The following article, originally written for and published by Global Legal Insights, covers 2022 FinTech Laws and Regulations in the UAE.
Approaches and developments
The United Arab Emirates (“UAE”) continues to maintain its position as the leader in financial technology (“FinTech”) in the Middle East. This position is maintained with the help of supportive governmental policies and most importantly, by the implementation of attractive programmes, both onshore and in free zones. The UAE consists of onshore and financial free zone jurisdictions, to which different legal frameworks apply. There are currently two financial free zones in the UAE: the Dubai International Financial Centre (the “DIFC”); and the Abu Dhabi Global Market (the “ADGM”).
The UAE attracts many investors who choose to conduct their business here for many reasons, including:
(i) Supportive government initiatives: as part of the UAE Vision 2022, the UAE aims to transform the country into a FinTech leader. Many initiatives have been introduced both onshore and in financial free zones to encourage entrepreneurs in the FinTech industry.
(ii) Supportive legislations: several impactful legislations have been issued in the last couple of years, bringing more clarity and assurance to FinTech areas of business. While such legislations will add certain financial and compliance obligations on FinTech companies, they are necessary to create stability and confidence in the FinTech industry.
(iii) Attractive environment for talent: the UAE has one of the most attractive immigration policies in the region which welcomes highly qualified and innovating expatriates into the country.
(iv) Advantageous taxation environment: despite the planned introduction of a corporate income tax in June 2023, the UAE will remain a leading choice for entrepreneurs in the region, especially for companies generating less than AED 375,000 who will be exempted from such tax, which supports the growth of start-ups and small- and medium-sized enterprises (“SMEs").
Investment in FinTech in the UAE has mainly been directed at either businesses dealing directly with consumers, or businesses providing technology solutions to existing financial institutions. There is also a considerable amount of investment directed at a variety of industries including the educational sector, healthcare sector, insurance sector, and emerging technologies (e.g. artificial intelligence, distributed ledger technology and deep-learning).
The outbreak of COVID-19 and the spread of the pandemic has led to the emergence of new market trends highlighted by the change in customer payment behaviour. This was clearly evidenced by several Buy Now Pay Later (“BNPL”) models rapidly reaching Series A rounds of funding.
It is worth noting that payment services are attracting a broad range of investments whereby the UAE has witnessed a growth in mobile payment methods such as mobile wallets and direct carrier billing. However, wealth management remains the most advanced area of FinTech evidenced by seed level investments to Series B.
FinTech offering in UAE
While FinTech comprises a broad range of activities, we note that some specific categories are currently trending such as:
1. Buy Now Pay Later (“BNPL”) allows buyers to acquire an item and pay it in installments on their debit or credit card with zero per cent interest rate. This service gained popularity during the pandemic when flexibility in payment patterns was primordial. Having the option to defer payments is very attractive to customers who are able to split large payments into smaller amounts. In 2022, the Middle East region has seen an increase in the number of companies offering BNPL options, with many of them raising substantial funding such as Cashew (USD 10 million).
2. Digital wallets or electronic wallets are a form of contactless mobile payment systems which have succeeded in making the big wads of bills we used to carry obsolete. It is similar to having a digital version of your credit card on your mobile device. Undeniably, the pandemic helped increase the acceptance of digital wallets in the Middle East and especially in the UAE, as customers were looking for a way to make easy, fast and convenient purchases. The first UAE Central Bank (“CBUAE”) licensed wallet is “eWallet” which is owned by Noor Bank and Etisalat.
3. Crowdfunding is the practice of funding a project by raising money from a large number of people through licensed online platforms. This allows anyone with an innovative idea or project to seek funds from investors to kickstart their business. In March of 2022, the UAE Cabinet approved crowdfunding activity for both the public and private sectors to finance new projects. Through this decision, the UAE aims to encourage the influx of investments for smaller businesses and broaden the country’s liquidity pool.
4. Fractionalised real estate investing means several people buying and owning fractions of a property. Assets are divided, so each fraction is attractively priced, thereby allowing small time investors access to the real estate market. Fractionalisation can either be achieved by tokenising the asset or holding a unit in a fund.
5. Cryptocurrency is an encrypted digital currency that operates using blockchain technology. Unlike fiat currency, which is regulated by a central bank, cryptocurrencies are validated through a decentralised system whereby any party participating in the process can verify the transactions that take place. The UAE already has several cryptocurrency exchanges licensed to operate in the country thanks to early regulation dating back to 2018. New Crypto regulations have been issued over the last 12 months, which has led to an increase in international market players setting up shop in the UAE and a larger risk appetite for cryptocurrency-related activities.
