KEY TAKEAWAYS
- The CBUAE has introduced the Open Finance Regulation as part of its ‘Financial Infrastructure Transformation Programme’ to boost financial technology in the country.
- Unlike earlier initiatives in Europe, the UK, and Australia, the UAE’s regulation offers a broader scope and sets a new benchmark in Open Finance.
- The framework consists of the Trust Framework, API Hub, and Common Infrastructural Services, which together ensure secure, efficient, and user-friendly financial data sharing and transaction initiation.
- Banks, insurance companies, brokers, and other financial institutions must jointhe framework, share user data with consent, and support Open Finance services.
- Entities must secure a CBUAE license to offer Open Finance services, comply with strict data protection measures, and face significant penalties for breaches.
- The regulation opens up vast opportunities for fintech companies to innovate, develop personalised products, and offer integrated financial services, positioning the UAE as a global leader in financial innovation.
On 15 April 2024, the Central Bank of the United Arab Emirates (“CBUAE”) published the Open Finance Regulation (”Regulation”). This Regulation adds to eight other initiatives introduced as part of the CBUAE’s Financial Infrastructure Transformation (“FIT”) Programme to promote technological innovations within the financial sector and to establish the UAE as a centre for financial technology.1
The UAE is not the first to introduce open finance regimes. In 2015, the European Parliament introduced the Revised Payment Services Directive, which included elements of open banking.2 In 2017, the Competition and Markets Authority of the United Kingdom launched its Open Banking Roadmap and issued directions to the biggest retail banks in the UK to allow certain licensed entities to access their data using secured data protocols.3
Australia also launched an open banking project in 2019, but rather than a financial services regulation, they introduced Consumer Data Rights legislation.4 However, the scope of the CBUAE’s Regulation is comparatively much broader.
WHAT IS OPEN FINANCE?
Open Finance is a system where banks and other financial institutions can securely share users’ financial data with authorised third parties. Financial service providers can offer innovative services tailored to customers’ needs by integrating data from different accounts into a single platform. Users can then manage all their financial data from various sources in a single place.
UNDERSTANDING THE KEY DEFINITIONS
Open Finance Providers5 are entities licensed under the Regulation to provide Open Finance Services,6 which include Data Sharing and Service Initiation. Only those with an Open Finance License7 from the CBUAE can provide these services. A User8 is anyone whose uses Open Finance Services, and their financial information is called User Data.9 The main types of Open Finance Services are as follows:
- Data Sharing:10 An online service that consolidates a User’s financial data from various accounts and products held with licensed financial services providers, i.e., a Licensee/Data Holder;11 and
- Service Initiation: Initiating transactions like transfers, crediting, debiting, placements, withdrawals, redemptions, sales, orders or cancellations related to an Account or Product.
The Regulation governs the licensing and operation of Open Finance Services for specific products and related accounts (“Products”)12 and the accounts related to these Products (“Accounts”).13 However, Accounts and Products regulated by the Securities and Commodities Authority are excluded from the purview of the Regulation.14
OPEN FINANCE FRAMEWORK
The Open Finance Framework consists of three components: the Trust Framework, the API Hub and the Common Infrastructural Services.
The Trust Framework includes a Participant Directory, which lists all approved financial institutions and service providers, ensuring only trusted entities can access the platform. This is similar to a registry of licensed banks and fintech companies participating in Open Finance. Digital Certificates are also part of the Trust Framework, providing secure digital IDs for safe communication between participants, akin to SSL certificates used by websites to secure online transactions. Additionally, the API Portal serves as a central site containing essential documentation and guidelines for participants, much like an online repository where fintech developers can find APIs and integration guides. The Sandbox offers a testing environment where participants can trial new services safely, comparable to a platform where banks and fintech companies simulate new financial products before launching them.
The API Hub acts as a central platform where all participants connect and interact. It functions as a central API gateway that fintech companies use to integrate their apps with multiple banks and financial services. This centralised system simplifies the implementation process for all involved parties.
Common Infrastructural Services encompass several key functionalities. The Consent and Authorization Manager oversees user permissions and privacy settings, allowing users to control which financial apps can access their bank account information. Service Assurance is responsible for handling technical issues and ensuring service quality, similar to a support system that monitors API performance and resolves downtime issues for participating banks and fintech companies. Reporting and Analytics involve analysing data and performance metrics and providing insights into API usage patterns and service efficiency across different financial institutions. Lastly, Administration Tools assist in managing disputes and administrative tasks, offering a set of tools to resolve transaction disputes between a bank and a fintech app providing budgeting services.
