CBUAE Retail Payment Services & Card Schemes License

UAE Central Bank Retail Payment Services & Card Schemes License

The UAE Retail Payment Services and Card Schemes (RPSCS) Regulation, introduced by the Central Bank of the United Arab Emirates (CBUAE) in July 2021, marked a significant milestone in the country's digital payment landscape. This comprehensive guide will explore the key aspects of the RPSCS license, its requirements, and its impact on the UAE's financial sector.

The RPSCS regulation came into force on 15th July, 2021, with a one-year transitional period for existing payment service providers and card schemes to obtain the relevant licenses. This new regulatory framework aims to enhance the safety, soundness, and efficiency of retail payment services while promoting innovation and establishing the UAE as a leading payment hub.

What are the key objectives of the RPSCS Regulation

The CBUAE introduced the RPSCS regulation with several objectives in mind:

1. Ensure greater safety during retail digital payments.

2. Allow financial service companies and FinTechs to participate in retail payment services.

3. Create a level playing field for market participants through innovation.

4. Help service providers adopt effective and risk-based licensing requirements.

5. Promote the UAE as a major payments ecosystem.

Licensing Categories and Services

The RPSCS regulation introduces a four-category licensing scheme for retail payment services. Each category covers different types of payment services:

Category IV

1. Payment Initiation Services

2. Payment Account Information Services

Category III

1. Payment Account Issuance Services;

2. Payment Instrument Issuance Services;

3. Merchant Acquiring Services;

4. Payment Aggregation Services; and

5. Domestic Fund Transfer Services.

Category II

1. Payment Account Issuance Services;

2. Payment Instrument Issuance Services;

3. Merchant Acquiring Services;

4. Payment Aggregation Services;

5. Domestic Fund Transfer Services; and

6. Cross-border Fund Transfer Services.

Category I

1. Payment Account Issuance Services;

2. Payment Instrument Issuance Services;

3. Merchant Acquiring Services;

4. Payment Aggregation Services;

5. Domestic Fund Transfer Services;

6. Cross-border Fund Transfer Services; and

7. Payment Token Services.

What does the UAE Central Bank consider a Payment Account?

UAE Central Bank Payment Licenses

As per the UAECB, a Payment Account is an account of the client with an authorised firm, wich is used for the execution of Payment Transactions, i.e. pay-in and pay-out transactions.

The Central Bank also defines Payment Account Issuance Services. These would be primary retal payment solutions that enable opening and operating Payment Accounts.  

The Payment Account can only used for holding monies in transit and not allowed to store and maintain the money, for instance, in an e-wallet.

What does the UAE Central Bank consider as Stored Value?

"Stored Value" refers to a system or arrangement (excluding cash) where:

a) A Customer, or someone acting on their behalf, provides monetary value to an issuer. This value can be in various forms, including:

 1. Traditional currency.

 2. Money's Worth (e.g., reward points, values).

 3. Crypto-Assets.

 4. Virtual Assets.

b) In exchange for this payment, the issuer offers:

1. A method to store the equivalent value, either partially or fully, within the system.

2. The "Relevant Undertaking"

This concept of Stored Value encompasses two main categories:

1. Device-based Stored Value Facilities.

2. Non-device based Stored Value Facilities.

The term "Stored Value Facility" (SVF) is used to describe these systems collectively.

The term "Money's Worth" in the context of Stored Value Facilities (SVFs) encompasses a broader definition of value than just traditional currency. It includes:

1. Value added to an SVF by a Customer.

2. Value received into a Customer's SVF account.

3. Value redeemed by a Customer.

These forms of value can include.

1.  Traditional money

Other forms of monetary consideration such as:

 1. Values.

  2. Reward points.

 3. Crypto-Assets.

 4. Virtual Assets.

To illustrate:

Topping up an SVF account:

A customer might increase their SVF balance using various forms of value. For instance, they could add value through reward points or virtual assets earned from purchasing goods and services.

Receiving value in an SVF account:

Value can be transferred between SVF customers in various forms. For example, one customer might send another customer value through an online transfer of virtual assets or reward points.

This expanded definition of "Money's Worth" reflects the diverse ways in which value can be stored, transferred, and utilized within SVF systems, going beyond traditional monetary concepts.

The UAE Central Bank has a separate regulation on Stored Value Facilities.

What is the difference between a Payment Token, a Security Token, a Commodity Token, and a Virtual Asset Token as defined by the UAE Central Bank?

Central Bank Token Definitions

Payment Token: A Payment Token is a Virtual Asset designed to maintain a stable value by referencing either the value of the same Fiat Currency it's denominated in or another Payment Token denominated in the same Fiat Currency. It's essentially a digital representation of fiat currency, similar to what the cryptocurrency industry calls 'stablecoins'.

