UAE Open Finance Regulation 2026: Powerful Guide to Federal Decree-Law No. 6 of 2025 for Fintech Founders
i ca use this title instead
UAE Open Finance 2026: What Federal Decree-Law No. 6 of 2025 Means for Fintech Founders
The UAE Open Finance moment is no longer theoretical
For several years, UAE Open Finance regulation 2025 was discussed as a future opportunity.
That changed.
The Central Bank of the UAE has moved Open Finance from policy direction into regulatory reality. With the Open Finance Regulation already in place and Federal Decree Law No. 6 of 2025 now modernising the Central Bank’s legal framework, fintech founders need to treat Open Finance as a licensing question, not just a product opportunity.
This matters because many founders are still thinking in old categories.
They ask whether they need an ADGM setup, a DIFC structure, a payment licence, a technology licence, or a sandbox route. Those questions still matter, but for any company building around financial data access, account aggregation, payment initiation, embedded finance, credit scoring, insurance data, or banking connectivity, the first question is now more direct:
Does your business fall within the UAE Open Finance regulatory framework?
If the answer is yes, the licensing path needs to be assessed before the product goes live, before bank integrations are promised, and before investor materials describe market access that the company may not yet be authorised to use.
At TruVis, this is where we see the biggest strategic gap. Founders understand the commercial opportunity. They do not always understand that Open Finance is now part of the regulated financial services perimeter.
1. What Federal Decree Law 6 of 2025 changes
Federal Decree Law No. 6 of 2025 is a major update to the UAE’s Central Bank framework. It strengthens the Central Bank’s authority over licensed financial institutions, financial activities, insurance business, payment services, emerging technology enabled financial services, and Open Finance.
For fintech founders, the most important point is simple: Open Finance Services are now expressly included as a licensed financial activity under the CBUAE framework.
This is not just wording. It changes the regulatory posture of the market.
Before this shift, some founders viewed Open Finance as a technical integration layer. They saw it as API access, bank data connectivity, user permission flows, and product design. Under the updated framework, those elements still matter, but they sit inside a regulated activity model.
If your business is accessing customer financial data, processing that data, transferring it between regulated institutions, initiating payments, or enabling a user to trigger a financial instruction through your platform, you may be dealing with an activity that requires CBUAE authorisation.
That means founders should not treat licensing as something to solve after traction.
The regulatory assessment belongs at the design stage.
2. Open Finance as a licensed activity
The most important misconception is that a fintech company can avoid regulation by calling itself a software platform.
That may be true for some pure technology vendors. It is not true for every platform that touches financial services.
The CBUAE’s position is that financial activities remain regulated when they are provided through technology. A product does not escape licensing simply because it is delivered through an app, API, dashboard, artificial intelligence layer, or embedded finance interface.
For founders, the question is not only “Are we a technology company?”
The better question is:
What financial activity does the technology enable?
If the platform only provides back-office software to a regulated institution, without handling regulated activity itself, the analysis may be different. But if the platform provides account information services, initiates payments, facilitates user instructions, connects customers to regulated financial products, or operates as part of the financial service delivery chain, licensing exposure becomes much more likely.
This is why early classification is so important.
Two startups can look similar from the outside. Both may use APIs. Both may use customer data. Both may serve banks or consumers. But one may be a technical infrastructure provider while the other may be an Open Finance Provider requiring authorisation.
That distinction changes everything: capital, governance, compliance staffing, technology controls, contracts, launch timeline, and investor readiness.
3. The mandatory participation requirement
The feature that makes the UAE Open Finance regulation 2025 framework commercially important is mandatory participation.
In many markets, open banking exists on paper but struggles in practice. Banks may technically provide access, but the quality of APIs, documentation, support, and consistency varies widely. Fintechs then spend months solving integration issues that should have been handled at infrastructure level.
The UAE is taking a more centralised approach.
The framework requires CBUAE licensed financial institutions to participate in the Open Finance ecosystem and provide access through the relevant infrastructure. That includes a dedicated API framework, trust structure, consent mechanisms, and common services intended to support secure, standardised data sharing and service initiation.
For fintech founders, this creates a very different market environment.
A licensed Open Finance Provider is not merely asking individual banks for bilateral access. It is operating within a regulatory infrastructure designed to make participation standard across the market.
That does not mean the process will be easy. It does not remove compliance requirements. It does not guarantee instant commercial partnerships.
But it does mean the UAE is building Open Finance as market infrastructure, not as a voluntary innovation experiment.
For serious founders, that is the opportunity.
4. Data Sharing vs Service Initiation licences
The UAE Open Finance regulation framework is built around two main functional categories.
The first is Data Sharing.
This is relevant where a company accesses, processes, aggregates, or transfers customer financial data with consent. Use cases include personal finance dashboards, account aggregation, credit analytics, cash flow underwriting, SME financial management tools, insurance comparison models, and financial wellness platforms.
The second is Service Initiation.
