CB UAE Explained: What the Central Bank Actually Regulates

If you're banking, borrowing, or running a fintech in the Emirates, you'll bump into the CB UAE sooner than you think. The Central Bank of the UAE — CB UAE for short — sits behind every loan approval, AED transfer, and licence application in the country's financial system. Most clients only learn what it does after something goes wrong. Let's fix that.

Quick answer

The CB UAE (Central Bank of the United Arab Emirates) is the federal regulator for banks, finance companies, exchange houses, insurance firms, and payment service providers operating in onshore UAE. It issues licences, sets capital and liquidity rules, runs the dirham, hosts the Al Etihad Credit Bureau data flows, and enforces anti-money-laundering compliance. Established under Union Law No. 10 of 1980 and now governed by Decretal Federal Law No. 14 of 2018, it does not regulate DIFC or ADGM firms — those sit under the DFSA and FSRA respectively.

What the CB UAE actually does

Think of the CB UAE as wearing four hats at once.

First, monetary authority. It issues the dirham, manages the peg to the US dollar at AED 3.6725, and sets the base rate that tracks the US Federal Reserve. When the Fed moves, CB UAE moves the same week. Usually the same day.

Second, prudential regulator. Every commercial bank, finance company, and exchange house operating onshore needs a CB UAE licence. The bank's standards on capital adequacy, large exposures, and liquidity coverage map closely to Basel III, with local tweaks published through Circulars and Standards.

Third, conduct and consumer protection. The Consumer Protection Regulation (Circular No. 8 of 2020) and its accompanying Standards force banks to disclose fees properly, give cooling-off periods on credit products, and handle complaints within set timeframes. If your bank ignores you, the CB UAE's Sanadak ombudsman unit is where you escalate.

Fourth, financial integrity. AML/CFT supervision, sanctions enforcement, and the goAML reporting system all run through here.

A practical takeaway: if your dispute is with an onshore UAE bank, the regulator you want is CB UAE — not the Department of Economic Development, not the courts as a first stop.

Who CB UAE regulates (and who it doesn't)

This trips up foreign founders constantly.

CB UAE regulates onshore licensed financial institutions: the four big locals (Emirates NBD, FAB, ADCB, Mashreq), the foreign branches (HSBC, Standard Chartered, Citi), exchange houses on Al Maktoum Street and elsewhere, finance companies, and — since 2020 — Stored Value Facility and Retail Payment Services providers under the Retail Payment Services and Card Schemes Regulation.

It does not regulate:

• DIFC-based banks, advisors, or fintechs — those answer to the Dubai Financial Services Authority (DFSA)
• ADGM firms — those report to the Financial Services Regulatory Authority (FSRA)
• Securities and commodities markets onshore — that's the Securities and Commodities Authority (SCA)
• Insurance, technically — though the old Insurance Authority was merged into CB UAE in 2020, so insurance now sits under it as a separate sector

If you're licensed in DIFC and someone tells you to file with CB UAE, ask twice. Frankly, the two regimes barely speak the same language on capital rules.

Watch out: A finance company licensed onshore cannot simply passport into DIFC, and vice versa. Cross-border activity inside the UAE itself requires careful structuring. Most clients get this wrong on day one.

The licensing reality

Getting a CB UAE licence is not a weekend project.

For a new bank, you're looking at minimum paid-up capital of AED 300 million for a national bank, with much higher buffers expected in practice. Foreign branches need head-office endowment capital plus local board representation. Finance companies sit at AED 150 million. Exchange houses scale by activity, starting around AED 2 million for remittance-only operations.

Timelines? Plan on 12 to 24 months for a full bank licence, including the pre-application engagement, in-principle approval, build phase, and final authorisation. Payment services and SVF licences move faster — 6 to 9 months is realistic if your file is clean.

The application fee structure is published on the CB UAE website and updated periodically; check the live fee schedule before budgeting [1].

What examiners actually care about, in my experience: source of funds, fitness and propriety of UBOs, the operating model's AML controls, and IT resilience. Skimp on any of these and you'll get a Request For Information that eats six months.

CB UAE and your credit record

Every loan, credit card, and post-dated cheque you've ever had in the UAE flows into the Al Etihad Credit Bureau (AECB), which works hand-in-glove with CB UAE.

