For any UAE business about to sign a card acceptance contract: which providers are actually licensed to hold your sales revenue, what the Central Bank forces them to disclose before you sign, and the parts of the deal no regulator polices.

Only a bank or a Central Bank licensed payment service provider may process card sales for a UAE merchant, and as of the CBUAE’s July 2026 register there are 36 licensed retail payment service providers: one holding a Category I license, 23 Category II and 12 Category III. Your provider must give you a written schedule of fees before you sign, must give 30 calendar days’ notice of any change to its terms, and you may terminate at no charge if you do not accept the change.

This guide works from the CBUAE Retail Payment Services and Card Schemes Regulation and from the CBUAE Register of licensed financial institutions, July 2026 edition. It assumes you already hold a trade license; if you do not, start with which authority licenses an online business in Dubai.

Who Is Legally Allowed to Process Your Sales

The Central Bank divides digital payments into nine retail payment services. Three of them decide who can stand between your customer’s card and your bank account: Merchant Acquiring Services, Payment Aggregation Services and Payment Instrument Issuance Services. Anyone providing them in the UAE needs a license, and card schemes need a separate one of their own.

The regulation defines a Merchant Acquiring Service as a service where a provider contracts with a payee to accept and process payment transactions, resulting in a transfer of funds to that payee. You, the business, are the payee. A Payment Aggregation Service is defined differently: it lets e-commerce sites and merchants accept various payment instruments without building their own payment integration, connecting merchants to acquirers, and in the process it receives payments from users, pools them, and transfers them on to merchants after a time period.

Who can process card payments for a business in the UAE?

A bank, or a company holding a CBUAE license for Merchant Acquiring Services or Payment Aggregation Services under the Retail Payment Services and Card Schemes Regulation. Card schemes require their own separate CBUAE license before commencing operations. Anyone offering to process your card sales without one of these is operating outside the framework.

The License Category on Your Provider’s Record, and What It Means

License categories are not seniority grades. They map to the list of services a provider is permitted to offer, and all three of the categories that matter to a merchant permit merchant acquiring and payment aggregation.

License category Merchant acquiring and aggregation Also permits Minimum initial capital
Category I Yes Domestic and cross-border transfers, and payment token services AED 3 million above AED 10 million monthly average transaction value; AED 1.5 million below it
Category II Yes Domestic and cross-border transfers, no payment tokens AED 2 million above the AED 10 million threshold; AED 1 million below it
Category III Yes Domestic fund transfers only, no cross-border AED 1 million above the AED 10 million threshold; AED 500,000 below it
Category IV No Payment initiation and payment account information services only AED 100,000 regardless of transaction value

The practical read is the cross-border line. A Category III provider is licensed for domestic fund transfers only. If your business sells into Saudi Arabia or bills a customer in Europe, a Category III acquirer is licensed for the acceptance side but not for cross-border transfer services, and you will need to check exactly which of your money flows it is permitted to handle rather than assuming a payments license covers everything.

The register itself is worth reading before you sign anything. Counting the Retail Payment Services section of the July 2026 edition gives 36 licensed providers: one in Category I, 23 in Category II and 12 in Category III. Not a single entity holds a Category IV license, which tells you that the open banking style services, payment initiation and account information, exist in the rulebook but had no licensed provider in that register. Familiar names appear with their category attached: Network International in Category I, Magnati, Checkout MENA and FIS Worldpay in Category II, Geidea, MyFatoorah and PayFort in Category III.

Acquirer or Aggregator: The Distinction That Decides Your Settlement Risk

Both models are licensed, and for a small merchant the aggregator is usually faster to onboard, because you sit under the aggregator’s own arrangements instead of getting a merchant identification number of your own. The difference shows up in where your money sits between the sale and the payout.

