The wealthy and innovative United Arab Emirates (UAE) is the region’s #1 fintech hotspot, and Dubai in particular is poised to compete with global digital hubs like Berlin, London and Singapore.1 The World Economic Forum’s Global Competitiveness Report 2020 ranks the UAE top ten in the world for its information and communications technology (ICT) adoption and digital legal framework, and strong cybersecurity has helped to cement its fintech-friendly status. The UAE ranked #5 in the world on the Global Cybersecurity Index 2020, developed by the United Nations’ International Telecommunication Union.
Although the COVID-19 pandemic drove a 6.1% contraction in the Emirati economy in 2020,2 which could potentially stall progress and allow for regional competitors like Saudi Arabia to gain ground, the future of the UAE’s digital economy is promising. Digitalization continues at breakneck speed and regulators are ambitious and venture capital funds are pouring in. The Emirati banking sector has remained strong amidst the health crisis,3 and the International Monetary Fund (IMF) predicts a 2021 GDP growth rate of 3.1%.4
As the UAE emerges from the COVID-19 pandemic, it plans to revamp its economy by tapping into innovative technologies like digital currency, blockchain, artificial intelligence and big data. The UAE already ranks #1 in the Arab world, and #34 in the world, for innovation in the economy, per the Global Innovation Index (GII) 2020, developed by Cornell University, INSEAD and the World Intellectual Property Organization (WIPO).
This year, the UAE is focused on central bank digital currency (CBDC), a licensing regime for providers of cryptoassets, AML/CFT, data protection in Abu Dhabi and a Dubai-based innovation hub. As the state digitalizes, regulators have an opportunity to support financial inclusion, especially amongst non-Emirati residents. The UAE is the globe’s second-largest sender of remittances,5 and its high number of migrant workers would benefit from cheaper and more accessible payment systems.
Financial Regulatory Authorities
The Central Bank of the United Arab Emirates (UAECB) is the primary monetary authority governing all financial institutions operating in the country that don’t fall within the financial free zones, the geographic economic centers that develop and enforce their own regulations and laws.
The Abu Dhabi Global Market (ADGM) Office of Data Protection (ODP) is the primary data authority for the ADGM financial free zone.
The ADGM Financial Services Regulatory Authority (FSRA) seeks to ensure a fair, stable and robust financial services sector in the ADGM financial free zone.
The Dubai Financial Services Authority (DFSA) regulates the financial services sector in the Dubai International Financial Centre (DIFC) financial free zone.
The Securities and Commodities Authority (SCA) regulates and oversees the UAE’s financial markets.
Policy, Laws and Regulations
Law on Electronic Transactions and Trust Services
In September 2021 Federal Decree-Law No. 46/2021 on Electronic Transactions and Trust Services was enacted, repealing the 15-year-old Federal Law No.1/2006 on E-commerce and Transactions. To support digital transformation efforts in the UAE, the new law encourages and facilitates all types of electronic transactions, while protecting the rights of customers who undertake electronic transactions.
According to the law, trust services include creating electronic signatures; issuing certificates of authentications for qualified electronic signatures; creating electronic stamps; issuing certificates of authentication for qualified electronic stamps; and issuing certificates of authentication for websites.
The new law took effect January 2, 2022. The law does provide a one-year grace period for businesses to comply.
Biometric Verification System, August 2021
The UAE’s Ministry of the Interior partnered with the Abu Dhabi Islamic Bank (ADIB) to launch a biometric identity verification-based onboarding system. Users wishing to open a new account with the ADIB can submit a selfie through the bank’s mobile app, and the selfie is then verified with facial recognition technology and biometric matching through the Ministry of the Interior’s Facial Recognition database. Users must also tap their Emirates ID card to their mobile phones during the onboarding process to facilitate the retrieval of data from the chip.6
The Emirati government has shown increasing interest in supporting the use of biometric identification to access services. In April 2021, the UAE enabled a capability that allows residents to connect their faces with their UAE Pass digital IDs. Residents can now access online government services through facial recognition.7
2023-2026 Strategy, 12 July 2021
The central bank launched its 2023-2036 Strategy, which seeks to secure the UAECB’s status as one of the top ten central banks in the world and promote digital transformation in the financial sector. Major plans include the development of a central bank digital currency and a digital identity system, as well as to further harness the power of innovative technologies like artificial intelligence and big data. The strategy also aims to promote green initiatives in the economy and strengthen financial inclusion.
