BNPL Regulation UAE 2026: Operating Legally

Buy-now-pay-later has become a familiar checkout option across the Emirates, but the rules changed decisively, and understanding BNPL regulation UAE providers must follow is now essential to operating legally. Since the Central Bank of the UAE (CBUAE) issued its 2023 Finance Companies Regulation, buy-now-pay-later is formally treated as consumer short-term credit — which means providers must be licensed. You either obtain a Restricted Licence Finance Company licence, requiring Aggregate Capital Funds of the higher of AED 20 million or 5% of lending, or you partner with a licensed institution. Total fees are capped at 30% of the loan, and repayment at 12 months.

That reclassification ended the era in which BNPL could operate in a regulatory grey zone. The CBUAE now supervises this activity as the credit product it always was, with consumer-protection guardrails on how much customers can borrow, how long they have to repay, and what they can be charged. This guide sets out exactly what changed, the two legal routes to operate, the capital and consumer-protection rules, what unlicensed providers must do now, and the tax and compliance duties that follow — so you can run a BNPL business on the right side of the line.

Is BNPL regulated in the UAE?

Yes — since the CBUAE's 2023 Finance Companies Regulation, buy-now-pay-later is treated as consumer short-term credit, so BNPL providers in the UAE must be licensed. You either obtain a Restricted Licence Finance Company licence — requiring Aggregate Capital Funds of the higher of AED 20 million or 5% of lending — or partner with a licensed institution. Total fees are capped at 30% of the loan and repayment is limited to 12 months.

The days of treating BNPL as unregulated "technology" are over. Because it extends credit to consumers, the CBUAE brings it squarely inside the finance-company framework, with clear rules protecting borrowers. The table below summarises the core requirements so you can see the shape of compliance at a glance.

Read this table as your compliance checklist. Every BNPL model in the UAE must sit within these boundaries, and the two routes — licence or partnership — are the only compliant ways to operate. Everything that follows in this guide expands on the rows above.

How the 2023 rules reclassified BNPL as short-term credit

The pivotal change came with the CBUAE's Finance Companies Regulation issued in 2023 (Circular No. 3/2023, effective 27 December 2023), which repealed the earlier 2018 regulation and — critically — formally recognised buy-now-pay-later schemes as a form of consumer short-term credit. Before this, BNPL occupied an ambiguous space; afterwards, there was no ambiguity at all. If you extend short-term credit to consumers, you are conducting a licensed activity.

This reclassification matters because it changes who can offer BNPL and on what terms. Short-term credit is now defined, bounded, and supervised, with the Central Bank monitoring providers to ensure they lend responsibly and protect consumers. The regulation reflects a wider global trend of bringing fast-growing BNPL products inside the regulatory perimeter to prevent consumer over-indebtedness, and the UAE moved deliberately to establish clear rules early.

For founders and existing operators, the practical takeaway is simple but far-reaching: BNPL is credit, and credit is regulated. Any business plan that assumes otherwise is built on sand. The correct starting point is to accept the classification and design your model — capital, consumer protection, and compliance — around it from the outset. This is licensing and compliance guidance, not financial advice; the aim is to help you operate lawfully and sustainably in a supervised market.

Two legal routes: restricted licence or partner

The CBUAE framework gives BNPL providers two compliant paths, and choosing between them is the central strategic decision. Companies seeking to offer short-term credit products, including BNPL, must either seek a licence directly from the CBUAE to operate as a Restricted Licence Finance Company, or partner with an established financial institution — a licensed bank or finance company — whose authorisation covers the activity.

The direct-licence route suits providers with the capital and ambition to operate as a regulated lender in their own right. It brings full control over the product, the credit decisions, and the customer relationship, but it carries the capital, governance, and compliance obligations of a licensed finance company. The partnership route suits providers who want to focus on the technology, user experience, and merchant relationships while a licensed institution carries the regulated lending on its balance sheet and under its authorisation. Many fintechs launch this way and consider a direct licence later, once volume justifies the capital.

Neither route is inherently better — the right answer depends on your capital, your control preferences, and your growth plan. What is not an option is a third path of operating without either a licence or a licensed partner. The regulation closed that door, and continuing to lend outside the framework is a serious breach. Deciding early and deliberately between the two legitimate routes is the foundation of a compliant BNPL business.

