Open Finance Is Becoming a Licensing Category, Not Just a Buzzword

Key Takeaways 

• The UAE's Federal Decree-Law No. 6 of 2025 (effective 16 September 2025) explicitly adds "Open Finance Services" to the list of CBUAE-Licensed Financial Activities - moving open finance from a voluntary API initiative into a licensed, supervised category of financial business. 

• Under the CBUAE Open Finance Regulation, any entity offering open finance services needs a licence covering Data Sharing, Service Initiation, or both - unless it is a bank, insurer, finance company or payment provider that is "deemed licensed" and only needs CBUAE notification and approval before going live. 

• The law's one-year reconciliation window (Article 184) closed on or around 16 September 2026 - before this article's publication date - which means any UAE-exposed institution that treated open finance as a product roadmap item, not a licensing decision, is already operating past the deadline the law set for it. 

• This is not an isolated UAE curiosity: it is the clearest real-world evidence yet that open finance/open banking regimes globally are converging toward licensing regimes, not just technical standards - a pattern CDOs and CTOs outside the UAE should read as a leading indicator, not a regional footnote. 

• sourceCode's Perimeter Crossing Diagnostic - introduced for Article 62's technology-provider scope - extends cleanly to open finance, with one addition: a Licence-Path Test that asks whether your organisation is "deemed licensed" or must actively apply. 

Introduction 

For most banks, insurers and fintechs in the Gulf, "open finance" has lived in the same planning conversation as "open banking APIs," "embedded finance," and "BaaS strategy." It has been owned by product and technology leaders, funded through innovation budgets, and measured against adoption curves and partner integrations. It has not, typically, been owned by legal, risk or compliance as a licensing question. 

That separation is now difficult to defend in the United Arab Emirates. On 16 September 2025, Federal Decree-Law No. 6 of 2025 - the UAE's new, consolidated Central Bank law - came into force, repealing the 2018 Central Bank Law and the 2023 insurance law in favour of a single statute (White & Case, 2025; Hadef Partners, 2025). Among its changes, the law explicitly names "Open Finance Services" as a Licensed Financial Activity in its own right (Addleshaw Goddard, 2025; CMS, 2025). That is a legislative act, not a regulatory circular - it elevates open finance from the domain of CBUAE guidance into the domain of federal law, with the licensing, supervisory and enforcement consequences that implies. 

This piece was produced on 20 October 2026 - more than a month after the law's one-year reconciliation period is reported to have lapsed (Addleshaw Goddard, 2025; Hadef Partners, 2025). That timing matters. This is no longer a "get ready" story. For institutions with open finance activity touching the UAE mainland, the question is not whether the perimeter now includes open finance - commentary from multiple law firms confirms it does - but whether their own open finance roadmap has actually been tested against it. 

On 1 October 2026 we published an analysis of Article 62 of this same law - the provision that brings technology partners facilitating licensed financial activity "regardless of the medium, technology, or form employed" inside CBUAE's regulated perimeter - and introduced the Perimeter Crossing Diagnostic to help CDOs and CTOs test whether a given initiative had crossed into licensed territory (Read more: Why the UAE's New Central Bank Law Also Regulates Your Technology Partner). Open finance is a useful, concrete test case for that same diagnostic - but it is not identical to the general technology-provider question Article 62 raises, and it deserves its own treatment. This article verifies what the law and its implementing regulation actually say about open finance specifically, and extends the diagnostic to fit. 

What the Law Actually Says 

Three distinct legal layers now govern open finance in the UAE, and conflating them is the most common mistake we see in early internal readings of this law. 

Layer one: the statute names the activity 

Federal Decree-Law No. 6 of 2025 lists "Open Finance Services" among the Licensed Financial Activities enumerated under Article 61, alongside the newly added "payment services using Virtual Assets" and a restructured set of insurance-related activities (Addleshaw Goddard, 2025; CMS, 2025). Several law firm summaries describing the same provision do not all cite the article number explicitly, but the substantive point is consistent across Ashurst (2025), White & Case (2025), Hadef Partners (2025) and CMS (2025): open finance services are now named, at statute level, as a category requiring a CBUAE licence to carry on. 

Layer two: Article 62 extends the test to "any medium" 

Article 62 is a separate, broader provision. It brings within CBUAE's licensing and supervisory authority "any person carrying on, offering, issuing, or facilitating a licensed financial activity... regardless of the medium, technology, or form employed" (CMS, 2025; Norton Rose Fulbright, 2025). This is the provision our 1 October piece analysed in detail, because its language is technology-neutral by design - it is meant to catch platforms, protocols, decentralised applications and infrastructure providers that enable a licensed activity without being the licensed institution themselves (Gibson Dunn, 2025; Hadef Partners, 2025). 