Dubai International Financial Centre Innovation Hub, 25 May 2021
The Dubai International Financial Centre (DIFC) Innovation Hub was inaugurated by Deputy Ruler of Dubai and President of the DIFC Sheikh Maktoum. The Innovation Hub seeks to bring together startups, tech unicorns and big tech to cultivate Dubai’s fintech ecosystem. Startups will receive financial support from the DIFC FinTech Hive’s accelerator program and the USD $100 million FinTech Fund. DIFC Governor Essa Kazim stated, “With a strong focus on promoting promising startups and innovative ventures, DIFC is accelerating the strategic and sustainable development of the economy to be future-ready. The DIFC Innovation Hub is the region’s dedicated zone for innovators and investors to leverage the extraordinary potential of new generation technology."8
Anti-Money Laundering and Countering the Financing of Terrorism Office, 24 February 2021
The UAE Cabinet approved the creation of the Executive Office of the Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT), which will implement the National AML/CFT Strategy and National Action Plan (NAP). Towards this end, the Executive Office seeks to strengthen national and international cooperation; collaborate with the Gulf Cooperation Council (GCC), Working Group on AML-CFT, G20 and the Financial Action Task Force (FATF); bolster information sharing between sectors; support legislative initiatives to strengthen the national AML/CFT framework; and coordinate with the Ministry of Foreign Affairs and International Cooperation (MOFAIC) in communicating progress to the Higher Committee on AML/CFT.9
On 13 April 2021, the National Committee for Combating Money Laundering and Financing of Terrorism and Illegal Organisations (NAMLCFTC) adopted AML/CFT guidelines for financial institutions and designated non-financial businesses and professions. The guidelines seek to raise awareness on adherence to AML/CFT regulations, as well as risks and penalties for non-compliance.
Multiple Central Bank Digital Currency Bridge Project, 23 February 2021
A joint statement announced the addition of the Central Bank of the United Arab Emirates and the Digital Currency Institute of the People’s Bank of China to the Multiple Central Bank Digital Currency (m-CBDC) Bridge Project, spearheaded by the Hong Kong Monetary Authority and the Bank of Thailand. The project, supported by the Bank for International Settlements (BIS) Innovation Hub, explores the use of a CBDC and distributed ledger technology (DLT) in instantaneous cross-border payments, and investigates scalability, interoperability, privacy and governance. It aims to simplify cross-border fund transfers by lowering costs, reducing inefficiencies and easing the burden of complicated regulatory compliance.
Abu Dhabi Global Market Data Protection Regulations, 11 February 2021
The ADGM issued new data protection regulations, modeled on the EU’s General Data Protection Regulation (GDPR), which expand data subjects’ rights and impose new obligations on data processors and controllers. The regulations apply to processors and controllers of data in the ADGM, even if the processing of data occurs outside the ADGM. Data subjects have the rights to erasure, access, rectification, portability and the right to object. The regulations established a new Office of Data Protection (ODP), a data breach notification system, requirements for record-keeping, requirements for data security and more severe non-compliance penalties. Violators may face fines of up to USD $28 million. Businesses may be required to appoint a data protection officer in some scenarios. International transfers of data may occur if the receiving entity or jurisdiction adheres to an adequate standard of data protection. Businesses established after 14 February 2021 had until 14 August 2021 to comply with the new regulations, and businesses established before 14 February 2021 have until 14 February 2022 to comply with them. Until the end of the transitional period, the preexisting data protection regulations will still be in effect.
