The UAE’s payments sector has grown well beyond traditional card processing. Digital wallets, merchant payment platforms, payment aggregators, cross-border transfer services and fintech applications are now part of a closely regulated financial ecosystem.
If your company intends to receive, process, route or facilitate payments in the UAE, getting a normal commercial licence may not be enough. Depending on the business model, you may need authorisation from the Central Bank of the UAE (CBUAE) before launching the service.
The important point is that there is no single licence called a “PSP licence” that covers every payment business. The required approval depends on exactly what the platform does, how money moves between parties and whether the company handles customer funds.
The CBUAE licensing framework covers regulated financial institutions and payment businesses, while the Retail Payment Services and Card Schemes Regulation provides the main framework for many conventional payment service providers.
What Is a Payment Service Provider License in the UAE?
A Payment Service Provider, or PSP, is generally a business that provides regulated services involved in making or receiving payments.
Under the CBUAE framework, retail payment activities include services such as:
Payment account issuance
Payment instrument issuance
Merchant acquiring
Payment aggregation
Domestic fund transfers
Cross-border fund transfers
Payment initiation
Payment account information services
The 2021 Retail Payment Services and Card Schemes Regulation states that a person cannot provide or promote regulated retail payment services in the UAE without prior CBUAE authorisation unless an exemption applies. Banks are treated differently under the regulation because they are already CBUAE-regulated institutions.
The regulatory perimeter became even more important after Federal Decree-Law No. 6 of 2025. The law expressly places retail payments, digital money, open finance, money transfers and certain virtual-asset payment activities within the Central Bank’s licensing framework. It also captures technology and infrastructure that facilitates regulated financial activities in relevant circumstances.
In a 30-minute call we map your situation against jurisdiction, activity and cost — no commitment required.
Which CBUAE PSP Licence Category Do You Need?
The Retail Payment Services Regulation uses four main licensing categories. Your category depends on the services your company intends to provide.
Category | Main activities | Initial capital under RPSCS |
Category I | Broadest combination of payment accounts, instruments, merchant acquiring, aggregation and domestic/cross-border transfers | AED 1.5m or AED 3m |
Category II | Payment accounts, instruments, acquiring, aggregation and domestic/cross-border transfers | AED 1m or AED 2m |
Category III | Payment accounts, instruments, acquiring, aggregation and domestic transfers | AED 500,000 or AED 1m |
Category IV | Payment initiation and payment account information services | AED 100,000 |
For Categories I to III, the lower or higher capital threshold generally depends on whether the average monthly value of payment transactions is below or at least AED 10 million. The Central Bank can also require higher capital depending on the applicant’s circumstances and risk profile.
What About Stablecoins and Payment Tokens?
Businesses dealing with payment tokens should not assume that the older Category I framework is sufficient.
The CBUAE Payment Token Services Regulation, effective from 31 August 2024, established separate categories for:
Dirham Payment Token Issuers
Payment Token Custodians and Transferors
Payment Token Conversion providers
These activities therefore need to be assessed separately from an ordinary payment gateway or merchant acquiring business.
Companies working with broader virtual assets should also distinguish CBUAE payment regulation from other UAE virtual-asset regimes. Nexture’s guide to a crypto business and VARA licensing in Dubai provides useful background on that distinction.
CBUAE Requirements for a Payment Service Provider
Obtaining a payment service provider license in the UAE involves much more than incorporating a company and submitting a form.
- Appropriate UAE Legal Entity
The applicant needs an acceptable legal structure that complies with the Central Bank law and applicable company legislation.
Businesses still at the incorporation stage can first understand the general process through this UAE business setup guide. The commercial structure must then be aligned specifically with CBUAE requirements before regulated activities begin.
Your constitutional documents must also accurately reflect the proposed activities. This makes the company's Memorandum of Association and corporate documents an important part of the setup.
Under the 2025 law, qualifying financial institutions other than banks can generally take forms such as a joint-stock company or limited liability company, subject to CBUAE rules.
- Minimum Capital
Applicants must demonstrate sufficient paid-up capital for the applicable licence category.
Capital is not simply an incorporation expense. The regulations require PSPs to maintain the prescribed capital position after licensing, and the Central Bank may impose additional capital requirements based on business volumes or risk.
- Fit-and-Proper Management
The CBUAE assesses the people controlling and managing the business.
This can include shareholders, directors, senior management and significant controllers. Under the retail payments rules, a person reaching specified control thresholds, including certain holdings of 20% or more, can require prior Central Bank approval.
The chief executive and alternate are generally expected to reside in the UAE, with the management structure having an appropriate presence in the country unless otherwise permitted by the CBUAE.
- Governance and Risk Controls
A PSP needs a governance structure proportionate to the complexity of its business.
Expect the regulatory application to demonstrate credible arrangements for:
Risk management
Compliance
Internal audit
Financial controls
Operational risk
Business continuity
Cybersecurity
Technology governance
Licensed PSPs are also subject to ongoing audit and control requirements after approval.
- AML and Customer Due Diligence
Payment companies can face significant money-laundering and financial-crime risks because they facilitate movement of funds.
Applicants therefore need policies covering customer due diligence, transaction monitoring, sanctions screening, suspicious transaction reporting, risk assessment and record-keeping.
These obligations sit within the UAE's broader AML and counter-terrorist financing legislation and CBUAE supervisory framework.
