Federal Decree-Law No. 6 of 2025 gave existing operators one year to regularise. The Central Bank had the power to extend the deadline and, as of this morning, has not done so: neither its Rulebook nor the press reports any such decision. Penalties range from AED 50,000 to AED 500 million, senior managers are personally liable, and the first party to ask questions will not be the Central Bank but the company's own bank, at the next KYC refresh.
What happened
Federal Decree-Law No. 6 of 2025, the new law governing the Central Bank of the UAE (CBUAE), was published in the Official Gazette on 15 September 2025 and, under Article 184, gave anyone already carrying on a financial activity one year to bring their position into compliance. That year ended on 16 September 2026 (15 September, on the count used by the law firm Hadef & Partners). The law gives the Central Bank's board the power to extend the deadline, and for weeks the market took it for granted that it would. As of the morning of 17 September, it has not: the Central Bank's official Rulebook records no extension and no news outlet reports one. We covered this on 31 August, with sixteen days to go; today the new fact is that the deadline has passed and the rule applies in full, with no further instrument required.
What changes in practice
Until yesterday an activity on the edge of the perimeter could describe itself as "in transition". From today there are three compliant positions: holding a Central Bank licence, or a licence from the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM) notified to the Central Bank; having a licence application filed and awaiting a decision; or having suspended the reserved activity. Anyone in none of the three is carrying on an unauthorised activity. Article 61 lists the reserved activities: deposit-taking, lending, open finance, money transfer, payment services including in virtual assets, electronic money and stored value, and the promotion of licensed financial activities. Article 62 adds that the technology used is irrelevant: an app, a platform or a protocol performing one of those functions falls within the perimeter as much as a branch counter does. Article 132 clarifies that contracts already signed are not affected retroactively; it is the activity from today onwards that must be authorised.
Who it applies to
Not to holders of a genuine virtual-asset licence from VARA (Dubai's Virtual Assets Regulatory Authority), the DIFC or ADGM: those structures have a regulator and a pathway. The issue concerns businesses operating under a general commercial licence, in a free zone or on the mainland, that in practice perform a financial function: the e-commerce business with a proprietary wallet that customers top up, the marketplace that holds sellers' funds before passing them on, the company collecting payments on behalf of third parties, the business offering instalment plans to its customers, anyone converting crypto-assets on a systematic basis, the introducer or promoter bringing clients to third-party financial products for a commission, the insurance broker without authorisation. These are activities frequently carried on under a "consultancy" or "general trading" licence by operators who have never read Article 61.
The exposure
Administrative penalties range from AED 50,000 (roughly USD 13,600) to AED 500 million (roughly USD 136 million), with a minimum of AED 1 million (roughly USD 272,000) for carrying on or promoting reserved activities without authorisation; senior managers are personally liable and criminal consequences are possible. But the penalty is not the first exposure. The first exposure is the bank: at the next KYC (Know Your Customer) refresh it may ask for the Central Bank licence and, in its absence, close the account, and a closed account stops a business within a week. The second exposure is one of interpretation: waiting for a late extension. If one were to arrive, it should be read as a suspension of penalties, not as a green light: the perimeter does not change, only the time allowed to enter it.
What to do now
Today, not this week: for every company with payment, wallet, crypto-asset or intermediation activities, write next to each actual activity whether it falls inside, outside or requires further analysis against Article 61. For those inside the perimeter without a licence, the choice is between two dated documents: the letter suspending the reserved activity, or evidence of the licence application filed. A written opinion on the perimeter, ready to show the bank when the request comes, is worth more than any verbal explanation. Those outside the perimeter should record that in writing too, with a date: before the bank, the difference between having checked before and having checked after is proved with a document. And the Central Bank Rulebook should be checked daily for a late extension, in the knowledge that it would not change the list.
Sources
- https://rulebook.centralbank.ae/en/rulebook/federal-decree-law-no-6-2025-regarding-central-bank-regulation-financial-institutions-and
- https://hadefpartners.com/news-insights/insights/uae-central-bank-law-2026-developments-and-the-september-2026-reconciliation-deadline/
Published 17 September 2026 on the basis of public sources and official United Arab Emirates instruments. This is not legal or tax advice. Verify your position with a qualified professional before acting.