The Restricted Licence Finance Company route

If you choose to be a regulated lender in your own right, the relevant vehicle is the Restricted Licence Finance Company, a category the CBUAE designed for focused, short-term credit providers. It carries a far lighter capital bar than a full finance company: Aggregate Capital Funds of the higher of AED 20 million or 5% of outstanding lending volume. The licence is granted for an initial three-year period and is renewable for further three-year terms, subject to the Central Bank's determination.

The AED 20 million floor is a deliberate on-ramp. It is high enough to ensure only serious, well-capitalised operators enter the market, but far below the AED 150 million a full finance company must hold — reflecting that short-term, capped-value credit is a narrower, lower-risk activity than broad lending. The 5%-of-lending element means that as your book grows, your capital must grow with it, keeping the buffer proportionate to the credit you extend.

Operating under this licence brings the obligations of a supervised lender: fit-and-proper owners and managers, a resident compliance function, robust underwriting and collections, AML controls, and continuous reporting to the CBUAE. In return, you gain full control of your product and customer relationships and the standing of a properly licensed institution. For a BNPL business with the capital and the intention to scale, this route offers the most autonomy — provided you accept the responsibilities that come with a licence.

The partnership route: operating under a licensed institution

The alternative is to partner with an institution that already holds the necessary CBUAE authorisation — an established bank or finance company — and to offer BNPL under that umbrella. In this model, the licensed partner carries the regulated lending, while your business typically provides the platform, the merchant integrations, the customer experience, and the technology that makes the product work at the point of sale.

This route can be the fastest, most capital-efficient way to bring a BNPL product to market, because it avoids the upfront capital of a direct licence and leans on a partner that has already cleared the regulatory bar. It suits founders whose strength is product and distribution rather than balance-sheet lending, and it is a common launch strategy for fintechs that intend to prove the model before deciding whether to seek their own licence.

The partnership must be structured carefully, however. The consumer-protection rules — the credit cap, the fee cap, the tenor limit — still apply to the product regardless of who holds the licence, and both parties must ensure the arrangement genuinely complies. You must confirm your partner is properly licensed and that responsibilities for underwriting, collections, disclosures, and reporting are clearly allocated. A partnership done well is a legitimate, scalable route; a partnership done loosely can leave both sides exposed. Getting the contractual and compliance architecture right is essential.

Consumer-protection rules: caps on credit, fees and tenor

At the heart of the BNPL regime are hard consumer-protection limits designed to prevent over-indebtedness, and every provider must build their product within them. There are three that matter most.

First, the maximum total short-term credit extended to a borrower must not exceed the lower of AED 20,000 or the borrower's verified net income for three months. This ties the amount a customer can owe to their genuine ability to repay, and it requires providers to verify income rather than lend blindly. Second, the repayment period is limited to 12 months from the initial agreement date, keeping BNPL genuinely short-term rather than drifting into long-duration consumer debt. Third, the total fees, including late-payment fees, must not exceed 30% of the initial loan amount, protecting customers from charges spiralling far beyond what they borrowed.

These caps are not optional design choices — they are regulatory boundaries, and pricing or structuring a product outside them is non-compliant. For providers, the implication is that responsible underwriting and transparent terms are built into the law, not left to goodwill. The best operators treat these limits as a floor for good conduct rather than a ceiling to test, because a reputation for fair, transparent lending is a competitive asset in a market where consumers and regulators alike are paying close attention.

What existing and unlicensed providers must do now

The regulation was not only forward-looking; it addressed the providers already operating. Existing providers of short-term lending products who are not licensed by the CBUAE must come into compliance by adopting one of the two legitimate routes — obtaining a licence or partnering with a licensed institution — or otherwise wind down their credit operations and leave the UAE market.

This is an unambiguous compliance mandate. There is no grandfathering that lets an unlicensed BNPL business continue indefinitely, and no volume small enough to escape the framework. Any provider that was operating in the old grey zone must now make an active choice: license, partner, or exit. Continuing to extend short-term credit without either a licence or a licensed partner places the business in breach, with the enforcement consequences that implies.

