The UAE Central Bank has taken a bold step towards consolidating financial sector regulation with the introduction of the New CBUAE Law. This reform is a game-changer, impacting financial institutions operating in the UAE and beyond.
A New Era of Financial Regulation in the UAE
The New CBUAE Law, published on September 15, 2025, and effective from September 16, 2025, represents a significant overhaul of the UAE's financial regulatory framework. It brings banks, payment service providers, and insurers under one legislative roof, introduces licensing for emerging-tech providers, and imposes stricter penalties.
This update provides a comprehensive overview of the key reforms and their implications.
Criminal Sanctions for Unlicensed Financial Activities
The 2018 Law had a glaring omission - the absence of criminal sanctions for unlicensed financial activities. The New CBUAE Law rectifies this, aligning the UAE with global standards. Article 60 reaffirms the prohibition, while Article 170 introduces criminal penalties, including imprisonment and fines up to AED 500 million. This development is a strong deterrent and may lead to increased enforcement.
Extending the Regulatory Perimeter
The New CBUAE Law introduces a novel provision, prohibiting unlicensed communications related to financial activities. This broadens the CBUAE's regulatory reach to include promotional and marketing communications targeting UAE residents. Article 61(1)(h) defines such activities as licensed financial activities, requiring appropriate licensing.
The definition of 'communication' is expansive, capturing not just local conduct but also foreign communications directed at UAE residents. This means foreign firms marketing financial products to UAE residents through online platforms now fall under the CBUAE's regulatory umbrella.
Regulating Virtual Assets and Decentralized Finance
Another groundbreaking provision is Article 62, which extends the CBUAE's regulatory scope to cover activities involving emerging technologies, virtual assets, and decentralized finance (DeFi) models. This goes beyond prohibiting unlicensed activities; it explicitly includes the facilitation of such activities. Entities providing technological support for financial services may now be subject to licensing requirements, even if they don't directly offer financial products.
Enhanced Obligations for Licensed Financial Institutions
The New CBUAE Law establishes an integrated framework of prudential, conduct, and consumer protection obligations for all Licensed Financial Institutions (LFIs). LFIs must comply with CBUAE regulations on capital adequacy, liquidity, governance, risk management, and related-party exposures. The CBUAE has the authority to issue detailed rules for board members and senior management, ensuring accountability.
The law also introduces a dedicated consumer protection regime, requiring LFIs to handle customer complaints, maintain transparency, implement anti-fraud measures, and promote financial literacy.
A Comprehensive Resolution and Recovery Framework
Articles 142 to 146 introduce a robust resolution and recovery regime for LFIs and insurers, aligning the UAE with international standards for financial stability. The CBUAE is empowered to intervene early in financial distress cases, impose corrective measures, and initiate resolution proceedings through a dedicated Settlement and Resolution Authority. The framework provides a range of tools to ensure the continuity of critical functions and protect depositors and policyholders.
Enforcement and Settlement
A notable addition is the negotiated settlement mechanism within the CBUAE's enforcement framework. This allows the CBUAE to resolve supervisory breaches through risk-based settlements, offering a more flexible approach than fixed penalties. This aligns the UAE's enforcement with international best practices, recognizing cooperation and remedial action.
Transitional Provisions and Legal Continuity
Articles 183 to 185 provide a clear framework for a smooth transition, ensuring regulatory continuity. All regulations and decisions issued under the previous frameworks remain valid until expressly replaced. Regulated institutions have one year to align with the new requirements, with the possibility of an extension at the CBUAE's discretion.
Conclusion
The New CBUAE Law marks a significant shift in the UAE's regulatory landscape, emphasizing the authorities' commitment to enforcement and supervision across the financial sector. Entities affected by the law have one year to comply, with the potential for an extension.
If you have any concerns about the impact of the New CBUAE Law on your business, don't hesitate to reach out to your Gibson Dunn advisor or any member of our UAE team.
This update was prepared by Renad Younes, Mohammed Bashir, Sameera Kimatrai, Aliya Padhani, and Holly Alderton from Gibson Dunn's Financial Regulatory team.