Security Token: A digital asset that represents ownership of a financial instrument. It grants the holder specific rights and obligations, typically embodying either a debt or equity claim against the entity that issued the token. These tokens essentially digitize traditional securities using blockchain technology.

Commodity Token: A digital asset that provides the owner with rights to access existing or future goods or services. This type of token is exclusively redeemable with the issuing entity. It's commonly known as a utility token in the crypto industry.

Virtual Asset Token: A digital cryptocurrency that can be exchanged electronically and serves as a means of value storage or accounting. While some merchants may accept these tokens for transactions, they typically aren't recognized as official currency and lack governmental backing or guarantees.

The key distinction lies in what these tokens represent and how they function. Payment tokens are primarily for exchange; security tokens represent ownership or debt; commodity tokens represent access to a product or service, and virtual asset tokens function as stores of value or a unit of account but are not widely accepted for payment.

Do I need to have a license from the UAE Central Bank, in order to provide retail payment services in the UAE?

Yes, this is a requirement. The financial free zones of the UAE – DIFC in Dubai and ADGM in Abu Dhabi, have their own Money Services Regulations that are more geared towards business-to-business activities. There are exemptions for banks licensed by the UAE Central Bank, who can notify the Central Bank of their intention to provide such services under their existing license.

We are a company that provides businesses multi-currency accounts and cross-border transfers. What licenses will we need from the UAE Central Bank?

Firms that wish to offer multiple currency accounts and effect cross-border transfers can opt for the Category II license from the UAE Central Bank. However, you may require the additional permission of operating as an exchange house, should you wish to handle the currency conversion in-house. The Exchange House regulations are currently being modified by the Central Bank, and an updated regulation is expected imminently.

Alternatively, the firm can collaborate with a bank or licensed exchange house to carry out currency exchange for cross-border transfers.

What are the capital requirements for RPSCS licenses?

The initial capital requirements depend on the category of license being applied for.

RPSCS License Categories

Category 1 RPSCS License

Initial capital of at least 3 million AED (US$ 818,000) where the monthly average value of Payment Transactions amounts to 10 million AED (US$ 2.7 million) or above; or

Initial capital of at least 1.5 million AED (US$ 409,000) where the monthly average value of Payment Transactions amounts to less than 10 million AED (US$ 2.7 million).

Category II RPSCS License

Initial capital of at least 2 million AED (US$ 545,000) where the monthly average value of Payment Transactions amounts to 10 million AED (US$ 2.7 million) or above; or

Initial capital of at least 1 million AED (US$ 272,000) where the monthly average value of Payment Transactions amounts to less than 10 million AED (US$ 2.7 million).

Category III RPSCS License

Initial capital of at least 1 million AED (US$ 272,000) where the monthly average value of Payment Transactions amounts to 10 million AED (US$ 2.7 million) or above; or

Initial capital of at least 500,000 AED (US$ 137,000) where the monthly average value of Payment Transactions amounts to less than 10 million AED (US$ 2.7 million).

Category IV RPSCS License

Initial capital of at least 100,000 AED (US$ 27,000) regardless of the monthly average value of Payment Transactions.

The monthly average value of Payment Transactions is calculated based on the moving average of the preceding quarter or, where such data does not exist at the time of being granted a License by the Central Bank, on the basis of the business plan and financial projections provided.

The Central Bank may impose additional capital requirements on a case-by-case basis, taking into consideration the scale and complexity of the business.

Why setup a financial services firm in the UAE Mainland under the UAE Central Bank?

The UAE Central Bank is the main regulator for businesses that cater to the UAE market. Licensees will be able to offer their services in all seven emirates, and to Retail Clients. Mainland companies can operate freely throughout the UAE and internationally, providing greater market reach and penetration.

UAE Central Bank RPSCS License – Resource requirements

The UAE Central Bank expects that the firm be adequately staffed depending on the scale, scope and nature of the product portfolio that is proposed to be offered. At a minimum, the regulator would like to see the following appointments:

People

Board of Directors – a well-organized Board with robust governance policies. The Chair would have to be a non-executive Director.

Chief Executive Officer (CEO) – Senior finance professional with over 10 years of experience, ordinarily resident in the UAE.

The Chief Executive officer (CEO) is responsible for the day-to-day management, supervision and control of the Firm’s Business activities. The CEO is expected to perform with the highest standards of skills and due diligence and take reasonable care to ensure that the Firm's business is organized, managed and controlled effectively. The CEO is also responsible to establish and maintain arrangements to provide relevant, accurate, comprehensive, timely and reliable information to Firm’s Board and senior management which is necessary to organize, monitor and control its activities, to comply with legislation applicable in the UAE and to manage risks.

