Stored value facility licence in the UAE: wallets and card apps

When a wallet or prepaid card app needs the CBUAE's stored value facility licence: who needs it, capital, safeguarding the float, the licensing steps and the free zones.

· Head of IT
· 6 min read
A phone showing a dirham wallet, with a teal glass dollar coin, a gold coin and ledger and shield blocks

A wallet in which customers keep a balance to spend later, or a prepaid card, is a stored value facility (SVF) in UAE law. The Central Bank of the UAE (CBUAE) licenses it under the Stored Value Facilities (SVF) Regulation, Circular No. 6/2020, which the CBUAE Rulebook shows in force since 30 October 2020.

This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply. UAE rules change often, so each rule below carries the version and date its regulator shows.

What an SVF is in law

An SVF is a facility, other than cash, into which a customer pays money in return for two things: the value is stored, and the issuer undertakes to pay for goods and services, or to pay another person, when the customer uses it. It can sit on a card or device, or in a network account such as a mobile wallet. The money customers pay in is the float.

The CBUAE law, Federal Decree-Law No. (6) of 2025 (in force since 16 September 2025), lists stored value services among licensed financial activities (Article 61(1)(g)), and regulations made under the old law stay in force until replaced (Article 183).

Not every balance needs a licence. A single-purpose facility, such as a closed-loop store card, is outside it. On application the CBUAE may exempt cash reward and bonus point schemes, digital content bought through a device, schemes limited to a group of merchants, and pilots with a float of at most AED 500,000 and no more than 100 customers, tested in its FinTech Office sandbox (Article 2).

Crypto top-ups are a separate case. The Payment Token Services Regulation (Circular No. 2/2024, in force since 31 August 2024) provides that the SVF Regulation stops applying to crypto-assets and virtual assets once its transition period ends: one calendar year from commencement, which the CBUAE may extend (Articles 39 and 40).

Who needs it, and where

Anyone issuing or operating an SVF in the UAE outside the financial free zones. The applicant must be a UAE company, free zones included, financial free zones excluded (Article 3). Banks are treated as licensed, but must notify the CBUAE and receive a letter of no objection before starting (Article 4). Firms regulated in DIFC or ADGM may run SVF business onshore only with a CBUAE licence.

An unlicensed issuer abroad may not invite the UAE public to use its facility. The CBUAE judges each case on factors such as pricing in dirhams, an Arabic website, a UAE domain, local top-up channels and marketing aimed at UAE residents.

What the licence asks for

Capital

Article 7 requires paid-up capital of at least AED 15,000,000, and aggregate capital funds of at least 5% of the float. With the application comes an unconditional bank guarantee for the full paid-up capital in favour of the CBUAE. You must also hold enough to wind down in an orderly way, refunds included, and the CBUAE may ask for more.

Safeguarding the float

Article 11 asks for:

  • the float in segregated accounts with licensed banks, or a foreign bank the CBUAE recognises, protected from your creditors; a bank guarantee or insurance can be used instead;

  • the same protection for money received but not yet credited, or deducted but not yet paid out;

  • reconciliation of the float with your ledger at least daily;

  • enough funds to redeem every customer and to cover the cost of doing so;

  • liquidity first: investment returns may not be a significant source of income, assets other than cash and deposits need the CBUAE's prior consent, and currency mismatches are limited to dirhams and US dollars unless exempted.

People, governance and substance

Issuing SVF must be your principal business. The CBUAE approves your chief executive, directors and controlling shareholders. The chief executive and alternate must be ordinarily resident in the UAE, and senior management and key operational, risk and compliance staff based there (Article 8). Compliance and internal audit are separate functions (Article 9). Customer data is stored in the UAE and kept for five years (Article 10).

Conduct, AML and technology

You set a maximum balance for each type of account in your operating rules; the CBUAE sets no hard limit but may require changes. You bear losses from unauthorised transactions where the customer is not at fault, and keep a business exit plan, reviewed yearly (Article 13). AML needs a compliance officer, an MLRO and suspicious transaction reports to the Financial Intelligence Unit; digital onboarding to the banks' eKYC standard is accepted (Article 14). Article 12 sets technology, cyber and payment security controls, and every outsourcing needs the CBUAE's approval (Article 8).

