RNKO Digital Solutions Licence Revocation: What Non-Bank Payments Businesses Need Before Entering the UAE

The Bank of Russia's register entry for RNKO Digital Solutions marks the company as not in effect. It lists licence number 3552-K, for banking operations as a settlement non-bank credit organisation, valid from 24 January 2025 to 27 August 2026, and an order revoking the licence dated the same day. It also lists the temporary administration appointed on 27 August 2026 and a liquidation entry dated 5 October 2026. The register page itself does not give a reason.

Russian press reports of the central bank's statement fill that gap. They say the regulator revoked the licence for violating banking and anti-money-laundering rules, including Federal Law 115-FZ, because the company had for a long time carried out suspicious client transactions and had not promptly submitted reliable information on transactions subject to mandatory control. The same reports describe the company as closed to operations, with payments and acquiring blocked, and say it mainly served businesses rather than individuals. They advise clients to ask the temporary administration about the status of their funds.

Two details deserve attention. The licence ran for about 19 months, so age was no protection. And the customers affected were mostly businesses: merchants who relied on the firm for acquiring found themselves unable to take payments overnight.

The CBUAE's retail payment services framework, as summarised by the law firm Simmons & Simmons, defines nine retail payment services: payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic and cross-border fund transfer, payment token, payment initiation and payment account information. There are four licence categories, I to IV, and lower-numbered categories permit more activities. Payment token services are permitted only under Category I. Banks do not need a payments licence for account issuance, instrument issuance or fund transfers, but need a no-objection letter from the CBUAE for other services.

Initial capital depends on the category and on the monthly average value of payment transactions, taken as a moving average of the preceding three months or, for a new firm, from its business plan. Category IV needs AED 100,000 whatever the volume. Category III needs AED 500,000 below AED 10 million a month and AED 1 million at or above it. Category II needs AED 1 million and AED 2 million, and Category I needs AED 1.5 million and AED 3 million. The firm must hold at least that amount at all times. If its monthly average stays above AED 10 million for three consecutive months, it must tell the CBUAE and becomes subject to the higher capital requirement the CBUAE sets.

The point for a founder is the structure of the regime. Capital is tied to transaction volume, and the licence covers named services only. The principal business must be the licensed service, and any ancillary service outside the licence needs CBUAE approval before it starts. The CBUAE may also require a separate entity for it. A business plan that adds stored balances or cross-border transfers after launch can therefore move the firm into a different category.

The first test for any payments idea is simple: does the company at any point hold, control or direct customer money? A software company that sells a payment tool to a licensed bank is in one position. A company that collects funds from shoppers and passes them to merchants is in another. A company that gives customers balances is in a third.

Draw the flow on one page. Show where each dirham sits at each moment, which account holds it, and which party can instruct a movement. The CBUAE regulation lets a payment provider hold users' funds only while they are in transit. If it settles within 24 hours, the funds must not be commingled or must be insulated from the provider's other creditors. If it settles after 24 hours, the funds go into a segregated client money account with a bank, which the regulation calls a separate escrow account, apart from the firm's own funds. Insurance or a bank guarantee from an institution outside the group is the other permitted cover. If the drawing shows the company's own account holding client funds beyond transit, the business is not a software vendor, whatever the website says.

The RNKO case adds a second test. Its stated failure was in monitoring and reporting, so the monitoring system has to exist and has to work before the first live transaction. That means a named compliance officer with real authority, transaction-monitoring rules suited to the customer base (merchants, not consumers, in RNKO's case), and an escalation route that reaches senior management. A tool bought in and left on default settings will not meet that test.

Payments firms usually outsource cloud hosting, card processing, identity checks and monitoring software. The CBUAE regulation puts the duties on the licensed provider: user records must be restorable if lost, damaged or destroyed, and records on personal and payment data are kept for 5 years from receipt. For each material provider, note where it operates, whether it holds those records, and what happens to them if it fails or exits.

Personal data adds a legal layer. Federal Decree Law No. 45 of 2021 on personal data protection came into force on 2 January 2022 and, per the UAE Government portal, covers processing carried out fully or partly through electronic systems, inside or outside the UAE. The UAE Data Office is the federal regulator. A payments company handles identity and transaction data by definition, so its vendor map should also show where that data goes.

The CBUAE regulation asks for an organisation chart that names the responsible individual for each division, department or unit, with separate risk management, internal audit and compliance functions. So the people who run the company must be findable, reachable and able to decide. A board that meets once a year abroad, with day-to-day staff elsewhere, is a harder case to present than a management team that sits where the regulated work happens.

RNKO's merchants were told to approach a temporary administration about their funds. Few founders write the equivalent plan for their own company, but a regulator will ask for one: if the firm stops trading tomorrow, how do customers get their money back, who tells them and who pays for it?

A usable wind-down plan names the segregated client money account with a licensed bank that keeps customer funds apart from the firm's own funds, the staff who stay on, the data that must be handed over, and the partners who need notice. It also states how long customers would wait. The CBUAE regulation requires a continuity programme that covers orderly scale-down of critical operations, and a plan written after a problem starts will be much weaker than one tested in advance.

For a payments firm the licence drives the location more than the trade licence does. The CBUAE regulation defines the applicant as a company incorporated in the UAE, so the entity exists before the application, and the CBUAE encourages management to meet its Licensing Division before filing. Whether a mainland company or a free-zone company is the better holding vehicle depends on what the regulator approves, where staff sit and which banks will open accounts. The wider choice between free-zone and mainland licensing is easier once the regulated function is known. Founders who relocate also need residence visas, and the visa route follows the entity.

Bank onboarding for a payments company is demanding because the bank sees the company as a source of risk. Bring the money-flow map, the compliance structure, the ownership chart, the wind-down plan and expected monthly transaction values, since the capital tier turns on that average. That pack is how Velarozone works with payments founders: the evidence is assembled before an application is made.