MANDATORY PARTICIPATION
The Regulation requires certain licensed entities, such as banks, insurance companies, insurance brokers, and other financial institutions, to participate in the Open Finance Framework. These institutions, regulated by the CBUAE, must share User Data and allow Open Finance Providers to initiate transactions on Users’ Accounts and Products. All services must have Users’ consent,15 use secure authentication procedures,16 and follow open communication standards.17 These requirements apply even if the institutions do not directly offer Open Finance services.
PROCEDURE FOR OBTAINING THE LICENCE
No company may provide Open Finance Services without obtaining a licence from the CBUAE.18 The application process involves submitting a comprehensive application to the CBUAE. Each Applicant19 can choose to undertake either Data Sharing or Service Initiation activities or both.
To be eligible, an Applicant must maintain a minimum capital amount of AED 1 million. The CBUAE may impose additional capital requirements based on the risk, size, and complexity of the Applicant’s activities.20 The Applicant must also obtain professional indemnity insurance.21
Alternatively, an entity may be designated as a Persons Deemed Licensed for specific categories of licences under the Regulation.22 These would usually include CBUAE-licensed banks, finance companies, retail payment service providers, insurance brokers, and stored value facility providers.
OBLIGATIONS OF LICENSEES
Licensees must meet several key requirements to comply with the Open Finance Framework. They must create a secure online interface for Open Finance Providers to access Accounts and Products via the API Hub, register as participants within 14 days of approval, and cooperate with Open Finance Providers in sharing User data and initiating transactions, all with User consent. They must not share data of non-customers, or any data received from a service owner. Clear terms and conditions, including fees and contact details, must be established with Users. Data scraping or any similar extraction methods are prohibited.23
PHASED ROLL-OUT
The Regulation will be implemented gradually and phased in, starting with the onboarding of Banks and Insurers into the Open Finance Framework. The CBUAE will communicate the subsequent phases through official channels. The CBUAE has outlined plans for most customers to gain access to Open Finance applications by 2024.24
DATA PRIVACY AND USER’S CONSENT
The Regulation requires that Open Finance Providers must have explicit User consent to process Personal Data.25 This consent must be clear, informed, unambiguous, and freely given, involving a specific action from the User. Separate consent is needed for different purposes, and Users should be able to withdraw consent easily. Consent is invalid if unnecessary data is requested, and Sensitive Data26 cannot be processed for Data Sharing. Personal Data must be handled lawfully, fairly, transparently, and only for specific, necessary purposes. It must be accurate and protected against unauthorised access or damage.27 Firms are strictly liable for data breaches, facing significant penalties,28 and must comply with existing consumer protection laws.29
IMPACT AND CONCLUSION
The Regulation is a transformative initiative that significantly enhances the transparency, security, and efficiency of financial services. By mandating the secure sharing of User data with explicit consent, it fosters a more competitive and innovative financial ecosystem. This regulation not only strengthens consumer trust but also provides a fertile ground for fintech companies to thrive.
The opportunities for fintech firms are vast, from developing personalised financial products to creating seamless, integrated services that cater to the diverse needs of consumers. With the UAE’s commitment to becoming a global fintech hub, companies entering this market can leverage the regulatory framework to drive growth, foster innovation, and build robust, user-centric financial solutions.
This regulatory environment positions the UAE as a leader in financial innovation, offering fintech companies a unique opportunity to be at the forefront of digital transformation in the financial sector.
***
DISCLAIMER: This article is provided for informational and educational purposes only and does not constitute legal advice. Readers should not act upon this information without seeking professional legal counsel tailored to their specific circumstances. The analysis presented herein reflects the authors’ interpretation of legal developments as of the date of publication and may not reflect subsequent changes in law or regulation.
At TLP Advisors, we are a legal consulting firm specialising in tokenised finance, agentic financial systems, digital assets, and emerging technologies. With deep roots in the financial services, Web3, and broader technology sectors, we offer unparalleled expertise and tailored support to navigate the unique challenges and opportunities of these rapidly evolving industries. TLP Advisors has consistently been the firm of choice for web3, fintech and other financial services companies. We have built a reputation for guiding clients through complex regulatory landscapes while supporting the development of innovative and compliant financial platforms.
***
