UAE Insurance Law and Compliance Guide For Insurers in 2026

An insurer that received its CBUAE licence before 16 September 2025 has four months left, as of May 2026, to align its operations with Federal Decree-Law No. 6 of 2025. The deadline falls on 16 September 2026. After that date, capital structures, governance models, fraud prevention controls, claims handling SLAs, and outsourcing arrangements built around the old Insurance Law no longer carry over by default. Administrative fines under the new framework can reach AED 1 billion. Unlicensed insurance activity moved into the criminal sphere under Article 170 of the new law.

The reconciliation period applies to every CBUAE-licensed insurer, reinsurer, broker, agent, third-party administrator, loss adjuster, actuary, and takaful operator that holds an onshore licence. It does not extend to insurers established in DIFC or ADGM, which sit under separate financial free zone regimes. For financial services lawyers in the UAE, the central question across this period is whether each subsidiary regulation, internal policy, contract template, and governance file matches what the consolidated Central Bank Law now requires. Existing licences themselves remain valid through Article 183 of the new law. The work sits below the licence layer.

What changed when Federal Decree-Law 6 of 2025 replaced the Insurance Law

Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025, the day after publication in the Official Gazette. It expressly repealed both Federal Decree-Law No. 14 of 2018 (the old Central Bank Law) and Federal Decree-Law No. 48 of 2023 (the 2023 Insurance Law). Insurance regulation no longer sits in a standalone statute. It sits inside the consolidated CBUAE framework alongside banking, payment services, and open finance.

Article 184 sets the one-year reconciliation period. The CBUAE Board may extend it. As things stand, the period closes on 16 September 2026. Article 183 carries forward all regulations, standards, circulars, and guidance issued under both repealed laws until the CBUAE replaces them. In practice, this means the Insurance Brokers' Regulation 2024, the Code of Conduct for insurance companies, the financial directives for actuarial reporting, and the prudential rules on capital adequacy continue to apply. The CBUAE will replace them piece by piece as it issues implementing instruments under FDL 6/2025.

Three structural changes matter most for in-house counsel and compliance officers at UAE insurers.

First, the regulatory perimeter widened. Article 61 enumerates licensed financial activities to include insurance, reinsurance, takaful, re-takaful, and insurance-related professions. Article 62 captures any person who carries out, offers, or facilitates a licensed financial activity by any medium or technology. Insurtech platforms, decentralised distribution applications, and infrastructure providers that previously sat in a regulatory grey zone now fall inside CBUAE jurisdiction.

Second, the penalty ceiling rose from AED 200 million under the old Central Bank Law to AED 1 billion. Article 170 introduces criminal liability for unlicensed financial activity. The CBUAE can publish enforcement decisions, including the names of individuals and institutions, which adds reputational consequence on top of financial penalty.

Third, the CBUAE now holds formal resolution authority for distressed insurers. Article 142 sets early-intervention triggers. Article 143 lets the CBUAE replace senior management, suspend payment obligations, transfer insurance portfolios, establish asset management vehicles for run-off books, and impose moratoria. Article 144 sets a creditor hierarchy that places insureds and beneficiaries above unsecured creditors. For a distressed insurer's board, the practical effect is that the CBUAE can take control of operations on a much faster timetable than under the old law.

We covered enforcement trends since FDL 6/2025 in detail in Insurance Compliance Failures in the UAE: Enforcement Trends and Regulatory Shifts After Federal Decree-Law No. 6 of 2025.

Who needs a CBUAE licence to write insurance business

Article 60 of FDL 6/2025 prohibits any person from carrying out a licensed financial activity, or offering one, without CBUAE authorisation. Article 170 makes the breach a criminal offence in addition to the administrative penalty. For insurance, the licensable categories are:

• Direct insurers (mainland insurers writing primary insurance)
• Reinsurers
• Insurance brokers, governed by the Insurance Brokers' Regulation 2024, in force since 15 February 2025
• Insurance agents
• Third-party administrators handling claims or premium collection on behalf of insurers
• Loss adjusters and surveyors engaged on UAE risks
• Actuaries acting for licensed insurers
• Takaful and re-takaful operators

Article 41(4) of the old Insurance Law, preserved through Article 183 of FDL 6/2025, declares insurance policies issued by unlicensed entities null and void. An injured third party retains a statutory right to compensation despite the policy's nullity. The practical effect for a UAE company that buys cover from an unlicensed offshore insurer is twofold. The policy itself does not bind in UAE courts, but the third-party claimant against the company can still pursue compensation, and the company has no recoverable cover.

