This country-specific Q&A provides an overview to Fintech law in UAE.
It will cover open banking, regulation of data, cryptocurrencies, blockchain, AI and insurtech.
This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech/
What are the sources of payments law in your jurisdiction?
The sources of payments law in the UAE depend on whether the payment service is governed by the laws of the United Arab Emirates (the “UAE”), or by the laws of distinct jurisdictions such as the Dubai International Financial Centre (the “DIFC”) or the Abu Dhabi Global Market (the “ADGM”) (the “Financial Free Zones”), all of which have their own payment laws.
The Regulatory Framework for Stored Values and Electronic Payment Systems 2017 (the “2017 Regulations”) governs the provision of payment services subject to the jurisdiction of the UAE.
The 2017 Regulations was issued by the UAE central bank pursuant to the authority granted to it under Union Law No. 10 of 1980 concerning the central bank, the monetary system and organization of banking.
These regulations set out the requirements imposed upon four main types of payment services providers:
- Retail payment services provider: Authorized commercial banks and other licensed payment services providers offering retail, government, and peer-to-peer digital payment services as well as money remittances;
- Micropayment payment services provider: Payment services providers offering micropayments solution facilitating digital payments targeting the unbanked and under-banked segments in the UAE;
- Government payment services provider: Federal and local government statutory bodies offering government digital payment services; and
- Non-issuing payment services provider: Non-deposit taking and non-issuing institutions that offer retail, government, and peer-to-peer digital payment services.
These regulations exclude from their scope technical service providers, defined as entities facilitating the provision of payment services to payment services providers, whilst excluded at all times from possession of funds (or transference thereof) (“Technical Service Providers”). A payment gateway operator could fall under this category.
The Dubai Financial Services Authority (the “DFSA”) rulebook (the “DFSA Rulebook”) governs the provision of payment services subject to the jurisdiction of the DIFC. The DFSA is the financial regulatory authority of the DIFC.
Section 2.6 of the DFSA Rulebook (General Module) defines the provision of money services as “providing currency exchange or money transmission”. Money transmission is defined as “selling or issuing payment instruments, selling or issuing stored value, or receiving money or monetary value for transmission, including electronic transmission, to a location within or outside the DIFC”.
Despite inclusion as a financial service, at the date of writing, no DFSA regulations exist specifically addressing requirements to establish a money transmission business. We are aware that the DFSA is currently working on such regulation which should be published in the near future.
The Financial Services and Markets Regulations 2015, as amended (the “FSMR 2015”), governs the provision of payment services subject to the jurisdiction of the ADGM. Further information regarding requirements for payment services providers in the ADGM can also be found under the Financial Services Regulatory Authority (the “FSRA”) rulebook (the “FSRA Rulebook”). The FSRA is the financial regulatory authority of the ADGM.
The FSMR 2015 and FSRA Rulebook set out requirements for the provision of financial activities in the ADGM including dealing in investments, insurance, accepting deposits, credit, operating trading facilities, managing assets, and providing money services.
Can payment services be provided by non-banks, and if so on what conditions?
Payment services can be provided by non-banks, however, except for non-issuing payment services providers, the 2017 Regulations limits the scope of persons that may provide payment services as follows:
- Retail payment services providers: a commercial bank or consortium thereof must hold majority ownership of it;
- Micropayment payment services providers: it must be a telecommunications service provider or operator licensed by the Telecommunications Regulatory Authority, a UAE licensed money exchange business, or corporate entity providing transport services and licensed by the National Transport Authority. Additionally, one or a consortium of the following must hold majority ownership of it: commercial bank, telecommunications services provider or operator, transport services entity and monetary or financial intermediary licensed by the UAE central bank; and
- Government payment services providers: one or a consortium of a federal ministry or authority or local government authority must hold majority ownership of it.