The relationship between the two articles matters for CDOs: Article 61 tells you open finance is now a named, licensable activity. Article 62 tells you that the test for whether your organisation is "carrying on" that activity is deliberately broad and does not depend on whether you call yourself a bank, a fintech, or a technology vendor. 

Layer three: the regulation sets the operating detail 

The substantive mechanics of open finance in the UAE sit in the CBUAE's Open Finance Regulation, first issued as Circular 7 of 2023 and updated by Circular 3 of 2025, which took effect on 10 July 2025 (Pinsent Masons, 2025; Hadef Partners, 2024). The regulation establishes three components - a Trust Framework, a centralised API Hub, and Common Infrastructural Services - operated in practice by Nebras (platform infrastructure) and Al Tareq (consent and authentication) under the Al Etihad Payments umbrella (Pinsent Masons, 2025; Kayrouz & Associates, 2025). 

Within that regulation, two things stand out for anyone running an open finance roadmap: 

A split licensing structure. The CBUAE Open Finance Licence has two selectable options - Data Sharing and Service Initiation - and an applicant can hold one or both, but adding the second later requires a fresh application and approval (Kayrouz & Associates, 2025; Hadef Partners, 2024). This is a materially different shape from a typical open banking API rollout, where "read" and "initiate" capability are often treated as a single product decision, not two separate regulatory filings. 

A two-track entry path. Existing CBUAE licensees - banks, insurers, finance companies, payment service providers - are "deemed licensed" for open finance, but still need to notify the CBUAE and obtain approval before going live (Pinsent Masons, 2025; Hadef Partners, 2024). Everyone else - fintechs, aggregators, third-party providers building on top of the API Hub - must apply for the licence directly, meeting minimum capital and fit-and-proper requirements from the outset (Kayrouz & Associates, 2025). The practical effect is that two organisations building the same open finance product can face entirely different regulatory paths depending on what they already are. 

Why Now: The Clock Most Roadmaps Didn't Account For 

The reconciliation period in Article 184 of the decree-law gave in-scope entities one year from the law's 16 September 2025 effective date to bring their position into line - commentary converges on a deadline of 16 September 2026, with the CBUAE retaining discretion to extend it (White & Case, 2025; Gibson Dunn, 2025; Kayrouz & Associates, 2025; Hadef Partners, 2025). [Unverified: whether the CBUAE has in fact granted any extension is not independently confirmed by this research; readers should check current CBUAE guidance before treating this date as closed.] 

As this piece goes to publication, more than a month has passed since the date most legal commentary identifies as the end of that reconciliation window. Participants are already live - Abu Dhabi Islamic Bank's rollout of open finance services under the AlTareq framework, reported by Salaam Gateway in January 2026, was described as covering the regulatory and technical requirements of a completed "first implementation phase" (Salaam Gateway, 2026). The regime is not theoretical: it is operating, with real participants, while some organisations' internal reviews of their own exposure may still be pending - the practical version of the pain point CDOs now face, where an API-and-partnerships initiative from eighteen months ago may sit inside a licensing perimeter whose deadline has already passed. 

Extending the Perimeter Crossing Diagnostic to Open Finance 

 

The Perimeter Crossing Diagnostic we introduced on 1 October 2026 asks four questions to test whether a technology-mediated activity has crossed into CBUAE's licensed perimeter under Article 62: Function (what does it actually do, not what is it called), Distribution (who is it offered to and through what channel), Substitution (does it substitute for a licensed institution's role in the value chain), and Licence-Gap. 

Open finance is, in effect, a case where the statute has already answered the Function and Licence-Gap questions for you - Article 61 names the activity, so there is no ambiguity about whether "open finance services" is inside the perimeter. What the general diagnostic does not fully capture is the two-track entry structure unique to the Open Finance Regulation: deemed licensing versus direct application. We extend the diagnostic with a fifth question for this specific case: 

The Licence-Path Question: are you deemed, or do you have to apply? If your organisation already holds a CBUAE licence as a bank, insurer, finance company or payment service provider, you are likely deemed licensed for open finance - but you still owe the CBUAE formal notification and approval before activating any open finance capability (Pinsent Masons, 2025; Hadef Partners, 2024). If you do not hold one of those licences - including fintechs, data aggregators, and most AI-native overlay products - "deemed" status does not apply to you, and the absence of an enforcement action against you so far is not evidence that you are outside scope; it may only mean the CBUAE's phased rollout has not reached your category of participant yet. 

Run together, the five questions give a CDO a usable test: Function and Substitution establish whether what you are building is, in substance, open finance. Distribution clarifies who is consuming it and through what rail. Licence-Gap and Licence-Path then tell you not just whether a licence requirement exists, but which of the two very different UAE entry routes applies to your organisation specifically. 

