The federal government of the United Arab Emirates (UAE) formally issued Federal Decree‑Law No. 6 of 2025 (the “New CBUAE Law”), marking a landmark overhaul of the country’s financial-institutions and insurance regulation in recent years. This new law repeals and replaces the earlier Federal Decree‑Law No. 14 of 2018 (the “2018 Law”), as well as the Federal Decree‑Law No. 48 of 2023 on insurance activity.
The UAE’s financial sector has evolved rapidly with increasing digital-payments activity, growth of virtual assets and new models of enabling technologies. Against this landscape, regulators deemed the earlier 2018 Law as obsolete and no longer fully aligned with current realities. The New CBUAE Law hence seeks to deliver a more integrated, future-facing regulatory framework.
By consolidating oversight of banks, payment-service providers and insurers under one umbrella, the law signals the UAE’s intention to strengthen regulatory coherence, enhance consumer protection, bolster financial-stability oversight, and widen the regulatory net to capture technology-enabled providers of financial services.
Key Changes and Provisions
Expanded Regulatory Perimeter
The new law broadens “Licensed Financial Activities” to include open finance, virtual asset payments, and insurance services. Any entity offering or facilitating these activities, including fintech platforms and tech providers, must now be licensed by the CBUAE.
Integration of the Insurance Sector
Insurance, reinsurance, and related professions are now fully governed under the same framework as banking and payments. This ensures uniform standards for licensing, supervision, and consumer protection.
Fraud Prevention and Digital Security
Licensed institutions must implement strong fraud-detection and cybersecurity systems. The CBUAE can set security standards, mandate breach reporting, and enforce data-sharing on suspicious activities.
Enhanced Enforcement and Penalties
Administrative fines increase from AED 200 million to AED 1 billion. Individual fines rise to AED 5 million, and operating without a licence can attract imprisonment or fines up to AED 500 million.
Transition Period
All entities have one year (until 16 September 2026) to comply with the new licensing and operational requirements. Existing regulations remain valid until replaced by new ones issued under this law.
Comparison with the 2018 Law
Broader Scope: The new law expands regulation to include fintechs, platforms, and enabling technologies, not just traditional financial institutions.
Unified Regulation: Integrates banking, payments, and insurance under one comprehensive framework.
Stronger Penalties: Raises fine limits significantly and adds stricter enforcement measures.
Digital & Fraud Controls: Introduces mandatory cybersecurity and fraud-prevention systems absent in the 2018 Law.
Structured Transition: Provides a one-year compliance period for institutions to adapt, ensuring smoother implementation.
The enactment of Federal Decree-Law No. 6 of 2025 marks a crucial step in the UAE’s regulatory evolution. By consolidating the banking, payments and insurance regulation frameworks, expanding the regulatory perimeter to cover enabling technologies and platform-providers, strengthening fraud-prevention obligations and raising sanctions, the New CBUAE Law sets a strong tone for the supervision of financial-activities in the UAE.
Financial institutions, fintechs, insurers and enabling-technology providers must recognise that the regulatory scenario has shifted not just incrementally but structurally. The one‐year transitional window offers time to adapt, but the speed and breadth of change suggest the time to act is now.
Going forward, market-participants should prioritise:
- a review of business models and service-chains to identify licensing-exposure under the new law,
- enhancement of risk, compliance and governance frameworks (especially around fraud, cyber-security and digital-asset payments),
- alignment of insurance-related operations with the consolidated framework, and
- proactive engagement with the regulator to understand the implementing regulations that will follow the law.
With the UAE positioning itself as a regional fintech and digital-finance hub, the New CBUAE Law arguably puts forth both a regulatory challenge and an enabler. A challenge in terms of compliance burden and oversight, but an enabler in terms of clarity, innovation-friendly regulation and market opportunity under a modernised regime.
