Payment Service Providers In The UAE: Legal Frameworks And Licensing Demystified

Introduction

As the United Arab Emirates ("UAE") accelerates toward becoming a leading global hub for digital finance and innovation, its payments ecosystem has evolved into a cornerstone of this transformation. With a sharp rise in electronic transactions and consumer demand for seamless, cashless experiences, Payment Service Providers (PSPs) have emerged as vital enablers of modern commerce. However, operating as a PSP in the UAE is not merely a technological undertaking—it requires navigating a highly structured and sophisticated regulatory environment.

Several well-known global and regional players have successfully obtained PSP licenses across different jurisdictions in the UAE, reflecting the growing maturity and strategic importance of the country's payments ecosystem. For instance, Amazon Payment Services, a subsidiary of Amazon, holds a PSP license in the UAE mainland regulated by the Central Bank of the UAE. Similarly, Telr and Checkout.com, two prominent payment gateways, operate under PSP licenses and are regulated either through the mainland or the DIFC. In the ADGM, NymCard and TPAY Mobile are licensed entities providing digital payment infrastructure and stored value services. These companies exemplify the diverse range of licensed PSPs that support e-commerce, fintech innovation, and cross-border digital commerce in the region, reinforcing the UAE's position as a regional leader in regulated digital finance.

This article provides a comprehensive analysis of the licensing regimes applicable to PSPs across the UAE mainland, DIFC, and ADGM, equipping businesses with the legal insight and strategic clarity necessary to enter and thrive in one of the world's most dynamic financial markets.

Understanding Payment Service Provider (PSPs)

At its core, a PSP is a third-party intermediary that facilitates payments between merchants and customers. It acts as the interface between merchants, consumers, and financial institutions (such as banks) to ensure a smooth, secure, and rapid transfer of funds. PSPs enable businesses to accept various forms of payments such as debit cards, credit cards and other alternative payment options by integrating them into a single platform, making transactions convenient for customers and manageable for merchants.

PSPs perform a diverse range of key functions including but not limited to:

• Payment Processing: Overseeing transactional authorisation, clearing and settlement as funds move from the customer's account to the merchant's account.
• Payment Aggregation: Allowing aggregation and settlement of funds where multiple customers are involved utilising different payment methods. It enables merchants to accept various payment methods, such as credit cards, debit cards, UPI, net banking, and digital wallets in a simplified manner.
• Gateway Services: Facilitating transfer and processing of information from a customer to the merchant's acquiring bank (an acquiring bank is a financial institution which processes payments on behalf of the merchant/seller).
• Currency Conversion: Facilitating seamless currency conversion where cross-border transactions are involved.

Jurisdiction-wise PSP Licenses and Legal Framework within the UAE

PSP activities in the UAE can be organised in mainland UAE or within either of the two financial free zones, i.e., the Dubai International Financial Centre ("DIFC") or the Abu Dhabi Global Market ("ADGM"). Each houses a comprehensive and distinct legal framework administered by their respective authorities, warranting a meticulous and interdisciplinary understanding of key regulatory considerations. Some key aspects are discussed below.

Mainland UAE

Legal Framework

PSPs in mainland UAE are regulated by the Central Bank of the U.A.E ("CBUAE"). Under the Central Bank & Organization of Financial Institutions and Activities Law ("CB Law"), financial activities and services are subject to CBUAE licensing and supervision. These licensed financial activities include those performed by PSPs such as currency exchange and money transfer services, monetary intermediating services, stored value services, electronic retail payments and digital money services.

Pursuant to the CB Law, the CBUAE has promulgated the Retail Payment System Regulations ("RPS Regulations") and the Retail Payment Services and Card Schemes Regulations ("RPSCS Regulations") to govern retail payment systems and services. While the RPS Regulations govern the broader retail payments infrastructure with a focus on settlement institutions and system operators, the RPSCS Regulations govern digital payment services in various forms and are the focus of the present part.

