PSP License in UAE: Requirements, Process, Costs & Regulations

Key Fact: To operate a Payment Service Provider in the UAE, one must have a specific license from the CBUAE or financial free zone regulator (DFSA/FSRA). A general commercial trade license is not enough. The licensing framework provided by the CBUAE consists of four unique categories of retail payment service licenses.

Introduction

The UAE is a global hub for digital trade and cashless payments, driven by Payment Service Providers (PSPs) that power electronic transactions for merchants, consumers, and institutions.

Because PSPs handle sensitive financial data and hold customer funds, they are strictly regulated. Entering the market requires understanding your regulatory path, which depends on your target audience and legal structure:

• Mainland UAE: Regulated by the Central Bank of the UAE (CBUAE).
• Financial Free Zones: Regulated by the Dubai Financial Services Authority (DFSA in DIFC) or the Financial Services Regulatory Authority (FSRA in ADGM).

What to Focus On Before You Apply

The biggest mistake that founders of fintech startups make while trying to expand their companies to the UAE market is considering a “PSP License” as a general type of license.

The truth is that there is no universal type of license called a “PSP License.” Applications for payment licenses before having the transactional process mapped lead to rejection of the application, an invalid company structure, and additional costs for hiring lawyers. Before incorporation of the company and development of the business plan, you need to map the revenue model, fund holding model, and geographical coverage.

What Is a PSP License in the UAE?

PSP License can be described as the formal authorization issued by a financial regulator in the United Arab Emirates to allow the corporate entity to offer one or several payment services to businesses or individuals.

Services that typically lead to obtaining the payment license in the UAE, according to the country’s financial regulations, include:

• Payment Account Issuance: Managing accounts intended for sending, receiving, or transferring funds.
• Payment Instrument Issuance: Issuing physical or virtual instruments of payment (for example, prepaid cards, wallets).
• Merchant Acquiring: Processing credit/debit card or online payment transactions in the name of the merchants.
• Payment Aggregation: Aggregating multiple merchants’ transactions into a master merchant account.
• Domestic and Cross-Border Transfers: Carrying out wire transfers, remittances, or other payments between different countries.
• Payment Token Services: Managing digital tokens denominated in fiat currencies as means of payment.
• Payment Initiation Services (PIS): Initiating the payment instruction in accordance with the request of the payment service user from the account of another entity.
• Account Information Services (AIS): Providing aggregation and consolidation of account information from several banks’ accounts.

Key Distinction: Providing vs. Using Payment Services

It is important to make a difference between a company that uses an external payment processor and a company that provides regulated payment services by itself:

Whether you provide payment services via a third party or not depends on what license you need in the UAE.

1. Fintech Enterprise

The main player is analyzing its payment infrastructure and business model to define if there is any regulation.

• Core Function: It defines the scope of payment operations, flow of funds, and the nature of responsibilities.
• Licensing Path: Varies based on whether payment processing is outsourced or handled directly.

2. Third-Party Integration (Using Payment Services)

Companies that use existing third parties providing payment services for transaction management.

• Core Function: Integration of APIs of existing third parties providing payment services (Stripe, Checkout.com) without handling funds, routing, and keeping them.
• Licensing Requirement: Standard Commercial E-Commerce or Tech License.

3. Direct Regulated Operations (Providing Payment Services)

Entities that build, control, and maintain their own payment rails to provide services to merchants or end users.

• Core Function: Handling custody of funds, merchant acquiring networks, card issuance, and money transfer on rails.
• Licensing Requirement: CBUAE, DFSA, or FSRA Financial Payment License.

Who Regulates PSPs in the UAE?

The jurisdiction and nature of your financial activity dictate which authority regulates your business:

1. Central Bank of the UAE (CBUAE): Regulates all payment services provided on the UAE mainland and non-financial free zones under the Retail Payment Services and Card Schemes (RPSCS) Regulation.
2. Dubai Financial Services Authority (DFSA): The independent regulator for financial services operating within the Dubai International Financial Centre (DIFC).
3. Financial Services Regulatory Authority (FSRA): The independent regulator governing financial entities within the Abu Dhabi Global Market (ADGM).

Crucial Clarification: Being established within a general business free zone (such as DMCC, IFZA, or Meydan) does not mean that the entity is not subject to financial regulations. The business free zones provide the ordinary commercial license; the free zones cannot issue any license for regulated financial activity. Your business dealings with clients within the UAE mainland and payments in onshore dirhams (AED) will require financial regulation from CBUAE.

CBUAE PSP License Categories

For businesses operating within the onshore federal jurisdiction, the CBUAE classifies Retail Payment Services into four distinct license categories based on risk exposure and operational scope:

Note: Selecting your category must be guided by your operational roadmap. Operating outside the bounds of your assigned category constitutes an immediate regulatory breach.

What Types of Payment Businesses Need a PSP License?

If your business infrastructure handles money flows directly or sits in the transactional loop, you likely require authorization.