The aggregation definition in the regulation is explicit that the provider receives payments from users, pools them, and transfers them on to merchants after a time period. That pooling is the whole risk. Your revenue sits in the aggregator’s flow, commingled with other merchants’ funds, until settlement. With a direct acquiring relationship the funds move to you as payee, which is what the regulation’s own definition of merchant acquiring describes.

The regulation does not ban pooling. It regulates how the pooled funds must be protected, which is the subject of the next section, and it is the single most important thing to verify about any aggregator you are considering.

Where Your Money Sits Between the Sale and the Payout

Article 14 draws a hard line: at no time may a payment service provider hold user funds unless those funds are in transit. How they must be safeguarded then splits at 24 hours.

  • Providers that settle within 24 hours must not commingle your funds with those of any person other than the users on whose behalf the funds are held, and must insulate the funds against the claims of the provider’s other creditors, “in particular in the event of insolvency.”
  • Providers that settle after 24 hours must open a separate escrow account at a bank, restricted so that nothing can happen on it except transfer to the end beneficiary, or cover the funds with an insurance policy or bank guarantee from a regulated insurer or bank that is not in the same corporate group as the provider.
  • Banks acting as payment service providers need no escrow, insurance or guarantee, but must set up a separate bank account in the name of the users concerned.

The “not in the same Group” wording in the second rule is deliberate and worth checking. A guarantee issued by an affiliate of your provider does not satisfy the regulation, because the point is protection when that group is the thing that fails.

Is my revenue protected if my payment provider goes bankrupt?

It should be, if the provider follows Article 14. Same-day settling providers must insulate user funds against other creditors’ claims specifically in insolvency. Slower settling providers must use a restricted bank escrow account, or an insurance policy or bank guarantee from an institution outside their own group. Ask which of the three applies to you, in writing.

What Your Provider Must Disclose Before You Sign

This is the provision most merchants do not know applies to them. The regulation’s consumer protections run to every “Retail Payment Service User,” and it defines that as a person who makes use of a retail payment service in the capacity of payer, payee or both. A merchant accepting card payments is a payee. The Article 14 disclosure duties therefore run in your favor against your acquirer, not only in your customer’s favor against you.

Before entering the contractual relationship, the provider must give you the following, in clear, plain, non-misleading language, and in both Arabic and English if you ask:

  • The schedule of fees, charges and commissions, including conversion rates and withdrawal charges where applicable
  • Its legal name and registered address, including the address of any agent or branch
  • The form and procedure for giving and withdrawing consent to a payment order
  • The communication channel between you and the provider
  • The manner in which funds are safeguarded under Article 14(3) and (4)
  • The manner and timeline for notifying it of an unauthorized or incorrectly executed transaction
  • Information on both parties’ liability for unauthorized payment transactions
  • The service level for the provision of the service
  • The complaint procedure
  • The procedure for reporting unauthorized transactions

Under a framework agreement, the same information must be provided before you consent to a transaction and at any later time you ask for it, within five business days of the request. If you have been quoted a headline rate on a call and never seen a written fee schedule, the provider has not met its obligation, and asking for it in writing is both reasonable and enforceable.

Note what the seventh item does and does not do. The regulation requires disclosure of the liability split for unauthorized transactions. It does not set that split. Who absorbs a fraudulent transaction is left to your contract, which makes it the clause to read hardest.

The 30-Day Notice Rule and the Free Exit

Any change to the terms and conditions must be communicated sufficiently in advance and at least 30 calendar days before it takes effect. If you do not agree with the revised terms, you are entitled to terminate the relationship at no charge.

Read that against a typical merchant agreement, which will often carry a minimum term, an early termination fee, or a notice period of its own. Where a fee increase is the trigger, the regulation gives you a costless exit that the contract cannot take away, but the clock is short and it runs from the notification. Diarize the date the notice arrives rather than waiting to see the higher rate on a statement, because by then the window has usually closed and you are terminating on the contract’s terms instead of the regulation’s.

