The United Arab Emirates is building one of the most ambitious open finance frameworks in the Middle East. Under the Central Bank of the UAE’s (CBUAE) Open Finance Regulation, requires banks, insurers and other licensees to share financial data under the customer’s explicit consent.
That regulation doesn’t operate in isolation. It forms part of the UAE’s wider digital-finance transformation alongside the live Aani instant-payments platform and the Digital Dirham initiative; the UAE completed its first pilot government financial transaction using Digital Dirham in November 2025.
This article explains how those three pieces (regulation, payments and CBDC) fit together, what figures back the project, and what it means in practice for banks and fintechs operating in the country.
What is the CBUAE’s Open Finance Regulation?
The CBUAE Open Finance Regulation (Circular 7/2023) was issued on 31 December 2023 and effective from 15 April 2024. A subsequent update in force, Circular 3/2025, was issued on 10 July 2025, and repeals and replaces Circular No. 7/2023.
Participation is mandatory for the categories of CBUAE licensee identified by the Regulation, for in-scope products and services and according to phased onboarding.
The legal perimeter follows CBUAE-regulated activities: activities regulated exclusively by the Dubai Financial Services Authority (DFSA) or Financial Services Regulatory Authority (FSRA) are outside that perimeter. Open banking generally concentrates on banking or payment-account data and associated payment initiation; UAE Open Finance extends permissioned access and service initiation across a wider range of financial products, including insurance.
The framework comprises a Trust Framework that vets participants (directory, digital certificates, an API portal and a certification sandbox), a common API Hub operated by Nebras Open Finance, and Common Infrastructural Services, including a Consent and Authorization Manager. Nebras operates the central infrastructure and administers applicable commercial and pricing arrangements under CBUAE-regulated standards. Full technical detail appears in the Open Finance Regulation on the CBUAE Rulebook, the primary regulatory source.
AlTareq is the UAE’s Open Finance initiative and participant- and customer-facing ecosystem, while Nebras operates the central platform. AlTareq supports financial-data sharing, comparable quote generation, service or transaction initiation, and onboarding to a new licensed institution using consented data. Reusable data may reduce repetition, but each receiving institution remains responsible for applicable customer due diligence and identity-verification obligations. These functions remain subject to the user’s explicit, informed consent and other applicable regulatory requirements.
Table 1. Timeline and infrastructure of the Open Finance Regulation
| Piece | Scope | Status |
| Phase 1 | Banks (including foreign bank branches) and insurance companies | First onboarding phase; Circular 3/2025 was issued on 10 July 2025 and is currently in force |
| Phase 2 | Other specified CBUAE licensee categories, for in-scope products and services (fintechs, exchange houses, payment providers) | Implementation date pending official CBUAE announcement |
| Nebras Open Finance | CBUAE subsidiary operating the centralised infrastructure and administering applicable commercial and pricing arrangements under CBUAE-regulated standards | Active |
| Al Tareq | UAE Open Finance initiative and participant- and customer-facing ecosystem; Nebras operates the central platform | Institution-reported milestones: ADCB/Pay10—first certified bank and first live transaction (Jul 2025); Commercial Bank of Dubai—full activation (Dec 2025); ADIB—first Islamic-bank implementation (Jan 2026) |
For institutions that need to build out their identity and consent layer ahead of Phase 2, Facephi details the UAE’s regulatory compliance requirements on its dedicated regional page.
The ecosystem in numbers: Aani, Al Tareq and the Digital Dirham
UAE open finance isn’t starting from zero. The country already runs Aani, the instant payments platform that Al Etihad Payments, the CBUAE’s own payments subsidiary, launched in October 2023.
As of Al Etihad Payments’ April 2026 update, Aani connects 74 licensed financial institutions and has surpassed 12.5 million users. Transactions complete in around three seconds, with an instant-transfer cap of AED 50,000 per transaction.