6. Robo-advisers are a class of financial advisors with moderate to minimal human intervention. By using algorithms to analyse a client’s profile and deliver solutions tailored to one’s goals and risk profile, robo-advisors are making investing simple and affordable. They have also opened investment advisory options to a wider audience at lower costs. In the past, customers turned to banks and financial advisory firms for investment advice. With the rise of digital wealth management platforms, customers have faster and more convenient options at their disposal.
Several laws have been enacted over the course of the last year with the aim to either supplement existing legislation or to create new legislation to address disruptive technology in financial services. Some of these include Large Value Payment Systems (“LVPS”) regulations, Security Tokens and of course cryptocurrency regulations. These innovations will be set out in the “Key regulations and regulatory approaches” section below.
Regulatory and insurance technology
In the wake of COVID-19, financial institutions were forced to move to remote working models, which was difficult to monitor, especially in terms of regulatory compliance. To deal with the pandemic and mitigate risks incurred, the UAE continued to push for the emergence of regulatory technology (“RegTech”), whereby artificial intelligence (“AI”) was utilised to help companies meet their due diligence requirements.
Regulations Lab (“RegLab”) was launched in January 2019 in partnership with Dubai Future Foundation, pursuant to a federal law issued in 2018 authorising the UAE Cabinet to grant temporary licences for the testing and vetting of innovations that utilise future technologies and its applications such as AI. RegLab was designed to proactively anticipate and develop future legislation governing the use and applications of emerging technologies in the UAE in ways that maximise the benefits and minimise the risks. It aims to create a reliable and transparent legislative environment, introduce new or develop existing legislation and regulate advanced technological products. RegLab will work closely with lawmakers from federal and local government authorities, as well as the private sector and business leaders to support the UAE’s role as a global incubator of innovations and creative projects.
Insurance Technology (“InsurTech”) is now engrained in the region after having gained popularity at a slow but steady pace in the UAE. Most InsurTech start-ups are focused on (i) offering comparison features to users allowing them to select the insurance package that best suits their needs, (ii) digitising the process of subscribing to an insurance policy, and/or (iii) streamlining processes between insurance companies using blockchain technology.
It is worth noting that we have seen traditional insurance companies collaborating with InsurTechs to improve their efficiency which is an indicator of the potential and benefits of the InsurTech industry.
Contrary to other jurisdictions, the UAE does not have a single regulator responsible for the supervision of FinTech efforts. In fact, FinTech companies often choose where they would like to do business, based on the regulator body supervising their activity. Below, you will find the four main regulatory bodies that exist in UAE onshore, DIFC and ADGM.
The main financial regulators in Onshore UAE are (1) the CBUAE, which regulates banks, finance companies, payment service providers and insurance companies, and (2) the Securities and Commodities Authority (“SCA”) that regulates markets, listed companies and securities brokers. They are primarily tasked with supervising and regulating financial activities conducted in onshore UAE.
The Dubai Financial Services Authority (“DFSA”) is the principal regulatory body of the DIFC. The DFSA supervises regulated companies and monitors their compliance with applicable laws and rules. The Regulatory Law, DIFC Law No. 1 of 2004 grants the DFSA its powers as a financial services regulator.
The ADGM’s financial regulator is the Financial Services Regulatory Authority (“FSRA”) which has regulatory and supervision oversight of the financial services provided within its jurisdiction. The FSRA was one of the first jurisdictions to introduce in 2018 a comprehensive and bespoke regulatory framework for the regulation of “Crypto Asset” activities. Since then, the ADGM has continued to update its legal framework to keep up with the cryptocurrency ecosystem.
Key regulations and regulatory approaches
1. Central Bank Circular No. 9/2020 on Large-Value Payment Systems Regulations
This Regulation focuses on Large-Value Payment Systems (“LVPS”) which are financial infrastructure systems that support the financial and wholesale activities in the UAE. The regulation covers the licensing requirements in relation to LVPS as well as the obligations and ongoing requirements in relation to a designated LVPS.
The Regulation applies to:
a. LVPS that are operated in the UAE; or
b. LVPS that accept the clearing or settlement of transfer orders denominated in the AED currency both in the UAE or outside the UAE.
We note that the regulation does not apply to LVPS incorporated in financial free zones, unless when expressly provided for.
LVPS in the UAE now requires a prior licence from CBUAE. The LVPS operator is also required to comply with the Principles of Financial Market Infrastructures (“PFMI”), which are key standards that the international community considers essential to strengthening and preserving financial stability. By way of example, the PFMI includes compliance with safety and efficiency requirements, submission of information or documents, and allows the CBUAE to examine at any time, with a short prior notice, any books, accounts or transaction of the LVPS operator.
2. The new Stored Value Facilities regulation
The new Stored Value Facilities (“SVF”) regulation, issued in September 2020, repeals and replaces the regulatory framework for Stored Value and Electronic Payment Systems.
A SVF is defined as a facility whereby a customer can pay a sum of money to the SVF issuer in exchange for the storage of that money on the facility.