The Counterargument: Is This Overreach, or Proportionate Catch-Up? 

A fair challenge to this piece's framing is that regulators are always a step behind technology, and that naming "open finance" as a licensed activity is simply regulatory catch-up with something the market - and the CBUAE's own Financial Infrastructure Transformation Programme - had already been building toward since at least 2023 (Hadef Partners, 2024). On this reading, nothing has fundamentally changed for well-governed participants: banks and insurers were always going to need CBUAE sign-off for new financial infrastructure, and the "deemed licensed" pathway specifically avoids disrupting institutions already inside the regulatory tent. 

There is also a reasonable argument that broad, technology-neutral drafting - Article 62's "regardless of the medium, technology, or form employed" language - is the right design choice precisely because narrow, technology-specific rules age badly; multiple law firms note that implementing regulations and exemptions are still expected to narrow the practical scope over time (CMS, 2025; Gibson Dunn, 2025). Treating the current drafting as a settled, maximalist perimeter, rather than a wide net still to be calibrated, risks overstating the burden on genuinely peripheral vendors. 

Both points are legitimate. What they do not change is the operational reality CDOs face today: the statute and regulation exist now, the deemed/apply distinction exists now, and the reconciliation deadline has, per current legal commentary, already passed. Waiting for implementing regulations to soften the perimeter is a defensible position for legal counsel to take deliberately - it is not defensible as a position arrived at by never having asked the question. 

What This Means for the Buying Committee 

For the CDO: the open finance roadmap you are sponsoring needs a licensing checkpoint, not just a product and partnerships checkpoint. Confirm in writing, before the next roadmap review, which of the five diagnostic questions above has actually been answered for each initiative in flight, and by whom. 

For the CTO: the API Hub, Trust Framework and consent/authentication layers (Nebras, Al Tareq) are shared infrastructure you will likely need to integrate with regardless of licensing path - run technical integration planning and licensing-path determination in parallel; they have different lead times. 

For the CRO/Compliance lead: the deemed-licensed pathway is not a free pass. Banks, insurers and payment providers still owe the CBUAE formal notification and approval before activating open finance capability - "deemed" describes the licence, not an exemption from the approval step. 

For the CFO: the Open Finance Licence requires minimum capital and professional indemnity insurance for entities applying directly (not deemed) - a balance-sheet and procurement-timeline question as much as a legal one, particularly for fintech or JV structures without an existing CBUAE licence to lean on. 

The sourceCode’s Perspective 

We have spent two decades inside BFSI delivery teams across Australia, Malaysia and Vietnam, largely on the insourcing and offshore/nearshore delivery (ODC) side of technology programmes, rather than as the vendor pitching the regulatory answer. From that vantage point, the pattern in this law is familiar even though the UAE specifics are new: regulatory perimeters tend to widen fastest exactly where delivery teams have been moving fastest - open APIs, embedded finance, consent-based data sharing - because those are the areas where "who is actually providing the regulated service" becomes genuinely ambiguous in the architecture diagram, not just the org chart. 

We do not have a UAE open finance client case study to cite here, and we are not going to invent one. What we can say, from delivery experience on data-sharing and API-led programmes elsewhere in APAC, is that the organisations that struggle most with this kind of regime change are rarely missing legal advice - most large institutions get the legal memo. They are the ones where the legal memo and the engineering backlog never talk to each other on a recurring basis, so a licensing determination made in month one quietly stops matching what the product has become by month twelve.  

A roadmap review cadence that re-asks the Function and Substitution questions every time scope changes is a cheaper control than any after-the-fact remediation programme. Talk to us here! 

Conclusion 

Open finance in the UAE has moved, within the space of about a year, from a CBUAE circular that shaped how banks built APIs, to a named Licensed Financial Activity under a federal decree-law with its own licensing options, deemed-status rules, and a reconciliation deadline that - per current legal commentary - has already closed. That is the definition of a category, not a buzzword: a defined activity, a defined licence, a defined enforcement posture, and defined penalties for getting it wrong (fines ranging up to AED 1 billion for institutions and AED 500 million for unlicensed activity, per Gibson Dunn, 2025, and Hadef Partners, 2025). 

The practical implication for CDOs and CTOs - in the UAE now, and plausibly in other markets watching the UAE's approach - is that an open finance roadmap can no longer be signed off purely as a product and technology decision. It needs a licensing-perimeter review as a standing item, using a diagnostic that asks not just "is this a good product" but "which licence, if any, does this already require, and which track gets us there." 

