Key takeaways
- Any business in the UAE offering one or more of the nine retail payment services (under RPSCS) or running a card scheme must hold the relevant license from CBUAE, unless clearly exempt.
- Capital and governance requirements scale with service scope and transaction volumes — exceeding AED 10 million monthly average for three consecutive months triggers higher capital obligations.
- Robust compliance, risk-management, cybersecurity & AML/CFT are not optional; these are core ongoing obligations that influence both application success and license retention.
- Overlapping regulation is increasingly relevant — payment token services, virtual assets regulation (VARA), payment-infrastructure rules (LVPS/RPS), and other regimes may also apply. mapping all applicable regimes early reduces risk.
UAE’s introduction of the RPSCS license
If you run or plan to run a fintech, payments company, money-transfer operator, or any business dealing in digital payments in the UAE, the RPSCS license from the central bank (CBUAE) can no longer be optional.
With rising expectations around regulation, consumer protection and global financial integrity, this license sets the standard. It’s the gateway to wider business setup in Dubai, integrating with crypto, offshore banking, and building credibility.
The official introduction
The Retail Payment Services and Card Schemes Regulation (RPSCS) was introduced in 2021, coming into effect mid-year, to formalise how payment service providers (PSPs) and card schemes operate in the UAE.
Previously many digital payment activities operated under lighter or ambiguous oversight. Now the license defines what is permissible, what oversight is required, and what obligations come with being licensed.
In this post, we’ll walk you through what the license is, who needs it, how to apply, what ongoing duties you’ll have, what it costs (in time & money), the risks if you get it wrong — plus how it ties into crypto, offshore and broader business setup in Dubai.
What is the RPSCS license (Retail Payment Services & Card Schemes Regulation)?
The RPSCS license is the regulatory framework by the central bank of the UAE (CBUAE) covering retail payment services and card schemes, divided into 4 licensing categories.
It sets out rules and conditions for anyone providing certain kinds of payment services or operating a card scheme. Non-licensed activity (unless exempt) is prohibited under the regulation.
Retail Payment Services
‘Retail payment services’ include digital payment services such as issuing payment accounts, payment instruments, merchant acquiring, aggregation, fund transfers (both domestic and cross-border), payment token services, payment initiation, and payment account information services.
Card Schemes
Card schemes (i.e. networks or infrastructure enabling card-based transactions) also fall under the license.
The regulation also empowers CBUAE to regulate fees & charges of card schemes, to impose reporting and supervisory obligations, to require contractual arrangements among different PSPs (for example, those issuing payment accounts vs. those initiating payments), and to ensure consumer rights and safety.
Who needs the license — who is exempt?
If your business does any of the activities listed under the RPSCS regime, you’ll probably need the license. key types include:
- Fintechs issuing digital wallets or payment accounts.
- Companies issuing payment instruments (cards, tokens etc.)
- Merchant acquiring services (i.e., enabling merchants to accept payments).
- Providers of domestic & cross-border transfer services.
- Providers of payment initiation or account info services
Exemptions/special cases
- licensed banks under CBUAE generally have certain activities covered, though may still need to notify or seek additional approvals for retail payment services.
- Some entities already in operation under older regimes got a transitional period back when the regulation launched (one year) to align and apply for the license.
It’s important to check whether your intended service is explicitly listed among the nine categories, and whether you fall under any exempt status. if not, operating without a license exposes you to legal risk, fines, and closure orders.
Our working hours: Monday to Friday, 9 AM – 6 PM GMT+4
The nine categories of Retail Payment Services
These are the payment services that trigger licensing under RPSCS. Each comes with its own risk profile, compliance expectations, and operational implications.
Understanding which ones you’ll offer is crucial for selecting the right license category and preparing your application.
- Payment account issuance services — providing accounts for receipt, holding, and use of funds.
- Payment instrument issuance services — cards, tokens, or other instruments enabling payments.
- Merchant acquiring services — enabling merchants to accept payments from customers.
- Payment aggregation services — collecting payments on behalf of multiple merchants or users.
- Domestic & cross-border fund transfer services — moving money within UAE, or internationally.
- Payment token services — digital tokens used for payments (not limited to physical cards).
- Payment initiation services — initiating payments at user request.
- Payment account information services — access to account details for payments or reporting etc.
- Card schemes — the rules, infrastructure, and networks for card based payments (e.g. debit/credit etc.)
Each service adds complexity. For example, cross-border transfers or payment token services often demand stronger governance, risk-management, tech & security requirements.
license categories & capital requirements: how to choose?
Once you know which services you will provide, you need to select the category of license and ensure your capital meets the required threshold.
- The regulation doesn’t use “category I, II, III” explicitly in all documents, but CBUAE has defined tiers/risk levels depending on the scale of transactions, the nature of services, whether cross-border, etc. This affects initial capital, ongoing capital, and other obligations.
