For payment, lending, wealth, remittance and BNPL businesses
A UAE Fintech: Licence, Bank and Payments Decided Together
The short answer
Setting up a fintech in the UAE starts with the regulatory perimeter: which activities need a licence from the Central Bank of the UAE, the Securities and Commodities Authority, the DFSA in the DIFC, the FSRA in the ADGM or VARA for virtual assets, and the regulator decides that, not Velarozone. Once the activity is placed, the operating model, the money flows and the customer base decide the jurisdiction and the structure, and those in turn decide which bank and which acquirer will take the business. We assess the activity against the regulators' perimeters, build the business plan, the AML programme and the policies a licence application and a bank need, and coordinate the licence, the bank and the payments applications together.
A payments, lending, wealth, remittance or BNPL business starts with a question of perimeter: which of what it does is a regulated activity, and under which regulator. The Central Bank of the UAE licenses payment services and retail lending; the Securities and Commodities Authority, the DFSA in the DIFC and the FSRA in the ADGM license investment and wealth activities; VARA licenses virtual assets. A product that straddles two of those can sit under more than one regulator, or under none, depending on whether client money and credit extension sit inside it or with a separately licensed institution — and that is the regulator's call, not ours. Regulatory consulting reads the activity against each perimeter before a jurisdiction or a licence is chosen.
The perimeter answered, the operating model decides the rest. Who holds the money between a payment coming in and going out, which corridors it moves through, and who the customers are decide the jurisdiction, the structure and the capital a regulator will expect. They also decide the bank: a bank reads the flows and the safeguarding arrangement together with the licence category before it opens a settlement account, and an acquirer reads the same file before enabling a payment method. A licence chosen before those questions are answered is a licence that may not bank.
At a glance
- Indicative cost
- Regulator fees, where any, are the regulator's; the Velarozone service fee for the perimeter assessment, the documentation and the coordination is itemised in your engagement letter.
- Timing
- The perimeter assessment in days; the documentation and the AML programme take the time a genuine build takes; the regulator's, the bank's and the acquirer's reviews each run on their own clock.
- What's included
- The activity placed against the right regulator's perimeter
- The business plan, financial model and AML programme built together
- The bank and acquiring file coordinated with the licence
This is for you if
- You run, or are launching, a payments, lending, wealth, remittance or buy-now-pay-later business, in the UAE or expanding into it.
- You are not yet sure which regulator your activity sits under, or whether it needs a licence at all.
- You need a bank and an acquirer that will actually take the business, not just a licence that issues.
- You want the AML programme, the compliance roles and the documentation built before the regulator asks for them.
This may not be the right route if
- You already hold the regulator's licence and need only the next ordinary filing; that is a narrower compliance engagement.
- You want a jurisdiction chosen for its cost before the activity has been placed against a regulator's perimeter.
- You expect a regulator's approval, a bank's appetite or an acquirer's pricing to be promised in advance.
At a glance
- Indicative cost
- Regulator fees, where any, are the regulator's; the Velarozone service fee for the perimeter assessment, the documentation and the coordination is itemised in your engagement letter.
- Timing
- The perimeter assessment in days; the documentation and the AML programme take the time a genuine build takes; the regulator's, the bank's and the acquirer's reviews each run on their own clock.
- What's included
- The activity placed against the right regulator's perimeter
- The business plan, financial model and AML programme built together
- The bank and acquiring file coordinated with the licence
What this service includes
- The activity assessed against the Central Bank, the Securities and Commodities Authority, the DFSA, the FSRA and VARA's perimeters, before a jurisdiction or a licence is chosen.
- The operating model and money flows mapped, so the structure and the licence category fit how the business actually moves money.
- The business plan, the financial model and the policies a licence application needs, prepared through business plans and documentation.
- The AML programme drafted and the compliance roles — MLRO, compliance officer, risk and audit where required — identified and resourced, with source of wealth and funds evidenced through source of wealth and funds wherever the regulator or the bank asks for it.
- The bank and acquiring file built around the flows and the safeguarding arrangement; where the activity touches virtual assets, the same file extends into VARA's virtual-asset framework.
What it does not include
- The regulator's decision on the licence category, the conditions attached to it, or its timeline.
- The bank's or the acquirer's decision, its pricing, or a named bank or acquirer in advance.
- Legal drafting of the regulator's application forms, and legal opinions on the law, which come from a licensed law firm we coordinate.
Process
How the work is sequenced
Each stage has its own dependencies — activity approvals, document legalisation, authority processing, and bank review — and we report progress against them rather than against one overall date.
- 01
Perimeter
The activity read against each regulator's perimeter; the licence question answered before anything else.
- 02
Operating model
Money flows, customer base and expected volumes mapped to decide the structure and the jurisdiction.
- 03
Documentation and AML
The business plan, the financial model, the policies and the AML programme drafted together.
Ownership spread across a group, several shareholders or a holding structure as well? The complex-ownership page covers that question.
Prefer to start in writing? Send the details through the contact form.
Start with a structure assessment
In an initial consultation you receive a plain-language decision summary, a document-preparation list, and the next actions for your situation. Current figures are confirmed within your adviser-reviewed route comparison.
Perimeter first
Where a fintech activity sits, and what that decides
The regulator decides the perimeter; everything below follows from where the activity lands in it.
What a regulator or a bank asks of a fintech, and what is prepared for each.
