Does a payment gateway in the UAE need a CBUAE licence? Licensing and how to choose a provider
In the UAE the licence follows the money, not the label. A gateway that only moves data can sit outside the CBUAE regime; whoever acquires, aggregates or settles your funds cannot.
In this essay
It depends on whether the gateway touches the money. Under the Central Bank of the UAE's Retail Payment Services and Card Schemes Regulation (Circular 15/2021), merchant acquiring and payment aggregation are licensed retail payment services, while a technical provider that supports a payment service without ever taking possession of the funds falls within the regulation's exclusions. Banks are deemed licensed, but must notify the CBUAE and obtain a No Objection Letter before offering acquiring or aggregation. For a merchant, the practical question is which legal entity acquires and settles your payments, and whether it appears on the CBUAE register.
The regulation is published in the CBUAE Rulebook: Retail Payment Services and Card Schemes Regulation. This page covers licensing and provider selection. For which cards and schemes you can accept, and how acceptance works day to day, see the UAE card acceptance merchant guide.
What does the CBUAE regulate under the retail payment services regime?
Annex I of the regulation lists nine retail payment services (CBUAE Rulebook: Annex I, Retail Payment Services):
- Payment account issuance
- Payment instrument issuance
- Merchant acquiring
- Payment aggregation
- Domestic fund transfer
- Cross-border fund transfer
- Payment token services
- Payment initiation
- Payment account information
Two definitions decide most gateway questions. Merchant acquiring is a service where the provider contracts with a payee to accept and process payment transactions, resulting in a transfer of funds to that payee. Payment aggregation connects merchants to merchant acquirers: the aggregator receives payments from users, pools them and transfers them to the merchants after a period. Both put the provider in the flow of funds, which is why both are licensed.
Wallets are a separate case. Stored value facilities have their own CBUAE regulation, and Checkout.com's UAE SVF approval shows what that adds to liquidity and safeguarding work.
Which licence category covers an acquirer or aggregator?
Article 3 sets four licence categories, and an applicant applies for the category that matches the services it intends to provide (CBUAE Rulebook: Article 3, License Categories).
| Category | Retail payment services covered | Merchant acquiring and aggregation? |
|---|---|---|
| I | Account issuance, instrument issuance, merchant acquiring, payment aggregation, domestic and cross-border fund transfer, payment token services | Yes |
| II | As Category I, without payment token services | Yes |
| III | Account issuance, instrument issuance, merchant acquiring, payment aggregation, domestic fund transfer | Yes |
| IV | Payment initiation and payment account information | No |
Minimum capital differs by category and by the provider's monthly transaction value, so ask the provider which category it holds rather than inferring it from a press release.
Banks follow a different route. Article 2 treats banks licensed under the Central Bank Law as licensed for retail payment services. For merchant acquiring, payment aggregation and the services at points 7 to 9 of Annex I, a bank must notify the CBUAE in writing and obtain a No Objection Letter before it starts (CBUAE Rulebook: Article 2, Licensing).
When does a payment gateway not need a licence?
The regulation's exclusions cover a technical service provider that supports a payment service without at any time taking possession of the funds being transferred. They also cover processing or storing data, IT security and authentication services, communication networks and the provision of terminals and devices (CBUAE Rulebook: Exclusions).
So a gateway that captures card details, encrypts them and passes authorization requests to a licensed acquirer can sit outside the licensing perimeter. Once it contracts with the merchant to acquire, pools funds or pays the merchant out, it is carrying on a licensed activity. The word "gateway" does not answer the question; the provider's role in the flow of funds does. Payment aggregator vs gateway vs processor explains how one brand can bundle all three roles.
Did the 2025 Central Bank law change who needs a licence?
Federal Decree-Law No. (6) of 2025, which the CBUAE Rulebook lists as in force from 16 September 2025, brings anyone who carries on, offers or facilitates a licensed financial activity, whatever the technology, within the CBUAE's licensing and supervision under its Article 62 (CBUAE Rulebook: Article 62). The CBUAE's FAQ describes the article as activity-based and says providers of software, infrastructure and purely technical solutions fall outside its licensing authority unless they themselves carry on a financial activity (CBUAE: Legislation).
