Best website design examples, and what they get right for Dubai and UAE businesses
What well known sites such as GOV.UK, u.ae, RTA, Apple and Stripe get right, and how to turn those qualities into a brief.
Read the articleFintech app development in Dubai starts with one decision that shapes every screen: will your company touch customer money, or will a licensed bank or payment provider do that while your app handles the experience? Paying merchants, issuing wallets, moving funds and issuing cards are regulated by the Central Bank of the UAE onshore, and by the DFSA in DIFC or the FSRA in ADGM. Invoicing and expense tools sit mostly outside that line until they start holding or moving funds.
This guide covers where that line falls as of October 2026, how each type of app is built around it, and the identity, tax and security rules a UAE fintech product must meet.
Key points
- The CBUAE Retail Payment Services and Card Schemes Regulation says no person may provide, or promote in the UAE, the retail payment services it lists without a prior Central Bank licence, unless exempted.
- Issuing or operating a stored value facility (a wallet) needs a CBUAE licence, except a single purpose facility that only buys the issuer’s own goods or services.
- Technical providers that never come into possession of the money are excluded from the payment services regulation, which is why many founders build on a licensed partner’s rails.
- DIFC offers the DFSA Innovation Testing Licence and ADGM offers the FSRA RegLab for testing new financial products under restrictions.
- B2B invoicing apps must plan for the Peppol based UAE e-invoicing system, with the first mandatory go live date set for 1 January 2027 for the largest businesses.
This guide is general information for product planning, not legal or regulatory advice. Licensing scope depends on your exact business model, the emirate or free zone you operate from, and how funds flow. Confirm your position with the relevant regulator or a qualified licensing adviser before you build or market any regulated feature.
Which fintech activities need a Central Bank licence
Onshore UAE, two CBUAE instruments do most of the work for anyone planning a payment or wallet product. Both are published in the CBUAE Rulebook, and both should be read before a single wireframe for a Dubai fintech app goes into development.
Retail payment services
The Retail Payment Services and Card Schemes Regulation (Circular 15/2021, in force from June 2021) sets four licence categories. Category I covers payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, domestic and cross border fund transfers and payment token services. Categories II and III cover narrower subsets, and Category IV covers only payment initiation and account information services.
In product terms: a checkout that settles card payments for many merchants looks like acquiring or aggregation; a send money feature looks like a fund transfer; an app that shows balances from a user’s bank accounts looks like account information. Each maps to a licence somebody in the chain must hold.
Stored value and wallets
The Stored Value Facilities Regulation (Circular 6/2020) says issuing or operating a stored value facility in the State requires a prior CBUAE licence, except a single purpose facility where the balance only pays for the issuer’s own goods or services. A closed loop scheme is the typical example. The Central Bank may exempt some low risk facilities on application, and one exemption route requires a trial in its FinTech Office sandbox.
That distinction decides a lot for wallet app development in Dubai, and for any fintech app that stores a balance. A café chain’s prepaid balance that only buys coffee from that chain is closed loop. The same balance that can pay a partner restaurant, or be sent to a friend, is a different product.
What sits outside the payment rules
The payment services regulation excludes technical service providers that support a payment service but never come into possession of the money, along with data processing, IT security and authentication services. This is the gap most fintech app development in Dubai works within: your company builds and runs the software, and a licensed entity owns the regulated activity.
DIFC, ADGM and testing under a sandbox
The two financial free zones run their own regimes. The SVF regulation states that its scope excludes the Financial Free Zones, and that institutions regulated by a free zone authority may conduct SVF business onshore only after obtaining a Central Bank licence. Choosing a base is therefore also choosing which rulebook your app will be built against.
In DIFC, the DFSA describes its Innovation Testing Licence as its version of a regulatory sandbox. Applicants submit a pre application form, then a full application with a technology related test plan. Testing typically runs for 12 months with restrictions such as limited clients and transaction volumes and values, after which the holder applies to remove the restrictions or withdraws its licence.
In ADGM, the FSRA describes its RegLab as a controlled environment for fintech participants to develop and test solutions without the full suite of regulatory requirements at the outset, for solutions that are ready for testing and do not currently fall under its regulated activities.
A sandbox changes fintech app development in Dubai and Abu Dhabi alike. Client and transaction limits must be enforced in code, regulator reporting must come out of the admin console, and the restrictions should lift without a rebuild.