For operators in this position, the priority is a clear-eyed assessment. Do you have the capital and appetite for a Restricted Licence Finance Company? Is a partnership with a bank or finance company a better fit for your model and resources? Or does the economics no longer work under the new rules? Answering these questions honestly and quickly is essential, because the cost of delay — operating out of compliance while you deliberate — is far higher than the cost of moving decisively toward a compliant structure.

Step by step: getting BNPL-compliant

Bringing a BNPL business into compliance follows a logical sequence. While each situation differs, the path below reflects how most providers should approach it.

1. Confirm the classification applies. If you extend short-term credit to consumers — which BNPL does — you are inside the framework and must act.
2. Choose your route. Decide between a direct Restricted Licence Finance Company licence and a partnership with a licensed institution, based on capital, control, and strategy.
3. Structure the company. Establish or adapt the corporate vehicle; the onshore trade licence comes from the Department of Economic Development, or in Dubai the Department of Economy and Tourism (DET).
4. Assemble capital or secure a partner. For the licence route, arrange the required Aggregate Capital Funds; for the partnership route, negotiate and document the arrangement with a licensed institution.
5. Build the compliant product. Ensure the credit cap, fee cap, and 12-month tenor are enforced in the product, alongside income verification and clear disclosures.
6. Prepare the application or agreement. For a licence, assemble the business plan, underwriting and AML frameworks, and fit-and-proper documentation; for a partnership, finalise the compliance and responsibility split.
7. Launch and report. Operate under ongoing supervision, with reporting, monitoring, and continuous compliance.

Costs, capital and timelines

Beyond capital, budget for CBUAE fees where you license directly, professional and legal costs, technology for underwriting and collections, and ongoing compliance staffing. The table below gives an indicative planning view — always confirm current official figures with the Central Bank.

On timelines, the direct-licence route can take several months to over a year from a complete application, while a partnership can be quicker to launch but requires careful contracting. Once operating, you maintain continuous compliance: capital adequacy where you hold a licence, adherence to the consumer-protection caps, AML controls, and reporting. The Central Bank's ongoing focus on responsible lending means your conduct is supervised throughout the life of the business, not just at authorisation.

AML and responsible-lending obligations

BNPL providers, like all credit businesses, sit within the UAE's anti-money-laundering framework and its responsible-lending expectations. On AML, you must conduct customer due diligence, monitor activity, screen against sanctions lists, keep records, and file suspicious-transaction reports through the goAML platform operated by the UAE Financial Intelligence Unit. AML supervision is coordinated across the Central Bank and the Ministry of Economy for the sectors each oversees, and standards continue to strengthen in line with international norms.

On responsible lending, the consumer-protection caps are only the baseline. The Central Bank expects genuine affordability assessment — hence the requirement to verify a borrower's income against the credit extended — clear and honest disclosure of terms, fair treatment of customers who fall behind, and no exploitative practices. Building these principles into your underwriting engine and customer communications is both a regulatory obligation and, increasingly, a market expectation, as consumers gravitate toward providers they can trust. In a supervised market, responsible conduct is not a constraint on the business; it is the licence to operate and grow.

Tax and corporate obligations

A BNPL business sits on top of the standard UAE tax framework. The Federal Tax Authority administers corporate tax at 0% on taxable income up to AED 375,000 and 9% above, with registration through EmaraTax and returns due nine months after the financial-year end. If your business is part of a large multinational group, the 15% Domestic Minimum Top-up Tax may apply under the OECD Pillar Two rules for financial years starting on or after 1 January 2025.

VAT at 5% also applies, with mandatory registration once taxable supplies exceed AED 375,000 and voluntary registration from AED 187,500. The VAT treatment of financing income versus fee and merchant income can differ, so classify each revenue line carefully. Confirm the current position with the Federal Tax Authority, and note that the Ministry of Finance sets the overarching tax policy the UAE follows. For a BNPL provider whose revenue blends merchant fees, customer fees, and financing, getting the tax classification right from the start avoids costly reassessments and keeps your first corporate-tax return clean.

