Skip to content 
As global demand for digital finance grows, the DIFC (Dubai International Financial Centre) has become a strategic hub for companies launching AISP (Account Information Service Provider) and PISP (Payment Initiation Service Provider) operations. These licensing models are built around “open banking” frameworks that allow firms to securely access customer account data and initiate transactions on their behalf.
Because DIFC falls under the Dubai Financial Services Authority (DFSA), fintech companies benefit from a trusted and predictable regulatory environment. In particular, the DFSA defines license categories clearly and outlines application steps transparently. As a result, startups and scale-ups can enter the market faster and with full compliance.
Unlike many other regions, DIFC offers 100% foreign ownership, zero corporate tax, and access to a supportive legal system based on English common law. This makes it especially attractive to companies in the payment and data services space.
Moreover, the DIFC’s licensing framework is purpose-built for innovation. AISP and PISP applicants can choose from specific DFSA categories, and the process has been optimized for quick approvals. For companies seeking fast growth without sacrificing compliance, this combination of speed, structure, and credibility gives DIFC a clear advantage. Learn more in our guide to financial licensing in the UAE.
Regulators in major hubs have responded by designing licensing regimes that allow these activities to take place. They focus on data security, consumer protection, and operational integrity. One of the most prominent destinations for such models is the Dubai International Financial Centre (DIFC). The DIFC operates under the Dubai Financial Services Authority (DFSA).It’s designed specifically for AISPs and PISPs. The region offers a clear licensing path, common law protection, world-class infrastructure, and a strong reputational drive toward innovation — all without compromising compliance.
Why set up AISP or PISP licensing in the DIFC?
DIFC operates under the Dubai Financial Services Authority (DFSA), a respected regulator known for its transparent structure. The DFSA offers clearly defined licensing categories and well-documented application steps. This helps new fintech firms launch quickly while staying compliant.
In addition, DIFC applies common law principles and offers zero tax on corporate income and personal earnings. The result is a streamlined business environment without unnecessary legal or tax burdens.
This guide explains how to launch an AISP or PISP under the DFSA in the DIFC, how open banking fits into existing license categories, and what fintech startups need to know before applying.
Strategic advantages for fintech startups
DIFC is home to the DIFC Fintech Hive, one of the top accelerators in the region. New companies get access to investors, mentors, and a supportive innovation ecosystem. There are also coworking spaces and legal support for startups. Furthermore, Dubai’s location bridges Asia, Europe, and Africa. This means faster access to key markets, both emerging and established.
The DFSA stands as the DIFC’s independent regulator. Known for a risk-based approach, it has historically attracted wealth managers, fund operators, and other regulated financial institutions. Over the last decade, however, the DFSA has also set specific categories for money services businesses that can handle advanced payment or data-sharing roles. Two of the main open banking activities, account information services and payment initiation, now fall under “Arranging and Advising on Money Services,” though the DFSA places them in the broader bracket of “money services business.” AISPs typically rely on “read-only” access to user financial data from banks or other lenders, while PISPs can go one step further, using “write” access to make payments or transfers on behalf of their clients. This interplay of data gathering and transaction facilitation forms the backbone of modern open banking solutions.
AISP and PISP explained
An AISP is a firm that collects financial account information from multiple institutions, consolidates it, and presents it in a unified interface, often including data analysis, budgeting, or spending insights. For consumers, it means seeing all bank balances, credit card debts, or mortgage obligations in one place, removing the headache of juggling separate websites or logins. For small enterprises, AISPs can compile real-time views of cash flow across different banks, enabling better financial planning. In advanced markets, AISPs also feed data to lenders who might offer quick or more personalized loan terms once they see real transaction history. However, AISPs do not themselves transmit money or hold user funds. They only retrieve and display data with the user’s consent.
PISPs, on the other hand, take that “read” function of an AISP and add “write” permissions, letting them initiate payments from a user’s bank account or e-wallet. Instead of paying a merchant by card or separate bank transfer, users can pay directly from their account via the PISP. Some PISPs tie into e-commerce platforms, triggering real-time bank transfers that do not require a card intermediary. Others might automate recurring payments, such as direct debits or systematic contributions to a savings or investment plan. While a PISP never fully holds user funds (the money is in the bank or e-wallet), it uses secure connections to initiate transactions in line with user instructions. This open banking approach can reduce friction, speed up settlement, and lower fees for both merchants and consumers, compared to older payment rails.
