PSP / EMI Licence in the UAE (2026): CBUAE Payment Services Guide

Quick Summary: PSP / EMI licence in the UAE

• What it is: a licence from the Central Bank of the UAE (CBUAE) to provide payment services – issuing payment accounts or cards, acquiring merchants, aggregating payments, transferring funds, or issuing e-money/wallets. It sits under the CBUAE’s Retail Payment Services & Card Schemes (RPSCS) regulation.
• Four categories (RPSCS): Category I is the broadest and heaviest (up to AED 3,000,000 capital, includes payment tokens); Category IV is the lightest (from AED 100,000, payment initiation/account information only). Categories II and III split on whether you offer cross-border transfers.
• E-money / wallets (SVF): holding customer balances – a “float” – needs a separate Stored Value Facilities authorisation, with minimum paid-up capital around AED 15,000,000, aggregate capital funds of at least 5% of the float, and typically a bank guarantee.
• Deadline to know: under the UAE’s 2025 licensing law, activities newly brought into CBUAE’s scope have a transition deadline of 16 September 2026 to become licensed or exempt.
• Where: this is a federal CBUAE licence – distinct from DIFC (DFSA) and ADGM (FSRA) financial licensing, and from VARA crypto licensing.

Fintech and payments are one of the most active licensing areas in the UAE right now, and also one of the most misunderstood – “PSP licence,” “EMI licence” and “payment gateway” get used loosely, but the actual legal framework is precise: the CBUAE licenses payment services under its RPSCS regulation, in four categories, and separately authorises anyone holding customer money as e-money under Stored Value Facilities (SVF) rules. This guide sets out exactly what each covers, the categories and capital, and how it differs from DIFC/ADGM financial licensing and VARA crypto licensing.

What CBUAE payment licensing actually covers

The Central Bank of the UAE regulates Retail Payment Services under its RPSCS regulation, covering nine defined activity types: payment account issuance, payment instrument (card) issuance, merchant acquiring, payment aggregation, domestic and cross-border fund transfer, payment token services, payment initiation, and payment account information services. Whatever your product actually does – a checkout button, a wallet, a remittance app, a card programme – it maps onto one or more of these activities, and that combination is what determines your licence category.

The four RPSCS categories

CBUAE groups the nine activities into four licence categories, running from lightest to heaviest:

Category	Typical activities	Indicative capital
Category I	The broadest bundle, including payment token services – the highest-risk tier	Up to ~AED 3,000,000
Category II	Payment accounts, acquiring, aggregation, transfers including cross-border	Higher tier (roughly double Category III)
Category III	The same core activities as Category II, but domestic transfers only – no cross-border	Mid tier
Category IV	Payment initiation and account information services only	From ~AED 100,000

The single biggest lever in this table is cross-border capability: adding the ability to move money internationally is what pushes a provider from Category III into the materially more expensive Category II. If your product genuinely only needs domestic transfers at launch, staying in Category III (or IV, if you are purely an initiation/information service) can be the difference between a light licence and a heavy one.

Holding customer money: Stored Value Facilities (SVF)

If your product holds a customer balance – a wallet, prepaid card, or any “top up and spend later” float – that is legally distinct from simply moving payments, and it triggers a separate Stored Value Facilities authorisation on top of your RPSCS category. SVF is capital-intensive by design, because the regulator is protecting customer money sitting inside your business:

• Minimum paid-up capital: around AED 15,000,000.
• Aggregate capital funds: at least 5% of the outstanding float (the total customer balances you hold).
• Safeguarding: customer funds must typically be safeguarded, often backed by a bank guarantee broadly equal to paid-up capital.

This is why a genuine e-wallet or prepaid-card business is a materially bigger undertaking than a payment gateway or acquiring business that never holds customer balances – know which one your product actually is before you plan capital.

PSP/EMI vs DIFC/ADGM vs VARA

Payments, regulated financial services, and crypto sit under different regulators, and mixing them up wastes months:

	CBUAE (RPSCS/SVF)	DIFC (DFSA) / ADGM (FSRA)	VARA
Covers	Payments, cards, transfers, e-money – federal, all emirates	Regulated financial services (funds, advisory, banking) – free-zone only	Virtual assets/crypto – Dubai ex-DIFC
Typical business	Payment gateway, wallet, remittance, card programme	Wealth manager, fund, bank, insurer	Exchange, custodian, crypto broker
Can overlap?	Yes – a DIFC/ADGM-based payments firm may still need a CBUAE licence for onshore UAE activity; a crypto payment product may need both VARA and CBUAE permissions.

Fintechs frequently need more than one of these – for example a DIFC-based firm that also serves customers onshore, or a crypto-payments product that touches both VARA and CBUAE activities. Map every activity you actually perform against all three regimes before assuming one licence covers you. See our VARA crypto licence and DIFC vs ADGM guides for the other two.

The 2025 Law and the 16 September 2026 deadline

The UAE's newer financial-activities law widened what counts as a licensed financial activity to include services “regardless of the medium or technology used” – explicitly capturing decentralised applications, protocols and technical infrastructure that enable payment services, not just traditional apps. Businesses whose activities are newly brought into CBUAE’s scope by this change have a transition deadline of 16 September 2026 to either become licensed or confirm they are exempt. If your product touches payments in any technical form – including infrastructure or protocol layers – this deadline is worth checking against your own activities now, not closer to the date.

