabling payments to merchants or enabling peer-to-peer payments; and custodian services. However, a PSP may only provide one of the latter two services – enabling payments to merchants or peer-to-peer payments, or custodian services. If it wants to provide both, and allows retail payment service users to redeem payment tokens with any fiat currency under a contractual arrangement, it must comply with the respective SVF requirements.

These provisions are important as they clarify the treatment of cryptographic payment tokens when they are part of a retail payment service. They also enable the establishment and operation of an over-the-counter payment token desk, which is an encouraging step.

PSPs issuing a payment token will have to draft and circulate a white paper containing information on the main participants involved in the project’s design and development; a detailed description of the project and the type of payment token that will be offered to the public; the number of payment tokens that will be issued and the issue price, among several other details.

Wage protection system

The RPSCS regulation also lists conditions for participating and obtaining access to the UAE’s wage protection system. PSPs can apply to the CBUAE to participate in and be given access to the system, subject to approval from the Central Bank.

Co-written by Barkha Doshi of Pinsent Masons, the law firm behind Out-Law