A new UAE banking rule gives some SMEs a number worth remembering: three business days. It is not a universal promise that every company bank account must be open within 72 hours.
The Central Bank of the UAE’s Small to Medium Sized Enterprises (SME) – Customer Protection Regulation, C 2/2026, took effect on September 13. For account opening, financial institutions must have systems to complete an SME bank account within three business days when the applicant has been assessed as low money-laundering and terrorist-financing risk and the bank is satisfied with standard customer due-diligence documentation.
Qualifying low-risk SME account applications now have a specific three-business-day opening standard once all necessary documents and information are supplied.
UAE SME owners, founders, finance teams and advisers opening or switching business bank accounts or handling complaints with regulated financial institutions.
SMEs can use the written timelines and disclosure requirements as concrete reference points when following up on qualifying account applications or unresolved complaints.
The three-day standard is not universal: financial-crime compliance, incomplete documents or applications outside the low-risk conditions can change the timeline.
Banks and finance companies must operate under C 2/2026 and maintain records and reporting that let the Central Bank examine customer-protection outcomes.
Keep proof of the date your complete account application or complaint was submitted so you can measure the bank's response against the applicable regulatory timeline.
SME customers gain clearer timelines, disclosure rights, complaint processes and protections around fees and switching financial institutions.
The regulation protects qualifying SME customers of banks and finance companies; the three-day account rule applies only where stated low-risk and due-diligence conditions are met.
Watch implementation of the three-day rule, written rejection reasons, fee-change notices, complaint response times and any Central Bank guidance clarifying the new requirements.
The clock starts only once the customer has made the request and supplied all information and documents necessary to open the account. The rule also allows the three-day obligation to be waived where the institution is complying with UAE financial-crime requirements. That is the catch behind the headline.
The Three-Day Rule Has Conditions
Article 4.46 of the new regulation is unusually specific. It says the three-business-day requirement applies when the institution has assessed the applicant as presenting low money-laundering and terrorist-financing risks and can demonstrate that it is satisfied with the standard due-diligence documentation.
That means the rule should not be read as a countdown beginning the moment a founder downloads a banking app or sends the first document. Missing ownership information, unresolved compliance questions or financial-crime checks can change the timeline.
If the three-day obligation is waived because of financial-crime compliance requirements, the Central Bank rule says the institution must adequately document the rationale and report it to senior management.
The regulation also requires institutions to keep records covering account-opening requests, accounts opened, rejected applications and reasons, average opening time, applicant risk classifications and low-risk cases that were not completed within three business days. Those records must be shared with senior management and the board at least quarterly and be available for regulatory examination.
Rejected Applications Need a Written Reason, With an Exception
The disclosure rules add another practical protection. When an application for a financial product or service is rejected, the institution must disclose the reason in writing, except where the reason relates to financial-crime risks or where disclosure is prohibited by law.
That exception matters. An SME should not assume that every rejected or delayed account application will come with a detailed explanation if doing so would conflict with anti-financial-crime obligations.
Terms Cannot Quietly Change Tomorrow
The new regulation also sets rules around disclosure. Information across channels including websites, mobile apps, ATMs and point-of-sale systems must be accurate, consistent, comprehensive and free from misleading statements. Customer information must be available in both English and Arabic and use plain language.
If a financial institution changes the terms and conditions of a product or service, including fees, it must give the SME customer at least 60 calendar days’ written notice before the changes take effect.
For annual automatic renewal clauses, the institution must send a notice at least 30 calendar days before renewal and explain how and when the renewal can be cancelled.
Switching Banks Has Its Own Protections
The regulation says financial institutions must not create unreasonable barriers preventing customers from switching their relationship to another institution. Where the customer asks to transfer accounts, products, services or payment information, the institution must facilitate the transfer and provide necessary information such as letters and certificates without additional fees.
There is also a rule on account closure. A financial institution must not impose a closing fee or penalty where the bank account has been open for six months or more.
Complaints Now Have Clear Timelines
SME complaint handling is also covered directly. Institutions must provide a complaint process without fees and acknowledge receipt in writing within two business days, including a unique reference number.
A final written response must be sent within 30 business days, unless the Central Bank prescribes another limit. The final response must explain whether the complaint is accepted or rejected, give detailed reasons where legally possible and tell the customer how to escalate an unresolved complaint to an external financial complaints function, including the Ombudsman Unit, Sanadak.
This Replaces the 2021 SME Market Conduct Regulation
C 2/2026 replaces the SME Market Conduct Regulation C 1/2021. The Central Bank describes the new framework as a customer-protection regulation intended to protect SMEs and improve their access to financial products and services through conduct requirements for financial institutions.
For SME owners, the practical change is not one single banking promise. It is a collection of specific rights and process requirements around opening accounts, disclosure, fees, switching and complaints.
What an SME Should Keep
- Your complete application date: the three-day clock depends on the request and all necessary documents and information being supplied.
- Written requests and replies: keep emails, portal confirmations and complaint reference numbers.
- Fee schedules and Key Facts information: compare what was disclosed when you signed with later changes.
- Change notices: terms and fee changes generally require 60 calendar days’ written notice under the new SME regulation.
- Complaint timing: note the two-business-day acknowledgment and 30-business-day final-response requirements.
The Bottom Line
The new regulation makes the three-business-day account-opening standard more concrete, but it does not eliminate KYC, financial-crime compliance or risk assessment. A low-risk SME with complete documents is in a different position from an application that still needs enhanced checks.
If your application fits the low-risk conditions and all requested information has been supplied, the new rule gives you a specific benchmark to refer to. If it does not, the regulation still gives SMEs clearer rights around disclosure, fees, written complaints and switching.
Sources
- Central Bank of the UAE Rulebook: Small to Medium Sized Enterprises (SME) – Customer Protection Regulation C 2/2026 — full regulation
- CBUAE Article 3: Disclosure and Transparency — official rule
- CBUAE Article 4: Responsible Conduct, including account opening, customer mobility and fees — official rule
- CBUAE Article 6: Complaint Management and Resolution — official rule
Checked 17 September 2026. This is general information about the CBUAE SME Customer Protection Regulation and is not legal or financial advice.
Robius.news — Dubai, UAE — 2026 | Built to be first. Built to be trusted.