Payment service providers in Financial Free Zones can be non-banks. However, they must satisfy an extensive range of requirements, many of which differ based on the applicable category. There are five categories of financial services in the DFSA, set out under the Prudential – Investment, Insurance Intermediation and Banking Business Module of the DFSA Rulebook. As explained above and illustrated below, although there are general conditions applicable to all provisions of financial services in the DIFC, there are no specific conditions set out for the provision of money services in the DIFC, and it is not expressly included under a category, therefore the category that best corresponds to the activities of a payment service provider would apply. The DFSA financial services categories are set out as follows:
- Category 1: Accepting deposits or providing credit;
- Category 2: Dealing in investments as principal (not including matched principal);
- Category 3: Dealing in investments as principal or agent, operating a collective investment fund, managing assets, providing custody, providing trust services, acting as the trustee of a fund;
- Category 4: Arranging credit or deals in investments, advising on financial products or credit, arranging custody, insurance intermediation, insurance management, operating an alternative trading system, providing fund administration; and
- Category 5: An Islamic financial institution managing a profit sharing investment account entirely in accordance with Sharia.
Payment service providers in Financial Free Zones can be non-banks. However, they must satisfy an extensive range of requirements, many of which differ based on the applicable category. There are five categories of financial services in the FSRA, set out under the Prudential – Investment, Insurance Intermediation and Banking Rules of the FSRA Rulebook. The provision of money services is included under Category 3C of the FSRA financial services. It is worth noting that an authorised person may, where authorised under its FSRA financial services permission to do so, conduct any number of regulated activities specified under any lower category than the one applicable to it.
The conditions applicable specifically to category 3C include:
- Capital requirements: Higher of Base Capital Requirement or Expenditure Based Capital Minimum:
- The maintenance at all times of an amount of assets exceeding its Expenditure Based Capital Minimum in the form of liquid assets;
- The maintenance at all times of a professional indemnity insurance in accordance with the FSRA’s requirements; and
- Supervisory review and evaluation processes requirements.
a) Base Capital Requirement: USD 250,000, and
b) Expenditure Based Capital Minimum: 18/52nds of the Annual Audited Expenditure, calculated as all expenses and losses that arise in the license holder’s normal course of business in a 12-month accounting period (excluding exceptional items) which are recorded in its audited profit and loss account, not including the following: non-discretionary staff bonuses, non-discretionary incentive shares, other automatic appropriations of profits, shared commissions and fees payable, fees, brokerage and other charges paid for purposes of executing, registering or clearing transactions, foreign exchange losses and contributions to charities;
What are the most popular payment methods and payment instruments in your jurisdiction?
Cash remains the most popular payment method in the UAE, many small establishments only accept cash. Credit cards and debit cards are a close second: VISA and MasterCard credit cards are widely accepted by businesses and government services, however American Express, Diners and Discover are less widely accepted.
Cheques are an important payment instrument in the UAE for transactions of large amounts. Online payments are also a common method of payment.
Various digital initiatives have emerged in the UAE but are not widely used yet. These include the government’s Mobile Wallet, Etisalat Wallet, NOL Cards, Apple Pay, Samsung Pay and Alipay. Payfort, an amazon-owned payments solutions company, conducted a survey suggesting a 21% increase in online payments in the UAE in 2016. Alipay, a large online and mobile payment platform, is also active in the UAE. The Dubai government introduced plans to launch its own wallet emCash which can be used as a digital currency and cryptocurrency as well.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
The current use of open banking in the UAE is generally limited to e-wallets. However, such use is gaining traction with the continual advancements of e-wallets, mobile payments and real time transfers. Etisalat Wallet, Apple Pay and Samsung Pay, among others, evidence the presence of open banking in the UAE.
Open banking services categorized as payment (or money) services providers must be licensed by the relevant authority. However, to the extent open banking service providers do not possess funds at any point (or transference thereof), such categorization would not apply.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
The impact of data regulation varies depending on the location of the provision of financial services.
