Insights
UAE Payment Service Provider Licence: CBUAE Requirements and Application Guide
Regulation last updated
September 2025 — Federal Decree Law No. 6 of 2025 and Retail Payment Services Regulation — Official source
The CBUAE regulates payment services in the UAE under the Retail Payment Services and Card Schemes (RPSCS) Regulation and the Stored Value Facilities (SVF) Regulation. Federal Decree Law No. 6 of 2025 reinforces and extends these frameworks. Any entity providing payment services to customers in the UAE — including digital wallets, payment gateways, remittance services, and card scheme operations — requires a CBUAE licence.
Payment Service Provider Licence Categories
- Retail Payment Services Provider — for payment initiation, account information, and merchant acquiring services
- Stored Value Facility Provider — for prepaid cards, digital wallets, and stored value products
- Card Scheme Operator — for operating a card payment network
- Payment Token Service Provider — for AED-pegged stablecoins and payment tokens under the 2024 Circular
Capital Requirements
- Retail Payment Services Provider: AED 2 million minimum base capital
- Stored Value Facility: capital proportional to outstanding balances, minimum AED 2 million
- Payment Token Service Provider: capital determined by CBUAE based on token issuance scale
- All licensees must maintain capital on an ongoing basis with quarterly reporting
Application Timeline
CBUAE payment licence applications typically take three to six months from submission to approval for well-prepared applications. The most common delays are incomplete technology architecture documentation, AML/CFT programmes that do not specifically address the payment activity type, and governance structures missing key CBUAE-required roles. Pre-application consultation with the CBUAE FinTech Office significantly reduces the risk of application rejection.
Need a regulatory readiness assessment?
Stablus generates tailored regulatory readiness reports, architecture blueprints, and project delivery packs in hours — built around your regulator, your stack, and your specific compliance gaps.
Get your regulatory readiness assessment →