Building on a licensed partner’s rails or holding funds yourself
Most early stage fintech app development in Dubai uses a bank or a licensed payment service provider as the regulated party. The partner holds the accounts, runs the acquiring or the wallet licence, and exposes APIs; your app owns the interface, the onboarding journey, the business logic and the brand. It is the quicker route, but it still shapes development of a fintech app for Dubai users, because the partner’s obligations reach you through the contract.
- Outsourcing approval. The payment services regulation says a licensed provider that outsources services to third parties must contractually bind them to the regulation, needs prior Central Bank approval for the outsourcing, and remains fully liable. Expect security and reporting duties in your contract.
- Funds in transit. The same regulation says providers must not hold users’ funds except funds in transit, and must segregate them rather than mix them with anyone else’s money. Your app should never route customer funds through your own company account.
- Wording. Because promotion of a listed payment service also needs a licence, your app store listing, website and push notifications must make clear which licensed entity provides the service.
Holding funds yourself means applying for a licence and running the controls that come with it. For a wallet, Article 11 of the SVF regulation requires the float to be protected against claims by the licensee’s other creditors, kept in segregated accounts with licensed banks or a recognised foreign bank, and reconciled against system records at least daily. Those requirements turn into ledger design, banking integrations and an operations team, which changes the scope of fintech app development in Dubai far more than the paperwork does.
Open finance as a third route
The CBUAE Open Finance Regulation (Circular 03/2025, issued July 2025) creates an Open Finance licence for data sharing and service initiation through a central API Hub with a Trust Framework. Data sharing and initiation of transactions are always subject to the user’s express consent and appropriate authentication. The Central Bank says onboarding of data holders is phased, starting with banks and insurance companies, and that an Open Finance licence does not permit holding customer funds in any form. For a personal finance or account aggregation app in Dubai, that licence and its consent rules frame the fintech development work.
Payment app development in the UAE: three apps, not one
A payment product is rarely a single app. A scope for fintech app development in Dubai should name three surfaces, each with its own users and permissions.
| Surface | Who uses it | What it must do |
|---|---|---|
| Customer app | Consumers or business users | Onboarding and identity checks, linking a card or account, paying or sending, receipts, disputes, limits, notifications, Arabic and English with proper right to left layout. |
| Merchant or business app | Shops, freelancers, finance teams | Payment links and QR codes, refunds, settlement reports, staff roles, invoice and payout history, exports for accounting. |
| Operations console | Your compliance, support and finance staff | Case management for KYC reviews, transaction monitoring alerts, account freezes, limit changes with an audit trail, reconciliation views, regulator and partner reporting. |
The operations console is the part of fintech app development in Dubai that budgets most often underestimate. Compliance staff must see why an alert fired and record what they decided; support staff must explain a failed payment without seeing more personal data than their role allows.
Wallet app development in Dubai: the ledger comes first
A wallet looks like a balance on a screen; underneath it is a double entry ledger that must agree with the money in the bank at all times. The SVF regulation requires the aggregate balance of all customer accounts to reflect the total float accurately, so every top up, transfer, fee, refund and reversal needs its own ledger entry, an idempotent API call that cannot post twice, and a daily reconciliation job against the safeguarding account.
Plan the failure states during development too: a card top up approved by the acquirer but never confirmed to your system, or a refund requested after the balance is spent. Each needs a defined path in the Dubai fintech app and in the console.
KYC for a fintech app: UAE Pass, Emirates ID and AML duties
UAE Pass is the national digital identity, managed by Digital Dubai, TDRA and the Abu Dhabi Digital Authority. Its developer documentation lists three capabilities: authentication, digital signature and eSeal, and data and document sharing, with document sharing available to private organisations. For fintech app development in Dubai this means a service provider onboarding process with its own development and assessment phases, plus a staging environment for proof of concept work, so allow for it in the plan.
The account type matters for a fintech flow. UAE Pass documents a basic SOP1 account that is unverified and can be created without an Emirates ID, an SOP2 advanced account verified with the Emirates ID, and an SOP3 qualified account verified with finger or face biometrics. An onboarding journey that depends on a verified identity should check which level the user holds and explain what to do if it is only basic.
Anti money laundering is the area to frame most carefully. The payment services regulation requires providers to identify and assess their money laundering and terrorist financing risks, apply risk based customer due diligence and monitoring, and carry out periodic risk profiling of users. It also refers to the federal AML law, Decree Federal Law No. 20 of 2018, and its implementing regulation. In practice the licensed entity owns that programme; the app collects the right data, passes it to screening and monitoring tools, holds transactions when the rules say so, and gives compliance staff the console to act. Your developer should not be setting risk thresholds.