High-Intent Business Types Requiring Authorization:

• Payment Gateways & Processors: Software systems handling credit/debit transaction authorizations.
• Merchant Acquirers & Aggregators: Entities settling merchant funds under shared master processing accounts.
• E-Wallet & Stored Value Providers: Digital apps storing customer balances for downstream utility or peer-to-peer (P2P) transfers.
• Remittance & Cross-Border Rails: Platforms facilitating international fiat or token-backed money transfers.
• Open Banking Enablers: Platforms providing payment initiation (PIS) or account aggregation (PAIS) under API protocols.

PSP License Eligibility and Requirements in the UAE

In order to get a PSP License, one needs to fulfill all corporate, governance, financial, and technical criteria prior to submitting the license application to the regulator.

1. Structural & Legal Readiness

• Approved Legal Structure: An entity is required to be registered as per the accepted organizational structure (Limited Liability Company or Public Joint Stock Company depending on the category).
• Fit and Proper Governance: Shareholders, Board of Directors, Key Management Personnel, and Key Personnel (Chief Risk Officer and Compliance Officer/MLRO) should pass due diligence to prove their competence and integrity.

2. Risk, Compliance & Operational Infrastructure

• AML/CFT Framework: Full set of documented anti-money laundering and countering the financing of terrorism framework as per UAE federal laws.
• KYC & Transaction Monitoring Systems: Efficient customer due diligence (CDD), enhanced due diligence (EDD), and sanctions screening systems.
• Cybersecurity & Data Resilience: Safe cloud or on-premises server architecture adhering to CBUAE Information Security Standards, including data encryption, pen-test protocol, and disaster recovery plan.
• Safeguarding Customer Funds: Client’s funds maintained in a segregated account with approved UAE Tier 1 commercial banks and fully segregated from company funds.

Step-by-Step Process to Obtain a PSP License

1. Business Model Mapping: Document transactional flows, fee structures, fund custody paths, and target customer profiles.
2. Jurisdiction & Category Selection: Choose between federal CBUAE licensing (for broad UAE mainland access) or financial free zones (DIFC/ADGM for common-law frameworks and international ecosystems).
3. Drafting Policy Frameworks: Prepare corporate policies including risk management matrices, AML/CFT frameworks, IT security baselines, and a 3-year detailed business plan with financial projections.
4. Application Package Assembly: Complete prescribed regulatory forms, incorporate shareholder resolution records, and compile proof of capital deposits.
5. Regulatory Engagement & Review: Submit the application package to the regulator. Be prepared for multiple review cycles, interviews with key personnel, and technical systems demonstrations.
6. In-Principle Approval & Operationalization: Receive In-Principle Approval (IPA), inject capital, finalize physical office leasing, hire required key personnel, and execute bank safeguarding agreements.
7. Final Licensing: Demonstrate readiness during final operational readiness reviews to receive your full license before processing live customer transactions.

Documents Required for Application

While exact requirements vary by category, the baseline documentation pack includes:

• Executive Business Plan: Detailed market analysis, target audience, 3-to-5-year financial projections, and operational revenue mechanics.
• Corporate Documents: Draft Memorandum and Articles of Association (MOA/AOA), certificate of incorporation, and ultimate beneficial ownership (UBO) disclosures.
• Fit & Proper Attestations: Resumes, police clearance certificates, credit reports, and reference letters for all directors, major shareholders, and key officers.
• Compliance & AML Manuals: Comprehensive frameworks covering AML/CFT procedures, sanctions screening, PEP tracking, and suspicious transaction reporting (STR) protocols.
• Risk & Governance Documentation: Internal control mechanisms, enterprise risk management policies, and operational risk registers.
• Technical & Security Architecture: Diagrams of systems infrastructure, data flow maps, cybersecurity policies, business continuity plans (BCP), and third-party audit reports.

PSP License Costs and Capital Requirements

PSP licensing necessitates heavy monetary investment aside from the basic application costs associated with government authorities. The amount of investment needed depends on the degree of regulatory risk.

• Minimum Paid-Up Capital: For CBUAE Categories I and II, there is considerable required paid-up capital (beginning from millions of AED), while for Category IV (non-custodial open banking), the required capital amounts to relatively smaller levels.
• Regulatory Application & License Fees: These include non-refundable submission fees and annual fees for supervisory oversight imposed by the CBUAE, DFSA, or FSRA.
• Legal & Advisory Overhead: Legal advisor and technical auditor retainers regarding fintech regulations.
• Technology & Operational Infrastructure: Investment for hosting, payment software, and office space.

PSP Compliance Requirements in the UAE

Securing your license is the start of an ongoing compliance lifecycle. The CBUAE and free-zone regulators enforce continuous supervision:

• Anti-Money Laundering (AML/CFT): Mandatory registration on the UAE Financial Intelligence Unit’s goAML portal for suspicious transaction reporting.
• Real-Time Transaction Monitoring: Automated rules engine to flag unusual velocity, high-risk geographical routing, or structured transactions.
• Periodic Regulatory Reporting: Submitting monthly, quarterly, and annual audited financial statements, capital adequacy calculations, and risk reports to regulators.
• Independent External Audits: Mandatory annual audits covering financial statements, IT security resilience, and AML compliance effectiveness.

