FinTech Licensing
Payment providers, e-money wallets, lenders, neobanks and Open Finance platforms — licensed under the Central Bank, ADGM or the DFSA. We tell you which regulator fits, what capital it takes, how long it runs, and then we build the whole application.
Confidential & non-binding · Same-day response in UAE hours
IN SHORT
The CBUAE licenses payments, e-money, lending and banking across onshore UAE. ADGM and the DFSA regulate the same activities inside their common-law free zones, with sandboxes for early-stage firms. If your product touches customer funds, the perimeter is strict — a perimeter analysis settles which regime, and which category, before you spend anything.
BUSINESS MODELS
Financial regulators licence by activity, not by label. Here are the FinTech models we license most — each with the regulator that fits, the indicative capital, and the obligations that come with it.
Payment accounts, card issuing, merchant acquiring, segregation and fund transfers — moving money without necessarily holding customer balances. The CBUAE's Retail Payment Services regime (Category I–IV).
Holding customer funds in a wallet or prepaid instrument — device-based or non-device based e-money. The moment you hold balances, you're in Stored Value Facility territory.
Extending credit, consumer or corporate — instalment lending, BNPL and financing — without taking demand deposits. A finance-company permission onshore, or the free-zone equivalent.
Taking deposits and offering the full banking permission through a digital-first model. The heaviest licence, and only the Central Bank can grant it.
Account-information and payment-initiation services, and the API infrastructure behind Open Finance — a dedicated CBUAE framework since 2024.
MAKE THE CALL
The right regulator turns on where your customers are and whether you touch their money onshore. These are the patterns we see most.
You issue wallets, move payments or lend to consumers nationwide — that's onshore, and only the Central Bank can license it.
You're B2B or wealth-facing and want an English-common-law jurisdiction with a sandbox to test.
You want to prove a model live, within a restricted scope, before committing to a full licence.
COMPARE THE REGIMES
The same activity can be licensed in more than one place. Here's how they differ on the things that drive the decision.
COST & CAPITAL
There's no single sticker price — the total is driven by your activity, regulator and how you build. These are the real cost lines to plan against.
HOW TO APPLY
Each regulator runs a two-stage process — initial approval before you build and deposit capital, then the full licence once controls are genuinely in place. Here's the path, end to end.
We assess your activities against the CBUAE, ADGM and DFSA and confirm the regulator and category that fit your model, customers and market.
Incorporate the right UAE entity, structure ownership and governance, and secure the office and substance the regulator expects.
We build the full submission — business plan, financial model, AML/CFT, safeguarding and risk frameworks, and fit-and-proper files for controllers.
The regulator reviews the file, holds meetings and issues initial approval setting the conditions to satisfy before launch.
Stand up systems and safeguarding, deposit capital, complete hires and pass readiness review — then the full licence is issued.
AML/KYT monitoring, safeguarding reconciliation, reporting and audit begin. We run them on our own RegTech from day one.
THE KOLL GROUP DIFFERENCE
Getting the licence is one thing. Staying licensed — with compliance that holds up to supervision and security that holds up to attack — is another. We're the only Dubai advisor that carries all three in-house.
We don't coach from the sidelines. We run the whole file — perimeter analysis, entity, capital structuring, the full application and every round of regulator questions — through to authorisation.
Safeguarding reconciliation, transaction monitoring and regulatory reporting on our own platform — so the controls you're approved on are the controls you actually run.
Payment infrastructure and customer data live or die on security. Our sister firm ITSEC delivers the penetration testing, cyber controls and audit evidence in-house.
Three disciplines competitors outsource to three vendors. With KOLL Group it's one engagement, one accountable team — advisory, RegTech and cybersecurity under one roof.
AVOID THESE
The same mistakes stall applications again and again. Here are the ones we harden against before you file.
Choosing a free-zone licence when your customers are onshore — then finding you can't serve them. Perimeter analysis first.
Customer float not properly segregated, with capital that misses the base-plus-float-overlay requirement.
Policies not tailored to your activity and risk profile draw immediate regulator pushback.
Infrastructure and controls below the regulator's technology and resilience expectations.
Senior management without genuine, verifiable financial-services experience won't clear fit-and-proper.
Capital is held on an ongoing basis, not spent at filing. Under-planning the runway is a costly error.
GET FLUENT
The terms that come up in every FinTech licensing conversation.
Stored Value Facility — the CBUAE licence to hold customer funds in a wallet or prepaid instrument in four categories.
Retail Payment Services & Card Schemes — the CBUAE regime for payment providers.
The pool of customer money an e-money issuer holds — segregated and safeguarded, never the firm's own.
A capital overlay of at least 5% of float that an SVF must hold above minimum paid-up capital.
The CBUAE framework for consented sharing of financial data and payment initiation via APIs.
Keeping customer funds separate and protected so customers rank first if the firm fails.
Money Laundering Reporting Officer — the approved person accountable for AML/CFT compliance.
The first-stage sign-off that lets you build and satisfy conditions before the full licence is granted.
A CBUAE-licensed lender that extends credit without taking demand deposits.
ADGM's RegLab and the DFSA's ITL — restricted-scope environments to test innovative products live.
GO DEEPER
Every FinTech route runs through one of these regimes. Read the full guide to the one that fits your model.
Institution-facing financial services with the Innovation Testing Licence.
Read the guide →FAQ
It depends on whether you touch customer money onshore. If you issue wallets, move payments or lend to consumers across the UAE, that's onshore and only the Central Bank (CBUAE) can license it. If you're B2B, institutional or want a common-law base and a sandbox, ADGM's FSRA or the DFSA in the DIFC fit. We confirm the right regime in a perimeter analysis before anything is filed.
An SVF (Stored Value Facility) licence is required the moment you hold customer balances in a wallet or prepaid instrument. RPSCS (Retail Payment Services & Card Schemes) covers payment accounts, card issuing and fund transfers without necessarily holding balances — a lighter regime with categories I to IV.
It varies sharply by category. Minimum capital ranges from around AED 100k for lighter payment categories up to AED 15m plus a float overlay for e-money issuers, and substantially more for a digital bank. We size the requirement against your specific model.
In some cases, yes. ADGM's RegLab and the DFSA's Innovation Testing Licence let early-stage FinTechs test a product live, within a restricted scope, before committing to a full licence. We help assess whether a sandbox route fits your model.
Initial approval typically lands in 2–4 months, with a further 2–4 months to build out systems, capital and controls before the full licence — 6–12 months end to end for most categories, though a digital bank licence can take 12 months or more.
Live compliance begins immediately — AML/KYT monitoring, safeguarding reconciliation and reporting. We run these on our own RegTech so the controls you were approved on are the controls you actually operate.
Building trust in payments
Tell us your goals. In one confidential call we'll confirm the framework you need, the right structure, a realistic timeline and the exact next steps.