The mainland of the UAE does not have any principal data protection legislation existing in its own right. Data privacy and protection is addressed across a number of separate regulations not specifically focused on data protection.
With respect to the provision of financial services, the 2017 Regulations prohibits the offshoring of data and bans the outsourcing of certain functions to offshore locations, including the storage or making available of consumer and transaction data.
Financial Free Zones
In the DIFC, the DIFC Law No. 1 of 2007 and DIFC Data Protection Regulations govern the protection of data. In the ADGM, the Data Protection (Amendment) Regulations 2018 and Data Protection Regulation of 2015 govern the protection of data.
Each Financial Free Zone has issued its own list of jurisdictions to which the transfer of personal data is permitted. With respect to jurisdictions not included in the list, each Financial Free Zone permits the transfer of personal data to such jurisdictions on the condition that certain requirements are fulfilled, e.g. obtaining the consent of the competent authority or the data subject.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
There is a clear mandate across all sectors of government to support and encourage the growth of fintech in the region. The financial sector, particularly in Financial Free Zones, represents a significant industry where innovation is sought, particularly through the authorities’ accelerator programs.
Pursuant to the Board of Directors’ resolution no. 28/R.M of 2018, the Securities and Commodities Authority of the UAE (the “SCA”) approved draft regulations setting out regulatory controls for the FinTech sector in the form of a pilot regulatory environment (sandbox) to enhance and support the financial integrity of fintech companies. The regulations achieve this by relaxing the regulatory requirements or exempting testers from some of these requirements. This testing environment is designed for developers of fintech projects, whether emergent or existing companies or individual projects by entrepreneurs.
The DIFC launched an accelerator programme named the Fintech Hive to encourage cutting-edge fintech solutions for leading financial institutions. The DIFC issued an innovation testing license which permits qualifying fintech firms to develop and test innovative concepts for a period of six to twelve months without being subject to all regulatory requirements that normally apply to regulated firms. If the outcomes detailed in the regulatory test plan are fulfilled and the firm can satisfy DFSA requirements, it may migrate to full authorisation.
The ADGM launched an accelerator programme named the Regulatory Laboratory (“RegLab”) to encourage cutting-edge fintech solutions for leading financial institutions. The ADGM established a financial services permission which permits qualifying fintech firms to develop and test innovative concepts for up to two years without being subject to all regulatory requirements that normally apply to regulated firms. Additionally, the ADGM implemented amendments to the FSMR 2015 to specifically address the emergence of new technologies, namely crypto assets.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
As previously stated, there is a clear mandate to encourage the growth of the fintech market in both the public and private sectors of the UAE.
From a general standpoint, strict legislation or none at all results in the risk of hindering the healthy growth of any industry. We have noted, that all regulators in the UAE are keeping a watchful eye on fintech activities in their respective jurisdictions. It is customary for regulations to lag behind developments in emerging technologies as regulators need to first assess the legal implications and consequences of such technology. These may be far-reaching, as illustrated by the emergence of AirBnb and Uber in their respective industries. It is expected that over the next couple of years, additional regulations will be issued by regulators to provide structure and clear policies in relation to the fintech market.
Although the current eligibility requirements under the 2017 Regulations restricts ownership of payment services providers, it is still possible for fintech entrepreneurs to enter joint ventures as minority shareholders with more established partners or establish themselves as Technical Service Providers. However, the provision of fintech services on mainland of the UAE may be considered limited by regulations pertaining to the offshoring of data. It is arguable that the current legislative structure offers a compromise between encouraging innovation and ensuring the retention of control by UAE financial institutions.
The SCA’s adoption of fintech regulatory sandbox guidelines pursuant to the Board of Directors’ resolution no. 28/R.M of 2018 set out a platform upon which fintech companies can test and launch modern technological initiatives in the securities sector. This structure includes the obtaining of an experimental license from the Ministry of Economy for a period between six to twelve months, under terms and conditions to be determined by the government commission upon evaluation of their business model and other factors.