AlTareq, Aani and the Digital Dirham are separate but complementary initiatives within the UAE’s wider financial-infrastructure programme.. According to the CBUAE’s 2025 Annual Report, published on 9 April 2026, the platform is already active and the Digital Dirham has been completed as an official payment instrument, with the first government transactions already executed.
The Digital Dirham runs on its own timeline. In November 2025, the Ministry of Finance and Dubai Finance completed the first domestic government pilot transaction using Digital Dirham through a government payments platform they identified as mBridge. The CBUAE principally describes mBridge as a wholesale cross-border multi-CBDC platform; the Digital Dirham’s wider issuance platform and phased retail and wholesale rollout are separate. The BIS withdrew from mBridge in October 2024, describing this as a ‘graduation’, while also stating at the time that the platform was not mature enough to operate and remained years away.
Table 2. The UAE fintech ecosystem in numbers (data as of April 2026)
| Indicator | Figure | Source |
| Aani users | 12.5 million+ | Al Etihad Payments / CBUAE |
| Institutions connected to Aani | 74 | CBUAE |
| Transaction completion time | Around 3 seconds | CBUAE |
| Licensed Fintech companies | 36 | CBUAE 2025 Annual Report |
| Digital Dirham status | Official instrument and platform milestones completed and platform milestones completed; first government transactions executed; phased retail and wholesale rollout pending | CBUAE 2025 Annual Report |
The number the headline misses: broad reach, still bank-heavy
The headline is striking: 74 institutions and 12.5 million users connected to instant payments. The fine print qualifies that figure.
Those 74 institutions don’t contribute equally by entity type. Al Etihad Payments itself specifies that Aani is integrated with 85% of the country’s banks, but only 10% of exchange houses and 5% of digital wallets and finance companies. Penetration was therefore high among banks but remained limited among exchange houses, wallets and finance companies..
Those figures relate to Aani, the instant payments infrastructure, not to participation in the Open Finance frameworkf; the CBUAE does not publish an equivalent segment-penetration figure for Open Finance. Even so, it works as a reasonable indirect indicator: if the payments base that Al Tareq is built on is already bank-centric, and Phase 1 of the regulation itself is limited to banks and insurers, it’s reasonable to expect open finance to follow the same pattern in its early years of rollout.
For a fintech planning to operate in the UAE, this creates a preparation window: it can assess whether it falls within a category and onboarding phase covered by the Regulation and build the required identity, consent and connectivity capabilities before any notified obligation applies.
That window doesn’t apply to every licence or activity in the same way. The Regulation applies within CBUAE perimeter; activities regulated exclusively by the DFSA or FSRA are outside that perimeter. A firm connected with DIFC or ADGM needs should perform a licence-by-licence and activity-by-activity perimeter analysis before planning its connection.
This gap between formal coverage and real adoption isn’t unique to the UAE, but it is especially visible in a market that presents itself as a global open finance benchmark. The right reading isn’t that the project is failing, but that its most demanding phase (bringing non-bank players up to the same trust level as a licensed bank) is still ahead.
Table 3. Classic open banking versus the UAE’s open finance model
| Concept | Open banking (classic model) | Open finance (UAE model) |
| Data scope | Banking or paymentaccount data; scope varies by regime | Banking, insurance, payments and other financial services |
| Core function | Data sharing, payment initiation in established regimes | Sharing data, initiating transactions and initiating services |
| Participation | Mandatory access for specified payment accounts in the EU (PSD2) and UK (CMA Order); varies elsewhere | Mandatory for specified CBUAE licensee categories, for in-scope products and services and according to phased onboarding |
| Governance | Institution-hosted interfaces, often under common standards and directory arrangements | Trust Framework + centralised API Hub + Common Infrastructural Services; Nebras operates the central platform under CBUAE-regulated standards |
A pattern that repeats outside the UAE: open data tied to instant payments
The UAE is not the only market developing open-finance policy during the rollout of an instant-payments infrastructure. In Canada, proposed Consumer-Driven Banking framework was pre-published in 2026 and the Payments Canada scheduled theReal-Time Rail for the fourth quarter of 2026.