Regulation on the Licensing of Cryptoassets, 01 December 2020
The SCA’s decision “The Authority’s Chairman of the Board of Directors Decision No. (21/R.M) of 2020 Concerning the Regulation of Crypto Assets,” published 01 November 2020 in the official gazette, has gone into effect. The law details a licensing regime for entities seeking to offer services involving cryptoassets, including exchanges, marketplaces, custodian services and crowdfunding platforms. Entities must be incorporated onshore either in the UAE or one of its financial free zones, and they must be licensed by the SCA prior to offering services involving cryptoassets. In order to obtain a license, entities must demonstrate compliance with UAE regulations on cybersecurity, data protection, anti-money laundering and counter-terrorist financing. Computer systems must be kept onshore. In the case that licensees rely on third-party contractors, entities will assume all legal liability for breaches to the Decision. The Decision also created a classification of customers to whom cryptoassets may be offered: Qualified Investors and those who do not meet the definition of Qualified Investor. Licensees must seek prior approval from the SCA before offering cryptoassets to a non-Qualified Investor, and licensees must file documents with the SCA before offering cryptoassets to a Qualified Investor. In conducting due diligence, licensees must consider all customers as “high risk.” The SCA reserves the authority to monitor transactions, audit licensees, impose fines, publish names of violators and withdraw licensees’ rights.10
Cross-Border Central Bank Digital Currency Pilot, 29 November 2020
The central banks of Saudi Arabia and the United Arab Emirates successfully completed a cross-border central bank digital currency (CBDC) pilot, called Project Aber. The experiment utilized DLT to facilitate cross-border payments between the two countries, with a dual-issued digital currency. Three use cases were tested: payment between central banks, domestic payments between commercial banks and cross-border payments between commercial banks.
1. Rahal, Nabila. “Why Dubai is set to become a 'flourishing' fintech hub.” Arabian Business, 30 August 2021. https://www.arabianbusiness.com/startup/467776-why-dubai-is-set-to-become-flourishing-fintech-hub.
2. “UAE economy shrank 6.1% last year amid COVID-19 crisis -preliminary data.” Reuters, 02 May 2021. https://www.reuters.com/article/us-emirates-gdp-idUSKBN2CJ09C.
3. Das Augustine, Babu. “UAE Central Bank finds banking sector resilient in its 2020 Financial Stability Report.” Gulf News, 17 June 2021. https://gulfnews.com/business/banking/uae-central-bank-finds-banking-sector-resilient-in-its-2020-financial-stability-report-1.1623936888881#.
4. “United Arab Emirates.” International Monetary Fund. https://www.imf.org/en/Countries/ARE.
5. Essaid, Salim. “UPDATE 1-Cryptocurrency promise for UAE's unbanked migrants - but not yet.” Reuters, 03 August 2021. https://www.reuters.com/article/emirates-tech-migrants-idUSL8N2PA7UG.
6. “Government Database Access Allows Abu Dhabi Islamic Bank to Enable Biometric Onboarding.” Mobile ID World, 30 August 2021. https://mobileidworld.com/abu-dhabi-islamic-bank-biometric-onboarding-808301/.
7. “UAE Uses Face Biometrics to Provide Access to Government Services.” Find Biometrics, 09 April 2021. https://findbiometrics.com/uae-uses-face-biometrics-provide-access-government-services-040905/.
8. Godinho, Varun. “New DIFC Innovation Hub to spur fintech ecosystem in Dubai.” Gulf Business, 26 May 2021. https://gulfbusiness.com/new-difc-innovation-hub-to-spur-fintech-ecosystem-in-dubai/.
9. “UAE Establishes Executive Office to Combat Money Laundering and Terrorist Financing.” United Arab Emirates Ministry of Foreign Affairs & International Cooperation, 24 February 2021. https://www.mofaic.gov.ae/en/mediahub/news/2021/2/24/24-02-2021-uae-office#.
10. Shivji, Khaled. “UAE announces new regulations for licensing crypto assets.” Keystone Law, 12 November 2020. https://www.keystonelaw.com/me/keynotes/uae-announces-new-regulations-for-licensing-crypto-assets/.
*DISCLAIMER: This information is OneSpan's interpretation of the compliance requirements as of the date of publication. Please note that not all interpretations or requirements of the applicable laws are well-settled and its application is fact- and context-specific. The information contained in this document should not be relied upon as legal advice or to determine how the law applies to your business or organization. We encourage you to seek guidance from your legal counsel with regard to law applying specifically to your business or organization and how to ensure compliance. This information is provided “as-is” and may be updated or changed without notice. OneSpan does not accept liability for the contents of these materials.
Last updated: November 2021