Financial Free Zones
The Financial Free Zones have taken an early-on approach to invite emerging companies, existing companies and individual projects to be able to apply for their own set of experimental licenses under their accelerator programs, Fintech Hive and RegLab (please refer to our answer under question 6 for more details about this).
What tax incentives exist in your jurisdiction to encourage fintech investment?
The UAE is generally considered attractive to businesses in terms of taxation. There are no tax incentives specifically directed at the fintech sector, however the UAE is generally a tax-free jurisdiction with no corporate income tax but a value added tax of 5%. This value added tax applies to the provision of financial services where (1) such services are performed in return for an explicit fee, discount, commission, rebate or similar; and (2) the recipient of the services is a consumer residing inside the UAE, including the Financial Free Zones.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Investment in fintech in the UAE is mainly directed either at businesses dealing directly with consumers, or businesses providing technology solutions to existing financial institutions.
There is also a considerable amount of investment directed at a variety of industries in the UAE, including the educational sector, healthcare sector, insurance sector, and emerging technologies in general (e.g. artificial intelligence, distributed ledger technology and deep-learning).
The level of investment in fintech differs per area and jurisdiction. In general, the majority of investment in cutting-edge fintech is currently in the Financial Free Zones and at friends and family or Series A level. Not many fintech companies have progressed beyond a Series A round of investment.
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
The government has reiterated on numerous occasions its policy to support and encourage technology innovation. This policy is implemented by, among others, sandboxes and accelerators set up on mainland of the UAE and in the Financial Free Zones.
Where the fintech product is well-tested and it is a new technology used to provide a service for which a license already exists, then upon the product meeting the regulatory requirements of the authorities, the service provider may obtain a license from the relevant authorities to conduct its activities in the UAE beyond the testing phase.
Another principal reason entrepreneurs consider initiating operations in the UAE is its advantageous taxation environment.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
The UAE has one of the more open immigration policies when it comes to acquiring talent. Its population consists of roughly 80% expatriates and 20% UAE nationals.
There are no quotas systems or immigration caps in place, although it is worth noting that an Emiratisation quota requirement exists whereby any company with more than 100 employees is obliged to recruit the stipulated number of UAE nationals to ensure the minimum percentage of participation of Emiratis in the workforce. This minimum participation varies depending on the economic sector of the company and job description.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
The UAE has a well-established policy of encouraging access to new talent. It implements this policy by providing, among others, employment visas for long-term talent as well as mission visas for short-term (less than 90 days) talent required in the UAE. The UAE has reiterated on numerous occasions its policy of encouraging innovation in the fintech sector. It recently implemented changes to its immigration policy including the introduction of a six-month visa specifically for jobseekers.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
UAE Onshore and the Financial Free Zones
The protections a fintech can use to protect its intellectual property are the same within the mainland of the UAE and the Financial Free Zones. However, implementation measures and procedures effected by the authorities differ among the jurisdictions, in particular, the DIFC and ADGM are subject to common law procedures, whereas the mainland of the UAE is subject to civil law.
The most applicable protection for fintech in the UAE is that for software, applications, and developments under Federal Law No. 7 of 2002 Concerning Copyrights and Neighboring Rights (as amended). The UAE is a member of the Berne Convention for the Protection of Literary and Artistic Works, pursuant to which all member states recognize and protect the copyrights of individuals of other member states. However, for evidentiary purposes, it is advisable to register copyrights under the applicable UAE registrar.
In the UAE, the financial rights of an employee to a copyright are not automatically assigned to his/her employer. A separate agreement must be executed to this effect. Additionally, it is not possible to assign the moral rights to a copyright under UAE law.
The financial rights to a copyright are effective for a period of 50 years from the death of the inventor or, where the identity of the inventor is not identifiable, from the date of publication (or launching) of the copyrighted product.