The DFSA’s approach to licensing
Under DFSA guidelines, open banking activities like AIS or PIS typically come under Arranging and Advising on Money Services. Because these providers do not hold user funds, they have fewer prudential or solvency risks than an entity that issues e-money or takes deposits. However, the DFSA views the data management aspects as crucial. AISPs and PISPs must prove robust cybersecurity, data privacy, and anti-money laundering controls. The DFSA lumps this set of activities under a broad category of money service business, but the licence specifically outlines what an AISP or PISP can and cannot do.
Another distinction is that AISPs or PISPs do not necessarily need the capital or overhead demanded by a stored value or e-money issuer, known as Category 3C or 3D. If the firm purely provides read-only or read-write account access (without issuing or storing funds), it typically falls in a lower capital bracket, at times around 10,000 US dollars base capital. The DFSA also calculates expense-based capital, selecting whichever figure is higher. In many cases, for small open banking platforms with modest overhead, 6/52 of projected annual expenses might be the binding figure. The DFSA encourages innovative fintechs to possibly use the Innovation Testing Licence if the business model is unproven, letting them test solutions with real clients under restricted terms before a full-scale licence is granted.
Our working hours: Monday to Friday, 9 AM – 6 PM GMT+4
Differentiating from other money services
Payment services in the DIFC can be varied. Some operators handle “money transmission,” akin to a traditional remittance business. Others “operate payment accounts” by letting customers hold multi-currency balances. Still others “issue stored value” akin to prepaid cards. AISPs and PISPs remain distinct, in that they rely on open banking protocols to access user data or initiate payments from external accounts rather than holding the funds themselves. If your aim is to create an aggregator platform that helps SMEs monitor multiple bank accounts in real time, you are an AISP. If you also want to trigger payments from those accounts, you become a PISP. Neither business model requires you to store the money, so you avoid certain capital or liquidity obligations that e-money issuers face.
That said, the DFSA carefully inspects the scope of your planned services, clarifying whether your firm might inadvertently store user funds or keep a running balance for them. In that scenario, you no longer fall under the simpler category for AISPs or PISPs. Instead, you might need a Category 3C or 3D licence for stored value or payment accounts, along with a higher base capital threshold.
"The DFSA’s case-by-case approach means you should be transparent in your regulatory business plan about precisely how you handle user data, how you connect to banks, and whether you hold or pass through funds."
A path to advanced fintech: Combining AISP or PISP with the innovation testing licence
Because open banking is relatively new in the region, the DFSA often encourages startups to consider the Innovation Testing Licence (ITL). This is a regulatory sandbox letting fintech entrepreneurs test solutions with real clients under limited conditions, for about 12 months or so, before going for a full licence. AISPs or PISPs that want to refine an advanced user interface or explore cross-border data retrieval might benefit from this approach. If the sandbox trial is successful, they can “graduate,” obtaining permanent authorization in the DIFC. This two-step route fosters an environment where risk is controlled, user feedback is integrated, and the DFSA can watch how effectively the platform manages data privacy and AML checks.
While the ITL does not remove all regulations, it can lighten certain burdens, letting a startup prove the concept with smaller capital demands. Then, once the firm has user traction and stable processes, a full application can proceed, typically with less friction because the DFSA is already familiar with the solution. This synergy helps maintain high standards while not stifling creativity, something that has led many global fintech watchers to see the DIFC as a prime hub for open banking developments.
Staffing and organizational requirements
Even if your business does not hold client funds, the DFSA wants a robust governance structure. The basic framework includes:
- A non-executive chair of the board, ensuring objective oversight
- A senior executive officer (SEO) with over 10 years of finance or banking experience, residing in the UAE
- A compliance officer (CO), also fulfilling the money-laundering reporting officer (MLRO) role if the scale is small, with at least a decade in compliance and ordinary residence in the UAE
- A finance officer, who can be part of the parent company if the group is recognized, or outsourced if necessary
- A risk officer (potentially outsourced), especially if the project expects large transaction volumes or complex data flows
- An internal auditor, typically outsourced to a professional firm
- An external auditor from the DFSA’s recognized list
Although the DFSA is open to outsourcing certain tasks, it insists that the AISP or PISP itself retains ultimate accountability. The management team must be well-versed in relevant local laws, including AML regulations, data protection, and any additional requirements for open banking connectivity. Because the region is still maturing in open banking frameworks, the regulator may also request special attestation about how you handle user credentials or store sensitive financial data retrieved from external banks.