The RPSCS Regulations include the following nine retail payment services within their ambit and require a license to be obtained from the CBUAE prior to operation:

• Payment Account Issuance Service: Includes all services related to opening a payment account, deposit/withdrawal of cash and other necessary modalities of operating a payment account.
• Payment Instrument Issuance Service: Includes provision of payment instruments (which may include personalised devices, payment cards such as debit or credit cards or agreed procedures) by a PSP to a user which enables the user to initiate payment orders and process different transactions.
• Merchant Acquiring Service: Includes services where the PSP contracts with the payee (usually a merchant) to accept and process payments resulting in a transfer of funds to the payee.
• Payment Aggregation Service: Includes aggregation of various payment instruments from retail payment service users and facilitates a connection between the merchants and merchant acquirers (banks) by pooling and aggregating funds received from users and subsequently transferring them to merchants.
• Domestic Fund Transfer Service: Accepting money or arranging for execution of payment transactions where both payer and payee are within the UAE.
• Cross-border Fund Transfer Service: Transfer of funds in which the PSPs of the payer and the payee are located in different jurisdictions.
• Payment Token Service: Includes issuing of payment tokens (a type of crypto-asset that is backed by one or more fiat currencies and can be digitally traded without having legal tender status).
• Payment Initiation Service: Initiating a payment order on behalf of a retail user with respect to a payment account held at another PSP.
• Payment Account Information Service: A service to provide consolidated information on one or more Payment Accounts held by a user with either another PSP or with more than one PSP.

It may be noted that PSPs undertaking issuance of payment tokens and stored value facilities ("SVF"), such as provision of digital wallets, may have to additionally comply with the Payment Token Services Regulations ("PTS Regulations") and Stored Value Facilities Regulations ("SVF Regulations").

License Conditions and Requirements

The RPSCS Regulations provide for a tiered licensing framework based on the nature and scope of payment services offered. A snapshot of the same is provided below.

*AED 10 million threshold refers to the monthly average value of payment transactions.

Obtaining a PSP license in the UAE is a rigorous process and is accompanied by the following key regulatory considerations:

• Principal Business Activity: Providing payment services must be the principal business activity of the PSP in furtherance of which it has obtained a license. Operating any service ancillary to the payment service would require prior approval of the CBUAE.
• Aggregate Capital Funds ("ACF"): PSPs must at all times hold and maintain ACF not falling below the initial capital requirements for the relevant license category. CBUAE may impose higher ACF requirements than those prescribed depending upon the complexity and scale of the PSP's business.
• Corporate Governance: PSPs must maintain effective, robust and well-documented corporate governance arrangements, including a clear organizational structure with well-defined, transparent and consistent lines of responsibility. This includes a clear organisational structure, controls on conflict of interests, integrity and transparency of operations, methods for maintenance of confidentiality and regular monitoring of corporate governance arrangements.
• AML/CFT Compliance: PSPs must comply with AML/CFT norms under UAE Law, namely Decree Federal Law No. (20) of 2018 on Anti-money Laundering and Combating the Financing of Terrorism and Illegal Organisations and accompanying cabinet decisions and regulations.
• Risk Management: PSPs must have and maintain robust risk management policies and procedures to identify, manage, monitor and report the risks arising from the provision of retail payment services and such policies must be kept up to date, reviewed annually and should be proportionate to the nature, scale and complexity of the services provided.
• Accounts and Audit: PSPs must appoint an auditor annually and prepare financial statements on a standalone or financial basis in accordance with accepted accounting standards and practices. CBUAE may call upon the auditor or PSP to submit an audit report as well as submit any additional information, enlarge, or extend scope of audit and carry out any other examination.
• Record Keeping and Data Protection: PSPs shall keep all necessary records of personal and payments data for a period of 5 years from date of receipt and shall have in place and maintain payment and personal data protection controls in accordance with UAE laws on the protection of personal data.

In addition to the above retail payment services, the RPSCS Regulations also impose conditions in respect of card schemes. A card scheme is defined as a single set of rules, practices and standards that enable a holder of a payment instrument (such as a debit or credit card) to effect the execution of card-based payment transactions within the UAE separate from any infrastructure of payment system that supports its operation. All card schemes operating within the UAE must obtain a prior license from the CBUAE and must adhere to prescribed license conditions, fit and proper requirements, reporting requirements, internal controls & audits and information security requirements.

DIFC

The DIFC is an economic free zone designed to be a global financial hub, operating under its own legal and regulatory framework based on English common law. It offers numerous attractive advantages such as zero-tax up to 50 years (from 2004), insulation from mainland regulators and a strategic geographical advantage. Financial services businesses in the DIFC are regulated by the Dubai Financial Services Authority ("DFSA").

Legal Framework

The DFSA has framed its own set of rules ("DFSA Rulebook") and developed a complete code of law governing financial services. Under the DIFC Regulatory Law of 2004, a person may carry on one or more financial services if such person is an authorised firm holding a license to carry on such financial services. The DFSA Rulebook includes various activities within the scope of 'financial service', including the provision of money services.

Provision of money services has been defined to include the following activities:

• Providing Currency Exchange
• Providing Money Transmission
• Providing or Operating a Payment Account
• Executing Payment Transactions on a Payment Account provided or operated by another Person
• Issuing Payment Instruments
• Issuing Stored Value.

