The Banking Regulation Review: United Arab Emirates


The United Arab Emirates, and in particular Dubai, have in recent years developed as the key financial hub of the Middle East. The UAE is fast becoming a leading global financial centre, and boasts one of the largest Islamic banking markets in the world, after Saudi Arabia and Malaysia.

There are essentially three broad categories of banks in the UAE: commercial banks, Islamic banks and foreign banks, all licensed and regulated by the Central Bank of UAE. Based on the total assets at the end of the third quarter of 2021, the five largest banks in the UAE are:

  1. First Abu Dhabi Bank;
  2. Emirates NBD;
  3. Abu Dhabi Commercial Bank;
  4. Dubai Islamic Bank; and
  5. Mashreq Bank.2

In Moody's long-term ratings of banks, the UAE banking system changed from negative in 2019 back to stable in 2021. The change has been attributed to Moody's view that the operating environment of UAE banks is recovering from the effects of the pandemic, attributed also to the Central Bank's support package, which supported the UAE's economy and consequently helped banks mitigate loan quality deterioration.3

The regulatory regime applicable to banks


The regulatory framework for banking in the UAE is based on the Banking Law,4 under which the Central Bank is entrusted with the issuance and management of the country's currency, and the regulation of the banking and financial sectors.

The Banking Law provides for the licensing and regulation by the Central Bank of:

  1. banks, which are defined to include institutions licensed to primarily carry on the activity of accepting deposits and other licensed financial activities such as granting loans, issuing and collecting cheques, placing bonds, trading in foreign exchange and precious metals, and carrying on other operations allowed by law or by customary banking practice;
  2. exchange houses and money intermediaries (i.e., foreign exchange dealers who purchase and sell currencies);
  3. Islamic financial institutions, which are defined as financial institutions licensed to undertake all the activities of a commercial bank, but in accordance with the principles of Islamic shariah; and
  4. other financial institutions.

The Banking Law does not apply to statutory public credit institutions, governmental investment institutions, development funds, private savings and pension funds, or to the insurance sector. Neither does it apply to the free zones or financial institutions established therein. The Central Bank does, however, have the right to exercise its powers over financial institutions outside the UAE or in free zones after consulting the relevant authority.

While the Central Bank is the principal regulatory authority of banks and financial institutions in the UAE, all such entities are also subject to additional registration and licensing requirements at the federal and emirate levels.

All commercial banks incorporated in the UAE must be established as public shareholding companies, and must be majority-owned by UAE nationals. A majority of directors of such companies must be UAE nationals. The minimum UAE national shareholding requirement for finance companies, banks and exchange houses is 60 per cent. Unlike branches of foreign companies in the UAE, foreign banks are not required to appoint a national agent to establish a branch in the UAE.

Based on data available on the Central Bank website, as at September 2021 there were 21 national banks, 27 foreign banks and 10 wholesale banks registered in the UAE.5

The principal difference in the treatment of local and foreign commercial banks is that local banks are not subject to any taxation on their income, whereas foreign banks are subject to tax at the emirate level.

Non-resident banks can grant bilateral credit facilities and participate in syndications in the UAE. They are not deemed to be resident, domiciled or carrying on business in the UAE, and are not liable to pay tax in the UAE merely on account of such bilateral facilities or participation in syndications. All licensed financial institutions are required under the Banking Law to maintain the confidentiality of all customer data and information.

ii Emirates Securities and Commodities Authority

The Emirates Securities and Commodities Authority (SCA) regulates the securities markets in the UAE. All UAE banks are listed in one of the two onshore markets, the Abu Dhabi Exchange and the Dubai Financial Market. The SCA licenses all brokers, consultants and custodians who provide services related to listed securities. The Investment Funds Regulation issued by the SCA in July 2013 transferred regulatory responsibility for the licensing and marketing of investment funds, and for a number of related activities, from the Central Bank to the SCA. The sale, marketing and promotion of foreign securities and funds in the UAE and the establishment of domestic funds require the approval of the SCA. This requirement has been further clarified and established under SCA Board of Directors Decision No. 3 of 2017 on the Regulation of Promotion and Arranging Activities.

