UAE Payment Gateway & Merchant Services: CBUAE PSP License Setup Guide 2026

Updated August 2026.

The UAE’s digital payments sector is among the fastest-growing in the MENA region, processing over AED 300 billion in annual transaction volume and expanding at a compounded rate exceeding 12% year-on-year. For entrepreneurs, fintech founders, and global payment companies seeking to establish a UAE-based payment gateway or merchant services business, understanding the regulatory architecture is the first critical step. This guide covers everything from the Central Bank of UAE’s licensing framework to practical cost planning and entity setup strategies for 2026.

CBUAE Retail Payment Service Provider (RPSP) Licensing Framework

The Central Bank of the UAE (CBUAE) is the primary regulator for payment service providers operating within the UAE onshore jurisdiction, excluding DIFC and ADGM which have their own regulators. Under the Retail Payment Services and Card Schemes Regulation (2021, as amended), any entity that operates a payment gateway, acquires merchant payments, processes card transactions, or provides payment initiation services must hold a valid RPSP license.

The CBUAE issues three licensing tiers:

• Tier 1 — Full PSP License: Permits acquiring, issuing, payment initiation, account information services, and stored value facilities. Minimum paid-up capital: AED 5 million.
• Tier 2 — Limited PSP License: Restricted to payment initiation and account aggregation only, without acquiring or issuing rights. Minimum capital: AED 1 million.
• Tier 3 — Stored Value Facility (SVF) License: For prepaid wallets and closed-loop gift card issuance. Minimum capital: AED 3 million with mandatory float safeguarding in a segregated bank account.

The annual CBUAE license fee is AED 150,000 for Tier 1, AED 75,000 for Tier 2, and AED 100,000 for an SVF. Applications are reviewed by CBUAE’s Fintech Office within the Financial Infrastructure and Payments Group (FIPG), with a standard review period of 90 to 120 working days for a complete submission. Incomplete applications can extend to 9 to 12 months, making document readiness critical.

Required Documents and Application Process

The CBUAE RPSP application process demands substantial pre-submission preparation. Applicants must submit the following through the CBUAE Licensing Portal:

• Five-year business plan with financial projections, target market analysis, and transaction flow diagrams
• Corporate governance framework including board composition, appointment of a UAE-resident AML/CFT Compliance Officer, and risk management policy
• Technology architecture overview covering UAE data residency requirements: all transaction data must be hosted within UAE-based Tier III or Tier IV certified data centres
• PCI DSS compliance roadmap with signed engagement letter from a Qualified Security Assessor (QSA)
• Source of funds declaration and Ultimate Beneficial Owner (UBO) documentation with KYC evidence
• Draft merchant agreements, user Terms and Conditions, and dispute resolution procedures
• Bank reference letters confirming AED 5 million in paid-up capital held in a CBUAE-licensed bank
• CVs and background checks for all board members and senior management

Incorporation must precede the CBUAE license application. Most RPSP applicants incorporate as a Limited Liability Company (LLC) with the Department of Economy and Tourism (DET) in Dubai or Abu Dhabi’s Department of Economic Development (ADDED). Free zone incorporation via DMCC or DAFZA is an option for holding structures, but a mainland subsidiary is required for the CBUAE license itself.

PCI DSS Compliance and Technology Infrastructure Requirements

Payment Card Industry Data Security Standard (PCI DSS) compliance is non-negotiable. For any payment gateway processing more than 6 million card transactions annually — which covers most commercial-scale UAE gateways — PCI DSS Level 1 certification is mandatory. CBUAE typically mandates a Level 1 readiness roadmap within 18 months of licensing for all Tier 1 RPSP holders.

