- One Open Finance Licence covers two options, Data Sharing and Service Initiation, and the applicant picks one or both.
- The licence permits nothing else. No advice, no arranging transactions, and no holding customer funds in any form.
- Every CBUAE licensee carries obligations as a data holder, whether or not it wants to provide open finance services.
- DIFC and ADGM permissions sit outside this framework and do not give access to the mainland API hub.
What the Open Finance Regulation requires
The Central Bank mandated open finance through Circular 7 of 2023. Circular 3 of 2025 updated it and came into force on 10 July 2025. The Open Finance Regulation sets up a framework built from three parts: a Trust Framework, an API Hub, and Common Infrastructural Services. Participation is mandatory for all licensees in respect of the products and services within scope. Our corporate lawyers in Dubai map a firm's activities against the licence categories before it applies.
The regulation splits the market into two roles. Licensees act as data holders and service owners. They must give framework participants access to customer data, and the ability to initiate transactions on customer accounts. Participants act as data recipients and service initiators. Every access event depends on the express consent of the user, appropriate authentication, and secure communication.
Named entities run the infrastructure. Nebras operates the platform components, and Al Tareq provides the consent and authentication layer that customers see. A licensed provider connects once to the hub rather than negotiating bilateral access with each bank.
One licence, two options
No juridical person may provide an open finance service in the UAE without an Open Finance Licence from the Central Bank. The exception is a firm that falls into the category of persons deemed licensed. The licensing provisions create a single licence with two selectable options.
An applicant has to satisfy requirements on legal form, minimum capital and fit and proper standards at the time it applies. Decide the option set before filing. A firm that starts with data sharing and adds payment initiation six months later goes back through approval rather than filing a variation.
What the licence does not allow
This is where founders lose time and money. An Open Finance Licence does not permit the holder to carry on any other category of licensed activity. It does not entitle the holder to give advice in any form. It does not allow the holder to arrange or mediate transactions in licensed activities. It does not allow the holder to hold customer funds in any form.
A product plan that reads "aggregate the customer's accounts, recommend a loan, and move the money" therefore needs three permissions rather than one. The lending and advisory limbs sit outside the open finance perimeter, and holding funds points to a stored value or payment services licence. Our guide to CBUAE payment service provider licensing covers the adjacent regime, and our fintech licensing guide covers jurisdiction choice.
Obligations that fall on banks and insurers first
A licensed institution with no interest in open finance products still carries duties under the regulation. It has to establish and maintain a dedicated interface giving access to account and product information through the API hub. That is an engineering programme, a consent programme and a change to customer terms.
The Central Bank onboards mandated licensees in phases. The first phase covers all banks, including branches of foreign banks, and insurance companies, covering both national companies and foreign branches. The Central Bank announces later phases through its official channels. Exchange houses, finance companies and stored value providers should track those announcements rather than assume a distant date.
Data protection adds a second layer. Consent, authentication and secure communication are conditions of every access event. The wider transfer rules apply in parallel. Our note on UAE data protection and cross-border transfers covers that layer.
DIFC and ADGM firms are outside this framework
The DFSA and the FSRA run their own regimes for firms doing data aggregation and payment initiation. Those regimes are separate from the Central Bank framework, and a permission from either regulator does not admit a firm to the mainland API hub.
That matters because a large share of UAE fintech incorporates in the DIFC or the ADGM by default. A firm whose product depends on data held by mainland banks needs to look at the Central Bank perimeter, whatever its free zone licence says. Our comparison of the DIFC and ADGM regulatory sandboxes sets out the free zone routes.
Why 16 September 2026 matters
Federal Decree-Law No. 6 of 2025 replaced the 2018 Central Bank law with effect from 16 September 2025. It also named open finance services as a licensed financial activity in their own right. Firms that fell inside the widened perimeter received one year from that date to obtain the licences they need. The Central Bank rulebook carries the text.
The penalties give the deadline weight. Carrying on or promoting a licensed financial activity without authorisation attracts a minimum administrative fine of AED 1 million. Criminal fines for unlicensed activity run from AED 50,000 to AED 500 million. Two groups should resolve their position now. Firms that have been aggregating bank data on a bilateral basis, and firms treating their activity as a technical integration layer rather than a regulated service.
What to do before the transition period closes
- Map each product feature against the two licence options and against the activities the licence excludes.
- Identify which additional licences the model needs for lending, advice or holding funds.
- Confirm whether the entity is a mandated licensee, a person deemed licensed, or an applicant.
- If already licensed by the Central Bank, scope the dedicated interface build and the consent flows.
- If licensed in the DIFC or the ADGM, test whether the product depends on mainland data.
- Prepare the capital and fit and proper evidence before filing rather than during review.
The Central Bank continues to announce onboarding phases and infrastructure releases through its official channels. The later phases affecting non-bank licensees have not all been fixed. Firms should check the current phase position before planning a launch date. Legal advice may be required to assess which licences a particular open finance model requires.
يبدأ نجاحك بالإرشادات الصحيحة.
سواء كان الأمر يتعلق بالعمل أو شخصيًا، يقدم فريقنا البصيرة والإرشادات التي تحتاجها للنجاح.
