Payment Services License UAE 2026: CBUAE SVF Guide

Launching a fintech, wallet, or payment gateway in the Emirates begins with one non-negotiable step: securing a payment services license UAE regulators recognise. The Central Bank of the UAE (CBUAE) supervises this entire space, and the rules are precise. Under the Retail Payment Services and Card Schemes Regulation, initial capital starts at AED 100,000 for the lightest Category IV licence and climbs to AED 3 million for a full-scope Category I provider. If you plan to issue e-wallets or stored value, a separate Stored Value Facility licence demands AED 15 million in paid-up capital.

Those numbers frame every business plan. Before you write a line of code or sign a merchant, you need to know which licence category fits your model, how much capital you must lock away, and what safeguards the CBUAE expects around customer money. This guide walks through the categories, the capital table, the application journey, and the tax and compliance obligations that follow — so you can build in the UAE with confidence rather than surprises.

Do you need a payment services license in the UAE?

Yes — almost any business that holds client money, issues wallets, or moves payments in the UAE needs a payment services license from the CBUAE. Under the Retail Payment Services and Card Schemes Regulation, initial capital ranges from AED 100,000 for a Category IV licence to AED 3 million for a Category I provider, while a Stored Value Facility demands AED 15 million in paid-up capital before you can go live.

The trigger is functional, not cosmetic. It does not matter whether you call your product a "gateway," an "app," or a "super-app" — if you initiate, aggregate, acquire, or store payments for third parties, you fall inside the CBUAE perimeter. The table below sets out the main licence tiers and their capital anchors so you can position your model quickly.

Read that table as a map, not a menu. Your services determine the category; the category and your projected volumes determine the capital. A payment initiation app that never touches funds sits far lower than a wallet issuer holding customer balances, and pricing your capital wrongly is the fastest way to stall an application.

What the CBUAE RPSCS framework covers

The CBUAE issued the Retail Payment Services and Card Schemes Regulation (commonly shortened to RPSCS) to modernise how digital payments are licensed and supervised. It replaced older stored-value and electronic-payment rules and created a single, tiered framework for what the Central Bank calls Payment Service Providers. If your business plan mentions any of the following activities, the RPSCS almost certainly applies to you.

The regulation defines a set of retail payment services, and most fintech models combine several of them:

• Payment account issuance — opening and maintaining payment accounts for users.
• Payment instrument issuance — issuing cards, virtual cards, or credentials that initiate payments.
• Merchant acquiring — enabling businesses to accept card and digital payments.
• Payment aggregation — pooling multiple merchants under one acquiring relationship.
• Domestic fund transfer — moving money between users inside the UAE.
• Cross-border fund transfer — sending funds into or out of the country.
• Payment token services — services connected to regulated payment tokens and stablecoins.

Each service carries its own risk profile, and the CBUAE bundles them into the four licence categories. The more services you offer — and the more customer money passes through your systems — the higher the category and the heavier the obligations. This is why two apps that look identical to a consumer can sit in completely different licence brackets: what matters is the plumbing behind the screen, not the branding on it.

RPSCS licence categories I to IV explained

The four categories run from the lightest-touch permission to the fullest scope. Getting the category right at the outset saves months, because you cannot quietly expand into activities your licence does not cover.

Category IV is the entry tier. It is designed for firms offering only payment account information services and payment initiation services — think open-banking style apps that display balances or trigger a payment from a user's existing bank account without ever holding the money. Because these firms never take custody of client funds, the CBUAE sets the initial capital at AED 100,000 regardless of transaction volume. It is the most accessible route for a lean fintech testing product-market fit.

Category III covers domestic retail payment services where the provider does handle payment flows but stays within the UAE and does not offer cross-border transfers. Category II builds on that by adding cross-border fund transfer services, which introduce heavier sanctions-screening and correspondent-relationship obligations. The CBUAE scales the capital for Categories II and III between the Category IV floor and the Category I ceiling, calibrated to the services offered and the volumes projected — so you should treat the exact figure as something the Central Bank sets during assessment rather than a fixed public number.