This is relevant where a company initiates a transaction or instruction on behalf of a customer. Use cases include payment initiation, account to account payments, automated savings transfers, embedded lending flows, bill payments, marketplace checkout, and other user authorised transaction flows.
Some companies may need only one permission. Others may require both.
For example, a personal finance app that only displays consolidated account information may fall primarily into Data Sharing. A payment product that lets a user initiate a bank transfer from within a merchant checkout flow may fall into Service Initiation. A lending platform that reviews bank transaction data and allows the user to initiate repayment instructions may need to assess both.
This is where founders should be careful.
Product descriptions often blur the line between data visibility and transaction capability. Regulators do not assess the pitch deck. They assess the actual activity.
Before applying, founders should map each product feature against the licensing perimeter:
- What data is accessed?
- Who provides the data?
- Who receives the data?
- What does the customer consent to?
- Can the platform initiate any payment, transfer, instruction, or financial action?
- Is the company acting independently, as an agent, as a technical vendor, or as a regulated provider?
- Which CBUAE licensed institutions are involved?
This mapping should happen before the licence application is prepared. It should also happen before commercial contracts are signed with banks, insurers, lenders, payment providers, or enterprise clients.
5. The September 2026 deadline
Federal Decree Law No. 6 of 2025 introduces a transition period for affected entities. The key date founders should be planning around is 16 September 2026.
That date matters for companies already operating in or near the regulated perimeter. It also matters for founders who are currently building products and expect to launch into the UAE market before or during 2026.
A year can sound like a long time. In financial licensing, it is not.
A serious Open Finance licensing process requires more than filling in forms. Founders should expect to prepare:
- A clear regulatory business plan
- Product and activity mapping
- Corporate structure documentation
- Governance framework
- Board and senior management profiles
- Compliance policies
- AML and CFT framework where relevant
- Data protection and consent architecture
- Information security controls
- Technology infrastructure documentation
- Outsourcing and vendor risk framework
- Financial projections and capital planning
- Professional indemnity insurance assessment
- Customer journey and disclosure materials
The licensing file needs to show that the company is not only innovative, but operationally ready.
That is where many fintech founders underestimate the process. A strong product is not enough. The regulator needs to see that the business can operate safely inside the financial system.
The September 2026 deadline should not be treated as a reminder date. It should be treated as a planning deadline.
6. What fintech founders should do now
The first step is not to apply for a licence immediately.
The first step is to classify the activity correctly.
Founders should begin with a structured licensing assessment covering the product, target customers, data flows, financial institution relationships, and UAE market strategy. In many cases, the answer will not be simply “CBUAE or ADGM” or “Open Finance or payments”. The right answer may involve sequencing.
For some companies, direct CBUAE Open Finance licensing may be the correct route.
For others, an ADGM RegLab or FSRA pathway may help build regulatory track record before pursuing CBUAE authorisation.
For a B2B infrastructure provider serving regulated institutions, the analysis may differ from a consumer-facing app that directly accesses retail banking data.
For a payment initiation product, the Open Finance question may overlap with retail payment services regulation.
For an insurtech or wealthtech platform, the Open Finance scope may extend beyond bank accounts into insurance or investment data.
The point is not to choose the most impressive licence.
The point is to choose the licence that matches the actual business model.
Founders should also review investor materials. If a deck claims “access to all UAE banks” or “regulated Open Finance infrastructure” without a clear licensing basis, that can create credibility issues in diligence. Sophisticated investors will ask how the company is authorised, what permissions it needs, and whether the regulatory timeline is realistic.
The companies that prepare early will have an advantage. Not because regulation is a marketing badge, but because licensing readiness shapes commercial readiness.
Banks will ask better questions. Enterprise clients will expect stronger controls. Investors will test the regulatory pathway. Customers will need clear consent and data protection standards.
Open Finance is not just a fintech growth opportunity. It is a regulated operating model.
The strategic takeaway
Federal Decree Law 6 of 2025 confirms the direction of travel: the UAE is building a regulated, mandatory, cross-sector Open Finance ecosystem.
For fintech founders, this creates a real opportunity. The UAE is moving toward a market where financial data and service initiation can support better products across banking, payments, insurance, lending, wealth, and embedded finance.
But the opportunity belongs to founders who treat regulation as part of the product architecture.
If your fintech depends on financial data, account access, transaction initiation, bank connectivity, customer consent flows, or embedded financial services, the licensing question should be answered now.
Not after launch.
Not after the first bank meeting.
Not after a regulator asks for clarification.
Now.
Assess your licensing requirements
TruVis advises fintech founders, financial institutions, and technology companies on UAE regulatory structuring, CBUAE Open Finance licensing, ADGM and DIFC pathways, and pre-application readiness.
If you are building a UAE fintech business involving Open Finance, payment initiation, account aggregation, financial data sharing, or bank connectivity, assess your licensing requirements before committing to a structure.
Assess your licensing requirements at truvis.ae