Who needs this licence

• Payment gateways & checkout providers processing payments on behalf of merchants.
• Merchant acquirers enabling businesses to accept card or digital payments.
• Wallet & prepaid-card issuers holding customer balances (also need SVF).
• Remittance and cross-border transfer providers.
• Open-banking / payment-initiation and account-information services (the lightest tier, Category IV).
• Fintechs building payment rails or infrastructure, including those newly in scope under the 2025 law.

If you are simply reselling an already-licensed provider's payment rails under a reseller or agent agreement, you may not need your own CBUAE licence – but the line between “reseller” and “principal PSP” is exactly the kind of question worth confirming before you build, not after.

How to get licensed, step by step

1. Map your activities against the nine RPSCS activity types and identify your category (I–IV), including whether you need cross-border capability.
2. Confirm whether you need SVF authorisation – i.e. whether you will ever hold a customer balance.
3. Prepare the regulatory business plan – model, governance, AML/CFT framework, technology and security controls, and the people in key functions.
4. Submit to CBUAE and go through review; expect requests for clarification and iteration on the business plan.
5. Meet conditions and go live – capital deposited, safeguarding/guarantee arrangements (if SVF) in place, and key appointments approved.

Common mistakes

1. Confusing “payment gateway” with a licensed activity. Reselling an existing licensed provider's rails is different from being the licensed PSP yourself – know which one you actually are.
2. Missing the SVF trigger. Any float or wallet balance brings SVF's much heavier capital into play – do not assume a standard RPSCS category covers it.
3. Adding cross-border too early. Jumping from Category III to II for a “nice to have” cross-border feature roughly doubles the capital requirement – sequence it deliberately.
4. Ignoring the 2026 transition deadline. Infrastructure and protocol-layer payment activities can be newly in scope – check your position well before 16 September 2026.
5. Picking the wrong regulator entirely. A crypto-payments or DIFC/ADGM-adjacent product may need CBUAE permissions in addition to, not instead of, VARA or DFSA/FSRA licensing.

PSP / EMI licence: frequently asked questions

What is a PSP licence in the UAE?

A licence from the Central Bank of the UAE (CBUAE) under its Retail Payment Services & Card Schemes (RPSCS) regulation, authorising a business to provide payment services such as payment accounts, card issuance, merchant acquiring, payment aggregation, or fund transfers.

What is the difference between a PSP and an EMI licence?

"PSP" generally covers moving and processing payments under RPSCS Categories I–IV. "EMI" (e-money) refers to holding customer balances – a wallet or prepaid float – which needs a separate Stored Value Facilities (SVF) authorisation with much higher capital, on top of any RPSCS category you also hold.

What are the RPSCS licence categories?

Four categories, I to IV. Category I is broadest and heaviest (up to ~AED 3,000,000 capital, includes payment tokens); Category IV is lightest (from ~AED 100,000, payment initiation/account information only). Categories II and III cover similar core activities, split by whether cross-border transfers are offered – Category II (cross-border) roughly doubles the capital of Category III (domestic only).

How much capital do I need for an e-wallet in the UAE?

If you hold customer balances, you need Stored Value Facilities (SVF) authorisation: indicatively around AED 15,000,000 minimum paid-up capital, aggregate capital funds of at least 5% of the outstanding float, and typically a bank guarantee. This is separate from, and additional to, your RPSCS category capital.

Is a PSP/EMI licence the same as a DIFC or ADGM licence?

No. CBUAE licensing is federal and covers onshore UAE payment activity; DIFC (DFSA) and ADGM (FSRA) license regulated financial services within their own free zones. A fintech can need both – for example a DIFC-based firm serving onshore UAE customers.

Do I need a CBUAE licence for a crypto payments product?

Possibly both CBUAE and VARA. VARA licenses virtual-asset activities in Dubai (ex-DIFC); CBUAE licenses the payment-services side. A product that moves both fiat payments and virtual assets should map its activities against both regimes.

What is the 16 September 2026 deadline?

Under the UAE's 2025 financial-activities law, services newly brought into CBUAE's licensing scope – including payment activity delivered through decentralised applications, protocols or technical infrastructure – must be licensed or confirmed exempt by 16 September 2026.

How long does CBUAE payment licensing take?

It varies by category and preparation quality, but as a regulated financial licence it typically runs several months, driven mainly by the depth of review on your business plan, AML/CFT framework and technology controls. A complete, well-prepared application is the main lever you control.

Sources and official references

Related guides

• VARA crypto licence Dubai
• DIFC vs ADGM comparison
• Fintech licence in Dubai
• DFSA licence categories explained
• UAE business setup overview

This guide is general information, not legal, tax or financial advice. UAE payment-services licensing under the CBUAE (RPSCS and Stored Value Facilities) is technical and changes frequently; every figure here is indicative for 2026 and must be confirmed directly with the Central Bank of the UAE. HenryClub is an independent advisory, is not affiliated with the CBUAE and does not itself hold a payment-services licence; always take licensed professional advice for your own application.