Category I is the full-scope licence. It permits the complete range of retail payment services, including payment token services. Here the capital depends on scale: a provider whose monthly average value of payment transactions stays below AED 10 million needs at least AED 1.5 million in initial capital, while one at or above AED 10 million needs at least AED 3 million. If your monthly average breaches the AED 10 million threshold for three consecutive months, the CBUAE can require you to step up to the higher aggregate capital funds requirement — so fast-growing firms should budget for the AED 3 million tier from the start.

Four real-world scenarios and the licence each needs

Abstract categories become clearer with concrete examples. Here are four common fintech models and where each typically lands under the CBUAE framework — a useful sanity check before you commit capital.

The open-banking budgeting app. A startup builds an app that connects to users' existing bank accounts, displays balances and spending insights, and lets users trigger a payment from their own bank without the app ever holding funds. Because it only provides payment account information and payment initiation, it fits Category IV, with initial capital around AED 100,000. This is the lightest path and a sensible way to test demand before scaling.

The domestic merchant gateway. A company enables UAE restaurants and shops to accept card and app payments, then settles funds to those merchants. It performs merchant acquiring and possibly aggregation, entirely within the country. That places it in the domestic-services bracket — Category III — with capital scaled by the CBUAE to its projected volumes and no cross-border permission attached.

The remittance and cross-border app. A provider lets users send money abroad and receive inbound transfers. Adding cross-border fund transfer services pushes it into Category II, with heavier sanctions screening, correspondent oversight, and a capital requirement scaled above the domestic tier. Exchange-house-style activity may additionally engage separate CBUAE money-services rules.

The consumer wallet super-app. A business offers a top-up wallet where users store balances to pay merchants, split bills, and hold value between transactions. Storing customer value makes it a Stored Value Facility, triggering the AED 15 million paid-up capital, the 5%-of-float buffer, and a bank guarantee — often combined with a Category I RPSCS licence for the payment services layered on top. This is the most capital-intensive model, and founders should confirm they can fund it before writing a line of code.

The lesson across all four is that consumer-facing similarity hides very different regulatory realities. Two apps with near-identical screens can sit three categories apart, because the CBUAE looks at whether you touch, move, or store other people's money — and how much of it.

Stored Value Facilities: the AED 15 million wallet licence

If your product stores value for customers — a prepaid wallet, a closed-loop balance, a top-up-and-spend app — you are almost certainly running a Stored Value Facility, and the CBUAE regulates SVFs separately and more heavily. The reason is simple: an SVF holds real customer money on its balance sheet, so the safeguards protect the public, not just the platform.

The headline requirement is AED 15 million in paid-up capital, held unencumbered with a UAE-regulated bank. On top of that base, the licensee must maintain Aggregate Capital Funds equal to at least 5% of the total customer float — the pooled balance of all stored value it holds. As the wallet grows, so does the capital buffer, which keeps the facility solvent even under stress. The Central Bank also requires an unconditional, irrevocable bank guarantee for the full paid-up capital, payable to the CBUAE on first demand, submitted with the licence application and kept renewed.

Practically, this means a wallet business cannot be bootstrapped on a shoestring. Before launch you must demonstrate not only the AED 15 million but a credible plan to grow the capital buffer alongside the float, plus segregation of customer money from operating funds. Many founders underestimate this and design a product that is commercially attractive but capital-impossible; scoping the SVF obligations early lets you decide whether to raise the capital, partner with an existing licensed issuer, or redesign the product so it never stores value in the first place.

Payment tokens and stablecoins under the 2024 rules

Digital-asset payments deserve their own note, because the CBUAE has moved decisively into this space. In 2024 the Central Bank introduced a dedicated Payment Token Services Regulation governing how "payment tokens" — including Dirham-backed stablecoins — are issued, converted, and held in the UAE. It sits alongside the RPSCS and reflects the Central Bank's expanding role in supervising payment tokens as part of the national payment system.

Under this framework, activities such as issuing a payment token, providing conversion between tokens and fiat currency, and offering custody or transfer of payment tokens are regulated services requiring the appropriate CBUAE authorisation. A key principle is that a Dirham-referenced payment token — an AED stablecoin used to pay for goods and services — must be issued by a licensed issuer under Central Bank oversight, giving merchants and consumers confidence that the token is genuinely backed and redeemable at par.