iii Dubai International Financial Centre

The Dubai Financial Services Authority (DFSA) has adopted a regulatory approach modelled, at least in part, on the former Financial Services Authority in the United Kingdom. The DFSA does not grant banking licences per se; rather, it authorises financial service providers to undertake specific financial services. The relevant financial services in respect of banks include providing credit and accepting deposits. There are about 630 financial services firms with a presence in the Dubai International Financial Centre (DIFC). Of these, a substantial number of institutions do not have authority to accept deposits. This reluctance on the part of various institutions to be a 'true' bank can be traced back to two causes:

  1. DIFC entities were historically not able to deal with retail customers. This restriction was lifted several years ago, but the business model of the vast majority of institutions within the DIFC has been to focus on corporate clients or high net worth individuals; and
  2. banks have been reluctant to apply for authorisation to accept deposits because they remain unable to deal in dirhams or accept deposits from the UAE markets.

Most of the banks that have set up in the DIFC have done so as branches of overseas companies; this has been done for capital adequacy reasons. Recently, however, it has been the policy of the DFSA to encourage banks to incorporate new subsidiaries within the DIFC and capitalise those subsidiaries to an acceptable level.

iv Abu Dhabi Global Market

Following the success of the DIFC, a financial free zone, the Abu Dhabi Global Market (ADGM), was set up in Abu Dhabi and became operational in the second half of 2015. The financial services regulatory framework for the ADGM aims to reflect current international best practices by assimilating the key aspects of other regulatory regimes across the world. The ADGM has its own regulator, the Financial Services Regulatory Authority (FSRA). Like the DFSA, the FSRA does not grant banking licences per se. Banks licensed in the ADGM are prohibited from accepting deposits from the UAE market, and may not accept deposits or undertake foreign exchange transactions involving UAE dirhams.

v US Foreign Account Tax Compliance Act

The UAE and the United States reached an agreement in substance in May 2014 to include the UAE on the list of jurisdictions to be treated as having an intergovernmental agreement in effect in relation to the US Foreign Account Tax Compliance Act (FATCA). The UAE has adopted Model 1. Banks and financial institutions now routinely comply with FATCA requirements.

vi Common Reporting Standard

The Cabinet has approved the agreement on mutual administrative assistance in tax matters and the multilateral competent authority agreement by way of Cabinet Resolution No. 9 of 2016. Thus, the Common Reporting Standard (CRS) of the Organisation for Economic Co-operation and Development (OECD) has been effective in the UAE since 1 January 2017 to implement the automatic exchange of information about financial accounts. International Financial Reporting Standard 9 is required to be complied with by banks and financial institutions in the UAE. International Financial Reporting Standard 16 (which applies to leases and replaces the IAS 17 standard) came into effect on 1 January 2019.

vii OECD

The UAE has implemented the standards of joint disclosures and the exchange of information for tax purposes set out by the G20 and the OECD. This follows the Cabinet's decision requiring the Ministry of Finance to coordinate with various government authorities to collect financial information to implement information exchanges for tax purposes. The CRS calls on jurisdictions to obtain information from their financial institutions and automatically exchange that information with other jurisdictions annually. Banks and financial institutions started collecting the required financial data as of 1 January 2017.

Prudential regulation


The Central Bank has issued regulations on a whole range of issues and ensures compliance with those regulations on the basis of a bank–examiner-type approach.

In a significant development, the Central Bank issued Circular No. 52 of 2017, which came into effect on 1 February 2017, on capital adequacy norms by way of the phased implementation of Basel III. Article 2 of the regulations explains the quantitative requirements and states that the total regulatory capital comprises the sum of two tiers, where Tier 1 capital is composed of a Common Equity Tier 1 (CET1) and an additional Tier 1. Banks must comply with the following minimum requirements at all times: CET1 must be at least 7 per cent of risk-weighted assets (RWA); Tier 1 capital must be at least 8.5 per cent of RWA; and total capital, calculated as the sum of Tier 1 capital and Tier 2 capital, must be at least 10.5 per cent of RWA. The regulations were fully implemented on 1 January 2018.

