The Banking Regulation Review: United Arab Emirates
The United Arab Emirates, and in particular Dubai, have in recent years developed as the key financial hub of the Middle East. The UAE is fast becoming one of the leading financial centres in the world.
There are essentially three broad categories of banks in the UAE: commercial banks, Islamic banks and foreign banks, all licensed and regulated by the UAE Central Bank. Based on the total assets at the end of the third quarter of 2019, the five largest banks in the UAE are:2
- First Abu Dhabi Bank;
- Emirates NBD;
- Abu Dhabi Commercial Bank;
- Dubai Islamic Bank; and
- Mashreq Bank.
The UAE banking system remained stable in 2019 and UAE banks benefited from strong capital, stable funding and healthy liquidity that balanced weakening asset quality and softening profitability.3
The regulatory regime applicable to banks
The regulatory framework for banking in the UAE is based on the Banking Law.4 The Banking Law came into force on 30 September 2018 and repealed the previous banking law, Federal Law No. 10 of 1980. Under the Banking Law, the Central Bank of the UAE was created and entrusted with the issuance and management of the country's currency, and the regulation of the banking and financial sectors.
The Banking Law provides for the licensing and regulation by the Central Bank of:
- banks, which are defined to include institutions licensed to primarily carry on the activity of accepting deposits and other licensed financial activities such as granting loans, issuing and collecting cheques, placing bonds, trading in foreign exchange and precious metals, or carrying on other operations allowed by law or by customary banking practice;
- exchange houses and money intermediaries (i.e., foreign exchange dealers who purchase and sell currencies);
- Islamic financial institutions, which are defined as financial institutions licensed to undertake all the activities of a commercial bank, but in accordance with the principles of Islamic shariah; and
- other financial institutions.
The Banking Law does not apply to statutory public credit institutions, governmental investment institutions, development funds, private savings and pension funds, or to the insurance sector. Neither does it apply to the free zones or financial institutions established therein. The Central Bank does, however, have the right to exercise its powers over financial institutions outside the UAE or in free zones after consulting the relevant authority.
The Banking Law has introduced several changes to the previous regime. Some of the key changes are:
- Federal Law No. 10 of 1980 Concerning the Central Bank, the Monetary System and the Organisation of Banking and Federal Law No. 6 of 1985 Concerning Islamic Banks, Financial Establishments and Investment Companies have been repealed. All existing Central Bank regulations, circulars and decisions issued under these repealed laws will remain in force for a period of three years, unless replaced by new regulations, circulars and decisions;
- licensed financial institutions are now prohibited from charging customers interest on accrued interest charged on any credit or funding facilities;
- the establishment of a Financial Activities Committee under the Ministry of Finance (composed of a member from each of the Central Bank, the Emirates Securities and Commodities Authority and the Insurance Authority) has been contemplated to opine on the introduction of new financial activities within the purview of the Banking Law;
- provisions pertaining to mergers of licensed financial institutions have been introduced;
- provisions pertaining to governance, financial infrastructure system oversight and maintenance of customer confidentiality have been introduced;
- provisions concerning credit control within banks (including restrictions on loans to management) have been introduced; and
- the Central Bank's enforcement powers have been strengthened by granting it authority to impose a wider range of penalties.
While the Central Bank is the principal regulatory authority of banks and financial institutions in the UAE, all such entities are also subject to additional registration and licensing requirements at the federal and emirate levels.
All commercial banks incorporated in the UAE must be established as public shareholding companies, and must be majority-owned by UAE nationals. A majority of directors of such companies must be UAE nationals. The minimum UAE national shareholding requirement for finance companies, banks and exchange houses is 60 per cent. Unlike branches of foreign companies in the UAE, foreign banks are not required to appoint a national agent in order to establish a branch in the UAE.
In recent years, only banks incorporated in Member States of the Gulf Cooperation Council (GCC) have been allowed to establish branches. GCC banks have also been allowed to acquire controlling stakes in UAE banks and financial institutions. A few non-GCC banks were issued wholesale banking licences in 2014 and 2015.
Based on data available on the Central Bank website, as at 30 June 2019, there were 22 UAE banks5 and 27 foreign banks registered in the UAE.
The principal difference in the treatment of local and foreign commercial banks is that local banks are not subject to any taxation on their income, whereas foreign banks are subject to tax at the emirate level.