For foreign insurers that want to write UAE risks, Chapter 11 of the old Insurance Law (preserved under Article 183) sets the framework for branches and representative offices. A branch requires a CBUAE licence, minimum capital, a UAE-resident authorised manager, and a cash deposit lodged with a UAE bank. A representative office cannot underwrite or accept premium and is limited to liaison activity.

The broader CBUAE financial-services framework, which now governs both banking and insurance, is covered in Banking and Financial Services Law in the UAE.

Where to set up an insurance business in the UAE

Article 2 of FDL 6/2025 carves out financial free zones from the CBUAE's perimeter. An insurer established in the Dubai International Financial Centre is regulated by the Dubai Financial Services Authority. An insurer established in the Abu Dhabi Global Market is regulated by the Financial Services Regulatory Authority. The federal Insurance Law does not apply to them.

The choice between mainland CBUAE, DIFC, and ADGM is a structural decision that locks in the corporate form, the governing law of the licence, the dispute regime for coverage and claims, and the rules on policyholder protection. Switching regimes after launch is operationally expensive and often requires re-papering policy stock.

A mainland CBUAE-licensed insurer must be a UAE public joint stock company. It can write all classes of insurance for UAE risks and is subject to Sanadak and the IDSRC for consumer disputes. A DIFC-licensed insurer can take any corporate form recognised by DIFC company law, applies English-law principles to insurance contracts by default, and is subject to DIFC Courts for disputes. An ADGM-licensed insurer operates under English common law as directly applied in ADGM, uses FSRA rules modelled on the UK PRA framework, and is subject to ADGM Courts.

The trade-offs that drive the decision in practice:

• Distribution model. A mainland licence allows writing direct retail UAE business through CBUAE-licensed brokers and agents. DIFC and ADGM insurers can write retail UAE risks only through specific arrangements and are oriented more towards corporate, reinsurance, and captive business.
• Capital and governance. CBUAE sets minimum paid-up capital and solvency margin requirements that differ from DFSA and FSRA prudential frameworks. Captive insurers tend to find DIFC or ADGM more workable.
• Dispute regime. CBUAE-licensed insurers route policyholder disputes through Sanadak before any court action. DIFC and ADGM insurers route disputes to the respective common-law courts of those zones.
• Reinsurance flexibility. Both free zones offer easier handling of cross-border reinsurance flows and recognise English-law reinsurance market practice directly.

A side-by-side comparison appears at the end of this guide.

Licensing requirements for onshore insurers

A new mainland insurer applying to the CBUAE must, at minimum:

• Incorporate as a UAE public joint stock company
• Meet the minimum paid-up capital fixed by CBUAE Board resolution (the current minimum is AED 100 million for direct insurers and AED 250 million for reinsurers)
• Lodge a cash deposit with a bank operating in the UAE, made out to the order of the Governor
• Submit a business plan covering three years of projected premiums, claims experience, reinsurance strategy, investment policy, and governance arrangements
• Appoint directors and senior managers who satisfy fit and proper standards under CBUAE Regulation
• Engage a CBUAE-approved actuary
• Implement governance, risk, and internal control frameworks meeting the CBUAE Corporate Governance Standards

The fit and proper test for directors and authorised individuals covers integrity, financial soundness, competence, and capability. CBUAE objections to specific appointments are common in practice. A foreign group setting up a UAE subsidiary should expect the licensing process to take 12 to 18 months from initial application to operational launch.

For branches of foreign insurers, Chapter 11 of the old Insurance Law preserved through Article 183 imposes additional conditions: a minimum operating history in the home jurisdiction, evidence of regulatory good standing from the home regulator, appointment of a UAE-resident authorised manager, and submission of audited financial statements of the head office.

Ongoing compliance obligations for licensed insurers

Once licensed, an insurer carries continuous compliance obligations under multiple subsidiary regulations preserved by Article 183 and the new direct obligations under FDL 6/2025.