Get the most relevant information about business life in Dubai
Calculation of capital: The final figure
The DFSA looks at three types of capital: base capital, expense-based capital, and risk-based capital. For an AISP or PISP, base capital might be just 10,000 US dollars, but if the forecasted annual expense is large, 6/52 of that figure might overshadow the 10,000 sum, so the final capital could be tens of thousands of dollars. The regulator also weighs the scale of data your business handles, the potential for reputational or operational risks, and the feasibility of your business model. Hence, thorough financial projections that track staff costs, marketing budgets, technology spending, and compliance overhead are essential to demonstrate your readiness.
In case your firm is a branch of a recognized foreign institution, the DFSA can consider capital waivers if the head office is in a strong jurisdiction and can guarantee support. This approach can reduce local capital demands, though the DFSA will want evidence of a healthy parent track record and stable liquidity in the group. The final figure emerges after the DFSA reviews your regulatory business plan, KYC data for owners, and any external references or group financial statements.
"Base capital requirements for AISPs and PISPs start from as low as $10,000, with final figures depending on forecasted expenses and business risk, making it accessible to early-stage fintech startups."
Can DIFC-licensed AISPs or PISPs serve the broader UAE?
Yes, they can. Under Law No. (5) of 2021, DIFC-based companies can provide services outside the free zone, as long as their primary operations originate from the DIFC premises. This means your open banking solution can sign up customers all over the UAE, though marketing or direct selling might remain subject to certain guidelines.
The important point is that you can supply the service (like an aggregator app or payment initiation portal) to individuals or businesses based in Dubai’s mainland or beyond. If you need to actively market or distribute certain services, you must ensure your approach respects local customs and additional laws, but the fundamental ability to service broader markets remains intact. For cross-border expansions, you might face further regulatory checks in other countries, but at least the base in DIFC can anchor your global footprint.
The application process at a glance
- Introductory talk with DIFC and DFSA, clarifying which category is suitable for AIS or PIS.
- Draft a regulatory business plan, describing the user journey, data flows, AML procedures, and financial projections.
- The DFSA reviews a near-final version, offering feedback.
- Compile the formal application with policies, KYC forms for key personnel, and board details.
- The DFSA checks completeness, then undertakes a detailed assessment over 60–90 days, sending queries or scheduling interviews.
- On success, the DFSA issues an in-principle approval. You proceed to incorporate a DIFC entity, open a bank account, deposit capital, finalize auditors, and secure insurance.
- A final submission leads to the DFSA awarding your financial service permissions, letting you operate from the DIFC.
During these steps, you also pick an office space in the DIFC. Costs can vary, from the business centre at roughly 35,000 US dollars per year for two desks, to larger premises for bigger teams. Once licensed, you can sponsor staff visas, typically at 1,500 US dollars each plus deposit fees, and hire local or international experts to refine your open banking platform.
-
The DIFC Innovation Testing Licence (ITL) provides a sandbox environment for new AISP or PISP platforms to trial services with real clients before applying for a full licence.
-
The licensing process typically takes 60–90 days after submission, involving meetings with DFSA, regulatory business plan drafting, due diligence, and final approval following incorporation and capital deposit.
-
Staffing must meet DFSA standards, including a UAE-based senior executive, compliance officer, and auditor, though some roles can be outsourced to qualified third parties.
Why choose the DIFC approach?
Open banking is steadily transforming how people and businesses engage with their financial data. The region still has enormous room to expand, with only about one-third of retail transactions made digitally. Many local banks have begun to experiment with open APIs, and tech-savvy customers appreciate the convenience of aggregator apps or frictionless payments. By licensing in the DIFC, an AISP or PISP can project trust and reliability, essential in a market where consumer data privacy is paramount.
Moreover, the DIFC’s robust ecosystem, housing leading banks, asset managers, and fintech specialists, can promote partnerships. An AISP that aggregates SME accounts might ally with a local bank for faster-lending decisions. A PISP focusing on direct e-commerce checkouts could link with major local retailers that also have a presence in DIFC. Over time, the synergy from co-location, networking events, and potential co-investment can help an open banking platform scale quickly.