Key technology requirements under CBUAE regulations include:

• Tokenization of all stored card data with no Primary Account Number (PAN) storage in plain text
• 3D Secure 2.0 (3DS2) authentication integration for card-not-present transactions
• End-to-end encryption (E2EE) across all payment channels including API, hosted payment page, and POS
• Semi-annual penetration testing by an Approved Scanning Vendor (ASV) accredited by the PCI Security Standards Council
• Real-time fraud monitoring system with configurable velocity rules and ML-based anomaly detection
• UAE data residency: all cardholder data and transaction logs must reside in UAE-based infrastructure such as Khazna Data Centres, du Data Hub, or e& Cloud

The cost of initial PCI DSS Level 1 QSA certification in the UAE ranges from AED 200,000 to AED 500,000, depending on the complexity of the cardholder data environment. Annual maintenance, including recertification, ASV scanning, and remediation, adds AED 80,000 to AED 150,000 per year.

Competitive Landscape: Key UAE Payment Gateway Providers

Understanding the existing market informs where new entrants can differentiate. The table below compares leading UAE payment gateway providers across key commercial parameters:

Provider	Transaction Fee	Monthly Fee	Strength	Gap / Opportunity
Telr	2.49% + AED 1.00	AED 349	Multi-currency, Arabic UX	Higher per-transaction cost for SMEs
PayTabs	2.75%	AED 0	Pan-MENA coverage, 168 currencies	Limited enterprise-grade SLA
Network International	Negotiated	Negotiated	Full acquiring bank services	Minimum volume thresholds exclude SMEs
Magnati (FAB-owned)	Negotiated	Negotiated	Government merchant base, POS hardware	Closed ecosystem, limited API flexibility
Checkout.com UAE	0.90% + AED 0.19	AED 0	Lowest per-transaction fee	Enterprise-only onboarding, no SME access

New entrants typically compete through vertical specialization such as real estate payment collection platforms, F&B integrated POS-gateway solutions, or government-services payment facilitators rather than attempting to be a generalist gateway competing with established incumbents.

DIFC Innovation Testing Licence and ADGM RegLab Sandbox

Both DIFC (Dubai International Financial Centre) and ADGM (Abu Dhabi Global Market) operate regulatory sandbox programmes that allow fintech companies to test payment services with real customers under reduced regulatory burden before committing to full licensing.

The DIFC Innovation Testing Licence (ITL), administered by the Dubai Financial Services Authority (DFSA), permits up to 12 months of live payment service testing with a maximum of 50 clients and AED 5 million in aggregate transaction volume. Capital requirements are substantially reduced or waived during the test period. The ITL application fee is AED 30,000, making it a cost-effective gateway validation tool.

The ADGM RegLab, administered by the Financial Services Regulatory Authority (FSRA), operates in twice-yearly cohorts with testing periods extending up to 24 months. ADGM RegLab is particularly suited for open banking, API-based payment initiation, and embedded finance use cases given ADGM’s forward-looking regulatory stance on data sharing and digital assets.

Sandbox graduation does not automatically yield a full license. After the testing period, companies must apply for either full DFSA or FSRA authorization within their respective jurisdictions. DIFC and ADGM licenses do not cover onshore UAE merchant acquiring — a separate CBUAE RPSP license is required for serving mainland UAE merchants directly.

Entity Setup Options: Mainland LLC vs Free Zone vs DIFC and ADGM

Choosing the right entity structure has significant implications for licensing eligibility, operational flexibility, and tax planning:

• UAE Mainland LLC (DET/ADDED): Required for CBUAE RPSP licensing. Since the 2021 UAE Companies Law amendments, 100% foreign ownership is permitted for fintech businesses. Requires a UAE physical office and at least one UAE-resident Compliance Officer.
• DMCC Free Zone: Popular for holding structures and international payment processing operations. The DMCC Fintech Licence costs AED 20,500 annually. A mainland subsidiary is needed for CBUAE licensing.
• DAFZA (Dubai Airport Free Zone): Cost-efficient for technology-first payment companies serving international markets without UAE-domestic merchant acquiring requirements.
• DIFC Incorporated Company: For DFSA-regulated payment services targeting international and GCC clients from a common law jurisdiction. Category 3C (payment services) minimum capital: USD 150,000. DIFC formation costs range from AED 12,000 to AED 25,000.
• ADGM Incorporated Company: Equivalent to DIFC with slightly lower incorporation costs. FSRA Category 3C minimum capital: USD 100,000. Preferred by institutional-grade payment infrastructure providers.

