The UAE SME Customer Protection Regulation: why fintech partners are inside the perimeter

The Central Bank of the UAE rulebook lists the instrument as “Small to Medium Sized Enterprises (SME) – Customer Protection Regulation”, numbered C 2/2026. It was issued under Federal Decree-Law 6 of 2025 and took effect on 13 September 2026. It applies to banks and finance companies, and that includes Islamic institutions.

The definition of “customer” is an SME, and the definition expressly includes sole proprietors. That matters commercially. A one-person trading business is a customer entitled to the protections in the regulation, even though it would not usually be thought of as a consumer.

Article 3 sets the disclosure standard. Disclosure must be made in English and in Arabic, and it must be available on all channels, including digital ones. The text must be in plain language. It must also carry warnings on risks, fees, rates and locked terms.

For a product sold through an app, a portal or a partner interface, the digital channel is not an afterthought. A disclosure that appears in full in a branch but is abbreviated or absent in a digital onboarding journey sits uneasily with a requirement that applies across all channels.

Article 3 requires a Key Facts Statement, and the customer must acknowledge receipt of it before contracting. The sequencing is the point: acknowledgement comes first, and signature follows. Full and final terms must be given at the point of contracting. The Central Bank of the UAE has also required that there be no partial or biased pre-sale disclosure, which rules out presenting favourable features first and deferring the unfavourable ones.

In a distributed model, this turns the onboarding journey into a compliance artefact. The order of screens, the point at which the statement is shown, and the way acknowledgement is captured and stored are all matters that a contract between the bank and its partner should now address expressly.

Article 2 addresses the governance of product design and sale. The regulation is therefore not confined to what is said to the customer at the point of sale. It reaches how the product is designed and how it is sold, which is the territory in which a platform or fintech partner often has real influence.

The stated objectives also cover responsible financing, complaint redress and support for customers in financial difficulty. The detailed provisions that give effect to those objectives, including fees, arrears, data and complaints, should be checked in the full text and not assumed from the headings.

Definition 1.2 provides that the conduct of Authorised Agents is attributed to the bank. For a fintech or platform that distributes or white-labels a bank’s SME product, this is the central commercial point. If the partner presents the product, the partner’s disclosure failures are treated as the bank’s own.

The bank cannot outsource the regulatory consequence, so it will look to contract to pass the risk back. Expect flow-down of obligations on disclosure, journey design and complaints, together with indemnities for agent conduct. A partner that is asked to accept those terms should understand precisely what standard it is being held to, and whether it has the control over the journey needed to meet it.

The following is drafting advice, not a statement of what the regulation requires of any particular agreement. It should be checked against the full text of C 2/2026, including the provisions not covered here.

• Disclosure obligations, stated in terms of English and Arabic content, all channels including digital, plain language and warnings on risks, fees, rates and locked terms, with a clear allocation of who drafts and who approves.
• Journey and sequencing controls, so that the Key Facts Statement is shown and its receipt acknowledged before contracting, and the full and final terms are delivered at contracting, with records retained.
• An agent conduct standard, defining the partner’s duties and the bank’s approval, monitoring and audit rights, given that the bank is answerable for an Authorised Agent’s conduct.
• Indemnities for agent conduct, with caps and carve-outs tested against the bank’s regulatory exposure rather than the fees the partner earns.
• A regulatory change clause, covering complaints handling and any provisions confirmed on review of the full text, and stating who bears the cost of redesigning the journey and whether the partner may renegotiate or exit.