Guide · updated 08.09.2026 · 11 min read · Lucent Legal team

CBUAE Licensing: Who Has to Be Ready by September 2026

A crypto wallet, a payment gateway, a stablecoin project with a UAE office — a year ago the Central Bank had nothing to do with any of them. It does now: the new Central Bank law of 2025 lets CBUAE licence any business that moves other people's money, whatever the technology. The law gave everyone one year to get licensed or get out, and that year runs out in mid-September 2026.

Who this actually covers

The perimeter is not "crypto in general" — it is money in motion. A CBUAE licence is needed by:

• payment services and gateways, including those settling in virtual assets;
• issuers of stablecoins and payment tokens pegged to the dirham or a foreign currency;
• wallets, custody services and token transfer services;
• token-to-fiat and token-to-token exchange offered as a service;
• DeFi protocols, DEXs, bridges and dApps that carry payments, lending or deposits;
• providers of technological infrastructure that enables someone else's financial service;
• companies marketing licensed activities to a UAE audience.

Trading crypto with your own money stays outside the perimeter. Sources also place pure asset-to-asset swaps with no payment function under VARA and the CMA (the SCA until 1 January 2026) rather than the Central Bank. The full map of regulators is in our guide on whether crypto is legal in the UAE.

The law also closes the "we're just code" argument. Article 62 attaches the duty to the function, not to the legal wrapper or the degree of decentralisation. Open source and the absence of a legal entity are not exemptions.

How this differs from a VARA licence in Dubai

A VARA licence does not replace a Central Bank one. Payment tokens and stablecoins sit with CBUAE even inside Dubai, outside DIFC. Everything else in Dubai's virtual-asset space stays with VARA.

That produces dual licensing. A VARA-licensed exchange that accepts a dirham stablecoin for payment, custodies foreign payment tokens in a wallet, or converts fiat into a stablecoin needs a separate CBUAE authorisation. The categories, fees and capital for the VARA licence itself are covered in our VARA licence in Dubai guide.

The Central Bank's Payment Token Services Regulation is narrow on coins. It covers dirham-backed tokens and approved tokens pegged to foreign currencies. Bitcoin and Ethereum fall outside it. Algorithmic stablecoins and privacy tokens are banned outright. Banks cannot issue a dirham token directly, only through a subsidiary.

Why ADGM and DIFC are not affected

The financial free zones are carved out of the law. ADGM in Abu Dhabi is regulated by the FSRA, DIFC in Dubai by the DFSA, and CBUAE requirements do not reach them. A company holding an FSRA or DFSA licence is not counting down to September.

One trap: jurisdiction follows where the company is registered and where the service physically runs, not the address on the website. A side-by-side comparison of all four regulators, with budgets and timelines, is in our UAE crypto licence comparison.

What operating without a licence costs

The penalty range widened sharply.

Promoting a service counts the same as providing it. Ads, a landing page and targeting a UAE audience without a licence fall under the same AED 1 million floor.

Article 132 does bar retroactive effect for regulations, decisions and circulars issued by the Central Bank under the new law. Past transactions are not reopened after the fact.

The CBUAE licence types and the capital behind them

The Central Bank's payment perimeter splits into three regimes, and one business may need several at once.

1. Stored Value Facilities (SVF) — holding prepaid customer balances. Minimum paid-up capital AED 15 million, or 5% of the total customer float, whichever is higher.
2. Retail Payment Services and Card Schemes (RPSCS) — payment execution and transaction processing, in four categories. Category IV (payment initiation) — AED 100,000. Category III (domestic) — AED 500,000 to 1 million. Category II (cross-border) — AED 1–2 million. Category I (full scope) — AED 1.5–3 million.
3. Payment Token Services (PTS) — payment tokens and stablecoins. Category A, dirham token issuer — AED 15 million plus 0.5–2% of tokens outstanding. Categories B (custody and transfer) and C (conversion) — AED 1.5–3 million, scaled by monthly volume.

Categories B and C have a lighter route, Non-Objection Registration instead of a full licence. It does not lower the capital requirement.

If you won't make September: the options

There is no automatic extension. The CBUAE Board can extend the period under Article 184, but sources recorded no general extension as the deadline approached. Four realistic paths:

1. File the application. The sequence is standard: classify the activity, hold a pre-application meeting, confirm incorporation, clear fit-and-proper checks on the principals, then submit. The regulator has stated that decisions on new applications take up to 60 days, counted from a complete file.
2. Run through a licensed partner. The licensable function moves to a company that already holds the licence. Your own product stays technical.
3. Geofence the UAE. Cut off users and marketing aimed at the country. Article 62 catches marketing too, so the landing page and the ads go dark as well.
4. Wind the activity down before filing. The only thing worse than a fine is a fine with a criminal case attached.

Leaving it to the last day is risky on the banking side too. A company with no clear licensing status is the first to draw a compliance request from its own bank.

What this means for ordinary bank customers

Alongside the licensing push, banks are re-running customers through KYC. On 16 April 2026 CBUAE issued updated AML/CFT guidance for licensed financial institutions. Identity verification stopped being a one-off step at account opening and became a continuous duty.

What the guidance requires of a bank:

• reassess a customer's risk profile on triggers — a change of ownership or control, unusual transaction patterns, adverse media, sanctions designations;
• identify the ultimate beneficial owner, meaning any individual holding 25% or more, or exercising effective control;
• keep due-diligence records for at least 5 years after the relationship ends.

Sources link the wave of reviews to the UAE's FATF mutual evaluation, scheduled for June 2026. Residents who have banked here for years are getting source-of-funds requests for the first time. From there it goes one of two ways: you answer and the account keeps working, or the bank restricts it. Restrictions typically hit the chequebook, online banking, cards and ATM withdrawals.

If such a request lands, answer it with documents rather than explanations — how to assemble the file is in our guide on a bank compliance request in the UAE. If the account is already frozen, the sequence and the timelines are in my UAE bank account is blocked.

Topic: Crypto & Digital Assets in the UAE 2026

This material is for information only and is not legal advice. UAE law changes — a lawyer will assess how it applies to your situation.