For founders, three practical points follow. First, if your model involves issuing or handling a stablecoin used for payments, you are inside the CBUAE perimeter and cannot rely on being "just a technology provider." Second, virtual assets used for trading or speculation are supervised under separate regimes — including the Securities and Commodities Authority nationally and dedicated virtual-asset regulators — so you must map exactly which activity you perform. Third, the boundary between a payment token, an e-money or stored-value product, and a security is where most compliance risk lives, and getting it wrong can invalidate an entire launch.

The takeaway is not to fear the space but to scope it precisely. The UAE has deliberately built one of the region's clearest digital-payments rulebooks, and firms that engage with it early — rather than launching first and licensing later — are the ones that scale without enforcement setbacks. This is licensing and compliance guidance only, not advice on any particular token or investment.

Capital, guarantees and safeguarding of client funds

Across every category, the CBUAE's central concern is the same: customer money must be protected even if the provider fails. Three mechanisms deliver that protection, and your application must address all three convincingly.

First, paid-up capital must be genuinely paid in, unencumbered, and verifiable — not a paper commitment. The Central Bank confirms the funds are held with a UAE-licensed bank before granting the licence. Second, safeguarding of client funds requires that customer balances are ring-fenced from the company's own money, typically in segregated accounts, so operational creditors cannot reach them. Third, bank guarantees provide an additional backstop the CBUAE can call on if the firm cannot meet its obligations.

Beyond capital, the Central Bank assesses governance. It expects fit-and-proper directors and senior managers, a resident and appropriately qualified compliance function, a clear organisational structure, and robust technology and operational-resilience controls. Cybersecurity, data protection, and business-continuity planning are not optional extras — they are examined as part of the licence decision. A strong application reads like an operating manual for a bank in miniature, because in the eyes of the regulator that is broadly what a payment provider is.

Step by step: how to apply for a payment services licence

The CBUAE process is structured and evidence-driven. While timelines vary with complexity, the sequence below reflects how most successful applications proceed. Treat it as a project plan spanning several months, not a form you file in an afternoon.

1. Scope your activities and category. Map your product to the RPSCS services and settle on Category I, II, III, or IV — or an SVF licence, or both. This single decision drives capital, cost, and timeline.
2. Build the corporate vehicle. Incorporate the UAE company that will hold the licence. Mainland companies are licensed at emirate level by the Department of Economic Development, or in Dubai the Department of Economy and Tourism (DET), before the CBUAE overlay applies.
3. Assemble the capital and guarantees. Deposit the paid-up capital with a UAE bank and arrange the required bank guarantee for SVF or higher-category licences.
4. Prepare the application file. This includes a detailed business plan, financial projections, ownership and source-of-funds evidence, governance structure, fit-and-proper documentation for controllers, and AML and technology-risk frameworks.
5. Submit and engage. File with the CBUAE and respond to its questions. Expect iterative clarifications on your compliance, safeguarding, and technology controls.
6. In-principle approval and readiness. Once the CBUAE is satisfied, it may grant in-principle approval subject to final conditions, after which you complete any outstanding setup and demonstrate live-readiness.
7. Final licence and go-live. With the licence granted, you can onboard customers — under ongoing supervision, periodic reporting, and audit obligations.

Costs, timelines and ongoing compliance

Capital is only part of the budget. Applicants should plan for CBUAE application and supervision fees, professional and legal costs for the application file, technology and audit spend, and the ongoing cost of a resident compliance team. The table below gives an indicative planning view — always confirm current official fees with the Central Bank, as they are updated periodically.

On timelines, a realistic expectation is six to twelve months from a genuinely complete application to a live licence, with SVF and Category I files at the longer end. Once licensed, you enter a continuous compliance cycle: periodic financial and prudential reporting to the CBUAE, maintenance of capital buffers, annual audits, transaction monitoring, and prompt suspicious-transaction reporting through the UAE's goAML system operated by the Financial Intelligence Unit. Anti-money-laundering supervision in the UAE is coordinated across the Central Bank and the Ministry of Economy for the sectors each oversees, and payment firms are expected to keep pace with evolving standards.