- Article 7 of RPSCS sets out that PSPs must hold and maintain aggregate capital funds not less than the minimum initial capital according to their license category. Capital can include paid-up capital, reserves, retained earnings; deductions for losses or goodwill apply.
- There is a threshold: If the monthly average value of payment transactions (over prior three months, or using projected business plan if new) exceeds AED 10 million for three consecutive months, the higher capital requirements kick in.
"Choosing the right category means balancing ambition vs what you can deliver in governance, capital, reporting. many businesses mis-estimate transaction volumes and end up under-capitalised."
How to apply for RPSCS license: The step-by-step process
Getting the license is procedural but detailed. preparing well dramatically increases chances.
Here’s a typical roadmap:
- Establish a legal entity/ensure the company setup aligns with CBUAE’s acceptable forms.
- Define exactly which retail payment services & card schemes your entity will offer (from the nine). This clarifies license category, capital, tech & risk demands.
- Prepare business plan & financial projections (especially transaction volumes over first 12-24 months), etc.
- Set up governance & compliance framework: board structure; fit & proper persons; risk management; AML/CFT policies, cybersecurity & IT security; internal controls.
- Ensure contractual arrangements if you will use other payment account issuers or involve account information/initiation services.
- Apply to CBUAE with required documents (forms, proof of capital, tech security, compliance manuals etc.).
- Wait for regulatory review: CBUAE assesses the risk, the compliance, the readiness. timelines can vary depending on complexity.
Typical timeline is several weeks to months after filing everything correctly. Unrealistic expectations about speed or missing documentation often delay things.
Ongoing obligations & compliance
Once you have the RPSCS license, you must meet ongoing regulatory obligations. These are not trivial, and non-compliance can lead to heavy fines or loss of license.
- Maintain approved levels of capital funds; if your transaction volumes increase (e.g. exceeding AED 10 million monthly in avg for three consecutive months), you must meet higher capital requirements.
- Corporate governance: transparent lines of responsibility, conflict-of-interest policies, clear board oversight, senior management that meets “fit & proper” criteria.
- Risk management/cybersecurity/tech security; robust internal controls; audit trails; disaster recovery, data protection etc.
- AML/CFT (anti-money laundering / counter financing of terrorism) and KYC obligations.
- Reporting obligations: regular reports to CBUAE about transactions, performance, fees & charges (especially for card schemes).
- Consumer protection: transparency, disclosure of fees & charges; mechanisms to handle disputes; ensuring users’ funds are protected etc.
- If participating in the Wages Protection System (WPS) distribution or access, additional requirements apply.
Benefits for your business
Holding the RPSCS license brings several advantages, especially in the context of business setup in Dubai, crypto license in the UAE, offshore banking etc.
- Regulatory legitimacy & trust: Partners, investors, other financial institutions will treat you more seriously once you’re licensed.
- Ability to scale: Once you satisfy obligations, you can offer more services, enter cross-border corridors, expand transaction volumes. For fintechs and crypto-adjacent companies this is crucial.
- Competitive advantage: Many clients prefer licensed PSPs for reliability, protection, risk mitigation.
- Synergies with other licenses: If you are also seeking a crypto license in Dubai, virtual asset license, or dealing with tokens, this RPSCS license may be complementary (identifying service overlaps, shared compliance etc.).
- Alignment with offshore banking & financial services: Once you have robust regulatory standing, integration with international payment networks, offshore operations, correspondent banking becomes more feasible.
Get the most relevant information about business life in Dubai
Case study: Instant cash
Instant cash, a FINTX company under Emirates Post Group, became the first money transfer operator (MTO) in the UAE to receive the RPSCS license under category 2.
This allowed them to expand beyond just remittances: to offer local and cross-border transfers under the license, build trust with partners, invest in technology such as open API platforms, target medium-small partners globally.
Their story shows that if you plan properly, the license can help convert a payments-oriented business into a broader fintech player.
Common pitfalls & what to avoid
Many businesses underestimate what’s needed. Here are things that trip people up:
- Unclear scope of services: Mixing categories without recognising the additional obligations (e.g., launching payment initiation alongside fund transfers).
- Wrong estimation of transaction volumes: Under-projections lead to capital shortfalls when thresholds are crossed.
- Weak governance or compliance framework: Missing board oversight, poor risk policies, weak cybersecurity,
- Delayed or incomplete documentation: Regulatory expectations are strict.
- Ignoring local laws & other regulatory bodies: Overlapping regulation with VARA (for virtual assets), free zones, cross-border laws.
- Thinking license is “once-and-done”: Ongoing reporting, auditing, adapting to new requirements, evolving risk profiles.
