For payment, lending, wealth, remittance and BNPL businesses
A UAE Fintech: Licence, Bank and Payments Decided Together
The short answer
A UAE fintech needs a licence from the regulator whose perimeter its activity falls inside, and the regulator decides that, not Velarozone. Payment services are licensed by the Central Bank of the UAE under its Retail Payment Services and Card Schemes Regulation, in Categories I to IV, with initial capital from AED 100,000 to AED 3 million. Securities and wealth activities sit with the SCA, the DFSA in the DIFC or the FSRA in the ADGM, and virtual assets with VARA. The money flows then decide the structure, the jurisdiction and which bank and acquirer will take the business, so we assess the activity, prepare the business plan, the AML programme and the policies, and coordinate the licence, bank and payments applications together.
A payments, lending, wealth, remittance or BNPL business starts with perimeter: which of its activities is regulated, and by whom. The Central Bank of the UAE licenses retail payment services, stored value facilities, exchange business, finance companies and loan-based crowdfunding, and lists licence types on its public register. The Securities and Commodities Authority, the DFSA in the DIFC and the FSRA in the ADGM license investment and wealth activities, and VARA licenses virtual assets. A product that straddles two of these can sit under more than one regulator, or under none, depending on whether client money and credit extension sit inside it or with a separately licensed institution, and the regulator makes that call. Regulatory consulting reads the activity against each perimeter before a jurisdiction or a licence is chosen.
The perimeter answered, the operating model decides the rest. Under the Central Bank's payments regulation a provider may hold customer funds only while they are in transit, and settlement time sets the safeguarding. Funds settled within 24 hours must be segregated and insulated from the provider's other creditors. Funds settled after 24 hours need a restricted escrow account with a bank, cover from an insurer or bank outside the group, or both. Monthly payment value sets the capital, with AED 10 million a month as the dividing line. A bank reads those flows and that safeguarding arrangement with the licence category before it opens a settlement account, and an acquirer reads the same file before enabling a payment method. A licence chosen before those questions are answered may not bank.
At a glance
- Indicative cost
- Regulator fees, where any, are the regulator's; the Velarozone service fee for the perimeter assessment, the documentation and the coordination is itemised in your engagement letter. Initial capital for a Central Bank payment licence is a separate requirement, set by category, and must be held when the licence is granted.
- Timing
- The perimeter assessment in days; the documentation and the AML programme take the time a genuine build takes; the regulator's, the bank's and the acquirer's reviews each run on their own clock. The Central Bank encourages management to meet its Licensing Division before a formal application, so that meeting comes before the filing.
- What's included
- The activity placed against the right regulator's perimeter
- The business plan, financial model and AML programme built together
- The bank and acquiring file coordinated with the licence
This is for you if
- You run, or are launching, a payments, lending, wealth, remittance or buy-now-pay-later business, in the UAE or expanding into it.
- You are not yet sure which regulator your activity sits under, or whether it needs a licence at all.
- You need a bank and an acquirer that will actually take the business, not just a licence that issues.
- You want the AML programme, the compliance roles and the documentation built before the regulator asks for them.
This may not be the right route if
- You already hold the regulator's licence and need only the next ordinary filing; that is a narrower compliance engagement.
- You want a jurisdiction chosen for its cost before the activity has been placed against a regulator's perimeter.
- You expect a regulator's approval, a bank's appetite or an acquirer's pricing to be promised in advance.
At a glance
- Indicative cost
- Regulator fees, where any, are the regulator's; the Velarozone service fee for the perimeter assessment, the documentation and the coordination is itemised in your engagement letter. Initial capital for a Central Bank payment licence is a separate requirement, set by category, and must be held when the licence is granted.
- Timing
- The perimeter assessment in days; the documentation and the AML programme take the time a genuine build takes; the regulator's, the bank's and the acquirer's reviews each run on their own clock. The Central Bank encourages management to meet its Licensing Division before a formal application, so that meeting comes before the filing.
- What's included
- The activity placed against the right regulator's perimeter
- The business plan, financial model and AML programme built together
- The bank and acquiring file coordinated with the licence
What this service includes
- The activity assessed against the Central Bank, the Securities and Commodities Authority, the DFSA, the FSRA and VARA's perimeters, before a jurisdiction or a licence is chosen.
- The operating model and money flows mapped, so the structure and the licence category fit how the business actually moves money.
- The business plan, the financial model and the policies a licence application needs, prepared through business plans and documentation.