There are general intellectual property protections applicable to all businesses, for instance with respect to logos, slogans and names. These intellectual property protections are implemented under Federal Law No. 37 of 1992 on Trademarks (as amended), upon registration with the Trademark Office of the Ministry of Economy. Registration with the Trademark Office results in protection for a period of 10 years, renewable upon application.
With respect to patent protections, Federal Law No. 17 of 2002 on Regulation and Protection of Industrial Property of Patents, Industrial Drawings and Designs (as amended), provides for protection of the same for a limited period of 20 years from the date of filing of the protection application with the Ministry of Finance and Industry.
The UAE is also a member of the Paris Convention for the Protection of Industrial Property. The Paris Convention for the Protection of Industrial Property requires, inter alia, that all member states recognize and protect the intellectual property rights of individuals of other member states. Additionally, the UAE is a member of the Trade-Related Aspects of Intellectual Property Rights (“TRIPS”), a minimum standards agreement for the protection of intellectual property rights.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
Reference to cryptocurrencies is made under the 2017 Regulations. This framework includes two contradictory provisions with respect thereto: at one point it provides that cryptocurrencies are “prohibited” and at another that they are “unregulated”. However, the governor of the UAE central bank has since clarified that the 2017 Regulations do not “cover ‘virtual currency’”.
Additionally, (1) the SCA’s recent announcement with respect to initial coin offerings (please refer to question 15 below); and (2) the Dubai government’s introduction of plans to launch its own wallet emCash which can be used as a digital currency and cryptocurrency as well, suggests that certain cryptocurrencies are not (or will not be) prohibited.
If an entity wishes to provide financial services in the UAE and such services involve use of the UAE Dirham, it must be licensed or authorised by the UAE central bank. It is currently unclear whether the UAE central bank would be willing to provide licenses to private entities for activities specifically related to the use of cryptocurrencies, such as a crypto currency exchange. As stated above, such activities are not specifically addressed under the central bank’s regulation.
The DIFC has, on previous occasions, advised investors to treat the use of cryptocurrencies as high-risk investments. The DIFC has also, as mentioned above, launched the FinTech Hive, which encourages innovation in technology, including through the use of blockchain and blockchain tokens. DIFC regulations do not, at the time of writing, include express reference to cryptocurrencies.
Pursuant to its regulatory framework, the ADGM does not prohibit the use of crypto assets, however it has set out mandatory requirements and conditions applicable to such use.
The ADGM regulations include a license specifically provided to operators of crypto asset businesses. Additionally, it has issued a legal framework clearly defining the term “crypto asset” and listing the factors the FSRA would consider while determining which crypto assets are “accepted” for use in the ADGM, such as under crypto asset exchanges.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
The SCA announced on 9 September 2018 the approval of a plan to regulate initial coin offerings and recognise them as securities. The plan developed includes a set of mechanisms as part of an integrated project to regulate digital securities and commodities. The relevant regulations are expected to be issued during the first half of 2019.
As mentioned above, the DFSA issued an investor warning stating that cryptocurrencies are “high-risk investments” and that it does not currently regulate these types of product offerings or license firms in the DIFC to undertake such activities.
Initial coin offerings are permitted under ADGM jurisdiction. The FSRA has issued a Regulation of Initial Coin/Token Offerings and Crypto Assets under the FSMR, therefore offering regulatory clarifications on the use of this technology in its jurisdiction.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
We are aware of live blockchain projects in various sectors of the UAE and both on mainland of the UAE and in Financial Free Zones.
In the financial sector, Emirates NBD, a major bank in the UAE, recently launched the “Cheque Chain” which integrates blockchain into issued cheques to strengthen authenticity and minimize potential fraud. It registered close to one million cheques using blockchain during the first month of its launch.
Additionally, Smart Dubai recently integrated blockchain technology into its online payment portal, DubaiPay, to allow reconciliation and settlement transactions to be performed in real time. There are also live blockchain projects in other sectors. For instance, in the educational sector, Educhain enables the instant issuance and authentication of digital records for institutions, corporates, and governments. It is working with top institutions and employers from Mena, Europe and North America, encompassing 400,000 students and professionals.