Key challenges & strategies for operating under RPSCS
license or not, there are several challenges businesses face under the RPSCS regime. Knowing them early lets you plan better. Here are some of the more common ones, plus what you can do about them.
Challenge: Compliance cost / technical capability
Setting up AML/CFT systems; cybersecurity; risk-management; fit & proper governance; technology resilience etc. demand specialised skills, oversight, and investment.
Smaller fintechs or startups often underestimate how much resource is needed to maintain compliance beyond license issue.
Strategy
Partner early with compliance consultants or legal firms that specialise in UAE fintech.
Build your tech stack with security standards baked in (e.g. ISO27001 or equivalent), robust internal audit, incident response plans, clear data protection on service-providers.
Plan budget for ongoing external audits / third-party reviews.
Challenge: Talent & expertise
Finding people who understand UAE regulation, payment systems, compliance, digital tokens, cross-border transfers is non-trivial. Demand is high, supply is limited.
Strategy
Consider hiring or working with international teams experienced in similar regimes (EU PSD2, UK payment services regulation), training internal staff, or using specialist contractors.
"Using global best practices can help speed regulatory review since you can show precedent of compliance."
Challenge: Evolving regulatory convergence & overlap
With new payment system regulations, related regimes like payment tokens regulation, sandbox regulation, and virtual asset regulation (VARA etc.), there’s overlap.
Some services under RPSCS may also be separately regulated under token rules or virtual asset rules in free zones or under VARA.
Not accounting for overlaps can cause double reporting, divergent compliance obligations, or delays.
Strategy
Map all regulatory touchpoints early. When designing services, check which regimes apply.
Engage with regulators/legal counsel to clarify overlaps. Possibly design modular compliance architecture so you can adapt to multiple regulatory rules without redoing everything.
Challenge: Meeting thresholds and capital requirements
As you grow transaction volumes – especially cross-border or token-based ones – you may cross thresholds (e.g. AED 10 million monthly average) that trigger stricter capital or governance standards.
Some firms find themselves with license category that becomes under-capitalised or lacking in risk controls as they scale.
Strategy
Build realistic financial models from day one. Project volumes and services growth over 12-24 months.
Cushion capital beyond the minimum so you can absorb growth or delays.
Challenge: Speed of application & regulatory review delays
Many applicants stall because of incomplete documentation, unclear service definitions, weak risk or governance structures. Even after filing, regulators will often ask follow-ups.
Strategy
Prepare thoroughly. Have business plan, projected service mix, tech and security architecture, compliance manuals, board and management structure set out in advance.
Engage with regulator/legal advisors in pre-application review if possible. And ensure document quality (clear, professional) to reduce back-and-forth.
Timeline & cost expectations
While exact cost depends heavily on your scale, category and services, here’s what you should budget in terms of time & cost:
- Preparation (defining services, governance, business plan, entity setup): 1-3 months (depending on readiness)
- Submission & regulatory review: A few weeks to several months, depending on complexity and whether documents are complete
- Adjustments/queries from reguator: Can add extra time if gaps are found
Costs include: Initial capital requirement (which depends on license category and transaction volume), legal & consultancy costs, tech & compliance infrastructure, audit and risk functions, ongoing operational compliance.
Looking ahead: Regulatory trends & what to watch
As payments go more global and tech-intensive, regulation will tighten. Particularly:
- How virtual asset regulation (including crypto license in Dubai) and tokenised payment services are integrated; overlap with VARA regulation etc.
- Increasing transparency requirements for fees, charges, transaction reporting.
- More expectations around cybersecurity, data protection, privacy (especially international data flows).
- Possible updates to threshold values, enforcement regimes, penalties.
Businesses that build for compliance from the start will have less friction later as requirements evolve.
- RPSCS license is mandatory for most payment-related businesses in the UAE.
- Covers 9 categories of retail payment services + card schemes.
- Correct license category depends on services and transaction volumes.
- Strong governance, compliance, and capital are non-negotiable.
- Non-compliance risks fines, license loss, or business closure.
Conclusion
The CBUAE Retail Payment Services & Card Schemes license is both a regulatory necessity and a strategic asset.
For high net worth founders, fintech firms, or enterprises aiming to operate in digital payments or build overlapping capabilities (crypto, offshore banking, payment tokens etc.), this license can be the foundation of credibility and growth.
If you are considering business setup in Dubai, looking at a crypto license in the UAE, or want to use this license to enhance offerings and trust, planning meticulously is key: define your service mix clearly, ensure compliance & risk frameworks are strong, capital is sufficient, and document the whole governance chain.
Ready to take the next step? Aston can guide you through business setup in Dubai, integrating offshore banking, or exploring a crypto license in the UAE — contact us for a tailored roadmap that fits your ambitions.