- The AML programme drafted and the compliance roles (MLRO, compliance officer, risk and audit where required) identified and resourced, with source of wealth and funds evidenced through source of wealth and funds wherever the regulator or the bank asks for it. For a Central Bank payment licence, that includes the source of the funds that make up the initial capital.
- The bank and acquiring file built around the flows and the safeguarding arrangement; where the activity touches virtual assets, the same file extends into VARA's virtual-asset framework.
What it does not include
- The regulator's decision on the licence category, the conditions attached to it, or its timeline.
- The bank's or the acquirer's decision, its pricing, or a named bank or acquirer in advance.
- Legal drafting of the regulator's application forms, and legal opinions on the law, which come from a licensed law firm we coordinate. That includes the legal opinion on payment tokens that the Central Bank requires with a Category I application.
Process
How the work is sequenced
Each stage has its own dependencies (activity approvals, document legalisation, authority processing, and bank review), and we report progress against them rather than against one overall date.
- 01
Perimeter
The activity read against each regulator's perimeter; the licence question answered before anything else.
- 02
Operating model
Money flows, customer base and expected volumes mapped to decide the structure and the jurisdiction.
- 03
Documentation and AML
The business plan, the financial model, the policies and the AML programme drafted together.
Ownership spread across a group, several shareholders or a holding structure as well? The complex-ownership page covers that question.
Prefer to start in writing? Send the details through the contact form.
Start with a structure assessment
In an initial consultation you receive a plain-language decision summary, a document-preparation list, and the next actions for your situation. Current figures are confirmed within your adviser-reviewed route comparison.
Perimeter first
Where a fintech activity sits, and what that decides
The regulator decides the perimeter; everything below follows from where the activity lands in it.
What a regulator or a bank asks of a fintech, and what is prepared for each.
Perimeter
- What the regulator or the bank asks
- Does the activity need a licence, and from which regulator: the Central Bank, the SCA, the DFSA, the FSRA or VARA. At the Central Bank, which of Categories I to IV the services fall in.
- What we prepare
- The activity read against each regulator's perimeter before a jurisdiction is chosen
Operating model
- What the regulator or the bank asks
- Who holds customer money between legs, and for how long: the Central Bank sets different safeguarding for settlement within 24 hours and after 24 hours.
- What we prepare
- The flow of funds mapped with settlement times, so the licence category and the segregation or escrow arrangement match it.
Structure and jurisdiction
- What the regulator or the bank asks
- Does the legal structure and the chosen jurisdiction fit the activity and the capital it needs: the Central Bank licenses a company incorporated in the UAE under the Commercial Companies law, with initial capital from AED 100,000 to AED 3 million by category.
- What we prepare
- A structure and a jurisdiction chosen against the activity and the capital category, not against the lowest fee, with the source of the initial capital funds documented.
Banking and payments
- What the regulator or the bank asks
- Can a bank keep the settlement account, and can an acquirer enable the payment method the licence implies
- What we prepare
- The bank and the acquirer file built around the flows, the safeguarding arrangement and the licence
AML and compliance roles
- What the regulator or the bank asks
- Is there a risk assessment, a programme and an appointed officer the regulator will recognise
- What we prepare
- The AML programme drafted and the compliance roles identified before the application is lodged
Documentation
- What the regulator or the bank asks
- Whether the business plan and the financial model support what the application claims. With no transaction data yet, the Central Bank sizes the capital tier from their projections.
- What we prepare
- The business plan, the financial model and the policies prepared for the application, with volume projections that can carry the capital tier applied for.
| Question | What the regulator or the bank asks | What we prepare |
|---|---|---|
| Perimeter | Does the activity need a licence, and from which regulator: the Central Bank, the SCA, the DFSA, the FSRA or VARA. At the Central Bank, which of Categories I to IV the services fall in. | The activity read against each regulator's perimeter before a jurisdiction is chosen |
| Operating model | Who holds customer money between legs, and for how long: the Central Bank sets different safeguarding for settlement within 24 hours and after 24 hours. | The flow of funds mapped with settlement times, so the licence category and the segregation or escrow arrangement match it. |
| Structure and jurisdiction | Does the legal structure and the chosen jurisdiction fit the activity and the capital it needs: the Central Bank licenses a company incorporated in the UAE under the Commercial Companies law, with initial capital from AED 100,000 to AED 3 million by category. | A structure and a jurisdiction chosen against the activity and the capital category, not against the lowest fee, with the source of the initial capital funds documented. |
| Banking and payments | Can a bank keep the settlement account, and can an acquirer enable the payment method the licence implies | The bank and the acquirer file built around the flows, the safeguarding arrangement and the licence |
| AML and compliance roles | Is there a risk assessment, a programme and an appointed officer the regulator will recognise | The AML programme drafted and the compliance roles identified before the application is lodged |
| Documentation | Whether the business plan and the financial model support what the application claims. With no transaction data yet, the Central Bank sizes the capital tier from their projections. | The business plan, the financial model and the policies prepared for the application, with volume projections that can carry the capital tier applied for. |
The service
Regulatory consulting and fractional roles
How the perimeter assessment, the licensing advisory and the AML programme are done, and which compliance roles a regulated business can take on a fractional basis.
