Key Takeaways
- The UAE's Federal Decree-Law No. 6 of 2025 names insurers, alongside banks, finance companies and payment providers, among the entities "deemed licensed" for open finance - meaning insurance innovation teams, not only banking teams, now sit inside a live licensing perimeter for open finance activity, whether or not they have been tracking that law.
- This publication's 20 October analysis found the UAE's reconciliation deadline for the law has, per current legal commentary, already closed - and that "deemed licensed" is not the same as exempt: insurers must still formally notify the CBUAE and obtain approval before activating open finance capability.
- Embedded insurance distribution already depends on real-time, API-native infrastructure - this publication's 16 September Exposure Line framework set out five dimensions (quote-to-bind latency, mid-term servicing, claims triggering, status webhooks, settlement reconciliation) most core policy administration systems were never built to meet.
- Open finance regulation adds a licensing-perimeter test on top of that existing technical-readiness test - two separate questions insurance innovation teams have typically treated as one, or tracked in different parts of the organisation entirely.
- This is not a call to slow down embedded distribution ambitions. It is a call to add a licensing checkpoint to roadmaps that, in most insurers, currently have only a technical and commercial one.
Introduction
Open finance has lived, almost everywhere, inside the banking conversation. It grew out of open banking mandates, it is operated through banking-sector API hubs, and the vendors, regulators and conference panels discussing it have overwhelmingly been banking-focused. Insurance innovation and digital teams have, reasonably, treated it as adjacent infrastructure worth watching rather than a regulatory category that applies to them directly.
The UAE's new Central Bank law makes that separation difficult to sustain. This publication's 20 October analysis established that Federal Decree-Law No. 6 of 2025 names "Open Finance Services" as a licensed financial activity in its own right, and that the implementing regulation's "deemed licensed" pathway - the route that lets an existing CBUAE licensee activate open finance capability without a fresh licence application - explicitly includes insurers alongside banks, finance companies and payment service providers. That is a direct, named inclusion, not an inference. Insurance innovation teams with any UAE mainland exposure are inside this perimeter now, whether their roadmap review has caught up to that fact or not.
>> Read more: Why the UAE's New Central Bank Law Also Regulates Your Technology Partner
Two separate readiness questions, usually tracked by two separate teams
This publication's 16 September analysis of embedded insurance distribution set out why the growth story behind embedded insurance - compounding in the high twenties to low thirties percent annually, with Asia-Pacific leading every major forecast - quietly assumes a technical capability most core policy administration systems don't yet have. The Exposure Line framework introduced in that piece tests five dimensions against a simple above-the-line/below-the-line standard: can the core system quote and bind in real time, process mid-term servicing via API, trigger and validate claims automatically, push status changes as event webhooks, and reconcile settlement data automatically across every party in the distribution chain. A carrier below the line on even one or two of these dimensions carries real deployment risk the moment a distribution partner's service-level terms assume otherwise.
The UAE's open finance licensing regime adds a second, independent test that has nothing to do with whether the core system is technically capable. A core system can sit comfortably above the Exposure Line on every dimension and still be operating the resulting embedded distribution capability without the licensing notification and approval the open finance regulation requires. These are genuinely separate failure modes - one is an engineering and architecture gap, the other is a compliance gap - and in most insurers they are owned by different functions that do not routinely compare notes on the same initiative. A Head of Digital sponsoring an embedded partnership is typically tracking the Exposure Line question, implicitly or explicitly. The licensing-perimeter question usually isn't on the same roadmap review at all, because until this year it wasn't obviously an insurance question.
What the open finance regulation specifically requires of insurers
The mechanics matter here, because "deemed licensed" is frequently misread as "exempt," and that misreading is exactly where the exposure sits. Existing CBUAE licensees - including insurers - are deemed licensed for open finance under the regulation, which spares them the capital and fit-and-proper application process a fintech or data aggregator without an existing licence would have to complete. But deemed status still requires formal notification to the CBUAE and approval before any open finance capability goes live. An insurer that has built or is building an open finance-adjacent capability - exposing policy data through the CBUAE's API Hub, consuming account-aggregation data to underwrite more accurately, or participating in a bank's open finance-enabled embedded distribution flow - without having completed that notification step is not outside the regulation. It is inside it, unapproved.
This matters specifically for embedded insurance distribution because several of the capabilities the Exposure Line framework tests for - real-time data exchange, event-driven status updates, API-native settlement - are close cousins of, and in some partnership structures directly built on, the same open finance infrastructure (the Trust Framework, API Hub and consent layer operated under Al Etihad Payments) the regulation governs. An insurer modernising its core system specifically to clear the Exposure Line's technical bar may, in the process, be building directly on top of infrastructure that itself carries a licensing-notification obligation the modernisation programme was never scoped to address.
>> Read more: Embedded Insurance Is Growing Faster Than the Core Systems Behind It
Why this is relevant beyond the UAE
The UAE's approach - naming open finance as a distinct licensed activity, with a deemed-licensing pathway for existing financial institutions and a direct application route for everyone else - is more explicit than most comparable regimes, but it is not an isolated curiosity. Regulators across multiple jurisdictions have spent the past two years moving open banking and open finance from voluntary technical standards toward supervised, licensed categories, and the UAE's law is simply the clearest, most concrete evidence yet of where that direction of travel ends up. An insurance innovation team with no current UAE exposure should still read this as a leading indicator for how its own home regulator is likely to treat open finance participation as the category matures - not as a reason to wait until a similar law exists locally before building the internal muscle to ask the licensing-perimeter question at all.