Finance Officer (FO) – Senior and suitably-qualified finance professional. In case of a group, the FO can be from the parent company and may not have to be resident in the UAE. This role can also be outsourced. You would also have to provision for a suitably qualified Accountant/Bookkeeper.

The FO contributes in making the best use of the overall corporate strategy of the company complemented by strategic planning to determine the overall aim of the Firm’s business.

This involves the financial status assessment, risk assessment and mitigation, understanding the Firm’s weaknesses and strengths and the use of analytical models to gain insights to the current financial position and opportunities for future growth.

Risk Officer – This position is usually outsourced.

Compliance Officer (CO) - Senior compliance professional with over 10 years of experience, ordinarily resident in the UAE.

Money-Laundering Reporting Officer – Senior AML professional with over 10 years of experience, ordinarily resident in the UAE. This function can be combined with Compliance and one individual can carry out both responsibilities.

The Compliance and AML officer will have the following primary responsibilities:

1.  Initiate, develop, maintain, and revise policies and procedures of the compliance framework and its related activities to prevent illegal, unethical, or improper conduct;

2.  Oversee the day-to-day implementation and operation of the compliance framework;

3.  Identify and assess the compliance risk associated with the Firm’s current and proposed future business activities, including new products, new business relationships and any extension of operations or network on an international level;

4. Establish written guidelines to staff and service providers on the appropriate implementation of the laws, regulation, rules and standards through policies and procedures;

5. Identify and keep an inventory available to all staff of essential laws and regulation pertinent to the Firm; provide advice with regards to the legislation;

6. Assess the appropriateness of internal policies, procedures and guidelines by performing regular and comprehensive compliance risk assessment, monitoring and testing; report the result on a regular basis and promptly where deemed necessary to SEO and Board;

7.  Establish and/or supervise appropriate compliance checks and controls;

8. Complete, check, verify clients’ due diligence and complete sanction screening at client on- boarding;

9. Provide guidance to the business on permissible activities, new products and programs;

10. Address any compliance audit remediation activities;

11. Liaise with the UAE Central Bank on compliance matters;

12. Centralise all information on compliance-related issues (breach of regulation, conflict of interest etc.);

13.  Respond to alleged violations of rules, regulations, and policies, procedures by evaluating or recommending the initiation of investigative procedures.

14. Develop and oversee a system for uniform handling of such violations; exercise any specific legal responsibilities such as reporting suspicions transactions related to money laundering and the fight against terrorism financing;

15. Maintain an effective compliance communication program for the organization, including promoting understanding of new and existing compliance issues and related policies and procedures;

16. Acting as a point of contact to receive Internal Suspicious Activity Reports (“Internal SAR”) from employees; taking appropriate action following the receipt of an Internal SAR;

17. Responding promptly to any request for information made by competent UAE authorities;

18. Receiving and acting upon any relevant findings, recommendations, guidance, directives, resolutions, sanctions, notices or other conclusions; and

19. Establishing and maintaining an appropriate AML training program and adequate awareness arrangements.

The CO and MLRO roles can also be outsourced to us.

Internal Auditor - Senior and suitably qualified internal audit professional. Usually outsourced to a professional firm.

The application process

The application process commences with formal introductions to the Fintech unit and the application team of the UAE Central Bank.

Following the introductory call, a detailed application form (A22) is filled out and submitted to the regulator. The form requires comprehensive details on the project, including an elaborate business plan that has to address the following:

1. A detailed description of the proposed business.

2. Geographic scope of operations, target markets, and customer segmentation.

3. Details on the client type, sources and client base size.

4. Details on products and service offerings this must be linked and mapped to the activities listed in the regulation.

5.  A detailed description of the product approval process.

6. Details on promotion and marketing activities, delivery channels.

7.  Details on the pricing. A clear list showing all proposed services and products against the proposed fees/charges must be provided.

8.  Diagrammatic Use Case explanation of functional flows of data, and funds, associated with transactions that the applicant facilitates, indicating the actors by type.

9. Details on how the proposed business aligns to the scope of license applied for.

10.  Explanation on the competitive advantage the applicant presents and how they intend to contribute to the UAE financial sector.

11. Details on the market research and competitor analysis, explanation on how they will increase their share of the market.

12. Detailed exit plan in case the company decides to shut down & seize operations. The explanation must take into account all costs related to the process.

13. Detailed stress test scenario showing the assumptions and the financial impact on both income statement & balance sheet under severely stressed scenarios.

14. Description of intended use of agents, branches and third party service providers;

15. Intended or current compliance with UAE Information Assurance Standards.

16. Details of any licenses held /applications in process with other authorities jurisdictions this includes any subsidiaries or groups related to the applicant.