Solvency, capital, and actuarial reporting

Insurers must hold a solvency margin calculated under CBUAE financial regulations. The actuary must conduct a technical provisions valuation at least annually and submit an actuarial report covering reserves, premium adequacy, and reinsurance arrangements. The CBUAE can require an interim actuarial assessment at any point if it has concerns about an insurer's financial position.

Investment rules

Insurers must hold assets covering technical provisions within prescribed asset categories and concentration limits. The Investment Regulation for insurers preserved under Article 183 sets out permitted asset classes, single-issuer limits, and required UAE-currency holdings against UAE-currency liabilities.

Outsourcing

The CBUAE Outsourcing Regulation requires insurers to notify or seek approval before outsourcing material functions. Claims handling, IT infrastructure, actuarial services, and underwriting authority delegation all fall within scope. The insurer retains regulatory responsibility for outsourced functions and must build oversight, audit rights, and termination triggers into the outsourcing contract.

Conduct of business

The Code of Conduct and Ethics for insurance companies and insurance-related professions, originally issued by the Insurance Authority in 2010 and preserved through Article 183, sets standards on policyholder disclosure, advertising, premium collection, claims handling timelines, and complaint handling. Claims must be acknowledged within stipulated periods, and decisions on coverage communicated within defined SLAs.

Fraud prevention

FDL 6/2025 introduces an explicit obligation, absent from the old laws, requiring insurers to implement fraud prevention and detection controls covering social engineering, identity theft, and other fraudulent activities. The obligation sits within the broader consumer protection framework of the new law. Internal fraud units, transaction monitoring, and incident response playbooks now sit inside the formal compliance perimeter.

AML and CFT

Insurers are designated financial institutions for AML purposes and must comply with Federal Decree-Law No. 20 of 2018 on AML and CFT, Cabinet Decision No. 10 of 2019, and the CBUAE's specific AML guidance for the insurance sector. Sectoral risk assessment covers life policies, savings products, and high-value general insurance. We covered the broader framework in UAE Tightens Anti-Money Laundering Rules for Financial Companies.

Sanctions

UAE insurers implement targeted financial sanctions in line with UN Security Council resolutions and the local terrorist list maintained by the Executive Office for Control & Non-Proliferation. Insurance policies issued in breach of sanctions are unenforceable and expose the insurer to administrative and criminal penalty. Sanctions screening must run at quotation, binding, claim notification, and payment stages. See Asset Freezing in the UAE on the broader enforcement regime.

Data protection

Insurers process large volumes of personal data, including special-category data on health and financial circumstances. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its executive regulations apply onshore. DIFC and ADGM insurers fall under DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 respectively. For groups operating across borders, the transfer rules require careful structuring; see Cross-Border Data Transfers Under UAE Law In 2026.

How insurance disputes work through Sanadak and the IDSRC

Onshore insurance disputes follow a mandatory pre-litigation route established by Sanadak, the UAE's first financial and insurance ombudsman, in operation since March 2024. The route applies to all CBUAE-licensed insurers. It does not apply to insurers in DIFC or ADGM, whose disputes go directly to the respective free zone courts.

The procedural sequence:

1. Internal complaint to the insurer. The complainant raises the matter with the insurer first. The insurer has 30 calendar days to respond.
2. Complaint to Sanadak. If unresolved, the complainant files with Sanadak online. Sanadak conducts a free, time-bound review and may interview parties, request documents, and propose a resolution. Sanadak completes its review or escalates within five business days.
3. Escalation to the IDSRC. The Insurance Disputes Settlement and Resolution Committee, a judge-led adjudicative body, hears matters escalated from Sanadak. Proceedings are in Arabic. The fee is 4% of the claim value (minimum AED 100, maximum AED 30,000), or AED 3,000 for unvalued claims. The IDSRC can appoint independent experts.
4. Appeal to the Court of Appeal. IDSRC decisions are appealable directly to the Court of Appeal, bypassing the Court of First Instance, within 30 business days. The IDSRC decision is final and enforceable unless appealed.
5. Cassation. Further appeal to the Court of Cassation is available from the Court of Appeal under standard cassation rules.

