UAE Central Bank enhances SME customer protection framework

Marie Chowdhry and Lana Akkad were commenting after the CBUAE introduced a new regulation that is set to significantly expand current conduct, disclosure, governance and customer protection obligations on banks and finance companies when dealing with SMEs.

The new Small to Medium Sized Enterprises (SME)-Customer Protection Regulation (Regulation C 2/2026), introduced on 17 February, replaces the previous 2021 SME Market Conduct Regulation.

Commenting on the new regulation, Chowdhry, a UAE-based financial regulation and fintech expert, said it would help to improve outcomes considerably for SMEs in the country. “The new SME Customer Protection Regulation marks a clear shift by the CBUAE towards treating SMEs as a distinct and protected customer segment, requiring tailored conduct standards rather than a purely commercial approach,” she said.

As well as strengthening obligations around customer data protection and confidentiality, the regulation imposes enhanced customer support requirements for SMEs facing financial difficulty and introduces new reporting obligations to the CBUAE, including on products, fees and complaints.

Chowdhry said these and other changes outlined in the regulation “demonstrate a shift from high‑level conduct principles to a prescriptive, customer‑outcomes‑focused framework, with much tighter operational requirements.”

The regulation applies to all banks and finance companies licensed by the CBUAE and will impose greater requirements around transparency, responsible financing, fee fairness, complaint handling, data protection, SME account mobility and access to banking services.

It also introduces new reporting obligations on products, fees and complaints, and imposes specific timelines for bank account opening and disclosure standards.

Chowdhry said firms will need to review product design, account-opening processes, fee structures and complaint-handling frameworks ahead of the regulation coming into force in August 2026 – six months after publication in the Official Gazette.

She added: “Financial institutions will also need to reassess how SME products are designed, marketed and sold, including whether existing disclosures, pricing structures, fee schedules and sales practices meet the regulation’s enhanced transparency and fairness requirements. For example, the Key Facts Statement requirement is one of the most significant changes. It formalises how products must be explained and must be provided before execution, not after.”

Firms can expect to face administrative, financial and even enforcement sanctions if they fail to comply with the new rules.

Lana Akkad of Pinsent Masons said that SME onboarding and account‑opening processes will also require review, particularly in light of the three-business day timeline for opening low‑risk SME accounts and the obligation to document and explain delays or rejections.

She said financial institutions may also be required to make additional changes to credit assessment processes, complaint handling frameworks and collections practices, which may necessitate early engagement and structured support for SMEs in financial difficulty. “Taken together, these requirements will require coordinated action across legal, compliance, risk, product, operations teams ahead of the regulation’s effective date,” she said.

The new regulation comes amidst a surge in SME activity in the country. According to the latest government data available, by mid-2022 there were already more than 550,000 SMEs contributing as much as 63.5% to the UAE’s non-oil GDP. The latest forecasts indicate that there could be as many as 1 million SMEs operating in the UAE by 2030.