Circular No. 16/93 issued by the Central Bank governed large exposures incurred by banks. Large exposures were funded exposures. Banks were restricted from exceeding the maximum exposure per client or group. Circular No. 32/2013 was issued by the Central Bank in November 2013 to replace Circular No. 16/93. Now large exposures include funded and unfunded exposures and unutilised committed lines. Revised restrictions have been imposed with regard to lending to government and government-owned entities. Banks cannot lend sums exceeding 100 per cent of their capital to governments and their related companies, or more than 25 per cent to an individual borrower. The rules also prescribe the manner in which different categories of assets are to be risk-weighted. In March 2020, the Central Bank issued new regulations with respect to major acquisitions (the Major Acquisitions' Regulations) with a view to regulating and supervising major acquisitions being undertaken by banks in the UAE. The Major Acquisitions Regulations apply to all banks licensed to carry out financial activities by the Central Bank in the UAE, including subsidiaries, affiliates and international branches, and restricts banks from, inter alia, acquiring any other institution or transferring any part of their liabilities without obtaining the prior approval of the Central Bank.

Furthermore, the mortgage caps of 75 and 80 per cent of the value of a first home issued by the Central Bank for expatriates and UAE nationals, respectively, were revised in 2020 to 80 per cent and 85 per cent, respectively. This was done by the Central Bank during the pandemic with a view to reducing the financial burden on residents and citizens.


i Relationship with the prudential regulator

Firms authorised by the DFSA are required to notify the DFSA of all matters that could reasonably be expected to be notified to the DFSA. There are quarterly reporting requirements in respect of capital adequacy. The DFSA regularly conducts themed reviews. Previous reviews have focused on the prevention of money laundering and terrorism financing. Recent reviews have also looked at client take-on processes and suitability assessments.

ii Management of banks

The DFSA requires all financial institutions active in the DIFC to have adequate systems and controls in place to ensure that they are properly managed. There are a number of mandatory appointments (senior executive officer, chief financial officer, etc.). Individuals holding these mandatory positions are subject to prior clearance by the DFSA. The DFSA does not impose any requirements or make any restrictions in respect of bonus payments to management and employees of banking groups other than recommending that remuneration structures and strategies are appropriate to the nature, scale and complexity of individual businesses.

iii Regulatory capital and liquidity

Those firms holding authorisations to accept deposits and provide credit fall into prudential category 1 (being the highest of categories 1 to 5). Category 1 firms have a base capital requirement of US$10 million. The actual capital requirement may be significantly higher, depending upon the volume of business being conducted and other factors set out in the DFSA Rulebook. Historically, most banking groups established branches in the DIFC and were able to obtain waivers of the capital adequacy requirements on that basis: in short, they looked to their head office balance sheet as support for their DIFC functions. This approach is becoming less and less acceptable to the DFSA, particularly for smaller financial institutions coming from jurisdictions other than Tier I jurisdictions.

In December 2021, the DFSA issued the new Prudential – Investment, Insurance Intermediation and Banking Business Module of the DFSA Rulebook repealing and replacing the earlier version. This was done to include the standards and recommendations of the Basel Committee on Banking Supervision, and with a view to changing the DFSA's prudential regime relating to large exposures of financial institutions regulated by the DFSA.


The Prudential – Investments, Insurance Intermediation and Banking Rules (PRU Rulebook) have been promulgated by the FSRA. Regulated firms are classified into five categories, primarily on the basis of the activities for which they are authorised. Banking activities, including taking deposits, fall into category 1, and attract stricter requirements such as a base capital requirement of US$10 million. Firms that are authorised to deal in investments as principal or provide credit but that cannot accept deposits fall under category 2, with a base capital requirement of US$2 million. These rules were revised by the ADGM in 2021 as part of the ADGM's ongoing commitment to continually improve its prudential regulatory framework in a manner that balances risk-based regulations with the needs of market participants.