Two procedural points matter for insurers. First, decisions involving claims of AED 50,000 or less cannot be appealed by the insurer. The insured retains the right of appeal. The asymmetry pushes insurers toward early settlement at the Sanadak stage for low-value matters. Second, Sanadak cannot accept a complaint that concerns risk management, internal pricing, or AML/CFT decisions of the insurer, but it can refuse jurisdiction where the matter is already before a court or has been settled.

Insurers should ensure that internal complaints handling, document retention, and claims-decision rationale meet Sanadak's documentary expectations. The IDSRC takes a structured view of the file. Weak documentation of coverage analysis routinely leads to adverse findings, and an insurer that cannot show its underwriting and claims rationale on paper tends to lose at first instance.

Subrogation rights of UAE insurers

The UAE Civil Code provides statutory subrogation for insurers. When an insurer pays a claim under a policy, it acquires the rights of the insured against any third party responsible for the loss, to the extent of the indemnity paid. The subrogation operates automatically by statute. The insurer can also rely on a contractual subrogation clause in the policy to strengthen evidence and confirm scope.

The recoverable amount is capped at what the insurer paid. The insured retains the right to recover any uninsured portion of the loss from the same third party in its own name.

Limitation rules require careful management. The insurer takes on the same time bars that bound the insured. For tort claims against third parties, the general three-year limitation period runs from the date the injured party became aware of the harm and the person responsible. For carriage of goods by sea, the UAE Maritime Commercial Code imposes a one-year limitation period. For carriage by road or air, separate shorter limitation periods apply under the relevant transport conventions and federal laws. An insurer that misses the applicable period loses the recovery entirely.

Subrogation against carriers, contractors, warehousemen, and other service providers is a recurring file flow for most UAE insurers. Marine cargo recoveries follow the framework discussed in Cargo Claims in the UAE, where the carrier's package and weight liability limits under the Hague-Visby framework cap the recoverable amount. Warehouse and logistics operator recoveries follow the framework set out in Warehouse Liability For Damaged Or Lost Goods In The UAE. Construction defect recoveries against contractors and sub-contractors run alongside the developer's claim and require coordination on quantum and limitation.

A subrogation file should be opened at the moment of claim settlement, not weeks later. The insurer's right of subrogation depends on the insured's cooperation and on preservation of evidence. Delays often lead to the insured releasing the third party in correspondence, destroying documentation, or losing key witnesses before the insurer takes operational control of the recovery.

Line-of-business legal issues

Motor insurance

Motor third-party liability cover is compulsory under the UAE Traffic Law (Federal Decree-Law No. 14 of 2017 and its executive regulations) for every registered vehicle. The Unified Motor Insurance Policy, issued by the Insurance Authority and preserved through Article 183, fixes the standard policy terms. Insurers cannot exclude or limit cover below the unified minimums.

Motor claims interact with diyya, the compensation for loss of life under Sharia principles incorporated into UAE law. Where a traffic accident causes death, the deceased's estate has a claim for diyya, fixed at AED 200,000 and subject to apportionment for contributory liability per the traffic file. Civil compensation for material loss and non-financial harm runs alongside the diyya claim. The insurer's exposure under the compulsory cover extends to both elements within the policy limit.

Third-party recoveries on motor claims turn on the police traffic report, which apportions liability between drivers in percentage terms. An insurer that pays its own insured acquires subrogated rights against the at-fault driver's insurer in proportion to the liability percentage in the traffic file.

Health insurance

Health insurance is regulated by the emirate health authorities in parallel with CBUAE prudential oversight. In Dubai, the Dubai Health Authority administers the mandatory health insurance scheme under Dubai Law No. 11 of 2013. In Abu Dhabi, the Department of Health administers the corresponding mandatory scheme. Both require employer-funded basic cover for all residents.

Health insurers face routine disputes with providers (hospitals, clinics, pharmacies) over claim adjudication, prior authorisation, contract pricing, and fraud markers. Provider fee recovery against insurers, and insurer recovery of overpayments against providers, sit outside the Sanadak consumer route and run through standard commercial courts or contractual arbitration where the provider contract specifies it.

Marine and cargo insurance

Marine cargo and hull policies sit alongside the Maritime Commercial Code (Federal Law No. 26 of 1981, as amended) for the underlying carrier and bailee relationships. Insurer recovery against carriers is subject to the carrier's package liability limits and the one-year limitation period. Insurers writing marine business should align policy language on subrogation rights with the carrier liability framework and ensure claims documentation supports the recovery within the limitation window.