Non-resident banks can grant bilateral credit facilities and participate in syndications in the UAE. They are not deemed to be resident, domiciled or carrying on business in the UAE, and are not liable to pay tax in the UAE merely on account of such bilateral facilities or participation in syndications. All licensed financial institutions are required under the Banking Law to maintain the confidentiality of all customer data and information.
ii Emirates Securities and Commodities Authority
The Emirates Securities and Commodities Authority (SCA) regulates the securities markets in the UAE. All UAE banks are listed in one of the two onshore markets, the Abu Dhabi Exchange and the Dubai Financial Market. The SCA licenses all brokers, consultants and custodians who provide services related to listed securities. The Investment Funds Regulation issued by the SCA in July 2013 transferred regulatory responsibility for the licensing and marketing of investment funds, and for a number of related activities, from the Central Bank to the SCA. The sale, marketing and promotion of foreign securities and funds in the UAE and the establishment of domestic funds require the approval of the SCA. This requirement has been further clarified and established under SCA Board of Directors Decision No. 3 of 2017 on the Regulation of Promotion and Arranging Activities.
iii Dubai International Financial Centre
The Dubai Financial Services Authority (DFSA) has adopted a regulatory approach modelled, at least in part, on the former Financial Services Authority in the United Kingdom. The DFSA does not grant banking licences per se; rather, it authorises financial service providers to undertake specific financial services. The relevant financial services in respect of banks include providing credit and accepting deposits. There are about 630 financial services firms with a presence in the Dubai International Financial Centre (DIFC). Of these, a substantial number of institutions do not have authority to accept deposits. This reluctance on the part of various institutions to be a 'true' bank can be traced back to two causes:
- DIFC entities were historically not able to deal with retail customers. This restriction was lifted several years ago, but the business model of the vast majority of institutions within the DIFC has been to focus on corporate clients or high-net-worth individuals; and
- banks have been reluctant to apply for authorisation to accept deposits because they remain unable to deal in dirhams or accept deposits from the UAE markets.
Most of the banks that have set up in the DIFC have done so as branches of overseas companies; this has been done for capital adequacy reasons. Recently, however, it has been the policy of the DFSA to encourage banks to incorporate new subsidiaries within the DIFC and capitalise those subsidiaries to an acceptable level.
iv Abu Dhabi Global Market
Following the success of the DIFC, a new financial free zone, the Abu Dhabi Global Market (ADGM), was set up in Abu Dhabi and became operational in the second half of 2015. The financial services regulatory framework for the ADGM aims to reflect current international best practices by assimilating the key aspects of other regulatory regimes across the world. The ADGM has its own regulator, the Financial Services Regulatory Authority (FSRA). Like the DFSA, the FSRA does not grant banking licences per se. Banks licensed in the ADGM are prohibited from accepting deposits from the UAE market, and may not accept deposits or undertake foreign exchange transactions involving UAE dirhams.
v US Foreign Account Tax Compliance Act
The UAE and the United States reached an agreement in substance in May 2014 to include the UAE on the list of jurisdictions to be treated as having an intergovernmental agreement in effect in relation to the US Foreign Account Tax Compliance Act (FATCA). The UAE has adopted Model 1. Banks and financial institutions now routinely comply with FATCA requirements.
vi Common Reporting Standard
The UAE Cabinet has approved the agreement on mutual administrative assistance in tax matters and the multilateral competent authority agreement by way of Cabinet Resolution No. 9 of 2016. Thus, the Common Reporting Standard (CRS) of the Organisation for Economic Co-operation and Development (OECD) has been effective in the UAE since 1 January 2017 to implement the automatic exchange of information about financial accounts. The International Financial Reporting Standard 9 is required to be complied with by banks and financial institutions in the UAE. On 1 January 2019, the new International Financial Reporting Standard 16 (which applies to leases and replaces the IAS 17 standard) became effective.
The UAE has implemented the standards of joint disclosures and the exchange of information for tax purposes set out by the G20 and the OECD. This follows the UAE Cabinet's decision requiring the Ministry of Finance to coordinate with various government authorities to collect financial information to implement information exchanges for tax purposes. The CRS calls on jurisdictions to obtain information from their financial institutions and automatically exchange that information with other jurisdictions annually. Banks and financial institutions started collecting the required financial data as of 1 January 2017.
The Central Bank has issued regulations on a whole range of issues and ensures compliance with those regulations on the basis of a bank–examiner-type approach.