Conduct of business


Local banks have a board of directors, a chief executive, a number of board committees and senior executives. There is currently no regulation of bonus payments to management; bonus payments have, however, not been of a magnitude that requires regulation.

UAE banks are all publicly listed companies, and must comply with the Central Bank, UAE companies and SCA laws, all of which, inter alia, regulate management.

There is currently little or no regulation of bank holding companies or subsidiaries.

Banks are required to publish quarterly audited accounts and to have their annual audited accounts approved by the Central Bank before they are published. Banks are required to obtain prior approval from the Central Bank for changes in directors, senior management, shareholders (holding more than 5 per cent equity), constitutional documents and capital.

The Banking Law, along with various circulars and notices issued periodically by the Central Bank, govern the conduct of business by banks in the UAE. The Banking Law lists various administrative and financial sanctions that may be imposed on banks as well as individuals for breach of provisions of law, regulations, decisions, rules, standards and instructions issued by the Central Bank. Accordingly, a bank may be subject to civil or regulatory liability under the Banking Law. There may also be occasions where a bank may be exposed to criminal liability under the UAE Federal Penal Code.

In accordance with the Companies Law,6 neither a company nor any of its subsidiaries can give financial assistance to any person to subscribe to its shares, bonds or sukuk. The term 'financial assistance' extends to giving loans or gifts, or providing any securities or guarantees. This is likely to have a significant impact on acquisition finance transactions in the UAE.

ii Value added tax

Value added tax (VAT) was introduced in the UAE on 1 January 2018. VAT is charged at a rate of 5 per cent for goods and services (unless exempted or zero-rated). Interest-bearing banking transactions are zero-rated, whereas transaction fees and margin-based transactions attract VAT at the rate of 5 per cent. For the purposes of VAT, Islamic banking products are treated at par with conventional banking products. This development has marginally increased the cost of banking for customers.

iii DIFC

The DFSA Rulebook contains a detailed conduct of business module. The Rulebook is essentially a principle-based system:7 for example, principle 1 (integrity) states that an authorised firm must observe high standards of integrity and fair dealing, while Principle 5 (marketing conduct) states that an authorised firm must observe proper standards of conduct in financial markets. There are 12 principles, the final two being 'compliance with high standards of corporate governance', which states that an authorised firm must meet the applicable standards of corporate governance as appropriate to the nature, size and complexity of the authorised firm's activities; and 'remuneration practices', which states that authorised firms must have remuneration structures and strategies that are well-aligned with the long-term interests of the firm, and that are appropriate to the nature, scale and complexity of its business. A bank operating in the DIFC will be subject to civil liability under the various DIFC laws; and to regulatory liability in respect of the applicable DIFC laws, such as the Market Law and the Regulatory Law, plus the provisions of the DFSA Rulebook. Depending on the relevant customer documentation, a bank in the DIFC may also be exposed to civil liability under the laws of the UAE outside the DIFC. Finally, there may be occasions when a bank in the DIFC would be exposed to criminal liability (i.e., under the UAE Federal Penal Code).


The FSRA promulgated the Code of Business Rulebook (COBS), which must be followed by regulated firms operating in the ADGM. The COBS describes the standard of business and client treatment obligations of these entities. The COBS consists of 19 chapters of various rules and regulations.



Under the Banking Law, commercial and investment banks must have a minimum paid-up capital. All foreign banks are required to allocate capital for their UAE operations. At least 10 per cent of the annual net profits of banks is required to be allocated to a special reserve until that reserve equals 50 per cent of the bank's paid-up capital or, in the case of a foreign bank, the amount allocated as capital for its UAE operations.


There is no central bank or equivalent within the DIFC; therefore, banks registered within the DIFC must fund their activities through support from other branches of their international operations or debt issuance programmes of their own. Deposit-taking is not a significant source of funding for any institution in the DIFC.

iii ADGM

The analysis set out above in relation to the DIFC is also valid for the ADGM.

