High-risk payment gateway and merchant accounts in the UAE

Three layers set the rules a UAE online merchant meets: federal law in all seven emirates, the licenses of each emirate, and the financial free zones of the DIFC and ADGM, which have their own regulators.

The federal data protection law, Federal Decree-Law No. 45 of 2021, has been in force since January 2, 2022, but its executive regulations had not been published by October 2026, and the compliance period runs from their publication. Companies in free zones with their own data protection law, such as the DIFC, follow that law instead.

Card schemes operating in the UAE must hold a Central Bank license, and the Central Bank may regulate their fees: since October 1, 2024, one of its notices has capped interchange on UAE-issued consumer debit and prepaid cards. Apple Pay works with UAE cards, and Google Wallet lists the main UAE issuers. Jaywan, the UAE’s first national card scheme, started nationwide issuance on July 20, 2026; its cards work at points of sale, in online shops and in digital wallets. Cards co-badged with UnionPay, and the Jaywan-Mastercard credit card announced on July 21, 2026, work abroad on those networks, and a UnionPay agreement of August 11, 2026 aims to open its network to Jaywan-only cards. Aani, the instant payments platform launched on October 16, 2023, passed 12.5 million registered users in April 2026, with transfers completing in three seconds on average, and offers QR payments and requests to pay.

Payment service providers must use multi-factor authentication for high-risk transactions, at least above set transaction limits. Under a 2021 Central Bank notice, card one-time password messages must show the full amount, the detailed merchant name and website, and a number to report fraud, and the Central Bank now requires stronger authentication than SMS codes, so most approvals happen in the bank’s app. The name and website your transactions carry are what your customer reads at the moment of approval: a mismatch with your shop invites declines and “not recognized” disputes. The 3-D Secure guide covers the mechanics.

Since October 14, 2023, a provider may not add any amount to the price when the consumer pays by credit card. The e-commerce law adds that an online trader publishes its digital payment fees in advance and may charge nothing beyond what it announced. The safe line is simple: no card fee, and any other payment fee shown before the purchase. Prices must be announced clearly, and the invoice gives the price in the local currency.

Buy now, pay later is regulated credit. Banks, finance companies, their approved agents and restricted-license finance companies may offer it. When an approved agent or a restricted-license finance company offers it, each borrower is capped at AED 20,000 or three months’ verified net income, whichever is lower, no interest may be charged, total fees, late fees included, may not exceed 30% of the credit, and the term may not exceed 12 months. A merchant running its own installment plan is lending, so installments go through a licensed provider.

The federal consumer protection law applies across the UAE, free zones included, and to e-commerce businesses registered in the UAE; it does not reach sales by online businesses registered abroad. Its main duties for an online seller:

• Arabic: invoices, consumer contracts, advertising and product data in Arabic, other languages alongside; failing to do so carries an administrative fine of AED 100,000;
• disclosure: the seller’s name, legal status, address and licensing authority, the labeling data of each product, such as components, origin and warnings, and published terms; a platform answers for its third-party sellers;
• returns: a no-return clause is void except for goods accepted with a known defect, goods that cannot be resold by nature, perishables, made-to-order goods and printed matter; goods without a warranty are taken back and refunded when the defect is raised within 30 days of its appearing;
• promotions: discounts and promotions need a prior license from the emirate’s competent authority.

The e-commerce law of 2023 lets the consumer return or replace goods that are defective, incomplete, not as described or delivered too late to be useful. Neither federal text gives a general change-of-mind withdrawal period. Breaches of the price, invoice, warranty and unfair-term rules can bring up to two years in prison, a fine of AED 10,000 to AED 2 million, or both, and breaches of the Arabic and promotion rules up to six months, AED 3,000 to AED 200,000, or both. A digital contract under AED 50,000 may not include an arbitration clause.

No federal rule is written for free trials or automatic renewal. A supplier of subscription services may not reserve the right to change the terms on its own, except to improve the service after telling the customer or for reasons beyond its control. A renewal shown clearly before the first payment is the safe route; the subscription billing guide shows how.

VAT is 5%. A UAE business registers once its taxable supplies and imports exceed AED 375,000 over twelve months, or are expected to within the next 30 days; that threshold does not apply to foreign businesses. A registered seller’s invoice carries its tax registration number, the TRN.