17. Detailed explanation of the initial and long-term business model.

18. Detailed exit plan in case the applicant decides to shutdown.

19. Detailed stress test scenario in case the applicant is an existing entity.

20. In case of an existing company, that provides RPSCS, monthly breakdown of values and volumes of the processed transactions for at least the past three (3) years.

Three-year financial projections also have to be submitted, along with the proposed corporate governance, risk management, compliance and AML arrangements.

The UAE Central Bank places a lot of emphasis on robust information technology and cybersecurity, and the following information has to accompany the application:

1. Approved IT architecture documentation, including a list of all applications and users.

2. An assessment of compliance with UAE-IA Standard performed by an independent third party.

3. Results of most recent Vulnerability Assessment and Penetration Testing exercise.

4. Evidence that the all cloud-based data storage is encrypted with field-level encryption, and that the applicant owns the encryption keys.

5. Consumer protection and business continuity measures are also submitted.

6. The UAE Central Bank then reviews the application pack, and this can take anywhere between 90 and 120 days to complete.

The regulator maintains communication with the applicant at all times during the review, reverting with an initial review 3-4 weeks into the application, and then follow-up reviews thereafter. The Central Bank officials may also want to meet with the CEO, FO and CO/MLRO designates, to understand details on the submitted application and assess their fitness and propriety.

An in-principle approval is issued in case the application is successful. The applicant then proceeds to satisfy the in-principle conditions, and this involves the setting up of a legal structure, opening a bank account, and depositing the share capital. Other tasks include finalization of auditors and obtaining professional indemnity insurance for the firm.

Once done, a final submission is made to the Central Bank, following which the regulator issues the Financial Service Permissions and the process is then complete. The firm is now open for business. 

The process is expected to take over a year in total, from start to finish.

Costs

Setting up a Regulated Firm licensed by the UAE Central Bank involves the following interactions:

UAE Central Bank (UAECB)

The UAECB is responsible for reviewing and approving all applications for financial services.

Currently, the UAE Central Bank does not charge any application processing fee or annual licensing fee.

Legal Structure

Setting up in the UAE Mainland will cost around US$ 10,000 for statutory licenses and permits. Office space will be a separate cost and spaces usually start from US$ 20,000 for a small-sized office. The firm would not be able to operate on virtual spaces or desk spaces, given the nature of the business and personnel requirements.

Our Services

We provide turnkey services for applications to the UAE Central Bank. From initial consulting to assistance in authorisations, to assistance in preparation of the legal documentation, 10 Leaves helps you navigate the relevant Rules and Regulations and submit an application that is comprehensive, complete and compliant.

Our services include assistance in:

1. Reviewing the business model and advice on the applicable regulatory framework;

2. Preparation of the Regulatory Business Plan and comprehensive financial projections;

3. Preparation of all policies, processes and manuals required;

4. Provision of Outsourced Compliance Officer and Outsourced Finance Officer services;

5. Provision of VAT and Corporate Tax consultation services;

6. Finalising the legal structure, including holding company setup and customisation of Memorandums; and

7. Finalisation of leased space, bank account opening and obtaining Financial Services Permissions.

We also assist such teams with corporate and commercial documentation through our legal consultany - 10 Leaves Legability. We assist in the drafting of:

(i.) Founder agreements

(ii.) Shareholder agreements

(iii.) Investor agreements

(iv.) Share vesting/ESOP plans

(v.) Client/Supplier/Distributor agreements

(vi.) Employment agreements

 We also provide services in Luxembourg, Saudi Arabia and Mauritius. 

Get in touch today! for more Information on UAE Central Bank Retail Payment Services & Card Schemes License

 

Get In Touch With Us
 
 
 

POPULAR ARTICLES

 

CBUAE Retail Payment Services & Card Schemes License

UAE Central Bank Retail Payment Services & Card...

DIFC Innovation Market Explorer Licenses

  DIFC Innovation Market Explorer Licenses   A gateway...

DIFC Active Enterprises - 10 Leaves

  DIFC Active Enterprises The Dubai International Financial...

Category 4 DIFC Investment Advisor & Arranger License

DIFC is one of the world’s top ten onshore...

DIFC Prescribed Companies - 10 Leaves

  DIFC Prescribed Companies The Dubai...

DIFC Investment Crowdfunding Business License - 10 Leaves

DIFC is one of the world’s top eight onshore...

DIFC Venture Studio Launchpad License - 10 Leaves

  DIFC Venture Studio Launchpad License The DIFC has now...

DIFC Loan Crowdfunding Business License - 10 Leaves

DIFC is one of the world’s top eight onshore...

Contact CONTACT