How to Set Up a BNPL or Consumer-Credit Fintech in the UAE

The CBUAE's Finance Companies Regulation created a defined category, Short-Term Credit, for consumer credit granted for a fixed period against the purchase of identified goods or services. It brought buy-now-pay-later products formally inside the regulatory perimeter, regardless of how the retailer or the app markets the product. Only two routes extend this credit lawfully: a Restricted Licence Finance Company authorised by the CBUAE for the purpose, or an Agent contracted to a licensed bank or finance company that already holds that authorisation. The regulator sets the conditions attached to this category, including limits on the amount advanced and on the fees charged, and those limits need checking against the Central Bank's current rulebook before a product is priced, because they are set by the regulator and not by the platform.

The label on the product does not decide the licence question; the function does. A screen that lets a customer defer payment, split an invoice into instalments, or avoid an upfront charge is a credit decision the moment a lender absorbs the risk of non-payment. Test the product against this list before choosing a jurisdiction or an entity type: who initiates the transaction, who carries the credit risk, who sets the repayment schedule, who handles a missed payment, and who services the account afterwards. A platform that performs all of these itself needs the CBUAE's authorisation in its own right; a platform that leaves the lending decision and servicing to a licensed institution can operate on a narrower commercial licence for everything else. A platform where clinicians treat patients is covered in the telemedicine guide, which sets out the health authority rules.

A BNPL business almost always does two things at once: it lends, and it moves money between the customer, the merchant and itself. The second function sits under a separate regime, the CBUAE's Retail Payment Services and Card Schemes Regulation, which licenses providers across nine categories (payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic and cross-border fund transfers, payment tokens, payment initiation and payment account information services, plus a separate licence for payment card schemes) and excludes stored-value facilities and remittances from its scope. A business that issues its own payment accounts or acquires merchants directly needs a licence for that function as well as for the credit; most BNPL platforms instead route settlement through a licensed bank or payment service provider and keep their own authorisation limited to the lending. The same split applies to businesses building a card-based or merchant-acquiring product, covered in payment gateway and merchant acquirer setup.

The entity a customer contracts with has to be able to answer for the product, either under its own CBUAE authorisation or under a sponsor's. A group can still put technology, brand and intellectual property in a separate operating company, but the licensed entity needs a genuine credit function: a credit committee or equivalent decision-maker, a compliance officer answerable to the CBUAE, and management the regulator is satisfied has relevant finance experience. Banks and sponsor institutions both start from the same question (whose licence covers this flow of money) and test banking readiness alongside the credit file, so the ownership chart, the credit policy and the funding plan have to tell one consistent story. Early documentation work, including the credit policy and the product's money-flow description, is easier to get right with structured business plans and documentation than written after a sponsor or a bank has already asked for it.

Marketing a product as interest-free does not change its licence category; several ventures have built around that assumption and had to restructure before launch. Handing underwriting to a partner while keeping legal responsibility for the credit decision is another: the regulator and the bank both hold the licensed entity accountable, not the technology supplier doing the scoring. A funding plan that assumes receivables will always be saleable, rather than committed in advance, is a common gap once volume grows. And treating collections, hardship and complaints handling as something to design after launch, rather than before, is the detail sponsor institutions test hardest during diligence.

A Short-Term Credit authorisation or an agency agreement is the start of operating, not the end of it. Key roles (the credit decision-maker, the compliance officer, anyone the CBUAE requires to be resident) need UAE visas and, typically, a physical presence the regulator can inspect. The licence is subject to ongoing CBUAE supervision and periodic renewal, and the business still carries the same federal obligations as any other UAE company: registration with the Federal Tax Authority (FTA) for corporate tax, and for VAT if turnover crosses the threshold the FTA sets. None of this is optional because the product looks like a payment feature rather than a loan.