Client Alert | November 13, 2025
This update summarises the most significant reforms introduced by the New CBUAE Law and the implications for financial institutions operating in the UAE.
On 15 September 2025, the Federal-Decree Law No. 6 of 2025 Regarding the Central Bank Regulation of Financial Institutions and Activities and Insurance Business (the New CBUAE Law) was issued in the Official Gazette and became legally effective as of 16 September 2025 (Art.188). The New CBUAE Law repeals and replaces both Federal Decree Law No. 14 of 2018 (the “2018 Law”), which previously governed the Central Bank of the United Arab Emirates (CBUAE) and onshore financial institutions, and Federal Decree Law No. 48 of 2023, which regulated insurance activities.
The New CBUAE Law represents a significant overhaul of the financial regulatory framework of the United Arab Emirates (UAE). It consolidates the regulation of banks, payment service providers, and insurers under a single legislative umbrella, introduces new licensing requirements for emerging-technology providers, and imposes enhanced penalty and enforcement provisions.
We have summarised below the most significant reforms introduced by the New CBUAE Law and the implications for financial institutions operating in the UAE.
Criminal Sanctions Introduced for Unlicensed Financial Activities
Under the 2018 Law, the prohibition on carrying out financial activities without a license lacked corresponding sanctions. While the previous law established that no person could engage in regulated financial activities without a license from the CBUAE, it did not specify criminal penalties for breaches. The New CBUAE Law addresses this and the approach is now consistent with what we see in other jurisdictions, where engaging in regulated financial activities without authorisation constitutes a criminal offence.
Article 60 reaffirms the general prohibition on conducting any regulated activities without an appropriate license. It provides that only persons or entities duly licensed in accordance with the Law, together with its implementing regulations and decisions, may engage in or offer such activities within the State.
The key development lies in Article 170, which now expressly criminalises the conduct of carrying out unlicensed financial activities. Article 168 provides that, without prejudice to other penalties or measures, the CBUAE may impose administrative penalties and fines where a person is engaged in any of the activities specified in the law without a license.
Article 170 introduces a new criminal penalty for such conduct. Persons that engage in a licensed financial activity without a license may face imprisonment and/or a fine between AED 50,000 and AED 500 million, representing a significant increase over the penalties available under the 2018 Law. This is a notable development, and we may see increased enforcement in light of this new framework. Importantly, this change reflects the UAE’s commitment to strengthening the deterrent framework for unlicensed financial activities.
The prohibition on engaging in financial activities without a license applies to those entities operating outside the UAE and to those operating in the financial free zones such as the Dubai International Finance Centre and Abu Dhabi Global Market. Accordingly, any firm targeting UAE retail customers — even if licensed by a financial free zone regulator— may be subject to criminal sanctions under the Federal framework. Pursuant to Article 4 of Federal Decree Law No. 8 of 2004 such financial free zones remain subject to all federal laws (with the exception of federal civil and commercial laws) and the New CBUAE Law shall take precedence in the event of any conflict.
Express Prohibition on Unlicensed Communications Extends CBUAE’s Regulatory Perimeter
The New CBUAE Law also introduces some entirely new provisions, one of which is an express prohibition on conducting, or communicating in relation to, licensed financial activities without proper authorisation. This is a significant development that materially broadens the CBUAE’s regulatory perimeter to include promotional and marketing communications directed at UAE residents.
By virtue of Article 61(1)(h), advertising, marketing or promoting a licensable financial activity is expressly defined as a licensed financial activity in its own right. Accordingly, any person engaging in such activities must hold an appropriate license from the CBUAE. Article 60(3) reinforces this principle by stipulating that licensed financial activities and products may only be offered or conducted from within the UAE in compliance with the provisions of the Law and its implementing regulations.
The New CBUAE Law defines “communication” broadly, encompassing any form of communication or invitation, including by telephone, fax, email, internet or mobile phone, as well as invitations to enter into or conclude transactions relating to licensed activities.
Given this expansive definition, the New CBUAE Law captures not only conduct taking place within the UAE, but also communications made from abroad to persons in the UAE. As a result, unlicensed foreign firms that market or promote financial products or services to UAE residents, whether through online platforms or other digital means, now fall within the regulatory perimeter and risk breaching the New CBUAE Law’s prohibitions. Firms operating outside the UAE should therefore assess whether their remote or online communications could constitute the carrying on of a licensed activity into the State and whether local licensing or authorisation is required.
Regulatory Perimeter Extended to Virtual Assets and Facilitation of Decentralised Platforms
Another entirely new provision is Article 62, which expands the CBUAE’s regulatory perimeter to capture activities conducted through emerging technologies, including virtual assets and decentralised finance (DeFi) models.
Article 62 extends the scope of the licensing framework by providing that, subject to existing licensed activities, any person who engages in, offers, issues, or facilitates a licensed financial activity – by any means or through any medium – is subject to the licensing, regulatory, and supervisory authority of the CBUAE.
Importantly, this goes beyond simply prohibiting the carrying out of regulated activities without a license; it now expressly captures the facilitation of such activities, either directly or indirectly. This means that entities providing technological infrastructure, platforms, protocols, or digital tools that enable or support the delivery of financial services may themselves fall within the regulatory perimeter, even if they do not directly offer the underlying financial products or services.