>> Read more: Open Finance Is Becoming a Licensing Category, Not Just a Buzzword
Business and technology implications
For a CDO or Head of Digital, the practical implication is that an open finance or embedded distribution roadmap needs a licensing checkpoint alongside its existing product and technical checkpoints - and that checkpoint needs an owner, not an assumption that compliance "would have flagged it" if it mattered.
For a CTO, the API Hub, Trust Framework and consent/authentication infrastructure an embedded insurance partnership increasingly depends on is shared regulatory infrastructure, not neutral technical plumbing - integration planning and licensing-path determination should run in parallel, on the same timeline, rather than compliance review happening after the technical build is already committed.
For Risk and Compliance, the deemed-licensed pathway needs to be understood precisely: it removes the application burden, not the notification and approval obligation, and an insurer should be able to show, for each live open finance-adjacent initiative, that the notification step has actually been completed.
A fair counterargument
It would be an overreaction to treat every embedded insurance initiative as now requiring a full open finance licensing review. Many embedded distribution arrangements - a travel insurer selling a policy inside an airline's checkout flow, a device-protection product embedded at point of sale - can operate through conventional API integration without ever touching the CBUAE's open finance infrastructure specifically, if the data exchange involved is proprietary to the two parties rather than routed through the shared Trust Framework and API Hub. The test that matters is function, not label: does the initiative actually use, or depend on, the open finance regulatory infrastructure, or does it sit entirely outside it on conventional bilateral APIs. Insurance innovation teams should apply that distinction deliberately, rather than either ignoring the regulation entirely or treating it as blocking every API-based distribution idea.
What leaders should do next
Add a licensing-perimeter question to the next review of any embedded distribution or open finance-adjacent initiative with UAE mainland exposure: does this initiative touch the CBUAE's open finance infrastructure specifically, and if so, has the deemed-licensed notification and approval step actually been completed, by whom, and when. Run that question alongside, not instead of, the Exposure Line's technical readiness test, since a system can fail either test independently of the other. And where the organisation has no current UAE exposure, use this as the occasion to confirm which function owns the equivalent question for the jurisdictions it does operate in, before a similar law makes the gap visible the way the UAE's law now has.
The sourceCode’s perspective
Working across insurers and insurtechs in APAC and the Gulf, we see embedded distribution and open finance participation sponsored almost without exception by product and digital teams, with compliance and legal brought in once the partnership is largely shaped - the same pattern this publication's 1 October analysis described for banking technology vendors generally.
The UAE's explicit inclusion of insurers in its open finance licensing perimeter is a useful forcing function: it gives insurance innovation teams a concrete reason to bring the licensing question into the same roadmap conversation as the technical one, rather than treating them as sequential - technical build first, compliance review later.
The insurers that will move fastest on embedded and open finance distribution through 2027 are not the ones that wait for every jurisdiction to pass an equally explicit law. They are the ones that have already built the habit of asking both questions together. Talk to us here for further discussion!
Conclusion
Open finance has been, correctly, a banking-led conversation for most of its history. The UAE's new Central Bank law is the clearest evidence yet that this is changing: insurers are named, directly, inside the licensing perimeter, with a deemed-licensed pathway that still requires active notification and approval, not passive compliance.
For an insurance innovation team already working through the technical readiness questions this publication's Exposure Line framework raises, the practical next step is straightforward - add the licensing question to the same roadmap review, because the two tests are independent, and a capability that clears one can still fail the other.
Frequently Asked Questions
Does the UAE's open finance regulation apply to insurers, or only to banks? It applies to insurers directly. Existing CBUAE licensees - including banks, insurers, finance companies and payment service providers - are named as "deemed licensed" for open finance under the regulation, though they still must notify the CBUAE and obtain approval before activating open finance capability.
What is the difference between being "deemed licensed" and being exempt from open finance regulation? Deemed licensing removes the capital and fit-and-proper application process a new entrant would face, but it does not remove the obligation to formally notify the CBUAE and obtain approval before any open finance capability goes live. An insurer that has not completed that step is operating without the required approval, not outside the regulation's scope.
How does open finance regulation relate to embedded insurance distribution specifically? Embedded insurance distribution depends on real-time, API-native infrastructure similar in kind to open finance infrastructure, and in some partnership structures is built directly on the CBUAE's shared Trust Framework and API Hub. A technically capable core system (one that clears the Exposure Line's five readiness dimensions) can still be operating without the separate licensing approval open finance regulation requires.
Is this relevant to insurers outside the UAE? Yes, as a leading indicator. Regulators in multiple jurisdictions are moving open banking and open finance from voluntary standards toward licensed, supervised categories. The UAE's law is the most explicit current example of where that direction of travel leads, which is useful for insurers elsewhere even before an equivalent law exists in their own market.
What should an insurance innovation team do about this now? Add a licensing-perimeter question to every embedded distribution or open finance-adjacent initiative's roadmap review, run alongside the existing technical-readiness review, and confirm which function owns answering it - rather than assuming compliance will raise it unprompted.
Reference List
sourceCode (2026) Open Finance Is Becoming a Licensing Category, Not Just a Buzzword. 20 October. https://sourcecode.com.au/blog-open-finance-is-becoming-a-licensing-category-not-just-a-buzzword (Accessed on 20 Oct 2026).
sourceCode (2026) Embedded Insurance Is Growing Faster Than the Core Systems Behind It. 16 September. https://www.sourcecode.com.au/blog/embedded-insurance-api-infrastructure-apac (Accessed on 20 Oct 2026).
sourceCode (2026) Why the UAE's New Central Bank Law Also Regulates Your Technology Partner. 1 October. https://www.sourcecode.com.au/blog/uae-central-bank-law-technology-provider-licensing (Accessed on 20 Oct 2026).