Card Schemes Are Licensed Too, and Their Fees Are Watched

A card scheme is defined as a single set of rules, practices and standards enabling card-based transactions in the UAE, separate from the payment infrastructure that supports it. Schemes operating in the State must obtain a CBUAE license before commencing operations, and the Central Bank must decide whether to grant or refuse within 90 calendar days of receiving the full application.

The regulation distinguishes a four party scheme, where transactions pass between payer and payee through the scheme, an issuer on the payer’s side and an acquirer on the payee’s side, from a three party scheme where the scheme itself does both the acquiring and the issuing. A three party scheme that starts licensing other providers to issue or acquire, or issues co-branded cards through a partner or agent, is treated as a four party scheme.

On fees, the Central Bank has given itself two powers that matter to merchant economics: the right to receive information on any fees and charges of card schemes and to regulate them as it considers appropriate, and the right to publicly disclose those fees and charges. Both are discretionary. Neither has produced a published interchange cap, so scheme fees remain a commercial input to your rate rather than a regulated ceiling.

Domestically, Al Etihad Payments, a CBUAE subsidiary, operates Jaywan, the UAE’s first domestic card scheme, issued by banks, licensed financial institutions and exchange houses as single-badged cards for local and GCC use or co-badged with international schemes. Whether your terminal accepts Jaywan is a question for your acquirer, and it is worth asking, because domestic scheme economics differ from international ones.

What the Regulation Does Not Cover

Being straight about the gaps is more useful than pretending the rulebook answers everything. Three of the numbers that will determine whether card acceptance is profitable for you sit entirely outside it.

  • The merchant discount rate. There is no published cap on what an acquirer may charge you per transaction. The regulation compels disclosure of the fee schedule, not its level. Rates are negotiated, and they move with your volume, average ticket size, sector risk and whether the card is present.
  • Settlement timing. The regulation splits safeguarding duties at 24 hours but does not mandate a settlement period. Your payout cycle is a contract term.
  • Chargebacks and rolling reserves. When a cardholder disputes a transaction, the process that follows runs on card scheme rules and your merchant agreement, not on this regulation. The same is true of any reserve your acquirer withholds against future chargebacks. The consumer side of that process is covered in our guide to card fraud, chargebacks and the Central Bank dispute route, which is the mirror image of what lands on your account as a merchant.

Treat all three as negotiable and get all three in the written schedule before you sign, because none of them has a regulatory floor to fall back on.

What You Actually Need in Place Before Applying

Onboarding requirements vary by provider, but the sequence rarely does, and each step gates the next.

  1. A valid trade license covering the activity you are selling. An acquirer underwrites against your licensed activity. Selling something outside it is the most common reason an application stalls, and the fix is on the licensing side. See adding a business activity to a Dubai trade license.
  2. A UAE corporate bank account for settlement. Providers settle to a local account in the company’s name. Our guide to opening a business bank account in the UAE covers the documents, and why corporate accounts get rejected covers the failure modes.
  3. Company documents and beneficial ownership. Memorandum, shareholder register, passports and Emirates IDs of the owners and signatories. The provider runs its own AML and know-your-customer file on you.
  4. A live, compliant website or checkout if you sell online. Underwriters check for displayed prices, a refund and returns policy, terms of service, delivery terms and working contact details. Your obligations to your own customers are set out in UAE consumer rights on returns and refunds.
  5. Your VAT position. If you are registered, your checkout and invoices must produce a compliant tax invoice on every sale. See what a valid UAE tax invoice must show and, if you are near the threshold, when VAT registration becomes mandatory.
  6. Verification of the provider itself. Find the entity’s exact legal name in the Retail Payment Services section of the CBUAE register, confirm the license category, and check that the contracting entity on your agreement is the licensed one rather than an unlicensed affiliate with a similar name.