The test is still what the provider does with money, not what it calls itself. If a provider tells you it needs no licence, ask it to name in the contract the licensed entity that acquires and settles your funds.
How do you check a UAE payment provider's licence?
The CBUAE publishes a register of licensed financial institutions, searchable by institution name, with downloadable editions that show each entity's licence type and category (CBUAE: Licensing and register). Check the legal entity that signs your merchant agreement rather than the brand, and check it again before renewal.
The licensed population is growing. The CBUAE's AML/CFT thematic review counted 30 licensed retail payment service providers in 2025, up from 23 in 2024 and 12 in 2023 (CBUAE: Thematic review of SVF, retail payment services, card schemes and payment token providers). That review is also why CBUAE payment controls are now a launch gate: a licence is where supervision starts, not where your diligence ends.
If your business is incorporated in a financial free zone such as DIFC or ADGM, confirm with counsel which regulator's rules apply to the payment services you are buying.
What should you ask before choosing a UAE gateway or PSP?
| Question | Why it matters | Evidence to request |
|---|---|---|
| Which legal entity acquires and settles my payments? | Decides whose licence covers you and whom you claim against | Merchant agreement naming the entity, plus its register entry |
| Which CBUAE category does it hold, or is it a bank with a No Objection Letter? | Category IV cannot acquire or aggregate | Register entry or written confirmation |
| Does any party pool or hold my funds before payout? | Pooling is aggregation, and held funds are your exposure | Funds-flow diagram with settlement timing |
| Where is payment and personal data stored? | Article 14 requires PSPs to store and maintain that data in the UAE | Hosting and backup locations |
| Which cards, wallets and local methods are live today? | Roadmap items do not convert customers | Test transactions in production |
| What do settlement reports contain? | You reconcile against them every day | Sample settlement file with fee lines |
| Who handles refunds, disputes and incidents out of hours? | Bundled roles blur responsibility | Named contacts and escalation route |
On data, Article 14 says personal and payment data shall be stored and maintained in the State, with a secure backup in a separate location for the five-year retention period (CBUAE Rulebook: Article 14). That duty sits with the provider, but ask how it affects the data exports, tokens and reports you receive. Then test the answers with the actual operating teams using a gateway responsibility map.
How do integration choices differ in the UAE?
Three questions come up in most UAE gateway evaluations:
- Local or cross-border acquiring. A provider without its own UAE licence acquires through a partner. Ask which entity acquires, which currency you settle in and how long settlement takes. Adyen's UAE licence shows how local acquiring changes the settlement and compliance loop.
- Pay by bank. Payment initiation is a separate Annex I service, not part of acquiring, so check who provides it and under which permission. If you want it at checkout, evaluate it as a separate provider decision.
- Reconciliation. Ask for the settlement file format before you sign, and check that each payout can be traced back to the transactions and fees inside it.
FAQ
Do I need a CBUAE licence to accept online payments as a merchant?
The licensing duty generally falls on whoever provides the retail payment service, not on a merchant accepting payment for its own goods. A business that collects payments on behalf of other merchants, such as a marketplace, should take advice, because pooling and passing on funds can amount to payment aggregation.
Is a payment gateway the same as a payment service provider in the UAE?
Not necessarily. A gateway that only transmits and secures data can fall within the regulation's technical service exclusion, while a provider that acquires, aggregates or settles funds needs a licence or, if it is a bank, a No Objection Letter.
Which CBUAE licence category allows merchant acquiring?
Categories I, II and III include merchant acquiring and payment aggregation. Category IV covers only payment initiation and payment account information.
How can I check whether a UAE payment company is licensed?
Search the register on the CBUAE licensing page by institution name and match it to the legal entity on your contract, not the trading brand.
Does the CBUAE require payment data to stay in the UAE?
Article 14 of the regulation requires payment service providers to store and maintain personal and payment data in the State and to keep a backup in a separate location for five years.
Closing thought and further reading
In the UAE the licence follows the money, not the label. A gateway that only moves data can sit outside the CBUAE regime; whoever acquires, aggregates or settles your funds cannot.
Ideas that continue the thread.
View all essays
Need help applying this to your business?
Explore practical support for payment operations, product decisions, program delivery and AI automation, grounded in the challenges behind this essay.