Two habits help during development of any Dubai fintech app: store identity data only where the partner’s policy says, never in analytics tools, and build reverification into the journey, because Emirates IDs expire and risk profiles change.
Invoicing app Dubai: tax invoice fields and e-invoicing as of October 2026
An invoicing app for UAE businesses has two jobs: produce a valid VAT tax invoice today, and fit the national e-invoicing system that is now being phased in. Neither requires a Central Bank licence on its own, but adding pay now buttons, collections or early payment financing moves the product back towards the payment rules above.
The Federal Tax Authority’s guide lists what a full tax invoice must show, including the words “tax invoice”, supplier and recipient details with TRNs, a sequential number, dates, line items with quantity, unit price and VAT rate, and totals in UAE dirhams. Our guide to tax invoice and VAT requirements for UAE stores covers those fields in more depth.
For e-invoicing, the Ministry of Finance says the system is based on the OpenPeppol standard, that issuers and recipients must appoint an Accredited Service Provider, and that it covers business to business and business to government transactions. A pilot began on 1 July 2026. In May 2026 the Ministry moved the deadline for the largest businesses to appoint a provider to 30 October 2026, with implementation still due by 1 January 2027. Smaller businesses follow from 1 July 2027 and government entities from 1 October 2027.
For an invoicing app, development has to start from a structured invoice data model, not a PDF template with fields painted on. A Dubai fintech app that issues invoices needs machine readable line data, tax categories, buyer and seller identifiers and a status history recording what the accredited provider returned.
Expense management app UAE: receipts, cards and approvals
An expense management app usually starts as a receipt capture and approval tool and grows into corporate cards. The first stage is ordinary software; the second brings payment instrument issuance, which the payment services regulation lists as a licensed service, so cards are almost always issued by a licensed partner with your app as the interface.
- Receipt capture. Photo or forwarded email, text recognition for supplier, TRN, date, VAT and total, with a manual correction step, because a misread TRN breaks VAT recovery.
- Policies and approvals. Spending limits by role, project or cost centre, multi level approval routes, delegation when a manager is on leave, and clear reasons when a claim is rejected.
- Cards. Virtual and physical cards from the issuing partner, instant freeze, merchant category controls and automatic matching of card transactions to receipts.
- Accounting. Reimbursement payouts and exports to the accounting system with VAT split out.
As with any fintech app development in Dubai, decide during development where receipts and employee data are hosted and who can see them.
Security and app store rules for fintech app development in Dubai
Annex II of the payment services regulation sets out technology risk and information security practices that read like a feature list. It calls for multi factor authentication for high risk transactions, end to end encryption of passwords between the mobile app and the system that verifies them, limits on login attempts and session controls, and reauthentication with controls such as two factor authentication before high risk actions, which include transactions above set limits and changes to personal contact details.
On top of that, careful fintech app development for Dubai users normally includes device binding so a new phone triggers verification, biometric sign in through the operating system rather than custom code, certificate pinning, detection of rooted or jailbroken devices, screenshot protection on sensitive screens and remote session revocation. None of these replaces an independent test; see our explainer on penetration testing for what a test should cover before launch.
The app stores add their own rules. Apple’s App Review Guidelines say apps in highly regulated fields such as banking and financial services should be submitted by a legal entity that provides the services, not by an individual developer, so for fintech app development in Dubai the developer account belongs to your company or your licensed partner. Google Play’s Financial Services policy requires any app with financial features to complete the financial features declaration in Play Console, requires compliance with local regulations in each targeted country, and sets specific disclosure rules for personal loan apps.
Questions to ask a fintech app development team in Dubai
- Which licensed partner APIs have you integrated, and how did you handle their security review?
- How will the ledger reconcile against the safeguarding or settlement account, and who sees the breaks?
- What does the operations console show compliance staff, and is every action audited?
- Which developer accounts will the apps be published under, and who owns the code and the store listings?
For build approach and budgeting, see our guides to building a first version of an app and what drives mobile app cost in the UAE.
How Digital Marketing Dubai can help
Our team designs and builds customer apps, merchant apps and operations consoles on top of licensed banking and payment partners, in Arabic and English. Our fintech work includes Purpose Payment, a US fintech app. You approve the full design before development begins, builds are tested on real devices, and handover includes training and a recorded walkthrough. We work alongside your licensing adviser rather than replacing one.
Start with our mobile app development service, or, if you also need a public site, our finance and insurance website design and online trading platform website pages. Send us your brief and we will return a written fixed price proposal within 45 minutes during business hours, with no obligation.
