Guide
Setting Up a Digital Wallet or Stored-Value Business in the UAE
The short answer
The Central Bank of the UAE (CBUAE) decides. It issues the Stored Value Facilities Regulation, the Retail Payment Services and Card Schemes Regulation and the Payment Token Services Regulation, and a wallet that holds redeemable customer value falls inside this rulebook whatever the app calls itself. A commercial licence does not permit you to hold customer money. What decides the route is a single question: who owes the balance to the user, you or a licensed institution you build on.
What a wallet is, legally
The word wallet covers four different things. It can be an interface onto an account that someone else holds. It can record stored monetary value that the customer can redeem. It can hold payment tokens or virtual assets. Or it can be a closed-loop balance usable only with one merchant or group.
The regulatory result differs for each. An interface that only displays accounts held elsewhere sits in a very different place from a balance you owe on demand. The test is functional. If a user can load money, keep a balance and later spend, transfer or withdraw it, you are close to the stored value perimeter, and the CBUAE's Stored Value Facilities Regulation is the document to read first.
Who decides, and what you are applying for
The CBUAE's rulebook is the starting point for onshore wallet products. Three of its regulations bear on a wallet:
- the Stored Value Facilities Regulation, for holding and redeeming customer value;
- the Retail Payment Services and Card Schemes Regulation, for payment initiation, issuing and related services;
- the Payment Token Services Regulation, if the product touches payment tokens.
Which of them apply depends on features, so list the features before you read the rules. A wallet that only stores value is one conversation. Add card issuance or payment initiation and a second regulation joins it. Add tokens and a third does.
The rulebook sets capital, safeguarding and governance terms for each category. When the CBUAE issued the SVF Regulation in December 2020 it lowered the capital requirement from AED 50 million to AED 15 million, but confirm the current figure for your category before applying. Where the product involves virtual assets, the VARA route belongs in the same discussion.
Licence or licensed institution
Most founders do not need to hold every permission themselves. A licensed institution can carry the regulated function while you build the product, the brand and the customer relationship. The choice is real and it changes everything downstream.
Holding the authorisation means your balance sheet backs the product. You meet the regulator's capital and governance expectations, you appoint the people the regulation requires, and you answer to the CBUAE directly.
Building on a licensed institution means the institution's licence covers the regulated functions, and your contract with it governs what you can offer. The trade is dependency. Its risk appetite becomes your product roadmap, and a change in its policy can change your features.
Decide this feature by feature. A common pattern is to launch on a licensed institution, prove the product, and move functions in-house as volumes justify the capital. Write down which functions you perform, which the institution performs, and which roadmap features would shift the split. Regulators, institutions and banks read that document with different eyes, so it must tell one consistent story. Fintech setup work usually starts with exactly this map.
How money moves, and what a bank or sponsor reads
Banks and licensed institutions begin from the same question: whose licence covers each flow of money? Be ready with:
- an end-to-end fund-flow diagram, from top-up to redemption;
- the safeguarding model, showing where customer money sits and that it is separate from your own funds;
- ledger and reconciliation design;
- fraud, chargeback and complaint procedures;
- product terms and a fee schedule.
Dormant balances deserve their own line. A wallet accumulates unclaimed value, and the terms need to say what happens to it and who is responsible.
The same facts must appear in the product, the contracts, the regulatory position and the bank file. Inconsistency is the commonest reason diligence stalls. Our work on corporate bank account readiness is built around that consistency check, and merchant-side acceptance raises its own questions, covered in the guide to merchant acquirer setup. Coherence removes avoidable questions. It does not guarantee an account, a sponsor or an authorisation.
People, ownership and substance
A regulated wallet needs real people in real roles. Decide early who runs compliance, who manages risk and who is accountable for safeguarding. Which roles are mandatory, and whether they must be resident, is set out in the rulebook for your category; confirm it before you recruit.
Where customer funds and a licensed function are involved, shareholders will be asked about their own funds and background. Prepare the source of wealth and funds evidence early, because it is slow to assemble. A business plan that matches the fund-flow diagram is the document that carries the application.
Group structure can place technology, intellectual property and the regulated function in different entities. Each entity needs a genuine role. A structure designed to advertise a low setup price tends to resurface later as a failed sponsor review or a stalled bank file.
What commonly goes wrong
- Describing the product as software only while users hold redeemable balances.
- Treating loyalty points as outside the rules without analysing whether they can be redeemed for money.
- Leaving safeguarding to a future conversation with a bank.
- Adding cross-border transfers, cards or crypto features after launch without reassessing the perimeter.
- Choosing a route because the formation price is low, then discovering the licence or institution the product needs sits elsewhere.
Compare complete routes rather than formation quotes. Cost depends on the route, and Velarozone's own fee is itemised in the engagement letter, as set out in how Velarozone works. Any capital or safeguarding requirement is a regulator figure, so take it from the CBUAE rulebook.

