DST 
Payments
Taking card payments in Dubai: check the licence
A shop taking cards in Dubai needs no payment licence of its own. The company selling it the terminal does. Since 6 June 2021 the Central Bank has licensed retail payment services under one regulation, in nine named categories, with initial capital running from AED 100,000 to AED 3 million depending on what the provider does and how much it moves. Knowing those categories is how a merchant asks one useful question instead of comparing four brochures.
The nine services, and the two you are buying
The Retail Payment Services and Card Schemes Regulation C 15/2021 covers nine digital payment services: payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic fund transfer, cross-border fund transfer, payment token services, payment initiation and payment account information. A merchant taking cards is buying the third and usually the fourth. Both sit in the licensable set, which means the provider is either licensed for them or is reselling somebody who is — and that is a fair question to put in writing.
What the licence costs the provider
Initial capital is set by licence category and by the monthly average value of payment transactions, with the dividing line at AED 10 million a month:
- Category I — account issuance, instrument issuance, acquiring, aggregation, domestic and cross-border transfer, and payment tokens: AED 3 million at or above the line, AED 1.5 million below it.
- Category II — the same without payment tokens: AED 2 million, or AED 1 million.
- Category III — account issuance, instrument issuance, acquiring, aggregation and domestic transfer: AED 1 million, or AED 500,000.
- Category IV — payment initiation and payment account information only: AED 100,000, whatever the volume, plus professional indemnity insurance.
A provider must hold aggregate capital funds at or above its category's initial requirement at all times, not only on the day it applied. Card schemes are licensed separately, and the Central Bank may both collect information on their fees and regulate those fees where it considers it appropriate.
What the regulation deliberately leaves out
It does not apply to transactions involving stored value facilities, commodity or security tokens, virtual asset tokens, or remittances; nor to currency exchange where the funds are not held on a payment account; nor to technical providers that support a payment service without ever coming into possession of the money — data processing, security, authentication, networks, and the supply and maintenance of terminals.
That last exclusion is the one to hold onto. A company can sell a Dubai merchant a card terminal and an integration and be entirely outside this regulation, because it never touches the funds. Nothing is wrong with that. It simply means the reassurance a merchant wants has to come from whoever settles the money, not from whoever installed the box.
Payment tokens are the one service with a further gate: they may not be offered to the public unless the provider holds a Category I licence, has drafted a white paper for those tokens, and has the Central Bank's approval before offering them. An offer that skips any of the three is not a product with paperwork pending.
What to ask a provider
- Which licence category it holds, and whether merchant acquiring and payment aggregation are both on it.
- Whether it settles the funds itself or routes them to a licensed party — and if the latter, who.
- Which card schemes it works with, all of which are separately licensed.
- How the fees are disclosed, given that the Central Bank may regulate scheme fees but the provider's own margin is a commercial matter.
The account the money lands in is on the banking page, the VAT that attaches to what you sold is on the tax page, and if you want to talk to someone rather than read, contact is here.
Does my Dubai company need a licence to take card payments?
No. The licence belongs to the provider. The Retail Payment Services and Card Schemes Regulation C 15/2021 licenses those who provide the service — merchant acquiring, payment aggregation, payment account issuance and the rest — not the merchants who buy it.
What service am I actually buying?
Merchant acquiring, and often payment aggregation with it. Both are named retail payment services under the regulation, which means the provider offering them holds a Category I, II or III licence from the Central Bank.
How much capital does a licensed provider have to hold?
It depends on category and volume. A Category I licence requires initial capital of at least AED 3 million where the monthly average value of payment transactions is AED 10 million or above, and AED 1.5 million below that. Category II is AED 2 million and AED 1 million; Category III is AED 1 million and AED 500,000; Category IV is AED 100,000 regardless of volume.
Are card schemes regulated too?
Yes. Card schemes must obtain a licence from the Central Bank, and the Central Bank has the right to receive information on their fees and charges, and to regulate those fees and charges where it considers it appropriate.
Does the regulation cover crypto payments?
No. Transactions involving virtual asset tokens are excluded, as are transactions involving commodity or security tokens, remittances, stored value facilities, and currency exchange where funds are not held on a payment account.
Service categories, licence categories, initial capital requirements, card scheme licensing, the payment token condition and the exclusions: the Central Bank of the UAE Rulebook, Retail Payment Services and Card Schemes Regulation C 15/2021, effective 6 June 2021, read 15 September 2026. Nothing here is legal advice.