Merchants and BNPL: what retailers should know

BNPL is a partnership between providers and the retailers who offer it at checkout, so merchants have their own compliance interest even though they are not usually the lender. A retailer offering a pay-in-instalments option typically does so through a licensed BNPL provider rather than by extending credit itself, which keeps the regulated activity with the licensed party.

That said, merchants should do their diligence. Confirm that your BNPL partner is properly licensed by the CBUAE or operating under a licensed institution, because associating your brand with a non-compliant provider carries reputational and potentially legal risk. Ensure that the consumer-protection rules — the credit cap, the fee cap, and the tenor limit — are respected in the product your customers use, and that terms are disclosed clearly at the point of sale. Retailers should also account for the commercial terms of the arrangement and any tax implications of the fees they pay or receive.

For merchants, the message is reassuring but not passive: BNPL remains a powerful conversion and basket-size tool, and offering it through a properly licensed partner is entirely legitimate. The key is to choose compliant partners and to understand the framework your customers are borrowing within, so that the product enhances trust in your brand rather than exposing it.

Building a compliant BNPL product: practical design points

Turning the rules into a working product means embedding compliance in the design itself, not policing it afterwards. A few practical design points make the difference between a product that is compliant by construction and one that is constantly at risk of breach.

Build the credit cap into the underwriting logic so the system cannot approve a customer for more than the lower of AED 20,000 or their verified three-month net income — which in turn means integrating reliable income verification, whether through salary data, bank information, or credit-bureau checks. Build the fee cap into pricing so that all charges, including any late-payment fees, can never in aggregate exceed 30% of the initial loan; this constrains not just headline pricing but the entire penalty structure. Build the tenor limit into the product so that no plan can extend beyond 12 months from the initial agreement date.

Beyond the hard caps, design for transparency: show customers the full cost, the repayment schedule, and the consequences of missing a payment before they commit, in clear and simple language. Design your collections process to be firm but fair, in line with responsible-lending expectations. And design your data and reporting so that you can demonstrate compliance to the CBUAE on demand, with clean records of approvals, disclosures, and outcomes.

The providers who get this right treat the rules as a product specification rather than a legal afterthought. A BNPL product engineered around the caps from day one is not only compliant — it is more trustworthy, more sustainable, and better positioned to earn the confidence of customers, merchants, and the regulator alike.

Common Mistakes to avoid

BNPL operators and would-be entrants stumble on predictable issues. Avoid these:

• Assuming BNPL is unregulated — treating it as mere technology when the 2023 rules classify it as licensed short-term credit.
• Ignoring the two-route rule — operating without either a Restricted Licence Finance Company licence or a licensed partner.
• Breaching the consumer caps — exceeding the AED 20,000-or-three-months-income credit limit, the 30% fee cap, or the 12-month tenor.
• Skipping income verification — lending without verifying a borrower's ability to repay, as the affordability rule requires.
• Loose partnership structuring — relying on a licensed partner without clearly allocating underwriting, disclosure, and reporting responsibilities.
• Delaying compliance — continuing to operate in the grey zone instead of moving decisively to license, partner, or wind down.
• Neglecting tax registration — overlooking corporate tax and VAT registration with the Federal Tax Authority.
• Weak AML controls — failing to build customer due diligence and goAML reporting into the business from day one.

Operate BNPL legally with Noble Core

The reclassification of BNPL as regulated short-term credit changed the rules of the game, and the providers that thrive are those that embrace the framework rather than resist it. Noble Core helps BNPL and instalment businesses decide between a direct restricted licence and a partnership route, structure the company, and build a product that respects the consumer-protection caps from day one.

We support the wider business setup in Dubai around your BNPL model — from corporate structuring and ownership to substance and governance. Because a lending business depends on strong banking relationships, we help you open a corporate bank account in the UAE and compare the best business bank accounts for 2026 so your funding and settlement arrangements are ready early. We also align your structure with the UAE corporate tax framework so your EmaraTax and VAT registrations are correct from the outset.

If you are building or fixing a BNPL business, start with a conversation. Book a free 20-minute consultation and we will map your route, capital, and compliance obligations — and tell you candidly whether a direct licence or a partnership gives your model the cleanest path to operating legally.

Frequently Asked Questions