Professional indemnity and directors and officers cover

Professional indemnity policies cover liability arising from the insured's professional services. UAE auditors, engineers, lawyers, doctors, and consultants face liability under contract and tort, with the tort limitation of three years from awareness. PI insurers underwriting these risks need policy language that addresses defence costs, claims-made triggers, and aggregation provisions consistent with how UAE courts treat related claims.

Directors and officers cover responds to claims against directors for breaches of duty under the UAE Commercial Companies Law (Federal Decree-Law No. 32 of 2021) and shareholder or third-party actions. D&O policies typically include a Side A individual director cover and a Side B company reimbursement cover. The interaction with the UAE Civil Transactions Law on indemnity by the company to its directors requires careful drafting of the policy and the company's articles of association.

Construction insurance and decennial liability

Construction All Risks and Erection All Risks policies are standard on UAE construction projects, often required by the developer and the funding bank. They cover damage during construction up to the issue of the Taking Over Certificate. After handover, professional indemnity for the consultants and decennial cover for the contractor take over the long-tail risk.

Decennial liability under Article 880 of the Civil Code imposes a 10-year strict liability on contractors and supervising engineers for total or partial collapse of the structure or defects threatening its stability. The liability cannot be contracted out. Decennial insurance is increasingly required by developers and lenders, particularly on residential and high-rise developments. Coverage triggers, exclusions for fit-out works, and the interaction with the main works policy require careful drafting. We covered the construction-specific framework in Insurance in Construction Contracts in the UAE and the broader construction law context in our UAE Construction Law Complete Legal Guide for 2026.

Cyber insurance

Cyber insurance has expanded as a line in the UAE following the rise in ransomware incidents and the introduction of the Personal Data Protection Law. Cyber policies typically cover first-party costs (incident response, forensic investigation, business interruption, ransom payment subject to sanctions screening) and third-party liability (regulatory fines where insurable, data breach claims, defence costs).

Three coverage issues recur. First, the sanctions exclusion. UAE insurers cannot pay ransoms to entities on UN, US OFAC, or UAE Local Terrorist List databases, regardless of policy wording. Second, the regulatory fines insurability question. Some regulatory fines are insurable under UAE law and some are not, depending on the nature of the breach and whether it carries criminal as well as administrative liability. Third, the interaction with PDPL breach notification timelines, which are tight and require insurer cooperation on incident response within hours rather than days.

Takaful and re-takaful

Takaful is the Sharia-compliant insurance model authorised under Chapter 14 of the old Insurance Law and carried through to FDL 6/2025. Takaful operators must establish an Internal Sharia Supervision Committee whose fatwas bind the operator on Sharia compliance matters. The Higher Sharia Authority at the CBUAE issues system-wide standards that bind all UAE Islamic financial institutions, including takaful operators.

The two principal operating models are wakalah (an agency model where the operator earns a fee for managing the participants' fund) and mudarabah (a profit-sharing model where the operator takes a share of the investment returns on the fund). Many UAE takaful operators use a hybrid wakalah-mudarabah structure. The technical separation of the participants' fund from the shareholders' fund is both a regulatory and a Sharia requirement.

Re-takaful operations face the same Sharia compliance constraints. Where a takaful operator places retrocession with a conventional reinsurer, the CBUAE permits this in limited circumstances where re-takaful capacity is unavailable, subject to Sharia governance review.

Surplus distribution from the participants' fund follows the actuary's certification and the Sharia committee's approval. The shareholders' fund cannot absorb deficits from the participants' fund except by way of qard hasan, an interest-free loan to be recovered from future surpluses.

Reinsurance arrangements

UAE insurers cede risk to reinsurers under treaty arrangements (proportional and non-proportional) and on facultative bases for specific risks. CBUAE financial regulations require insurers to maintain reinsurance arrangements sufficient to support the portfolio, with reinsurance security ratings and concentration limits applied.

Cut-through clauses, which give the insured a direct claim against the reinsurer if the insurer becomes insolvent, are increasingly common in UAE large corporate placements. Their enforceability under UAE law depends on the policy wording and the position of the insurer's other creditors under the FDL 6/2025 resolution and creditor hierarchy framework.