Tax and corporate obligations for payment firms

A payment licence sits on top of the ordinary UAE tax and corporate framework, so budget for both. The Federal Tax Authority administers corporate tax at 0% on taxable income up to AED 375,000 and 9% above that threshold, with registration completed through the EmaraTax portal and returns due nine months after the financial-year end. If your group is a large multinational, the Domestic Minimum Top-up Tax may raise the effective rate to 15% under the OECD Pillar Two rules for financial years starting on or after 1 January 2025 — a point worth checking early with your advisers.

Value Added Tax also applies. The standard rate is 5%, with mandatory registration once taxable supplies exceed AED 375,000 and voluntary registration available from AED 187,500. Importantly, many financial services are VAT-exempt while others are standard-rated, and the treatment of fee-based versus margin-based payment revenue can be nuanced — so map your revenue lines to their VAT categories before you launch. You can confirm current rules directly with the Federal Tax Authority. The Ministry of Finance sets the wider tax policy framework, including the UAE's alignment with international standards, which is why financial-services businesses should treat tax structuring as a launch-stage decision rather than a year-end afterthought.

Mainland, ADGM and DIFC: choosing your base

The CBUAE licence governs onshore payment activity across the UAE, and your commercial trade licence comes from the emirate-level authority — the DET in Dubai or the relevant Department of Economic Development elsewhere. That is the standard route for firms serving the domestic mainland market.

The UAE also hosts two financial free zones with their own regulators and frameworks. In Abu Dhabi, the Abu Dhabi Global Market (ADGM) licenses payment and fintech firms through its Financial Services Regulatory Authority, and ADGM's regulatory-sandbox heritage makes it popular with early-stage innovators. In Dubai, the Dubai International Financial Centre licenses through the DFSA. These free-zone regimes are separate from the CBUAE's onshore perimeter and suit firms targeting institutional, cross-border, or regionally clustered clients. Choosing between onshore and a financial free zone is a strategic decision about your customers, your capital, and your growth path — not merely a cost comparison, and one worth modelling carefully before you commit.

Common Mistakes to avoid

Founders lose the most time on avoidable errors. Steer clear of these:

• Mispricing the licence category — assuming Category IV when your product actually holds or moves customer funds, which forces a costly reset mid-application.
• Underestimating SVF capital — designing a wallet without the AED 15 million and the 5%-of-float buffer, then discovering the model is capital-impossible.
• Treating capital as spendable — paid-up capital is locked as a solvency cushion, not working capital for marketing or salaries.
• Weak AML from day one — bolting on compliance late instead of building customer due diligence, screening, and goAML reporting into the product from the start.
• Ignoring safeguarding rules — commingling customer money with operating funds instead of ring-fencing balances in segregated accounts.
• Forgetting tax registration — overlooking corporate tax and VAT registration with the Federal Tax Authority while focusing solely on the CBUAE.
• Choosing the wrong base — picking mainland, ADGM, or DIFC on cost alone without matching the regime to the target customer and product.
• Skipping the resident compliance function — assuming a part-time or offshore compliance officer will satisfy a regulator that expects genuine local substance.

Build your UAE payment business with Noble Core

A payment services licence is one of the most rewarding but demanding permissions to secure in the UAE, and the difference between a smooth approval and a stalled file usually comes down to preparation. Noble Core helps fintech founders scope the right category, model the capital, build the corporate vehicle, and assemble an application the CBUAE takes seriously.

Our team supports the full journey around your business setup in Dubai, from choosing mainland versus a financial free zone to structuring ownership and substance. Because payment firms live and die by their banking, we help you open a corporate bank account in the UAE and compare the best business bank accounts for 2026 so your safeguarding and settlement arrangements are ready before launch. We also align your structure with the UAE corporate tax framework so your EmaraTax registration and VAT position are correct from day one.

If you are weighing a CBUAE payment or SVF licence, start with a conversation. Book a free 20-minute consultation and we will map your category, capital, and timeline — and tell you honestly whether a direct licence or a partnered launch is the smarter first move.

Frequently Asked Questions