Until now, account opening was the point where a newly licensed company could sit for months, with no explanation and no deadline to hold the bank to. The Central Bank has rewritten the rules governing the relationship between banks and SMEs, replacing the 2021 regulation: for the first time every waiting period, every charge and every complaint has an article number and a number of days attached. The benefit is not the same for everyone, and what decides it is the file the company brings to the bank.
What happened
The Central Bank of the UAE (CBUAE) has issued the Small to Medium Sized Enterprises Customer Protection Regulation, Circular C 2/2026, adopted under Federal Decree-Law 6/2025 on the Central Bank. It enters into force on 13 September 2026 and repeals the SME Market Conduct Regulation of 26 January 2021, which governed the same relationship in more general terms. It applies to all banks and finance companies licensed by the Central Bank, including Islamic institutions, in their dealings with small and medium-sized enterprises (SMEs), sole establishments included. The definition of an SME is the one in Cabinet Resolution 22/2016, based on headcount and turnover: the large majority of UAE companies, whether in a free zone or on the mainland, fall within it.
What changes in practice
Six protections matter for a company. First: for a customer the bank classifies as low risk for money laundering, the account must be opened within three working days of all documents being delivered (articles 4.46-4.48); if the bank delays for reasons other than anti-money laundering (AML) checks, it must explain them in writing, and the delay cannot exceed two weeks. Second: the bank must publish the minimum list of documents required to open an account (article 4.49), so it cannot add unexpected requests along the way. Third: banks may not charge for activities imposed by law, starting with the periodic refresh of identity documents — the know-your-customer (KYC) update that banks repeat every one or two years — and there is no closure penalty once the account has been open for at least six months (articles 4.39-4.45). Fourth: before changing terms or fees the bank must give sixty days' written notice, and thirty days' notice before an automatic annual renewal (articles 3.10-3.11). Fifth: a customer who wants to switch banks cannot be obstructed, and the bank may not ask why they are leaving or what offer they have received, except where a financial crime is suspected (articles 4.33-4.36). Sixth: a complaint must receive a written acknowledgement with a reference number within two working days and a reasoned reply within thirty working days, from an independent complaints function (article 6).
Who it applies to
Every UAE company, mainland or free zone, with an account already open or in the process of being opened, and every sole establishment. In particular three situations that recur constantly: an account opening stalled for months with the licence already issued, a closure notice received without warning, and a fee charged for updating documents. Note that the regulation binds the banks, not their customers: no new obligation arises for the company itself.
The exposure
The three-day deadline applies only to customers the bank classifies as low risk, and the regulation says so explicitly: where the bank is applying its AML obligations, the deadline does not apply. The classification is decided by the bank on the basis of the file: ownership structure, source of funds, activity and expected flows. A holding company with no operations, a trading business with counterparties across the Gulf, or a shareholder unable to explain where the capital came from will land in the medium or high band, where the fast track does not exist. The exposure is therefore twofold: continuing to bear delays and charges that are no longer due from 13 September, or arriving with a weak file and receiving a classification that removes the right to the three-day window. Refunds of fees paid before 13 September are not automatic either: the regulation is not retroactive.
What to do now
A company with a stalled application should go back to the bank after 13 September and ask in writing which risk class it has been placed in and which documents are missing, citing articles 4.46 and 4.49. A company whose account has been open for more than six months should review the last twelve months of statements and mark every charge for a KYC refresh or for closure: from 13 September these can be contested through a written complaint, which must be answered within thirty working days. A company yet to open an account should prepare the file before approaching the bank — corporate documents, source of funds supported by statements and contracts, a description of the activity and of the expected flows — because it is that file, not the regulation, that decides whether the three days apply.
Sources
Published 4 September 2026 on the basis of public sources and official United Arab Emirates instruments. This is not legal or tax advice. Verify your position with a qualified professional before acting.