In a significant development, the Central Bank issued Circular No. 52 of 2017, which came into effect on 1 February 2017, on capital adequacy norms by way of the phased implementation of Basel III. Article 2 of the regulations explains the quantitative requirements and states that the total regulatory capital comprises the sum of two tiers, where Tier 1 capital is composed of a Common Equity Tier 1 (CET1) and an additional Tier 1. Banks must comply with the following minimum requirements at all times: CET1 must be at least 7 per cent of risk-weighted assets (RWA); Tier 1 capital must be at least 8.5 per cent of RWA; and total capital, calculated as the sum of Tier 1 capital and Tier 2 capital, must be at least 10.5 per cent of RWA. The regulations were fully implemented on 1 January 2018.
Circular No. 16/93 issued by the Central Bank governed large exposures incurred by banks. Large exposures were funded exposures. Banks were restricted from exceeding the maximum exposure per client or group. Circular No. 32/2013 was issued by the Central Bank in November 2013 to replace Circular No. 16/93. Now large exposures include funded and unfunded exposures and unutilised committed lines. Revised restrictions have been imposed with regard to lending to government and government-owned entities. Banks cannot lend sums exceeding 100 per cent of their capital to governments and their related companies, or more than 25 per cent to an individual borrower. The rules also prescribe the manner in which different categories of assets are to be risk-weighted. Circular No. 32/2013 allows banks five years within which to bring their exposure within the prescribed limits. Given the current banking situation, the deadline is likely to be extended.
In 2012, a circular was issued by the Central Bank to restrict mortgage loans to expatriates to 50 per cent of the value of a first home and 40 per cent of the value of a second home. Loans to UAE nationals were capped at 70 per cent of the value of their first home and 60 per cent of their second home. At the request of the banks, the circular was reconsidered by the Central Bank and reissued in October 2013. As reissued, the mortgage caps have been revised, and banks are now permitted to grant mortgage loans to expatriates of up to 75 per cent of the value of a first home and up to 60 per cent of the value of a second. Loans to UAE nationals are capped at 80 per cent of the value of their first home and up to 65 per cent of the value of the second. If the value of the first home exceeds 5 million dirhams, the mortgage loan cap applicable to an expatriate and a UAE national is 65 and 70 per cent, respectively.
Relationship with the prudential regulator
Firms authorised by the DFSA are required to notify the DFSA of all matters that could reasonably be expected to be notified to the DFSA. There are quarterly reporting requirements in respect of capital adequacy. The DFSA regularly conducts themed reviews. Previous reviews have focused on the prevention of money laundering and terrorism financing. The DFSA has also focused on authorised firms' compliance with restrictions imposed on dealing with Iranian counterparties arising from the United Nations sanctions relating to nuclear non-proliferation and politically exposed persons. Recent reviews have also looked at client take-on processes and suitability assessments.
Management of banks
The DFSA requires all financial institutions active in the DIFC to have adequate systems and controls in place to ensure that they are properly managed. There are a number of mandatory appointments (senior executive officer, chief financial officer, etc.). Individuals holding these mandatory positions are subject to prior clearance by the DFSA. The DFSA does not impose any requirements or make any restrictions in respect of bonus payments to management and employees of banking groups other than recommending that remuneration structures and strategies are appropriate to the nature, scale and complexity of individual businesses.
Those firms holding authorisations to accept deposits and provide credit fall into prudential category 1 (being the highest of categories 1 to 5). Category 1 firms have a base capital requirement of US$10 million. The actual capital requirement may be significantly higher, depending upon the volume of business being conducted and other factors set out in the DFSA Rulebook. Historically, most banking groups established branches in the DIFC and were able to obtain waivers of the capital adequacy requirements on that basis: in short, they looked to their head office balance sheet as support for their DIFC functions. This approach is becoming less and less acceptable to the DFSA, particularly for smaller financial institutions coming from jurisdictions other than Tier I jurisdictions.
In line with the revised rules outlined for Basel III implementation, the DFSA revised the Prudential Investment Business Module of the DFSA Rulebook in 2018. This introduced changes to minimum capital requirements, new capital buffers, leverage and liquidity coverage ratios, and disclosure and monitoring requirements.
The Prudential – Investments, Insurance Intermediation and Banking Rules (the PRU Rulebook) have been promulgated by the FSRA. Regulated firms are classified into five categories, primarily on the basis of the activities for which they are authorised. Banking activities, including taking deposits, fall into category 1, and attract stricter requirements such as a base capital requirement of US$10 million. Firms that are authorised to deal in investments as principal or provide credit but that cannot accept deposits fall under category 2, with a base capital requirement of US$2 million. These rules were revised by the ADGM in 2018 for the purposes of compliance with Basel III.