Follow-the-fortunes and follow-the-settlements clauses operate under UAE law as agreed contractual terms rather than as default principles. Reinsurers can therefore challenge the insurer's claims handling and settlement decisions where the wording allows it. Reinsurance disputes most often go to arbitration rather than to the courts, with London, Singapore, and DIFC-LCIA the most common seats for UAE-domiciled cedants. Where UAE-seated arbitration is preferred, the choice between DIAC and ArbitrateAD has practical consequences covered in DIAC vs ArbitrateAD: choosing the right UAE arbitration clause in 2026.

Sanadak and the IDSRC do not have jurisdiction over reinsurance disputes between insurers and reinsurers. Those disputes proceed under the contractual dispute resolution clause.

CBUAE enforcement and resolution authority

Enforcement under FDL 6/2025 operates on three tracks: administrative penalties, criminal prosecution for unlicensed activity, and resolution measures for distressed institutions.

Administrative penalties extend to fines, suspension or revocation of licence, removal of directors and senior managers, restrictions on business lines, and publication of the enforcement decision including the names of the institution and individuals involved. The maximum administrative fine rose from AED 200 million under the old Central Bank Law to AED 1 billion under FDL 6/2025.

Criminal liability under Article 170 covers carrying out a licensed financial activity without authorisation, breach of licence conditions, obstruction of CBUAE supervisors, breach of confidentiality, and contravention of early intervention measures. Penalties include imprisonment and fines that sit alongside the administrative consequences. For directors and senior managers of unlicensed insurance operations that target UAE customers (including from offshore), personal criminal exposure is now direct.

The resolution framework under Articles 142 and 143 gives the CBUAE the power to act early on an insurer that is failing or likely to fail its prudential requirements. The toolkit includes:

• Imposing remedial measures and additional capital or liquidity requirements
• Requiring changes to business strategy, legal structure, or operational structure
• Replacing the chairman, board members, and senior management
• Appointing a resolution administrator
• Transferring insurance portfolios to another insurer or to a bridge institution
• Establishing asset management vehicles to run off books in distress
• Writing down or converting liabilities (with specified safeguards for insureds and beneficiaries)
• Suspending contractual payment obligations on a temporary basis

Article 144 sets the creditor hierarchy in resolution. The order runs from secured creditors up to the value of their security, then employment-related claims, then resolution costs and CBUAE advances, then customers (including insureds and beneficiaries), then other unsecured creditors, and finally shareholders. Placing insureds and beneficiaries above general unsecured creditors is a substantive protection for policyholders in a failed insurer scenario.

The Grievances and Appeals Committee established under FDL 6/2025 hears appeals against CBUAE decisions. Appeals from the committee go to the Higher Federal Court. The committee creates a formal recourse path for insurers and individuals subject to CBUAE enforcement action, which the old framework lacked.

Mainland CBUAE, DIFC, and ADGM compared

How should UAE insurance companies prepare for the 16 September 2026 reconciliation deadline?

The reconciliation period under Article 184 of Federal Decree-Law 6 of 2025 closes in four months. Insurers that have not yet mapped their existing operations against the new consolidated framework face an accelerating compliance window. The mapping covers licensing perimeter (which group entities now fall inside CBUAE scope under Article 62), governance and senior manager appointments against new fit and proper standards, capital and solvency positions, outsourcing contracts, fraud prevention controls, and claims handling documentation against Sanadak and IDSRC procedural expectations.

The CBUAE has signalled stronger enforcement appetite since the new law came into force, with the AED 1 billion fine ceiling and Article 170 criminal liability working as the substantive backstop. For insurers that have grown through bolt-on acquisitions or that operate distribution arrangements with technology providers and brokers, the perimeter analysis under Article 62 is the area most likely to surface compliance gaps that did not exist under the old law. Reinsurance arrangements, sanctions screening, and AML controls for high-value general insurance lines also benefit from a fresh review in light of the publication powers the CBUAE now holds over enforcement decisions.

For insurers, reinsurers, brokers, agents, third-party administrators, and takaful operators preparing for the September 2026 deadline, our financial services team advises across licensing, governance restructuring, compliance programme review, claims handling defence, Sanadak and IDSRC proceedings, subrogation recovery, and regulatory enforcement representation.

‍