See the consulting service
Every route is planned against how the business will actually operate in the UAE.
After the licence
What you may also need
The four services most founders in this situation ask about next, each on its own page.
Visas & PRO services
Residence visas for owners, staff and family, plus the MOHRE labour files, medicals and Emirates ID renewals that keep a licence and its people in good standing. A sponsored visa lasts 1, 2 or 3 years; approval stays with the authority.
→UAE bank account setup
A bank-ready file built around your ownership, activity and expected transactions, matched to the bank whose risk appetite suits your profile. The bank alone decides approval and timing.
→Accounting & tax
Monthly bookkeeping, VAT and corporate-tax filings and year-end accounts, with statutory audit signed by a registered auditor.
→Legal services
Contracts, corporate documents, disputes and regulatory matters, advised by lawyers licensed to practise in the UAE and named in the engagement letter.
→
Questions
Frequently asked
- Does Velarozone decide which regulator my fintech needs?
- No. Each regulator, whether the Central Bank of the UAE, the Securities and Commodities Authority, the DFSA, the FSRA or VARA, publishes its own perimeter. The Central Bank, for example, sorts payment services into Categories I to IV. We read the activity against each perimeter and bring back where it appears to fall, before any jurisdiction or licence is chosen.
- Can I choose the cheapest jurisdiction and fix the regulatory question later?
- Not without risk. The activity decides which regulator applies and which jurisdictions that regulator licenses in. A Central Bank payment licence, for instance, goes to a company incorporated in the UAE under Federal Law No. 2 of 2015 on Commercial Companies, with initial capital set by category. A jurisdiction chosen first and reconciled with the activity afterwards is usually the one that has to be unwound.
- Will a bank open an account once I have the licence?
- A licence is necessary, not sufficient. The bank reads the licence category together with the money flows and the safeguarding arrangement, and sets its own appetite for the activity. Where a provider settles after 24 hours, the Central Bank's rules themselves call for an escrow account with a bank or cover from an insurer or bank outside the group. We build that file alongside the licence application rather than after it.
- Do I need a compliance officer from day one?
- Most regulators expect an appointed officer, an MLRO, a compliance officer or both, in place at licensing, not added afterwards. For a Central Bank payment licence the AML Law is Decree Federal Law No. (20) of 2018 with Cabinet Decision No. (10) of 2019. We identify which roles the activity needs and resource them, including on a fractional basis, before the application is lodged.
- What if my product touches virtual assets as well as fiat payments?
- Then more than one regulator's perimeter can apply. VARA's framework sits alongside whichever authority licenses the fiat side, and the Central Bank separately licenses Payment Token Services, which only a Category I licence covers. A Category I applicant files a list of its payment tokens and a legal opinion on them. We read the perimeters together rather than treat the virtual-asset feature as an afterthought.
Sources
- Central Bank of the UAE, the UAE banking and payments regulator
- Securities and Commodities Authority (SCA)
- DFSA, the Dubai Financial Services Authority (DIFC)
- FSRA, the Financial Services Regulatory Authority (ADGM)
- Virtual Assets Regulatory Authority (VARA)
- UAE AML/CFT framework guidance
Regulations, fees, and eligibility can change. Every regulatory statement is re-checked before publication and dated above.
Legal notes and scope
Velarozone provides setup and operational-readiness coordination. This page is general information, not legal, tax, immigration, or banking advice.
General information drawn from the CBUAE Rulebook, including the Retail Payment Services and Card Schemes Regulation (C 15/2021), and Cabinet Resolution No. (134) of 2025 as published, not legal or tax advice. Rules and guidance change, so confirm the current text and each institution's own requirements before you submit.
Which activities are regulated, by which authority and on what conditions is decided by the regulator; nothing here asserts a licence category or approval it has not published or decided. Customer money a fintech safeguards is held under the relevant regulator's rules: under the Central Bank's payments regulation that means segregation, or an escrow account, insurance or a bank guarantee where settlement takes longer than 24 hours. Velarozone assesses, prepares and coordinates, and does not itself hold a payments, lending or virtual-asset licence.