This regulation applies to companies wishing to undertake a SVF activity, with certain exceptions. For instance, the regulation does not apply to the below SVFs:
- SVFs used for certain cash reward schemes;
- SVFs used for purchasing certain digital products;
- SVFs used for certain bonus point schemes;
- SVFs that can only be used within a limited group of products or service providers; and
- those within which the aggregate amount of the float of the facilities does not exceed AED 500,000 and the aggregate number of customers is not more than 100 (subject to being accepted by the CBUAE).
While different capital requirements are put in place, the most important change we note is that the requirement to have a regulated bank as a majority shareholder in SVFs has been removed. Moreover, the Regulation introduces an express prohibition on the marketing of overseas SVFs in the UAE.
This regulation is highly focused on technology and risk management and includes extensive obligations around cyber security and technology governance that businesses will need to consider when setting up a SVF activity in the UAE.
3. Regulation of Security Tokens
The DFSA has launched its regulatory framework for “Investment Tokens” based on its Consultation Paper No. 138 – Regulation of Security Tokens, published in March 2021.
An “Investment Token” is defined to include:
(i) a security (which includes, for example, a share, debenture or warrant) or derivative (an option or future) in the form of a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using Distributed Ledger Technology (“DLT”) or other similar technology; or
(ii) a cryptographically secured digital representation of rights and obligations that is issued, transferred and stored using DLT or other similar technology and: (i) confers rights and obligations that are substantially similar in nature to those conferred by a security or derivative; or (ii) has a substantially similar purpose or effect to a security or derivative.
This means that key cryptocurrencies (i.e., bitcoin, ETH) will not be subject to this regulatory framework, given that they are not securities, nor are considered substantially similar in nature or purpose to a security or derivative.
Firms which undertake financial services relating to Investment Tokens in or from the DIFC (i.e., issuing, trading, holding, dealing in, advising on, managing portfolios, etc.) must meet certain licensing and technological requirements set by the DFSA.
4. Regulation of cryptocurrency transactions
In what could be characterised as the most surprising shift in attitude in our jurisdiction, the UAE and the financial free zones have finally broken their silence by issuing the long-awaited regulations on cryptocurrencies.
The SCA issued Decision No. 23 of 2020 concerning Crypto Assets Activities Regulation (the “CAAR”), which aims to regulate and license key aspects of dealing in crypto assets, from issuance and promotion thereof, provision of crypto asset custody services, operating exchanges, and fundraising platforms. The CAAR applies to most forms of crypto assets whether securities or otherwise, which are listed and available for trading on a recognised market. The CAAR is not intended to include items regulated by the CBUAE such as currencies, virtual currencies, digital currencies, stored-value units, payment tokens and payment units(s).
Generally, there are two main requirements to provide cryptocurrency assets or related services in the UAE:
1. The service provider must be incorporated onshore within the UAE or any of the UAE’s financial free zones.
2. The service provider must be licenced by the SCA.
Having previously excluded crypto assets from the scope of application of issued regulations regarding Security Tokens and Investment Tokens, the DFSA issued in early March a consultation paper on the regulation of crypto-tokens. The DFSA was influenced by the increase in the use of cryptocurrency as a means for financial transactions. Following this public consultation paper, the DFSA will finalise its approach and enact legislation as needed.
Within the ADGM, the FSRA released a framework in conjunction with its original guidance issued in 2017. The Framework makes it evident that: (a) crypto asset activities may only be permitted in connection with crypto assets that are categorised as “Accepted Crypto Assets”, i.e. those crypto assets that fulfil criteria prescribed by the FSRA; and (b) any person dealing with such accepted crypto assets including intermediaries (such as brokers/dealers, asset managers, crypto asset exchanges, crypto asset custodians) involved in dealing, managing or arranging Accepted Crypto Assets, would require an Financial Service Provider to operate in and from the ADGM.
Various initiatives have been taken to encourage innovation, especially in the financial sector. Most notably, regulators have put in place sandbox regimes to allow innovators to test their products under more lenient regulatory requirements. To name a few initiatives:
Many governmental authorities have shown in the last couple of years an increasing interest in FinTech. In fact, many initiatives to encourage the emergence of FinTech in the UAE has been introduced. Notably, the SCA has put in place a pilot regulatory environment (sandbox) to encourage innovation in the FinTech industry and allow entrepreneurs to test their products in more relaxed regulatory environments.
Furthermore, CBUAE has launched a FinTech Office since the second half of 2020, to support start-ups and build a mature FinTech ecosystem in the UAE.