The CB UAE doesn't run AECB directly — AECB is a federal company under its own law (Federal Law No. 6 of 2010). But the supervisory pressure on banks to report accurately, and on customers to understand their score, comes from CB UAE Standards on responsible lending.

A few things worth knowing:

• Your debt burden ratio is capped at 50% of monthly income under the Mortgage Loan Regulation (Circular 31/2013) and the Retail Loans Regulation
• Personal loans cannot exceed 20 times your monthly salary, with a max tenor of 48 months
• Banks must check AECB before extending credit; if they don't, you have grounds to challenge

If a bank breaches these rules and you've signed anyway, the agreement isn't automatically void — but you have a real complaint to file. Sanadak first, courts second.

For more on disputes with banks, see our guide on filing a banking complaint in the UAE [internal link if available].

Sanctions, AML, and why CB UAE has teeth

Since 2019 the regulator has visibly sharpened its enforcement posture.

CB UAE publishes monetary fines regularly — AED 5.8 million here, AED 12 million there — for AML weaknesses, sanctions screening failures, and consumer protection breaches. The Standards on the AML/CFT obligations of licensed financial institutions, last updated in June 2021, set the playbook. Boards of directors are personally on the hook for ensuring compliance frameworks actually work, not just exist on paper.

If you're a compliance officer at a UAE bank, three documents live on your desk:

1. The AML/CFT Federal Decree-Law No. 20 of 2018 and its Cabinet Decision No. 10 of 2019
2. CB UAE's AML/CFT Guidance for LFIs
3. The Targeted Financial Sanctions guidance issued jointly with the Executive Office for Control & Non-Proliferation

Miss a TFS match by even one business day and you're explaining yourself in writing.

Key dates: CB UAE typically publishes its Annual Report in March-April covering the prior calendar year, and the Financial Stability Report in mid-year. Both are free on centralbank.ae and worth reading if you operate in this space.

How to actually deal with CB UAE

Three practical points.

Use the right channel. Consumer complaints go through Sanadak (sanadak.gov.ae). Licensing queries go through the relevant supervisory department — Banking Supervision, Insurance Supervision, or the Financial Activities Authorisation Division. Random emails to general inboxes get parked.

Document everything. If your bank closed your account without notice — which happens often, particularly to crypto-adjacent businesses — your complaint to CB UAE needs the closure letter, your written objection, the bank's response (or lack of one), and dates. No paper trail, no traction.

Know when to escalate to court. CB UAE is a regulator, not a debt collector or a contract enforcement body. If your dispute is fundamentally contractual — say, a disputed fee or a wrongful repossession — the Dubai Courts or the relevant onshore court is your venue, with the CB UAE complaint running in parallel as supervisory pressure.

A quick rhetorical question: if your bank gives you a runaround on an unauthorised AED transaction, would you rather wait six weeks for Sanadak or file in small claims and let the bank's lawyers explain why they didn't refund within the regulator's mandated timeframe? Sometimes both, in that order.

Bottom line on CB UAE

The CB UAE has shifted from a fairly quiet central bank in the 2010s to an active, opinionated regulator that fines, names, and structures the entire onshore financial sector. If you're a consumer, learn the complaint route. If you're a business, build the compliance function before you launch — retrofitting it after a supervisory visit is twice the cost and ten times the stress.

And remember the jurisdictional split. CB UAE is onshore. DIFC and ADGM are separate worlds with separate regulators. Mixing them up is the single most common mistake I see.

---

Sources

[1] Central Bank of the UAE — Licensing and Regulation, https://www.centralbank.ae/en/regulation/

[2] Decretal Federal Law No. 14 of 2018 Regarding the Central Bank & Organisation of Financial Institutions and Activities

[3] CB UAE Consumer Protection Regulation, Circular No. 8 of 2020 and Consumer Protection Standards 2021

[4] CB UAE AML/CFT Guidance for Licensed Financial Institutions, June 2021 (updated)

[5] Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism

[6] Retail Payment Services and Card Schemes Regulation, CB UAE 2021

[7] Federal Law No. 6 of 2010 Concerning Credit Information (AECB)

Need this checked for your situation? Talk to a UAE-licensed lawyer →