UAE's New Central Bank Law Sets a September 2026 Reconciliation Deadline for Banks, Insurers and Fintechs

The United Arab Emirates rewrote the legal foundations of its financial sector in 2025, and regulated firms were given a fixed period to catch up. Federal Decree-Law No. 6 of 2025, known as the Central Bank Law, came into force on September 16, 2025. It repealed the earlier Central Bank legislation of 2018 and the standalone insurance law, Federal Decree-Law No. 48 of 2023, and placed banking, payments, open finance and insurance regulation under one statute administered by the Central Bank of the UAE (CBUAE). This article is based on published analyses by the law firms Norton Rose Fulbright and Hadef & Partners. An earlier version of this article described some details more loosely than those sources do, so the figures below follow the firms' own wording, and where they differ, that is noted. It is general information and not legal advice.

What does the law do? The law consolidates regulation that had been spread across several instruments. Insurance, which was moved under the central bank in 2020 when the former Insurance Authority was merged into it, no longer sits in a standalone statute. The same regulator now supervises banks, payment providers, insurers and other licensed financial institutions under one framework, with powers to examine and, where needed, penalise.

What is the reconciliation deadline? Article 184 gives persons subject to the law one year from commencement to reconcile their positions with its requirements. Norton Rose Fulbright gives the end of that period as September 16, 2026, while Hadef & Partners refers to 15 September 2026 under Article 184. The one-day difference reflects different ways of counting the year; firms should rely on the Central Bank's own statements. Both firms note that the Central Bank's board may extend the period where appropriate, and Hadef & Partners reported that no general extension had been announced at the time of its article. Because that date has now passed, readers should check the CBUAE website for any extension or guidance issued since, and this article does not say whether any firm has been found non-compliant.

What is the new regulatory perimeter? Article 61 lists activities that require a licence, including deposit-taking, credit and funding, open finance, money transfer, virtual-asset payment services, stored-value and digital money services, and certain promotion or marketing of licensed activities. Article 62 adds that using a particular technology or business model does not by itself take an activity outside the perimeter. According to the law firms, this expressly captures certain virtual-asset payment tokens, decentralised finance, platforms, decentralised applications and supporting technological infrastructure. For insurers, the practical meaning is that insurtech platforms and technology providers that enable regulated activity should check whether they now need authorisation.

What are the penalties? Norton Rose Fulbright says the law raises the maximum administrative fine from AED 200 million to AED 1 billion, a fivefold increase. Hadef & Partners separately reports that carrying on licensed financial activities without the required licence or authorisation can bring imprisonment and fines from AED 50,000 to AED 500 million. These are different penalty regimes, one administrative and one criminal, which explains why two different headline numbers appear in commentary. Article 181 also allows personal consequences for responsible management where their knowledge, negligence or failure to perform duties is established, which means senior managers cannot assume that liability stops with the company.

What about existing contracts? Hadef & Partners points to Article 132, under which Central Bank regulations are not retroactive and do not stop agreements made before they were issued from being carried out. Existing loan, security and other finance documents are not invalidated or required to be re-executed. The firm describes the reconciliation deadline as a compliance date, not a date after which existing arrangements lapse.

What obligations apply to insurers? Norton Rose Fulbright notes that the law introduces specific obligations on licensed institutions, including insurance companies. They must have fraud prevention and detection systems, notify customers promptly of breaches or fraud and take immediate corrective action to limit harm. Several 2026 regulations apply as well, according to Hadef & Partners: C1/2026 on operational risk and operational resilience, issued in February 2026; C4/2026, the Insurance Company Licensing Regulation, also from February 2026, which covers branches of foreign insurers and the opening of branches and subsidiaries; C5/2026, a remuneration regulation for banks and insurance companies effective April 2026; and C3/2026, a telemarketing regulation effective March 31, 2026. The Central Bank has also issued guidance on the responsible use of artificial intelligence and machine learning by licensed institutions.

What should firms be doing? Practical steps include mapping every activity against Articles 61 and 62 to confirm whether a licence is needed; reviewing board and management responsibilities in light of Article 181; checking that fraud detection and customer notification processes meet the new duties; aligning remuneration structures with C5/2026; and documenting the reconciliation work so that it can be shown to the regulator. Foreign insurers with branches in the UAE should also review C4/2026.

What is not yet clear? The sources do not say how the Central Bank will treat firms that miss the deadline, whether it will grant extensions to individual firms, or how it will apply the new fine ceiling in practice. Nor do they quantify how many firms are affected. Until the regulator publishes enforcement guidance, the size of the penalty increase tells readers about the ceiling, not about likely outcomes.

Why does it matter beyond the UAE? The UAE positions itself as a regional hub for insurance, banking and fintech. A single, broader regulatory framework with explicit coverage of digital assets and platforms signals to international firms how the country intends to supervise new business models. Companies weighing whether to base operations there will want to read the underlying law and the CBUAE's regulations rather than rely on summaries.

This article is a summary of third-party legal commentary, not legal advice. Firms should take advice from UAE counsel and confirm current requirements with the Central Bank of the UAE.