Two clocks, one week
Compliance calendars across the Gulf have 16 September 2026 circled. That is the day the one-year reconciliation period under the UAE’s new Central Bank Law expires. Federal Decree-Law No. 6 of 2025 was issued on 8 September 2025, published in the Official Gazette on 15 September, and entered into force the following day. Article 184 gave everyone subject to it one year to reconcile their position. Some advisers date the expiry to 15 September and some to 16 September, which is itself a signal about how the deadline is being read.
The date that actually changes what banks do lands two days earlier, and almost nobody outside the retail conduct teams is talking about it.
On 13 September 2026 the SME Customer Protection Regulation comes into force. It was issued as Circular No. 2/2026 on 17 February 2026 and replaces the SME Market Conduct Regulation, Circular No. 1/2021, which had been in place since January 2021. It applies to every bank and finance company the central bank licenses. It has a fixed commencement date written into its own Article 13, and no provision that lets anyone move it.
The Central Bank Law deadline does have such a provision. The board can extend the reconciliation period as it sees fit.
Why the headline deadline is soft
Article 184 asks regulated persons to “reconcile their position” with a law that repealed and replaced two statutes at once: Federal Law No. 14 of 2018 on the central bank and financial institutions, and Federal Decree-Law No. 48 of 2023 on insurance. That is an enormous instruction and a vague one.
For an already licensed commercial bank, reconciliation mostly means updating governance documents, licence permissions and internal policies against implementing regulations that the central bank has been issuing through 2026: operational risk and operational resilience in February, telemarketing in February with effect from 31 March, insurance company licensing in February, and bank and insurer remuneration in April. Much of that work is continuous supervision rather than a cliff. Institutions that are close are close. Institutions that are not will be in supervisory dialogue, not in court.
The teeth are elsewhere. The new law expanded the regulatory perimeter to capture activities that previously sat outside it, including the provision of open finance services, payment services using virtual assets, and technology providers running the platforms, decentralised applications, protocols and infrastructure that enable financial activity. For a firm inside that new perimeter, reconciliation is not a documentation exercise. It is the difference between holding a licence and having conducted licensed activity without one.
That is where the criminal tail sits. Carrying on a licensed financial activity without authorisation attracts imprisonment and fines running from AED 50,000 to AED 500 million. Separately, the administrative fine ceiling for institutions rose from AED 200 million under the old law to AED 1 billion, with lower caps of AED 20 million for market infrastructures and AED 5 million for authorised individuals.
Read together, the penalty architecture says what the deadline means. Big numbers attach to unlicensed activity and to serious supervisory failure. They do not attach to a bank whose board charter still cites the 2018 law on 17 September.
The rulebook with no release valve
The SME Customer Protection Regulation is a different kind of instrument. It does not ask firms to reconcile a position. It tells them what to do, by when, with specified timings.
Under the new regime, a licensed firm must acknowledge an SME complaint in writing within two business days and issue a final response within 30 business days, then retain the record for at least five years after resolution. It cannot charge for an original paper statement. It cannot levy a closing or penalty fee on an account that has been open more than six months. It must keep fees consistent across the customer lifecycle. It must facilitate account switching without additional fees, cannot require the customer to explain why they are leaving, and cannot ask to see a competitor’s offer. It must report to the central bank on products, fees and complaints.
Those are not principles. They are configuration changes to core banking systems, complaint-handling workflows, fee schedules and onboarding scripts. Each one has an owner and a build ticket.
The runway the central bank granted tells you how much rebuilding it expected. The regulation it replaces gave firms 30 days’ notice in 2021. The telemarketing regulation issued on 19 February 2026 took effect on 31 March, a runway of 40 days. The SME rulebook got 208.
A regulator that gives a conduct rule seven months of lead time is telling the market it expects the rule to be operational on day one. A regulator that hands a whole statute a one-year reconciliation window and keeps the power to extend it is telling the market something different.
What this actually changes
Three consequences follow.
First, for licensed incumbents, the compliance risk this week is conduct risk, not licensing risk. The failure mode is a bank that still charges an SME an account closure fee on 14 September, or misses a complaint acknowledgement by a day. Those are recorded, reportable and countable. The central bank’s own reporting obligations under the regulation are designed to surface exactly that.
Second, for firms inside the newly captured perimeter, the reconciliation deadline is the only thing that matters, and an extension would be the most consequential decision the board could make in September. Open finance providers and virtual-asset payment firms operating in the UAE have spent a year in a licensing queue whose end date is discretionary. No public statement has changed it.
Third, the split shows how the UAE is actually building supervision. The statute sets the perimeter and the penalty ceiling. The circulars do the binding work, on their own timetables, with their own commencement articles. Reading the law and ignoring the circular stack produces exactly the wrong ranking of this week’s risks.
The deadline with the criminal tail is the one that can be moved. The one that cannot be moved is a conduct rulebook for small business customers. That inversion is the story, and it is not an accident of drafting. It is what a supervisor does when it wants the rulebook to change behaviour and the statute to set the boundary.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.