Your UAE Business Bank Gets New Rules on September 13

This is not financial advice.

If your UAE business has ever waited weeks for a bank account, received a fee you did not expect or struggled to get a complaint out of a call-center loop, September 13 is a date worth knowing.

The Central Bank of the UAE’s new Small to Medium Sized Enterprises Customer Protection Regulation takes effect on September 13, 2026. It applies to CBUAE-licensed banks and finance companies when they provide products or services to SME customers, including sole proprietors covered by the regulation’s definition.

The rules do not promise that every SME gets approved. Financial-crime checks still matter, and banks still make risk decisions. But the regulation gives businesses a much clearer framework around what must be disclosed, how low-risk account opening should be handled, what complaint timelines look like and how fees or contract changes must be communicated.

This Is Not the Other September CBUAE Deadline

Robius has another September banking story on the site, so the distinction matters.

Our Article 62 licensing checklist is about businesses that may themselves need a CBUAE licence under the new Central Bank law. The September 13 regulation in this article is different. It is about how CBUAE-licensed banks and finance companies must treat SME customers.

The new regulation replaces the existing 2021 SME Market Conduct Regulation. Its stated objective is customer protection, with requirements around governance, disclosure, responsible conduct, financing, complaints and data protection.

The Three-Business-Day Account Rule Has Important Conditions

One of the most practical provisions is in the business-account section. A financial institution must have systems to complete a customer bank account within three business days where it has assessed the applicant as presenting low money-laundering and terrorist-financing risk and is satisfied with the standard customer due-diligence documentation.

That is not a universal three-day guarantee. The regulation expressly allows the obligation to be waived where financial-crime compliance requires more work. If another valid circumstance causes a delay after the application has been accepted, the bank must explain the delay and document the reason. The rule says that such a delay must not exceed two weeks, while limited transactions can apply until the issue is resolved.

This is useful because it gives a low-risk SME with complete documentation something more concrete than ‘your application is under review.’ It also gives banks a clear exception where deeper compliance checks are genuinely required.

That practical split matters in a market where banking is increasingly embedded into other services. Our Wio and Geidea analysis showed how a payment-terminal provider can now become an entry point into a regulated business-banking relationship. The new conduct rules sit behind that convenience.

You Should See the Important Information Before You Sign

The regulation requires information to be proactive, accurate, consistent, comprehensive and free from misleading statements. It applies across communication channels, including websites, mobile apps, ATMs and point-of-sale terminals.

Information for SME customers must be available in both English and Arabic. Banks and finance companies must use plain language and warnings to explain risks, costs, fees, rates, payment schedules and locked terms.

Before a product or service is provided, the customer must receive a Key Facts Statement and acknowledge receiving it before entering the contract. The institution also has to explain the process and expected timeline for the application and keep the customer informed about its status.

If an application is rejected, the institution must disclose the reason in writing unless the reason relates to financial-crime risk or another legal restriction. That is a meaningful difference from a vague rejection screen with no useful next step.

Fee Changes Need Notice

The new rules also make fee visibility more specific. Financial institutions must provide clear information about one-time and recurring fees, their frequency and a fee schedule. Where third-party fees are available, those should be disclosed too. If an exact third-party amount is not available, the bank must provide an estimate or range with a disclaimer that more fees may apply.

Changes to terms and conditions, including fees, require at least 60 calendar days’ written notice before they take effect. If a contract has annual automatic renewal, the customer must receive a notice at least 30 calendar days before renewal explaining how and when it can be cancelled.

The responsible-conduct section goes further. Fees must be fair, reasonable and proportionate. The regulation says no closing fee or penalty can be imposed where a bank account has been open for six months or more, and no fee can be charged for the original paper statements provided to customers.

This is where it becomes useful to keep your own records. A fee schedule saved at onboarding is much more powerful than trying to reconstruct what the app showed nine months later.

Tied Selling Is Explicitly Banned

The regulation says a financial institution must not condition the sale of one financial product or service on the purchase of another. It specifically names tied selling and bundling.

That does not mean banks can never offer bundles or discounts. It means the customer should not be forced to buy another product as the condition for getting the one they actually came for.

For SME owners, this is worth remembering when a bank account, financing product, card, insurance-like add-on or other service arrives as one sales conversation. Ask which pieces are required, which are optional and what each one costs.

The same entity-mapping habit is central to our Wio Bank review. A polished app can make several financial services feel like one product, but the legal provider and the rules behind each service still matter.

Complaints Get a Clock

From September 13, the regulation requires an accessible, transparent complaint process provided without fees. A financial institution must acknowledge a complaint in writing within two business days and give the customer a unique reference number.

The institution must send a final written response within 30 business days, unless the Central Bank prescribes another limit. The response must accept or reject the complaint in whole or in part, explain the reasons where permitted and tell the customer how to escalate an unresolved complaint to an external resolution function, including Sanadak.

This is a simple operational change for SME owners: stop treating a complaint as a phone call. Put it into the formal process, keep the reference number and start the clock from the documented submission.

Financing Has Its Own Guardrails

For credit, the rules say financial institutions must not provide credit beyond amounts the customer is capable of servicing. They cannot grant or extend credit without a prior written request from the customer, and they must examine the customer’s credit record to assess solvency, monthly obligations and past credit behavior.

The responsible-conduct section also requires support mechanisms for customers in financial difficulty, including possible restructuring, product modification or adjusted payment plans, plus impartial credit counselling for customers having difficulty servicing debt.

None of that makes borrowing risk-free. It does make the expected conduct around selling and servicing SME credit more explicit.

What to Save From September 13

Keep the Key Facts Statement. Keep the fee schedule. Save the account-opening document list and the date you supplied the last required item. If terms change, save the written notice. If you complain, keep the submission, acknowledgment and reference number.

For founders still building their basic operating stack, our Dubai SME in a Box guide explains how banking, payments and other setup services are increasingly bundled into startup journeys. Convenience is useful. The September regulation gives you a better checklist for what the banking layer should disclose once you arrive there.

And remember the boundary: these rules apply to the CBUAE-licensed bank or finance company serving the SME. A software platform, referral partner or free-zone portal does not automatically become the regulated financial institution just because it sits in front of the application.

The Robius Read

The new regulation does not turn business banking into consumer banking. SMEs still face commercial risk assessments, KYC, AML checks and product eligibility.

What changes is the amount of ambiguity the customer should have to tolerate. There are clearer rules for disclosure, fees, timelines, selling behavior, account opening and complaints.

For a small UAE business, that is useful leverage without being a guarantee. Know which rule applies, keep the paper trail and use the formal process when something goes wrong.

Sources

• CBUAE Rulebook: SME Customer Protection Regulation C 2/2026
• CBUAE Rulebook: Article 3 Disclosure and Transparency
• CBUAE Rulebook: Article 4 Responsible Conduct
• CBUAE Rulebook: Article 5 Responsible Financing Practice
• CBUAE Rulebook: Article 6 Complaint Management and Resolution

Robius.news — Dubai, UAE — 2026 | Built to be first. Built to be trusted.