Mainland vs. DIFC vs. ADGM Comparison

Choosing where to establish your PSP depends on your strategic market focus:

PSP License vs. Payment Gateway: What Is the Difference?

These terms are often confused, but they refer to fundamentally different layers of the payments stack:

UAE Regulatory Framework Overview

Payment regulation in the UAE has modernized rapidly:

1. CBUAE Retail Payment Services and Card Schemes (RPSCS) Regulation: Sets out technical, financial, and governance standards applicable to all retail payments operations in the onshore UAE.
2. Decree-Law No. (14) of 2018 (and subsequent updates): Sets out the CBUAE’s main supervisory responsibilities with respect to banking, credit, retail payments, stored value services, digital currencies, and other fintechs.
3. Federal AML/CFT Legislation: Very strict statutory requirements for real-time oversight, goAML reporting, and beneficial ownership.

Common Mistakes When Applying for a PSP License

• Confusing Commercial Licenses with Financial Authorization: Registering a company in an ordinary free zone and starting payment processing services without obtaining regulatory authorization.
• Applying Under the Wrong Category: Miscalculations of transaction flow and classification in a lower category (such as Category III) when higher category licensing is needed for cross-border functionality.
• Underestimating Capital and Operational Reserves: Not taking into account capital buffers, staffing requirements, and software maintenance costs.
• Generic or Template Compliance Manuals: Providing generic policy documents that do not correspond to the technical and procedural specifics of the platform being considered.
• Weak Leadership Profile: Offering a management team/Board of Directors that does not have credible financial industry experience.

How Arnifi Assists with PSP Licensing in the UAE

The journey through the complexities of UAE PSP setup entails careful and organized execution. Arnifi advises fintech entrepreneurs and companies during all steps of licensed PSP incorporation:

• Regulatory Mapping & Category Selection: Analysis of your payment architecture to determine the correct jurisdiction (Mainland, DIFC, ADGM) and license type.
• Corporate Structuring & Incorporation: Coordinating the incorporation of your corporate structure in line with regulatory capital requirements.
• Documentation & Business Plan Drafting: Advising on the drafting of detailed regulatory business plans, 3-year financial models, and governance structure.
• Compliance Framework Development: Supporting the development of your localized AML/CFT program, risk register, and operational control framework.
• Regulator Engagement: Advising you on the whole process of your application submission, regulatory questions, etc.

Frequently Asked Questions

What is a PSP license in the UAE?

PSP license is a financial license provided by the Central Bank of the UAE (CBUAE), DFSA (DIFC), and FSRA (ADGM), enabling an enterprise to conduct regulated activities related to the provision of payment services, like merchant acquiring, issuance of e-wallets, payment aggregation services, or money transfers.

Do I need a CBUAE license to operate a payment gateway in the UAE?

If your platform offers just technical software (white-label gateway technology) and does not hold, aggregate, and process customer funds, then a technical/commercial software license will suffice. On the other hand, if your gateway conducts any activities related to payments and settlements or holds funds, then a PSP license from the CBUAE is mandatory.

What are the different PSP license categories under the CBUAE?

The CBUAE classifies the Retail Payment Services into four categories: Category I (the broadest scope of activities including cross-border transfers and payment tokens), Category II (domestic and cross-border transfers and acquiring), Category III (domestic payments and acquiring), and Category IV (non-custodial Payment Initiation and Account Information Services).

How much does it cost to obtain a PSP license in the UAE?

The total cost of setting up will be determined by the jurisdiction selected and category of license. The cost will include a non-refundable application fee, legal advisory retainer fee, IT security set-up cost, and the requirement of paid-up capital (which can be low for Category IV and up to several million AED for Category I and II).

How long does it take to secure a PSP license?

The process takes between 6-12 months on average, depending on the quality of the initial documentation package, business model complexities, leadership assessment results, and more.

Conclusion

Acquiring a Payment Services Provider license in the UAE means ensuring that your business structure fits into the right regulatory body and type of license. No matter whether you seek a license under the federal supervision of CBUAE or in special financial hubs such as DIFC and ADGM, it all comes down to proper preparation, which includes developing a sound anti-money laundering/anti-knowledge client strategy as well as strong IT security and keeping appropriate finances.

References

For direct verification of regulatory frameworks, statutory publications, and licensing portals, consult official authority resources:

• Central Bank of the UAE (CBUAE): CBUAE Regulatory Frameworks & Retail Payment Rules
• Dubai Financial Services Authority (DFSA): DFSA Regulatory Guidelines for DIFC Entities
• Financial Services Regulatory Authority (FSRA – ADGM): ADGM FSRA Financial Services Regulations