The UAE’s New Central Bank Law Is Moving From Framework to Enforcement
This creates an important compliance reality:
Firms may need to operate under three layers simultaneously.
- The 2025 Central Bank Law
- New 2026 regulations
- Older rules that remain effective until replaced
This is precisely why a simple “new law checklist” may be insufficient.
What institutions need is a regulatory obligations map showing which requirements remain operative and which have been superseded.
The Enforcement Consequences Are Material
The Law significantly reinforces the importance of getting the regulatory perimeter right.
Article 170 provides that a person carrying on a Licensed Financial Activity without the required licence or authorisation can face:
- imprisonment;
- a fine of at least AED50,000;
- a fine of up to AED500 million; or
- either of those punishments.
Management exposure also deserves attention.
Under Article 181, where a juridical person commits a violation, the management official can face the same prescribed penalty where their knowledge is established or where the violation results from negligence or failure to perform their duties.
This changes the governance conversation.
The question is not simply:
“Is the company compliant?”
It is also:
“Can responsible management demonstrate that it took reasonable steps to understand and manage the compliance risk?”
A September Readiness Test
With the reconciliation deadline approaching, we would recommend that management test at least the following areas.
Area | Question for management |
Licensing | Do our actual activities still match our approved licence? |
Regulatory perimeter | Are any new technology-enabled activities now regulated? |
Governance | Have board and senior-management responsibilities been updated? |
Operational resilience | Have critical services and disruption scenarios been identified? |
Remuneration | Are incentive structures aligned with risk and customer outcomes? |
Telemarketing | Are internal and outsourced marketing practices compliant? |
AI / ML | Is there documented governance around models and customer impact? |
Insurance | Do licensing structures comply with the new C4/2026 framework? |
Legacy rules | Have we identified older rules that remain in force under Article 183? |
Contracts | Have we distinguished genuine compliance changes from contracts protected by Article 132? |
Management accountability | Is ownership of each regulatory obligation clear? |
From Legal Reform to Operating Model
The most important message from the first year of the new Central Bank Law is not simply that more regulations have been issued.
It is that the regulatory framework is becoming more integrated.
Technology is now part of licensing.
Remuneration is part of risk.
Marketing is part of customer protection.
AI is part of governance.
Operational continuity is part of prudential supervision.
And management accountability sits across all of them.
That means financial institutions should stop treating regulatory change as a sequence of separate legal updates.
The real task is to translate the new framework into an operating model that management can evidence, monitor and defend.
For many institutions, the approaching September 2026 reconciliation deadline is therefore less a finishing line than a useful governance checkpoint.
The better question is not:
“Have we updated the policy?”
It is:
“Can we show that the business now operates differently because of the rule?”
That is where effective compliance begins.
How NR Doshi & Partners Can Support
At NR Doshi & Partners, we support financial institutions and businesses operating within the regulated financial sector with practical regulatory-readiness and control reviews, including:
- Regulatory gap assessments
- Licensing-perimeter reviews
- Governance and policy alignment
- Operational-risk and resilience reviews
- AML and compliance frameworks
- Internal controls and assurance
- Technology and AI governance assessments
The objective is not simply to document compliance.
It is to help management establish whether the organisation can demonstrate that its activities, controls and governance actually meet the requirements now expected of it.
This publication is current as at 2 September 2026 and is intended for general information only. It does not constitute legal or regulatory advice. Institutions should assess the specific application of the Central Bank Law, regulations and other applicable requirements to their own activities and licences.
UAE Pillar Two Registration Deadline: 30 November 2026
October 12, 2026