A 'payment service' under the Rulebook means an activity referred to in the definition of money services (above) other than providing currency exchange or issuing stored value. A PSP is construed accordingly. However, PSPs may undertake currency exchange and stored value services including arranging/advising on money services (such as Account Information Services and Payment Initiation Services) subject to obtaining appropriate authorisations under their license.

License Conditions and Requirements

Under DIFC law, an authorized firm may be licensed in one of 8 different categories which cover different distinct financial activities. An authorized firm may, however, conduct any financial activity specified under a lower license category than the one it applies for, subject to DFSA approval. PSPs, depending on the nature and extent of payment services that they offer, may fall under 3 relevant license categories. Each set of license categories is accompanied by varying capital requirements. A snapshot of the same is provided below:

Similar to the UAE, the DIFC follows a tiered licensing structure with different options depending upon the scale of the business of the PSP. For instance, a PSP looking to provide only money transmission services in or from the DIFC may opt for a Category 4 License while one looking to undertake a larger operation with a multifarious scope of services may choose a Category 3C license with additional authorisation for other financial services as may be necessary.

Following are the key points to be noted while obtaining a PSP license in the DIFC:

• Structural Flexibility: A PSP may be organised as a partnership or body corporate under DIFC law.
• 'By way of Business' Requirement: An authorised firm providing financial services in the DIFC must carry on such activities by way of business. PSPs providing financial services as nominees or carrying on such activities solely as principal with or for their group companies/JV partners are not organised 'by way of business.'
• Capital Requirements: As denoted in the table above, the capital requirement of a PSP holding a license in Categories 3C, 3D & 4 is calculated as the highest of the:
• 1. Base Capital Requirement
  2. Expense Based Capital Minimum
  3. Stored Value Capital Requirement (where the PSP issues stored value)
  4. Transaction Based Capital Requirement
  5. Aggregate of Stored Value Capital Requirement and Transaction Based Capital Requirement (where the PSP offers both services)
• Mandatory Appointments: An authorised firm in the DIFC must mandatorily appoint and have at all times a Senior Executive Officer ("SEO"), Finance Officer ("FO"), Compliance Officer ("CO") and a Money Laundering Reporting Officer ("MLRO"). The SEO, CO and MLRO must be UAE residents. An individual may perform more than one of these licensed functions concurrently subject to meeting appropriate requirements.
• AML/CFT Compliance: An authorised firm carrying on activities in or from the DIFC must comply with the Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module under the DFSA Rulebook. AML/CFT obligations pertinent to PSPs include, inter alia, maintenance of a complete, current and accurate register of all agents used by PSP to conduct its money services business; assessing relevant information about the payer, payee and any beneficiary when executing payment transactions to determine suspicious activities etc.
• Additional Disclosures: PSPs are subject to disclosure requirements in relation to a service user including but not limited to information relevant to details of rates, fees and charges, transmission of information, confirmation of transactions and safeguards and corrective measures.
• Professional Indemnity Insurance: A PSP holding a Category 3C/3D/4 License must take out and maintain professional indemnity insurance cover appropriate to the size, nature, complexity and risk profile of the PSP's business.

All in all, DIFC offers a robust and streamlined legal and regulatory environment for the operation of PSP business. It has also facilitated innovation in the field of financial services and technology by instituting a simplified regulatory framework under an Innovation Testing License ("ITL").

The ITL allows emerging businesses and start-ups to test innovative financial products in a regulatory sandbox (tailored to the specific business proposal) for a limited time period by setting up an office in the DIFC. This time period normally ranges from 12 to 24 months, upon completion of which the applicant would be expected to either carry on its business on a broader scale (complying with all relevant legal and regulatory requirements) or cease operations in the DIFC.

In this regard, the DFSA may also grant exemptions from prudential requirements (including capital requirements under different license categories) subject to the applicant showcasing a demonstrable need for the same.

ADGM

Established in 2015, ADGM quickly rose through the rankings and is now one of the top 25 financial centres in the world. Similar to the DIFC, ADGM is an international financial center operating under its own common law jurisdiction in the MENA region, offering a business-friendly environment with 100% foreign ownership and unique tax benefits.

Legal Framework

The Financial Services Regulatory Authority ("FSRA") is the independent financial services regulator of the ADGM. Under ADGM law, obtaining a money services or PSP license is governed by Financial Services and Markets Regulations, 2015 ("FSMR Regulations") and, more generally, the ADGM Rulebook. Under the FSMR Regulations, provision of money services/payment services is a regulated activity and requires a 'financial services permission' ("FSP") from the FSRA prior to operation.