Additionally, the Dubai Land Department launched blockchain technology to automate and optimize end-to-end real-estate business processes. It employs blockchain in three initiatives: ownership verification in its mobile application, property sale by developer and smart leasing process. It placed existing title deeds onto a blockchain ownership platform, through which it secures more than 500,000 title deeds and 1.5 million smart contract records that connect investors/owners to the property.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
The use of artificial intelligence in the financial sector is well-established. We do not believe UAE legislation impedes the use of artificial intelligence in the UAE. However, such use would need to satisfy UAE security requirements which are in line with international standards.
Banks use artificial intelligence for a variety of reasons, including the automation of processes, interaction with customers, and building intelligent and real-time lending models. For instance, Emirates NBD has launched the chatbot Eva, which helps customers cut through time consuming layers and access the information they want immediately.
The DIFC has, through its innovation testing program, approved the first robo-wealth advisor in the Middle East, Sarwa. The Dubai Electricity and Water Authority has also launched its robot, Rammas, which listens to customers’ concerns and knows their entire history with Dewa.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
Insurtech business is present in the UAE, however it is developing in the UAE at a slower pace than other areas of fintech such as payment services.
Successful insurtech business include (1) Aqeed, which developed an insurance wallet where customers can store and recall all their policy documents, it also sends reminders to customers with respect to renewal dates, compares different policies and informs customers where there is a duplication of coverage; and (2) Souqalmal.com, an insurance, personal loan and credit card comparison website, which underwent a Series B funding in 2017.
Are there any areas of fintech that are particularly strong in your jurisdiction?
To a certain extent, advanced fintech is present in almost every sector of the UAE. As illustrated above, the payment services sector of fintech is particularly strong, with banks and government bodies launching cutting-edge technology in this sector.
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
Whether there is collaboration or disruption between fintechs and incumbent financial institutions in the UAE depends on the activity undertaken by the fintech and in which jurisdiction.
With respect to the provisions of payment services, the 2017 Regulations require that, in the majority of cases, payment services providers are majority-owned by, among others, UAE-licensed financial institutions. Due to the difficulty in obtaining licenses to establish such financial institutions, many fintech entrepreneurs wishing to access the payment sector either partner with incumbent financial institutions or establish themselves as Technical Service Providers.
Financial Free Zones
The nature of regulations in the Financial Free Zones, in particular, the more flexible ownership and data storage requirements relative to mainland of the UAE, result in a larger potential for disruption between fintechs and incumbent financial institutions.
There is a predominant trend of incumbent financial institutions investing largely in fintech start-ups, resulting in a hedge against or containment of a significant part of detrimental disruption from fintech start-ups. However, adoption of fintech results in a high likelihood of many redundant banking jobs and certain fintech entities have created business models able to bypass the high barriers to entry traditional financial institutions must satisfy.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
Many banks and other incumbent financial institutions in the UAE are active in the authorities’ accelerator programs and provide their services and support to participants. Additionally, these financial institutions are prospective investors for start-ups and their presence facilitates the provision of pitches to them.
Many banks and other incumbent financial institutions in the UAE, particularly in Financial Free Zones, have also launched a variety of initiatives to carry out their own fintech development or innovation programmes, e.g. Emirates NBD established the Future Banking Lab as a key initiative of its digital strategy, it is through this program that it developed and launched the “Cheque Chain” mentioned under question 16.
Are there any strong examples of disruption through fintech in your jurisdiction?
A strong example of disruption through fintech in the UAE is the lower requirement for over the counter banking services due to the availability of digital services. Another strong example is the launch of crow-funding platforms, which result in a decrease in demand for loans from banks, e.g. Smart Crowd, which was a part of the DIFC Fintech Hive program and now a company licensed by the DFSA, obtained an operating license in April 2018 as a property crowdfunding website.