Total Cost of Setting Up a UAE Payment Gateway Business in 2026

The following cost model covers a Tier 1 CBUAE RPSP launch for a mid-scale payment gateway targeting UAE e-commerce merchants:

• Minimum paid-up capital (CBUAE Tier 1 RPSP): AED 5,000,000
• CBUAE annual license fee: AED 150,000
• LLC incorporation and annual trade license: AED 15,000 to AED 25,000
• Commercial office lease (mandatory): AED 60,000 to AED 120,000 per year
• PCI DSS Level 1 QSA certification: AED 200,000 to AED 500,000
• Technology development including gateway software, APIs, hosted payment page, and fraud module: AED 500,000 to AED 1,500,000
• Visa/Mastercard scheme membership and certification: AED 200,000 to AED 400,000 setup plus annual fees
• Legal, AML/CFT framework, and compliance consultancy: AED 100,000 to AED 200,000
• Recruitment including Compliance Officer, CTO, Operations Manager Year 1 salaries: AED 400,000 to AED 800,000
• Total estimated setup investment (excluding AED 5M capital floor): AED 500,000 to AED 3,000,000

Chargeback reserve requirements, operational working capital for the first 12 to 18 months, and merchant acquisition costs should be budgeted additionally at AED 1 million to AED 3 million. Total cost of launch including capital and working capital typically ranges from AED 7 million to AED 12 million for a full-scale Tier 1 RPSP operation.

Frequently Asked Questions

Can a foreigner own 100% of a UAE payment gateway company?

Yes. The UAE’s 2021 Commercial Companies Law amendments permit 100% foreign ownership for most commercial activities including financial services technology. For the CBUAE RPSP license, there is no mandatory local UAE shareholding requirement, though a UAE-resident AML/CFT Compliance Officer and local board presence are required for the license application.

How long does the CBUAE RPSP license application take?

From submission of a complete application to the CBUAE Fintech Office, the standard review period is 90 to 120 working days (approximately 4 to 6 calendar months). Applications with missing documents or requiring multiple clarification rounds can take 9 to 12 months. Engaging a regulatory consultant experienced with CBUAE fintech licensing significantly reduces timeline risk.

Is a UAE free zone payment gateway license valid for processing UAE-resident merchant payments?

No. Free zone entities including DMCC, JAFZA, and RAKEZ do not hold CBUAE RPSP licenses and cannot independently acquire UAE-resident merchant payments. They must either partner with a CBUAE-licensed acquiring bank under a payment facilitator agreement or establish a mainland UAE subsidiary with its own CBUAE RPSP license.

What is the difference between a payment gateway and a payment aggregator under UAE law?

A payment gateway is a technology service that routes transaction data between a merchant’s system and an acquiring bank. A payment aggregator (also known as a payment facilitator or PayFac) holds the acquiring relationship directly and onboards sub-merchants under its master merchant ID. Payment aggregation requires Tier 1 RPSP licensing plus additional KYB (Know Your Business) due diligence obligations for each sub-merchant onboarded. Telr and PayTabs both operate aggregator models for their SME client base.

Does the UAE have specific regulations for Buy Now Pay Later (BNPL) integrated with payment gateways?

Yes. CBUAE’s Buy Now Pay Later Regulations (effective 2024) specifically regulate BNPL providers as a distinct payment service category. BNPL operators integrated into a payment gateway require both a CBUAE RPSP license and compliance with BNPL-specific consumer disclosure rules, credit risk frameworks, and affordability assessment requirements. Notable UAE BNPL providers operating under this framework include tabby, Tamara, and Cashew, all of which hold CBUAE authorizations.