If your organisation has open finance initiatives with any UAE mainland exposure - or is watching the UAE as a bellwether for how open finance regulation develops elsewhere - we'd welcome a conversation about where your roadmap currently sits against this perimeter, and what a licensing-aware review cadence could look like for your delivery teams. 

Frequently Asked Questions 

Is open finance now a licensed activity in the UAE? Yes. Federal Decree-Law No. 6 of 2025 explicitly lists "Open Finance Services" among the Licensed Financial Activities requiring CBUAE licensing, supervision and oversight (Addleshaw Goddard, 2025; CMS, 2025). 

Do banks and insurers need a new licence to offer open finance in the UAE? Existing CBUAE licensees, including banks, insurers, finance companies and payment service providers, are generally "deemed licensed" for open finance, but they must still formally notify the CBUAE and obtain approval before activating open finance capability (Pinsent Masons, 2025; Hadef Partners, 2024). 

What licence do fintechs and third-party providers need for open finance in the UAE? Entities that are not already CBUAE-licensed need to apply directly for a CBUAE Open Finance Licence, choosing Data Sharing, Service Initiation, or both, and meeting minimum capital and fit-and-proper requirements (Kayrouz & Associates, 2025; Hadef Partners, 2024). 

What is the difference between Article 61 and Article 62 of the new UAE Central Bank law for open finance? Article 61 names open finance services as a Licensed Financial Activity in the statute. Article 62 is a separate, broader provision that extends CBUAE's licensing test to anyone facilitating a licensed financial activity "regardless of the medium, technology, or form employed," which is relevant to technology providers supporting open finance infrastructure (CMS, 2025; Norton Rose Fulbright, 2025). 

Has the UAE's one-year transition deadline for the new Central Bank law passed? Legal commentary identifies the reconciliation deadline as approximately 16 September 2026, one year after the law's effective date, with the CBUAE able to extend it at its discretion. This research did not find independent confirmation of whether an extension has been granted, so organisations should verify current status directly with CBUAE guidance (White & Case, 2025; Gibson Dunn, 2025). 

Reference List 

Addleshaw Goddard (2025) CBUAE new 2025 law. Available at: https://www.addleshawgoddard.com/en/insights/insights-briefings/2025/financial-services/cbuae-new-2025-law/ (Accessed: 16 October 2026). 

Ashurst (2025) UAE enacts landmark Central Bank law. Available at: https://www.ashurst.com/en/insights/uae-enacts-landmark-central-bank-law/ (Accessed: 16 October 2026). 

CMS (2025) The new UAE Central Bank law: expanding the regulatory perimeter for a digital era. Available at: https://cms.law/en/are/legal-updates/the-new-uae-central-bank-law-expanding-the-regulatory-perimeter-for-a-digital-era (Accessed: 16 October 2026). 

Gibson Dunn (2025) UAE Central Bank issues new Central Bank law consolidating financial sector regulation. Available at: https://www.gibsondunn.com/uae-central-bank-issues-new-central-bank-law-consolidating-financial-sector-regulation/ (Accessed: 16 October 2026). 

Hadef Partners (2024) Open finance regulation. Available at: https://hadefpartners.com/news-insights/insights/open-finance-regulation/ (Accessed: 16 October 2026). 

Hadef Partners (2025) UAE introduces new Central Bank law 2025: key changes for licensed institutions. Available at: https://hadefpartners.com/news-insights/insights/uae-introduces-new-central-bank-law-2025-key-changes-for-licensed-institutions/ (Accessed: 16 October 2026). 

Kayrouz & Associates (2025) Open finance licensing UAE. Available at: https://www.kayrouzandassociates.com/insights/open-finance-licensing-uae (Accessed: 16 October 2026). 

Norton Rose Fulbright (2025) UAE ushers in new era of financial regulation with Central Bank law overhaul. Available at: https://www.nortonrosefulbright.com/en/knowledge/publications/757ebc41/uae-ushers-in-new-era-of-financial-regulation-with-central-bank-law-overhaul (Accessed: 16 October 2026). 

Pinsent Masons (2025) UAE open finance. Out-Law guide. Available at: https://www.pinsentmasons.com/out-law/guides/uae-open-finance (Accessed: 16 October 2026). 

Salaam Gateway (2026) 'ADIB rolls out open finance under UAE Central Bank framework', Salaam Gateway, 21 January. Available at: https://salaamgateway.com/story/adib-rolls-out-open-finance-under-uae-central-bank-framework (Accessed: 16 October 2026). 

White & Case (2025) UAE enacts the new CBUAE law which repeals and replaces the 2018 law. Available at: https://www.whitecase.com/insight-alert/uae-enacts-new-cbuae-law-which-repeals-and-replaces-2018-law (Accessed: 16 October 2026).