Perimeter
- What the regulator or the bank asks
- Does the activity need a licence, and from which regulator — the Central Bank, the SCA, the DFSA, the FSRA or VARA
- What we prepare
- The activity read against each regulator's perimeter before a jurisdiction is chosen
Operating model
- What the regulator or the bank asks
- Who holds customer money between legs, and for how long
- What we prepare
- The flow of funds mapped so the licence category and the safeguarding arrangement match it
Structure and jurisdiction
- What the regulator or the bank asks
- Does the legal structure and the chosen jurisdiction fit the activity and the capital it needs
- What we prepare
- A structure and a jurisdiction chosen against the activity, not against the lowest fee
Banking and payments
- What the regulator or the bank asks
- Can a bank keep the settlement account, and can an acquirer enable the payment method the licence implies
- What we prepare
- The bank and the acquirer file built around the flows, the safeguarding arrangement and the licence
AML and compliance roles
- What the regulator or the bank asks
- Is there a risk assessment, a programme and an appointed officer the regulator will recognise
- What we prepare
- The AML programme drafted and the compliance roles identified before the application is lodged
Documentation
- What the regulator or the bank asks
- Does the business plan and the financial model support what the application claims
- What we prepare
- The business plan, the financial model and the policies prepared for the application
| Question | What the regulator or the bank asks | What we prepare |
|---|---|---|
| Perimeter | Does the activity need a licence, and from which regulator — the Central Bank, the SCA, the DFSA, the FSRA or VARA | The activity read against each regulator's perimeter before a jurisdiction is chosen |
| Operating model | Who holds customer money between legs, and for how long | The flow of funds mapped so the licence category and the safeguarding arrangement match it |
| Structure and jurisdiction | Does the legal structure and the chosen jurisdiction fit the activity and the capital it needs | A structure and a jurisdiction chosen against the activity, not against the lowest fee |
| Banking and payments | Can a bank keep the settlement account, and can an acquirer enable the payment method the licence implies | The bank and the acquirer file built around the flows, the safeguarding arrangement and the licence |
| AML and compliance roles | Is there a risk assessment, a programme and an appointed officer the regulator will recognise | The AML programme drafted and the compliance roles identified before the application is lodged |
| Documentation | Does the business plan and the financial model support what the application claims | The business plan, the financial model and the policies prepared for the application |
The service
Regulatory consulting and fractional roles
The service page sets out how the perimeter assessment, the licensing advisory and the AML programme work, and the fractional compliance roles a regulated business can draw on.
See the consulting service
Every route is planned against how the business will actually operate in the UAE.
After the licence
What you may also need
The four services most founders in this situation ask about next, each on its own page.
Visas & PRO services
Residence visas for owners, staff and family, Emirates ID and medicals, and the PRO work that keeps a licence and its people in good standing. Eligibility and approval stay with the authority.
→UAE bank account setup
A bank-ready file and an introduction to the bank whose appetite matches your profile. Approval and timing stay with the bank.
→Accounting & bookkeeping
Monthly bookkeeping, VAT and corporate-tax filings, and year-end accounts, with statutory audit signed by a registered auditor.
→Legal services
Contracts, corporate documents, disputes and regulatory matters, advised by lawyers licensed to practise in the UAE.
→
Questions
Frequently asked
- Does Velarozone decide which regulator my fintech needs?
- No. Each regulator — the Central Bank of the UAE, the Securities and Commodities Authority, the DFSA, the FSRA or VARA — publishes its own perimeter. We read the activity against each one and bring back what the regulator would say, before any jurisdiction or licence is chosen.
- Can I choose the cheapest jurisdiction and fix the regulatory question later?
- Not without risk. The activity decides which regulator applies and which jurisdictions that regulator licenses in; a jurisdiction chosen first and reconciled with the activity afterwards is usually the jurisdiction that has to be unwound.
- Will a bank open an account once I have the licence?
- A licence is necessary, not sufficient. The bank reads the licence category together with the money flows and the safeguarding arrangement and sets its own appetite for the activity; we build that file alongside the licence application rather than after it.
- Do I need a compliance officer from day one?
- Most regulators expect an appointed officer — an MLRO, a compliance officer, or both — in place at licensing, not added afterwards. We identify which roles the activity needs and resource them, including on a fractional basis, before the application is lodged.
- What if my product touches virtual assets as well as fiat payments?
- Then more than one regulator's perimeter can apply, and VARA's framework sits alongside whichever authority licenses the fiat side. We read both perimeters together rather than treat the virtual-asset feature as an afterthought.
Sources
- Central Bank of the UAE — the UAE banking and payments regulator
- Securities and Commodities Authority (SCA)
- DFSA — Dubai Financial Services Authority (DIFC)
- FSRA — Financial Services Regulatory Authority (ADGM)
- Virtual Assets Regulatory Authority (VARA)
- UAE AML/CFT framework guidance
Regulations, fees, and eligibility can change. Every regulatory statement is re-checked before publication and dated above.
Legal notes and scope
Velarozone provides setup and operational-readiness coordination. This page is general information, not legal, tax, immigration, or banking advice.
This page is general information about UAE business setup, not legal, tax, immigration, or banking advice. Rules, fees, permitted activities, and bank policies can change. Final eligibility depends on your facts and the applicable rules at the time of application.
Which activities are regulated, by which authority and on what conditions is decided by the regulator; nothing here asserts a licence category or approval it has not published or decided. Customer money a fintech safeguards sits in a segregated client money account with a licensed institution, under the relevant regulator's oversight. Velarozone assesses, prepares and coordinates, and does not itself hold a payments, lending or virtual-asset licence.