It may be noted that the ADGM Rulebook draws a key legal distinction between the provision of 'money services' and 'payment services.'

The scope of money services under the FSRA includes the following:

• Providing Currency Exchange
• Providing Money Transmission Services (including electronic transmission)

On the other hand, the scope of payment services under the FSRA includes the following:

• Providing or Operating a Payment Account (including services enabling deposit/withdrawal of cash and all necessary operations for operating a payment account)
• Execution of Payment Transactions (including direct debits, transactions through payments instruments and credit transfers between bank accounts)
• Issuing Payment Instruments
• Selling or Issuing Stored Value
• Receiving money or monetary value for transmission by means of a Payment Instrument to a location within or outside ADGM.

Accordingly, a PSP is an authorized person with an FSP to perform one or more of the above payment services. Under the Conduct of Business Module ("COB Module"), the FSRA has stipulated that the provision of payment services involves handling of 'relevant money', i.e, sums received from or for the benefit of a user in the course of the execution of a payment transaction, operation of a payment account or exchanged for a payment instrument or stored value.

Because operations of PSPs involve retaining/holding money on behalf of their users, obligations in relation to safekeeping of relevant money under Chapters 14 and 16 of the COB Module become applicable to them. However, these obligations are not applicable to an authorised person providing only 'money services', i.e., currency exchange and money remittance services.

To understand simply, while making an application to the FSRA for an FSP, an applicant must enlist the range of money services and/or payment services that it seeks to undertake by way of business. Accordingly, if it chooses to undertake any payment services involving the use of relevant money, it must enlist itself as a PSP and adhere to additional compliances under the FSRA Rulebook.

License Requirements and Conditions

Although the FSMR Regulations differentiate money services and payment services, both are covered under the Category 3C License. Following are the key requirements:

Following are the key points to be noted while obtaining a Category 3C License in the DIFC:

• Structural Flexibility: Similar to the DIFC, a PSP may be organised as a partnership or body corporate under ADGM law.
• 'By way of Business' Requirement: An authorised person in the ADGM must be organised by way of business to obtain an FSP.
• Capital Requirements: As denoted in the table above, the capital requirement of a PSP holding a Category 3C License is calculated as the highest of the:
• 1. Base Capital Requirement
  2. Expense Based Capital Minimum (where it undertakes currency exchange)
  3. Variable Capital Requirement (for money remittance services)
  4. Variable Capital Requirement (for payment account providers)
  5. Variable Capital Requirement (for stored value issuers)
  6. Total Variable Capital Requirement (summation of each category of variable capital requirement where multiple services are offered)
• AML/CFT Compliance: An authorised person carrying on activities in or from the ADGM must comply with the Anti-Money Laundering and Sanctions Rulebook under the FSRA and other relevant legislations.
• Controlled Functions: The following controlled persons must be performed by a person approved by the FSRA: Senior Executive Officer ("SEO"), Senior Manager ("SM") Licensed Director/Partner, Finance Officer ("FO"), Compliance Officer ("CO"), and a Money Laundering Reporting Officer ("MLRO") and Responsible Officer ("RO"). An individual may perform more than one of these licensed functions concurrently subject to meeting appropriate requirements.

Conclusion

The UAE's strategic vision to become a global leader in the digital economy has created a fertile environment for PSPs. This growth has been accompanied by a robust and evolving regulatory framework designed to ensure financial stability, protect consumers, and combat financial crime.

Applicants must approach the licensing process with a clear understanding of the distinct regulatory landscapes governed by the CBUAE for mainland operations, and the DFSA and FSRA for the financial free zones of DIFC and ADGM respectively. The journey to obtaining a PSP license in the UAE is not without its complexities, demanding substantial investment in capital, technology, and human resources. For instance, capital requirements for an all-inclusive license can be expensive, ranging from $250,000 (equivalent AED 900,000 approximately) for a Category 3C License in ADGM to AED 1.5 million for a Category-1 License in mainland UAE and $500,000 (equivalent AED 1.8 million approximately) for a Category 3C License in the DIFC, being the most expensive.

For well-prepared and compliant entities, the rewards are considerable: access to a rapidly growing, innovation-driven market, a strong legal and regulatory environment that fosters trust, and the opportunity to be at the forefront of digital payment transformation in one of the world's most dynamic regions. By prioritizing robust governance, stringent compliance, and strategic planning, PSPs can confidently navigate the regulatory maze and build a successful presence in the thriving UAE market.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.