The DIFC launched an accelerator programme named the FinTech Hive to encourage cutting-edge FinTech solutions for leading financial institutions. Pursuant to this programme, the DIFC established an innovation testing licence which permits qualifying FinTech firms to develop and test innovative concepts for a period of six to 12 months without being subject to all regulatory requirements that normally apply to regulated firms. If the outcomes detailed in the regulatory test plan are fulfilled, and the participating firm can satisfy DFSA requirements, it may migrate to full authorisation. If on the contrary, such conditions are not met, the firm must cease to carry on any and all activities requiring regulation in the DIFC.
The ADGM launched an accelerator programme named the Regulatory Laboratory to encourage cutting-edge FinTech solutions for leading financial institutions. Pursuant to this programme, the ADGM established a special type of financial services permission (i.e. licence) which permits qualifying FinTech firms to develop and test innovative concepts for up to two years without being subject to all regulatory requirements that normally apply to regulated firms. If participating firms are capable of meeting ADGM requirements at the expiry of the licence, they may be transferred to the regular authorisation and supervision review. If such firms cannot meet these requirements, they must cease to carry on activities requiring regulation in the ADGM.
In addition to launching an accelerator programme, the ADGM added legislation in the Financial Services and Markets Regulations (“FSMR”) specifically addressing the emergence of new technologies, namely crypto assets.
The CBUAE and ADGM have together signed a FinTech cooperation agreement to develop FinTech initiatives. This agreement will improve their collaboration along with a co-sandbox programme. Additionally, the DIFC and the CBUAE have also signed a cooperation agreement in the field of FinTech with the implementation of a co-sandbox programme.
We do not see any imminent risks to the growth of the FinTech market in the UAE. However, we note certain challenges that FinTech entities must consider:
(i) Licensing requirements: FinTech businesses must have a local presence in the UAE and be licensed to be able to reach UAE customers. This may create some regulatory uncertainties for businesses located outside the UAE who wish to target UAE residents as there are no clear-cut guidelines in this respect.
(ii) Data Transfer Limitations: the newly issued Federal Law on data privacy allows cross-border data transfers only if the recipient jurisdiction offers an adequate level of protection but subject to the approval of the UAE Data Office. This means that FinTech businesses which collect and process data from UAE customers may not be able to transfer the data to the jurisdiction of their choice and as such may need to physically store their data in the UAE.
(iii) Evolving regulatory framework: FinTech regulations are constantly being updated and FinTech companies must watch-out for any development that may require them to implement important changes in their businesses.
There are also various examples of disruption through FinTech in the UAE. To name a few:
• BNPL is an emerging online payment method attractive to both buyers and sellers.
• Insurance aggregators are disrupting the insurance market by being one step closer to the customers and offering quotes online.
• We are also keeping an eye out on Islamic FinTech which is expected to lead the next big disruption in 2022.
• Real estate crowdfunding platforms connecting investors to property investments, therefore democratising real estate investments by fractionalisation, and making it accessible to those with less capital.
From a middle eastern standpoint, the UAE is one of the front runners along with countries such as the Kingdom of Saudi Arabia and Bahrain when it comes to enacting FinTech legislation. In light of this, the UAE is able to attract a lot of FinTech companies which are looking to enter the Middle East region, and these entities will tend to use the UAE as a launching pad to enter other regional markets.
Certain FinTechs, and specifically those in the wealth management and crypto industries, have signed agreements with global corresponding businesses to utilise their infrastructure as custodians. FinTechs in the UAE have also long been attractive targets for acquisition by large successful international players, and this has always encouraged cross-border collaboration.
Within the UAE, as there are multiple regulators, which in certain instances have overlapping statutes, we regularly see active collaboration endeavours between them to encourage strategic partnerships and sandbox programmes. By way of example, in June 2021, the CBUAE, SCA, DFSA and FSRA published joint guidelines setting out principals and best practice for financial institutions when adopting disruptive technologies.
In the past, we have also seen regulators in the UAE sign framework agreements to collaborate on building partnerships between government entities and business entities such as the Monetary Authority of Singapore.
The DFSA and the FSRA are also parties to the Global Financial Innovation Network (“GFIN”), a network of regulators across the world which have committed to facilitate cross-border trials to ensure the benefits of using innovative technology in the financial sphere. Members of the GFIN include regulators in Australia, Hong Kong, the United States, and the United Kingdom.
Throughout 2021, the UAE continues to maintain its title as...
The Legal 500 & The In-House Lawyer Comparative Legal Guide...
BSA & The Legal 500 launch Market Watch - The...
Real estate funds (“REF”) and real estate investment trusts (“REIT”)...
Over the past two years, the UAE Central Bank (“CBUAE”)...
A criminal complaint takes precedence over a civil claim or...
In a recent edition of The Oath Magazine, Arsalan Tariq...
More than ever, crypto-investors in UAE need awareness and defense...
Since the implementation of Corporate Tax (CT) into the UAE...
The ongoing legal battles surrounding the NMC Healthcare, the largest...
The UAE’s Crypto Industry’s Exponential Growth Leading to an Increase...