In November 2019, the FSRA published a consultation paper setting out a number of proposed updates to the PRU Rulebook. The proposals cover the prudential supervision of banks, insurance intermediaries and investment firms operating within and from the ADGM's jurisdiction and would align its internationally recognised prudential regime more closely with the regulatory framework developed by the Basel Committee on Banking Supervision. The main proposals are in relation to the net stable funding ratio, large exposures, disclosure requirements and further, miscellaneous amendments that will provide greater clarity to institutions operating in the ADGM.6 The deadline for providing comments was 5 January 2020, following which the ADGM is considering modifications. The updated rules are yet to be published.
Conduct of business
Local banks have a board of directors, a chief executive, a number of board committees and senior executives. There is currently no regulation of bonus payments to management; bonus payments have, however, not been of a magnitude that requires regulation.
UAE banks are all publicly listed companies, and must comply with the Central Bank, UAE companies and SCA laws, all of which, inter alia, regulate management.
There is currently little or no regulation of bank holding companies or subsidiaries.
Banks are required to publish quarterly audited accounts and to have their annual audited accounts approved by the Central Bank before they are published. Banks are required to obtain prior approval from the Central Bank for changes in directors, senior management, shareholders (holding more than 5 per cent equity), constitutional documents and capital.
The Banking Law, along with various circulars and notices issued from time to time by the Central Bank, govern the conduct of business by banks in the UAE. The Banking Law lists various administrative and financial sanctions that may be imposed on banks as well as individuals for breach of provisions of law, regulations, decisions, rules, standards and instructions issued by the Central Bank. Accordingly, a bank may be subject to civil or regulatory liability under the Banking Law. There may also be occasions where a bank may be exposed to criminal liability under the UAE Federal Penal Code.
In a significant development, the New Companies Law7 came into force on 1 July 2015, replacing Federal Law No. 8 of 1984, the previous Companies Law of the UAE. Under the New Companies Law, neither a company nor any of its subsidiaries can give financial assistance to any person to subscribe to its shares, bonds or sukuk. The term financial assistance extends to giving loans or gifts, or providing any securities or guarantees. This is likely to have a significant impact on acquisition finance transactions in the UAE. In a positive development, a mortgage of shares of UAE companies is recognised as a registrable security under the New Companies Law.
The New Companies Law also empowers the SCA to regulate the listing of public companies.
Dubai Law No. 31 of 2016 imposes restrictions on the registration of mortgages of granted or gifted land in the emirate of Dubai.
ii Value added tax
In a significant development, value added tax (VAT) was introduced in the UAE on 1 January 2018. VAT is charged at a rate of 5 per cent for goods and services (unless exempted or zero-rated). Interest-bearing banking transactions are zero-rated, whereas transaction fees and margin-based transactions attract VAT at the rate of 5 per cent. For the purposes of VAT, Islamic banking products are treated at par with conventional banking products. This development has marginally increased the cost of banking for customers.
The DFSA Rulebook contains a detailed conduct of business module. The Rulebook is essentially a principle-based system:8 for example, principle 1 (integrity) states that an authorised firm must observe high standards of integrity and fair dealing, while Principle 5 (marketing conduct) states that an authorised firm must observe proper standards of conduct in financial markets. There are 12 principles, the final two being 'compliance with high standards of corporate governance', which states that an authorised firm must meet the applicable standards of corporate governance as appropriate to the nature, size and complexity of the authorised firm's activities; and 'remuneration practices', which states that authorised firms must have remuneration structures and strategies that are well-aligned with the long-term interests of the firm, and that are appropriate to the nature, scale and complexity of its business. A bank operating in the DIFC will be subject to civil liability under the various DIFC laws; and to regulatory liability in respect of the applicable DIFC laws, such as the Market Law and the Regulatory Law, plus the provisions of the DFSA Rulebook. Depending on the relevant customer documentation, a bank in the DIFC may also be exposed to civil liability under the laws of the UAE outside the DIFC. Finally, there may be occasions when a bank in the DIFC would be exposed to criminal liability (i.e., under the UAE Federal Penal Code).
The FSRA promulgated the Code of Business Rulebook (COBS), which must be followed by regulated firms operating in the ADGM. The COBS describes the standard of business and client treatment obligations of these entities. The COBS consists of 16 chapters of various rules and regulations.