The difference is in the starting point. The UAE already had Aani running before completing its Open Finance regulation, whileCanada developed its Consumer-Driven-Banking rules and Real-Time Rail during overlapping periods, as explained in the equivalent open banking and real-time payments process in Canada. That sequencing (payments first, data regulation second) from the analytical comparison gives the UAE a potential deployment edge over markets that regulate and build infrastructure at the same time.
The identity challenges for banks and fintechs in the UAE
A shared-data framework between banks, insurers and fintechs only works if the identity of whoever authorises each operation can be verified reliably. The CBUAE has already moved on this: Notice 2025/3057 bans SMS OTP, email OTP and static passwords as standalone financial authentication methods, with 31 March 2026 as the compliance deadline. Banks’ liability for 3D Secure fraud via SMS OTP had already shifted onto the institutions themselves from July 2025, ahead of that deadline.
Table 4. Identity pains in an open finance ecosystem
| Pain | Why it matters | What it requires |
| Strong authentication without relying on SMS/email OTPs or static credentials as the sole method | Notice 2025/3057 sets 31 March 2026 as the deadline to stop using SMS OTP, email OTP and static passwords on their own | Implementations may include device-bound or app-based controls, biometrics with liveness detection, FIDO2 passkeys |
| Cross-sector remote onboarding | Open finance increases permissioned data-sharing and onboarding interactions across institutions | Document and biometric verification aligned with the National KYC Platform |
| Auditable consent | The regulation requires auditable consent records for data sharing and service initiation | Auditable records of consent, authentication and relevant risk or identity decision |
Facephi offers identity verification and biometric authentication capabilities that may support stronger-authentication and remote-onboarding controls and aligned with Open Finance and AML/CFT obligations, including the SMS OTP replacement required by CBUAE Notice 2025/3057.
“The introduction of Open Finance Regulation establishes global standards for open finance and accelerates the adoption of digital financial services.”
— Khaled Mohamed Balama, Governor of the CBUAE
Frequently asked questions about Open Finance in the UAE
It is the framework originally issued under Circular No. 7/2023 and repealed and replaced by Circular No. 03/2025.It requires specified CBUAE licensee categories to participate, for in-scope products and services and according to phased onboarding, and supports consent-based data sharing and service initiation. The framework comprises a Trust Framework, central API Hub and Common Infrastructural Services operated by Nebras under CBUAE-regulated standards and AlTareq which is the UAE Open Finance initiative and ecosystem name.
Open banking generally concentrates on banking or payment-account data and associated payment initiation. UAE open finance extends that scope to insurance, payments and other financial services, and adds the ability to initiate transactions and services directly, not just view them.
It’s the UAE Central Bank subsidiary that operates the centralised Open Finance infrastructure, including API Hub and the shared open finance services: Nebras administers applicable commercial and pricing arrangements under CBUAE-regulated standards.
It’s the consent, authentication and user-experience layer for Open Finance in the UAE.. ADCB was the first certified bank, in July 2025 in partnership with payments provider Pay10; Commercial Bank of Dubai, with full activation, and ADIB, the first Islamic bank to implement it, have since joined.
Aani and AlTareq are complementary initiatives within the UAE’s broader financial-infrastructure transformation. Aani enables instant domestic payments, while AlTareq enables regulated, consent-based financial-data sharing and service initiation.
The CBUAE completed important Digital Dirham platform and official-instrument milestones, and the Ministry of Finance and Dubai Finance completed the first UAE government pilot transaction using Digital Dirham in November 2025.
They should first assess whether each relevant activity and licence falls within the CBUAE’s perimeter, activities regulated exclusively by the DFSA or FSRA are outside that perimeter., and then build an auditable identity verification and consent layer aligned with Notice 2025/3057, the National KYC Platform and the CBUAE’s traceability requirements, before Phase 2 of Cpen Finance forces them to connect.
