Guide
How to Set Up an Open Finance Provider in the UAE
The short answer
The Central Bank of the UAE (CBUAE) decides whether an Open Finance business needs its own licence, under the Open Finance Regulation's Data Sharing and Service Initiation categories. Holding either licence lets a firm read account data or instruct a transaction on a customer's behalf — it does not permit holding funds, lending or giving regulated advice. What usually decides the route is whether the firm initiates transactions itself or only supplies insight built on data someone else already holds under licence.
The regulatory perimeter: Data Sharing and Service Initiation
Under the CBUAE Open Finance Regulation, an applicant chooses one or both licensable activities: Data Sharing and Service Initiation. They are assessed and granted separately, so a firm that only shows a customer their account balances across institutions does not automatically gain the right to move money for them, and vice versa. The CBUAE must decide on a complete application within sixty working days.
Neither licence brings a firm inside banking, payments or securities regulation by itself. Holding customer funds, extending credit or giving investment advice needs the separate CBUAE or Securities and Commodities Authority (SCA) authorisation those activities require, on top of — not instead of — the Open Finance licence. It is the same scope test as a neobank built in the UAE: who touches money, and whose licence says they may.
What the Regulation requires before a licence is granted
The Regulation sets out financial resources a firm must hold, not just the activity it declares:
- Minimum paid-up capital of AED 1,000,000 for an Open Finance Provider, with the CBUAE able to require more based on the firm's risk, size and complexity.
- Professional indemnity insurance covering at least AED 5,000,000 per claim, with an aggregate limit of whichever is higher: AED 5,000,000 or 50% of annual income.
- Minimum two-factor authentication on every customer-facing channel.
- Consent that is explicit, specific to its purpose, informed, unambiguous and freely given — and, for a recurring instruction, valid for no longer than twelve months before the customer has to reconfirm it.
These are financial and operational commitments, not formation paperwork, and a business plan that treats them as later problems tends to meet them during the licensing review instead. Velarozone's own fee is itemised separately in the engagement letter; see how Velarozone works for how that sits alongside the regulator's own figures.
Connecting to the Trust Framework and the API Hub
A licensed Open Finance Provider does not build its own network: it connects into infrastructure the CBUAE itself specifies. Within fourteen days of approval, a provider must register and maintain its registration under the Trust Framework, which validates participants, issues the digital certificates each connection needs, and holds the technical standards every firm must build to. Customer-facing interfaces must use ISO 20022 message formats, not a provider's own API design.
The API Hub that aggregates participant APIs into one platform is itself a licensed, separately capitalised function: a minimum AED 20,000,000 paid-up capital, operational within six months of approval. Most providers will never run it — they connect to it — but a firm positioning itself as Open Finance infrastructure for other participants, rather than as a licence holder in its own right, is choosing the API Hub route and its much larger capital base.
How money and liability actually move
A Service Initiation licence lets a firm instruct a payment; it does not let the firm hold the money moved, which stays with the bank or payment institution carrying the account. A Data Sharing licence does not move money at all — it is read access to data the customer has consented to share. Both models end at the same wall: funds sit in segregated client accounts with licensed institutions under regulator oversight, never with the Open Finance Provider itself.
This is also what a bank will test before opening an account for the business: which licence category the firm holds, whether it ever takes custody of customer funds even transiently, and how consent and authentication controls are actually implemented rather than described. A firm preparing for that conversation benefits from bank account readiness work done before the application, not after a bank has already said no.
Outsourcing, data residency and who has to be in the UAE
The Regulation keeps two things close to home. First, data: customer data accessed under an Open Finance licence must be stored within the UAE, and a copy outside the country needs both CBUAE approval and the customer's consent — the only built-in exception is a licensed foreign bank branch keeping a daily-updated master record copy in the UAE. Second, control: a firm cannot outsource a material activity, or a key control function such as compliance or risk, without first notifying the CBUAE and receiving no objection. Records must be kept for at least five years.
These rules decide where compliance and engineering roles actually sit, not just where the holding company is registered. A plan that assumes an offshore team can run production data access, or that compliance is a part-time retainer, usually needs rework once this section is read properly. How those roles are filled belongs in the licence file — see business plans and supporting documentation for what that record needs to show.
What commonly goes wrong
- Treating Data Sharing and Service Initiation as one licence instead of two separate applications.
- Budgeting the AED 1,000,000 capital figure without the professional indemnity insurance that sits alongside it.
- Writing consent as a one-time tick box rather than a time-bound, revocable instruction capped at twelve months.
- Planning to outsource compliance or risk functions the Regulation expects the licence holder to keep in-house.
- Assuming a connection to the API Hub is itself a form of authorisation, rather than infrastructure a provider plugs into.