What actually happens after submission is an underwriting review rather than an instant approval. Aggregators typically approve low-risk retail activities in days on standard pricing. A direct acquiring relationship with your own merchant identification number takes longer, involves a rate negotiation, and for higher risk sectors will come back with a rolling reserve attached rather than a refusal.

Frequently Asked Questions

Do I need a CBUAE license to accept card payments for my own business?

No. The license is required to provide payment services to others, not to accept payment for your own goods and services. You are a merchant, defined in the regulation as a person who accepts payment instruments as a mode of payment for the purchase and sale of goods and services. Your provider needs the license.

How do I check that my payment provider is licensed in the UAE?

Look it up in the Retail Payment Services section of the CBUAE Register of licensed financial institutions, published on the Central Bank’s licensing page and updated periodically. The register gives the exact legal name, license type, license category, head office emirate and identification number. Match the legal name against the entity on your contract, not the brand on the website.

What is the difference between a merchant acquirer and a payment aggregator?

An acquirer contracts with you directly to accept and process transactions resulting in a transfer of funds to you. An aggregator connects merchants to acquirers, receiving payments, pooling them and transferring them on after a time period. Aggregators onboard faster; acquiring relationships give you your own merchant identification number and usually better pricing at volume.

Can my payment provider raise its fees without telling me?

No. Any change to the terms and conditions must be notified at least 30 calendar days before it becomes effective, and you may terminate the relationship at no charge if you do not agree with the revised terms. That right comes from the regulation and applies regardless of what your contract says about termination fees.

Is there a cap on merchant discount rates in the UAE?

No published cap. The Central Bank has the right to receive information on card scheme fees and charges and to regulate them if it considers it appropriate, and to publicly disclose them, but those powers are discretionary and no interchange ceiling has been published. Your rate is negotiated commercially.

What happens to my money if my payment aggregator collapses?

It depends on how the provider safeguards funds. A provider settling after 24 hours must hold funds in a restricted bank escrow account or cover them with an insurance policy or bank guarantee from an institution outside its own group. A provider settling within 24 hours must keep funds uncommingled and insulated from its other creditors in insolvency. Ask which arrangement applies before you sign.

Do I need a separate license to sell to customers outside the UAE?

You do not, but your provider might. Cross-border fund transfer services are permitted under Category I and Category II licenses and are not included in Category III, which covers domestic transfers only. If your settlement or your customer payments cross a border, confirm your provider’s category covers it.

Does the Central Bank decide who pays for a fraudulent card transaction?

No. The regulation requires providers to disclose information on the liability split for unauthorized payment transactions before you sign, but leaves the allocation itself to the contract. Read that clause carefully, because for a card-not-present business it is often the largest single risk in the agreement.

Can I pass the card fee on to my customer as a surcharge?

The Retail Payment Services and Card Schemes Regulation does not address surcharging. In practice the constraint comes from card scheme rules and from your merchant agreement, which commonly prohibit it, and from consumer protection rules on displaying the price a customer actually pays. Check your merchant agreement before adding any card fee at checkout.

How long does the Central Bank take to license a card scheme?

Ninety calendar days from receipt of the full set of documents and information requested in the application, after which it must notify the applicant of its decision in writing and give reasons for any refusal. That timeline applies to the scheme’s own license under Article 18, not to your merchant onboarding.

Official Sources

This guide is for informational purposes only and is not legal, financial or regulatory advice. Information is current as of August 2026. The count of 36 licensed retail payment service providers is taken from the July 2026 edition of the CBUAE register, which is republished periodically and will change; verify any provider against the current edition rather than this figure. Capital thresholds, license categories and the Article 14 obligations are quoted from the Retail Payment Services and Card Schemes Regulation as published in the CBUAE Rulebook, which is amended from time to time. Merchant discount rates, settlement periods, chargeback allocation and rolling reserves are commercial terms and are not set by this regulation. Businesses licensed in the DIFC or ADGM operate under the DFSA and FSRA respectively, whose payment services rules differ from the federal regime described here.