- Technology, Cybersecurity and Data Protection
A fintech business cannot treat technology security as an issue to address after licensing.
The CBUAE expects PSPs to maintain technology-risk and cybersecurity controls, independent assurance arrangements and tested business-continuity plans. Payment and personal data are also subject to specific protection, storage and retention requirements.
This is especially relevant for founders building new payment platforms. Our guide to technology startups in the UAE covers the broader startup environment surrounding such businesses.
How to Set Up a Payment Service Provider in the UAE
- Map Your Payment Flow
Start by documenting exactly how a transaction works.
Identify who pays, who receives the money, whether your company ever controls funds, where funds are held, whether settlement is domestic or international and how fees are collected.
This helps determine whether the model constitutes merchant acquiring, payment aggregation, fund transfer, payment initiation or another regulated activity.
- Determine the Regulatory Perimeter
Do not choose a licence based purely on labels such as “payment gateway” or “fintech platform.”
The actual functions determine the regulatory treatment. A software platform that technically facilitates regulated financial activity may still fall within the Central Bank perimeter under the 2025 law.
- Engage With the CBUAE
The RPS framework encourages applicants to engage with the Central Bank's Licensing Division before submitting a formal application.
Early regulatory discussions can clarify the licence category, permitted activities, capital expectations and documentation required for the proposed model.
- Incorporate and Structure the Company
Once the regulatory route is clear, establish the appropriate UAE entity and ensure its ownership, corporate documents and licensed activities match the proposed PSP business.
The commercial incorporation process and the CBUAE licensing process should be coordinated rather than treated as unrelated approvals.
- Prepare the Regulatory Application
A strong application should clearly demonstrate the applicant’s:
Business model and transaction flows
Ownership and controllers
Management structure
Financial projections and capital
AML framework
Risk-management procedures
Cybersecurity controls
Business-continuity arrangements
Outsourcing arrangements
Customer protection processes
If an external service provider performs a material function, outsourcing does not remove the PSP's regulatory responsibility. Certain outsourcing arrangements require prior CBUAE approval.
- Arrange Operational Banking
A regulated payments company will normally need a banking structure capable of supporting its operating and settlement arrangements.
- Complete the CBUAE Review
Federal Decree-Law No. 6 of 2025 provides for a licensing decision within up to 60 working days after the applicable licensing conditions and requirements have been satisfied. This should not be interpreted as a guaranteed 60-day end-to-end setup period because preparation, completeness checks and requests for additional information can occur before that point.
A business should not commence regulated payment services merely because it has obtained a commercial licence. The institution must be entered in the relevant CBUAE register before commencing the licensed financial activity.
Important CBUAE Changes to Consider in 2026
Payment regulation in the UAE is continuing to develop.
Federal Decree-Law No. 6 of 2025 took effect on 16 September 2025 and substantially broadened the regulated financial-activity framework. Existing or newly captured businesses should pay particular attention to the law's transitional provisions, which generally provide one year to reconcile their position unless the period is extended by the CBUAE.
Businesses providing payment initiation or financial-data services should also review the CBUAE Open Finance Regulation rather than relying solely on the original RPSCS categories.
These changes make regulatory classification one of the most important stages of launching a UAE payment business.
We’ll model the requirements and send back a single-page breakdown within 24 hours.
Common PSP Licensing Mistakes
Problems often begin before the formal application is submitted. Common mistakes include choosing a commercial activity before mapping the payment flow, applying under the wrong CBUAE category, underestimating capital needs, submitting generic AML or cybersecurity policies and assuming outsourced processors carry the regulatory responsibility.
Another mistake is budgeting around the statutory 60-working-day decision period while ignoring the preparation and regulatory-review work needed before an application reaches that stage.
A well-structured application should make it easy for the regulator to understand exactly how money and data move through the business.
Conclusion
Obtaining a Payment Service Provider license in the UAE requires the right combination of corporate structuring, CBUAE authorisation, capital, governance, AML controls and technology safeguards.
The first question should not be “How quickly can we get a payment licence?” It should be “Which regulated activities does our business model actually perform?”
Once the payment flow and regulatory perimeter are clear, the company can select the correct licensing route, prepare its controls and approach the CBUAE with a structure designed around the actual service it intends to provide.
Frequently Asked Questions
Who regulates payment service providers in the UAE?
The Central Bank of the UAE regulates retail payment services within its jurisdiction, including merchant acquiring, payment aggregation and various fund-transfer services.
How much capital is required for a UAE PSP licence?
Under the RPSCS framework, initial capital can range from AED 100,000 for the original Category IV framework to AED 3 million for certain higher-volume Category I businesses. Other frameworks, including Open Finance and Payment Token Services, have separate capital requirements.
Is a payment gateway automatically required to obtain a CBUAE licence?
Not solely because it calls itself a payment gateway. Licensing depends on what the company actually does, including whether it acquires merchants, aggregates payments, transfers funds or otherwise facilitates regulated financial activities.
How long does a CBUAE PSP licence take?
The current law provides up to 60 working days for the licensing decision after the relevant conditions and requirements have been satisfied. Total setup time may be longer because incorporation, application preparation and regulatory queries occur separately.
Is a CBUAE PSP licence the same as a crypto or VARA licence?
No. CBUAE payment regulation and virtual-asset licensing are separate regulatory frameworks. Payment-token activities themselves are now governed by the CBUAE Payment Token Services Regulation, so the required approvals depend on the specific product and activity.