The electronic invoicing system runs through accredited service providers. Businesses with revenue of AED 50 million or more appoint one by October 30, 2026 and go live on January 1, 2027; the others appoint one by March 31, 2027 and go live on July 1, 2027. Business-to-consumer transactions sit outside the system for now, so a shop selling only to consumers is not yet subject to it.

Corporate tax applies to financial years starting on or after June 1, 2023: 0% on taxable income up to AED 375,000 and 9% above. Tobacco, electronic smoking devices, their liquids and energy drinks carry 100% excise tax. Goods imported from outside the GCC pay 5% customs duty, and goods leaving a free zone for the mainland pay duty on exit.

Under the Central Bank’s Consumer Protection Standards, a customer has at least 30 business days to report an unauthorized transaction, and the bank reimburses an unauthorized payment after its investigation or within 30 calendar days of the report, whichever is shorter, unless the customer acted fraudulently or with gross negligence. A payment validated properly and securely is presumed authorized, unless the customer gives prima facie evidence of reasonable doubt. Under the payment services regulation, a provider is fully liable for unauthorized transactions, outside fraud or gross negligence by the payer, and refunds them by the end of the next business day.

The bank refunds its customer and then recovers the amount from the merchant through the card scheme’s chargeback process. For fraud disputes, a payment authenticated with 3-D Secure normally shifts the loss to the issuer; delivery and description disputes are not covered by that shift. Customers can take unresolved complaints against banks to Sanadak, the UAE’s banking and insurance disputes unit. Each card chargeback counts toward your chargeback ratio.

A mainland business takes its license from its emirate’s licensing authority, in Dubai the Department of Economy and Tourism. A free zone company trades freely inside its zone and abroad, but selling directly to the mainland needs a mainland license or approval, or a licensed distributor; in Dubai, Executive Council Resolution No. 11 of 2025 lets a free zone establishment work in mainland Dubai with a license or permit from the department and separate financial records. Under the e-commerce law, an online seller’s license must cover what it sells, with prior approval for restricted goods.

Companies keep a register of beneficial owners, anyone owning or controlling 25% or more of the capital or votes, and report changes to the registrar within 15 days; the DIFC and ADGM keep their own registers. The establishment card, issued by the ICP once the company holds a valid trade license, carries the trade name, license number, partners and activity. The anti-money laundering law of 2025, in force since October 14, 2025, replaced the 2018 law, and Central Bank guidance tells payment firms to examine a merchant’s business and expected volumes and ask why it is changing provider.

The dirham is pegged to the US dollar at 3.6725. Banks settle between themselves in real time through the UAE Fund Transfer System, run by the Central Bank since 2001, and Aani carries instant payments around the clock. A payment provider other than a bank that pays merchants more than 24 hours after collection must hold the funds in an escrow account at a bank, or cover them by insurance or a bank guarantee.

1. Selling to mainland customers on a free zone license alone. Direct mainland sales need a mainland license, a Dubai permit or a distributor, and the acquirer compares the license with the customer base.
2. A license activity that does not match the products. The e-commerce law requires the license for the activity and prior approval for restricted goods; products outside the license read as a misdescribed file.
3. Invoices and terms in English only. Arabic is compulsory, with a fine of AED 100,000 for missing it.
4. Adding a card fee at checkout. Banned for credit cards, and any other payment fee must be announced before the sale.
5. “No refunds, no exchanges” in the terms. The clause is void outside the listed exceptions, and a refused return can become a chargeback.
6. Accepting crypto or stablecoins for goods. Outside the financial free zones, only licensed dirham payment tokens may be accepted.
7. A billing name the cardholder does not recognize. The bank’s authentication request shows your merchant name and website, and a mismatch produces declines and disputes.
8. Letting the beneficial owner register go stale. Changes reach the registrar within 15 days, and due diligence checks ownership.
9. Running installments in-house. Pay later is licensed credit, offered only by banks, finance companies and their approved agents.
10. Promotions without a permit. Discounts and promotions need a prior license from the emirate’s authority.

Most of these are fixed before go-live. A business model that needs one of them to work is declined, whatever its volume.