Under the Banking Law, commercial and investment banks must have a minimum paid-up capital. All foreign banks are required to allocate capital for their UAE operations. At least 10 per cent of the annual net profits of banks is required to be allocated to a special reserve until that reserve equals 50 per cent of the bank's paid-up capital or, in the case of a foreign bank, the amount allocated as capital for its UAE operations.
There is no central bank or equivalent within the DIFC; therefore, banks registered within the DIFC must fund their activities through support from other branches of their international operations or debt issuance programmes of their own. Deposit-taking is not a significant source of funding for any institution in the DIFC.
The analysis set out above in relation to the DIFC is also valid for the ADGM.
Control of banks and transfers of banking business
There is no specific definition of control (except in relation to the determination of large exposures). Control is generally viewed as a majority shareholding interest or a right to appoint the majority of the board of directors of a bank, or both. Any change in control requires the prior approval of the Central Bank.
A transfer of customer relationships (e.g., deposits, loans, credit cards, accounts, investment products) generally requires customer consent. There is no statutory mechanism for the transfer of such relationships. In recent acquisition activities, customer consent has been assumed on the basis of the provision of information regarding such acquisition activities to the customer, as well as correspondence by both the acquiring and the selling parties to the customer and the customer's failure to object.
Any material change of control in a DFSA-authorised firm requires prior approval from the DFSA.
The DFSA Rulebook does not include detailed provisions regarding the methods by which banks may transfer all or part of their business (comprising deposits, and possibly loan agreements and other assets) to another entity without the consent of the customers concerned. The ability of an institution to do this would be governed by the assignment clauses in their contractual documentation as interpreted in accordance with the DIFC Contract Law. Further, any such material transfer would also require the consent and approval of the DFSA.
Change of control provisions are set out in the Financial Services and Markets Regulations (FSMR) issued by the FSRA. Any material change of control in an ADGM-regulated firm requires prior approval from the FSRA. Part 10 of the FSMR deals with changes in control.
The year in review
The following developments were observed in the UAE in the past year:
- the implementation of Basel III is ongoing in the UAE (including in the DIFC and the ADGM);
- Cabinet Decision No. 10 of 2019 concerning the implementing regulation of Decree Law No. 20 of 2018 on anti-money laundering and combating the financing of terrorism and illegal organisations was issued requiring both financial institutions and designated non-financial businesses to carry out a detailed risk analysis when assessing a client's money laundering risk;
- Abu Dhabi Commercial Bank, Union National Bank and Al Hilal Bank merged in May 2019, establishing a bank with combined assets of nearly 423 billion dirhams; and
- the impact of the cryptocurrency industry continued to be felt. These are still nascent days for these rather borderless currencies, and the Central Bank is rather apprehensive about bitcoin and other cryptocurrencies.
The DIFC further consolidated its position as the regional financial hub in the past year.
The ADGM has made substantial developments in terms of issuing licences to new entities in the past year. In 2019, the ADGM also invited comments on proposed updates to the PRU Rulebook with a view to aligning its prudential regime more closely with the regulatory framework developed by the Basel Committee on Banking Supervision.9 The updated rules are yet to be published by the ADGM.
Outlook and conclusions
2019 was a year of many developments, and we expect that trend to continue in 2020.
In September 2019, the Central Bank issued a consultation paper to regulate loan-based crowdfunding platforms operating in the UAE. These regulations seek to establish an appropriate regulatory oversight framework for crowdfunding platforms to carry on business in the UAE while seeking to create a balance between market development, risk mitigation and customer protection. The regulations are expected to be enacted in 2020.
In February 2020, the Central Bank also announced that it would develop a new customer protection framework. In this regard, it has launched a consultation process with key stakeholders to develop a new financial consumer protection regulatory framework.
The updated PRU Rulebook is expected to be issued by the ADGM later in 2020.
At the time of writing, it is unclear what the long-term implications of the covid-19 pandemic will be. The UAE government and the Central Bank have announced various schemes to support the UAE economy. At this stage, the details and consequences of such schemes remain unclear.
1 Amjad Ali Khan is a senior consultant, Stuart Walker is a partner and Adite Aloke is a senior associate at Afridi & Angell.
4 Federal Law No. 14 of 2018 concerning the Central Bank, and Organisation of Financial Institutions and Banking.
7 Federal Law No. 2 of 2015.
8 The principles are set out in the general module of the Rulebook, not the conduct of business module.
9 See footnote 6.