Control of banks and transfers of banking business


There is no specific definition of control (except in relation to the determination of large exposures). Control is generally viewed as a majority shareholding interest or a right to appoint the majority of the board of directors of a bank, or both. Any change in control requires the prior approval of the Central Bank.

A transfer of customer relationships (e.g., deposits, loans, credit cards, accounts, investment products) generally requires customer consent. There is no statutory mechanism for the transfer of such relationships. In recent acquisition activities, customer consent has been assumed on the basis of the provision of information regarding such acquisition activities to the customer, as well as correspondence by both the acquiring and the selling parties to the customer and the customer's failure to object.


Any material change of control in a DFSA-authorised firm requires prior approval from the DFSA.

The DFSA Rulebook does not include detailed provisions regarding the methods by which banks may transfer all or part of their business (comprising deposits, and possibly loan agreements and other assets) to another entity without the consent of the customers concerned. The ability of an institution to do this would be governed by the assignment clauses in their contractual documentation as interpreted in accordance with the DIFC Contract Law. Further, any such material transfer would also require the consent and approval of the DFSA.

iii ADGM

Change of control provisions are set out in the Financial Services and Markets Regulations (FSMR) issued by the FSRA. Any material change of control in an ADGM-regulated firm requires prior approval from the FSRA. Part 10 of the FSMR deals with changes in control.

The year in review


The following key developments were overseen by the Central Bank in the UAE in the past year:

  1. Development of an enhanced framework to supervise banks' exposure to the real estate sector. The new standards cover all types of on-balance sheet loans and investments, and all off-balance sheet exposures to the real estate sector. They also require banks to review and improve their internal policies to enhance sound underwriting, valuation and general risk management for their real estate exposures.8
  2. Extension of several measures of the Central Bank's Targeted Economic Support Scheme until June 2022 to support the continued recovery of the UAE economy. These include prudential relief measures regarding banks' capital buffers and stable funding requirements, which are available to all banks operating in the UAE.9
  3. Imposition of administrative measures and financial sanctions on banks operating in the UAE on matters relating to compliance with extant anti-money laundering regulations.10


The DIFC further consolidated its position as the regional financial hub in the past year. In December 2021, the Commercial Bank of Dubai announced the opening of its digital lab at the DIFC Innovation Hub. The CBD Digital Lab is the first initiative by a bank to establish a research and development facility in the DIFC Innovation Hub. The objective is to create a collaborative ecosystem in the fintech sector by fostering innovation and supporting integration between financial institutions and fintech startups.11

iii ADGM

The MENA FinTech Association (MFTA) Open Banking Working Group published a landmark report on 'Open Finance – A framework for the Arab region is more than a question of scope' in collaboration with the Arab Regional FinTech Working Group and the ADGM. The framework serves as the basis for open finance by allowing for the expansion of specified information types as demand for new third-party services increases.12

Outlook and conclusions

The pandemic has accelerated digitalisation in the banking sector. The business environment during the crisis has forced more banking customers to try digital solutions, and 2022 is expected to see a rise in digitalisation. Banking sector assets in the UAE are also anticipated to grow within a range of 8 to 10 per cent in 2022.13 Further, in a move to diversify government income, the Ministry of Finance announced on 31 January 2022 the introduction of a corporate tax commencing from June 2023. Many details pertaining to the UAE corporate tax regime remain unknown at this time; however, once promulgated, the UAE corporate tax law will provide the operational detail and guidance required.


1 Bashir Ahmed and Rahat Dar are partners and Adite Aloke is a senior associate at Afridi & Angell.

4 Federal Law No. 14 of 2018 concerning the Central Bank, and Organisation of Financial Institutions and Banking.

6 Federal Law No. 32 of 2021.

7 The principles are set out in the general module of the Rulebook, not the conduct of business module.

The Law Reviews content