Guide
How to Set Up a Neobank in the UAE
The short answer
The Central Bank of the UAE (CBUAE) decides whether a neobank needs a full banking licence, a Retail Payment Services licence, or neither, because a sponsor carries the regulated function. The trigger is functional, not branding: taking deposits and using the word "bank" needs a banking licence; issuing payment accounts, cards or transfers sits in one of four Retail Payment Services licence categories instead. The one thing that decides the route is which of those functions the company performs itself, set out feature by feature, not what the app calls itself.
The regulatory perimeter, and who decides it
CBUAE licenses and supervises every entity providing money transfer, electronic retail payment or digital money services in the UAE, under the Central Bank Law and the Retail Payment Services and Card Schemes Regulation (RPSCS Regulation, C 15/2021, in force from 6 June 2021). It sets out nine Retail Payment Services: payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic and cross-border fund transfer, payment token services, payment initiation and payment account information services. A neobank performing any of these itself needs a licence for it; one that only provides the app, relying on a licensed bank or payment service provider for the regulated function, does not — provided the contract and the customer-facing disclosure say so clearly.
What the Retail Payment Services and Card Schemes Regulation requires
The regulation sorts applicants into four licence categories by which services they combine, with an initial capital figure for each, set against the monthly average value of payment transactions over the preceding three months. Category I (all nine services, including cross-border transfers) needs at least AED 3 million where that average is AED 10 million or above, or AED 1.5 million below that threshold. Category II (domestic and cross-border transfer, without payment tokens) needs AED 2 million or AED 1 million on the same split. Category III (domestic transfer only) needs AED 1 million or AED 500,000. Category IV, limited to payment initiation and account information — functions that never touch customer money — needs a flat AED 100,000 regardless of volume. A licence holder must hold capital at or above its category's initial figure at all times, not only on grant, and CBUAE can set a higher figure once volumes justify it.
Why most neobanks cannot hold customer money themselves
This decides whether the product needs a bank or a payment service provider licence. Under the RPSCS Regulation, a payment service provider "shall not at any time hold funds" of its customers unless strictly in transit, and funds settled within 24 hours must be segregated from the provider's own money and every other customer's. Holding deposits beyond that — what makes a product a bank rather than a payment app — is reserved to licensed banks. This is why the near-universal neobank structure pairs a technology and brand company with a licensed bank or payment service provider that actually holds the money.
Open Finance: data access and payment initiation
If the product reads account data or initiates payments on a customer's accounts held elsewhere, the CBUAE Open Finance Regulation (C 03/2025, in force from 10 July 2025) is the relevant source, not the RPSCS Regulation alone. It creates a dedicated Open Finance Licence for Data Sharing Providers and Service Initiation Providers, onboarded in phases — banks and insurers first, with other mandated entities, including payment service providers, following as the Central Bank announces. This licence does not permit holding customer funds in any form, and does not substitute for any other licence the business needs for its other functions; combining data initiation with card issuance needs both authorisations, not one.
Ownership, governance and the roles a licence demands
Nobody becomes a controlling shareholder of a licensed payment service provider without CBUAE's prior approval, which turns on the controller's likely influence and whether they meet the Central Bank's fit-and-proper requirements. Once licensed, the regulation requires an organisation chart naming the individual responsible for each function, documented conflict-of-interest controls, a designated AML/CFT compliance function that escalates suspicious-transaction reports, and risk-management policies proportionate to the business's scale. A licensee's principal business must stay within what its licence covers; an ancillary service outside that scope needs prior CBUAE approval and can require a separate entity. For a neobank group, the regulated entity, the technology company and the sponsor contract each need a genuine, documented role.
What commonly goes wrong
Branding a product as a "bank" before any entity holds a banking licence is the most visible failure, but not the costliest. More common is choosing a licence category from launch features, then adding cross-border transfers or card issuance later, pushing the business into a higher category and a capital requirement it has not raised. Others treat a sponsor bank relationship as a vendor contract rather than the arrangement deciding who legally holds customer funds, and discover during banking readiness diligence that the contract does not say what they assumed. A written, feature-by-feature allocation, reviewed before the entity is formed, avoids most of this.