By explicitly capturing facilitation, the New CBUAE Law ensures that firms cannot avoid regulatory oversight by characterising themselves solely as technology providers. Going forward, technology companies, payment processors, and DeFi operators will need to evaluate whether their business models could be deemed to facilitate licensed activities and therefore trigger a licensing requirement under the new framework.
Expanded Obligations for Licensed Financial Institutions (LFIs)
The New CBUAE Law also sets out an integrated framework of prudential, conduct, and consumer protection obligations for all LFIs.
Under Articles 114 and 130, LFIs must comply with all regulations, standards, and circulars issued by the CBUAE, including those governing capital adequacy, liquidity, governance, risk management, and related-party exposures. The CBUAE has authority to issue detailed governance and fit-and-proper rules for board members and senior management, strengthening accountability and oversight across the sector. The New CBUAE Law makes clear that the CBUAE may take all necessary measures and procedures and use all means necessary to ensure the proper functioning of LFIs.
On the conduct side, Articles 148 through 152 introduce a dedicated consumer protection regime, requiring LFIs to handle customer complaints through independent channels, maintain transparent product disclosures, implement anti-fraud measures, and promote financial literacy and inclusion.
Articles 183 and 184 confirm that during the transitional period, existing prudential and conduct regulations issued under the repealed 2018 Law continue to apply until replaced, ensuring regulatory continuity while the CBUAE phases in new standards under the updated framework (please refer to “Transitional Provisions and Legal Continuity” below).
Enhanced Resolution and Recovery Framework
Articles 142 through 146 of the New CBUAE Law introduce a comprehensive resolution and recovery regime for LFIs and insurers, positioning the UAE in line with leading international standards on financial stability and systemic risk mitigation. Under these provisions, the CBUAE is empowered to intervene early in cases of financial distress, impose corrective measures, and, where necessary, initiate resolution proceedings through a newly established Settlement and Resolution Authority. The framework provides the CBUAE with extensive tools, ranging from management replacement and capital restructuring to the transfer or sale of assets and liabilities, in order to ensure the orderly continuity of critical functions and protect depositors and policyholders. Article 144 codifies a clear creditor priority and loss allocation system whilst Articles 145 to 146 establish transparency obligations and oversight until full wind down. Any resolution, dissolution, or liquidation decision requires public notification through official channels, including publication in the Official Gazette and local newspapers, with a minimum three-month notice period to allow customers and creditors to safeguard their interests. The provisions also mandate the appointment and disclosure of the designated resolution or liquidation administrator, who is responsible for implementing the resolution plan and coordinating with affected stakeholders. The CBUAE retains supervisory authority over institutions throughout the resolution and liquidation process.
Collectively, these reforms mark a major step toward a risk based, internationally aligned resolution framework that underpins confidence in the UAE’s financial system.
Enforcement and Settlement
The New CBUAE Law introduces, for the first time, a negotiated settlement mechanism within the CBUAE’s enforcement framework. Under Article 168(6), the CBUAE may, at its discretion, enter into settlements with regulated entities or individuals in respect of administrative penalties and fines, in accordance with procedures and regulations to be issued in due course. We expect that the implementing regulations (once issued) will set out the criteria, documentation, and approval process for such settlements.
This provision creates a formal legal basis for the CBUAE to resolve supervisory breaches through proportionate, risk-based settlements, rather than solely through the imposition of fixed penalties. The new approach aligns the UAE’s enforcement framework with international best practice, allowing the regulator to recognise cooperation, remedial action, and the scale of impact when determining outcomes, while still preserving regulatory deterrence.
Transitional Provisions and Legal Continuity
Articles 183 to 185 of the New CBUAE Law establish a clear framework to ensure regulatory continuity and an orderly transition from the repealed legislation. All regulations, circulars, guidelines and decisions issued under the previous frameworks shall remain in full force and effect until expressly replaced by new instruments issued under the New CBUAE Law, with existing definitions and technical terms retaining their meaning during the interim period. Regulated institutions must regularise their position within one year from the Law’s effective date to align with the new requirements (although note that this one year period is extendable at the CBUAE’s discretion). At the same time, any provisions under the old framework that are inconsistent with the New CBUAE Law are repealed.
Collectively, these articles safeguard legal certainty and market stability while the CBUAE implements the new regulatory framework and issues updated prudential and conduct regulations.
Conclusion
Entities captured under the New CBUAE Law have one year from 16 September 2025 to bring their operations into compliance, and this one year may be extended as CBUAE deems appropriate. The new framework marks a significant shift in the UAE’s regulatory landscape, underscoring that the CBUAE and UAE authorities are taking enforcement and supervision seriously across all segments of the financial sector, ranging from unlicensed financial activities to emerging technologies.
If you have any concerns about how the New CBUAE Law may affect your business, please contact your regular Gibson Dunn advisor or any member of our UAE team.
Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. If you wish to discuss any of the matters set out above, please contact any member of Gibson Dunn’s Financial Regulatory team, including the following members in Dubai:
Sameera Kimatrai (+971 4 318 4616, skimatrai@gibsondunn.com)
Aliya Padhani (+971 4 318 4625, apadhani@gibsondunn.com)
© 2025 Gibson, Dunn & Crutcher LLP. All rights reserved. For contact and other information, please visit us at www.gibsondunn.com.
Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.