The licensing steps

  1. Meet the CBUAE to discuss your business plan; it strongly encourages this.

  2. File the application with the documents in the Annex, including a three-year business plan, float and investment policies, operating rules, customer terms and AML policies.

  3. Add an independent assessment of seven areas: governance and risk, float management, technology risk, payment security, business continuity, conduct and customer protection, and AML. It must be no more than six months old.

  4. The CBUAE may meet your board and consult your group's home regulator. An incomplete file is treated as a draft; one suspended for six months or more generally needs a new application.

  5. On approval, the CBUAE issues a licence, possibly with conditions, and a reference number you show on your website and marketing.

The CBUAE's licensing page adds that an in-principle approval comes first, with one year to meet its conditions. No processing time is published.

How it fits with the other regimes

  • Payment services. The Retail Payment Services and Card Schemes Regulation (Circular No. 15/2021, in force since 6 June 2021) excludes SVF transactions, and its payment accounts may hold money only in transit. If customers keep a balance, you are in SVF territory.

  • Remittances. The Exchange Business Regulation (Circular No. 7/2025, in force since 26 June 2025) lets the CBUAE allow an SVF licensee to offer app-based remittances, if it meets that regulation's capital and guarantee (Article 3.7).

  • DIFC. The DFSA licenses issuing stored value as a money service (GEN Rule 2.6.1, GEN module VER72/07-26). Its Conduct of Business module (VER51/07-26) caps stored value at $5,000 per individual and $1,000 per payment, bans interest on it, and settles dirham transactions through a CBUAE-licensed deposit taker.

  • ADGM. Issuing stored value is a payment service under Providing Money Services, paragraph 52 of Schedule 1 to the Financial Services and Markets Regulations 2015 (consolidated version 29, in force from 21 May 2026). Chapter 19 of the FSRA's Conduct of Business Rulebook (VER24.160926) requires issue and redemption at par, safeguarding, and no interest.

Before your own licence

A bank can issue stored value under its own licence once the CBUAE has given its no-objection, so a product can launch with a partner bank as the issuer. Check your own role first: the 2025 law also lists arranging, promoting and marketing licensed activities as licensed activities (Article 61(1)(h)). Small pilots can ask for the sandbox exemption described above.

Common mistakes

  • A wallet built on a payment account. Payment accounts under the payments regulation cannot store funds.

  • A business model that lives on float income. The Regulation rules it out.

  • Management abroad. The chief executive and alternate must be ordinarily resident in the UAE.

  • Customer data hosted outside the UAE.

  • Marketing an offshore wallet to UAE residents.

  • Treating a stablecoin wallet as an SVF. Payment tokens follow the Payment Token Services Regulation.

What this means for your platform

The float, the limits and the records are where the Regulation meets the software.

Our white-label banking app runs on a double-entry ledger that reconciles every balance daily against bank statements and tracks holds and pending funds, with KYC, transaction monitoring, spending limits and an admin backoffice with roles and audit logs. It is deployed on your infrastructure, so customer data can stay in the UAE. Our crypto card app holds stablecoin balances in custody wallets and issues cards through a licensed issuer, so in the UAE its licensing combines a crypto licence and the payment token rules with the licence for the cards, yours or your issuer's. We configure both to match your legal set-up.

Sources

Checked on 6 October 2026.

Written by

Paynoramic's Head of IT

Head of IT

Head of IT at Paynoramic, responsible for the module library every platform is built from. Has worked on payment, banking and workforce platforms for companies including American Express, Teya and Indeed Flex, and for a global card issuer-processor. Writes about what a fintech or crypto launch needs beyond the software: licensing, certification and the real cost.

Keep reading

All insights

Building something like this?

Tell us the idea and we will show you the platform it maps to.

Start your project