Roughly nine SME loan applications out of ten are funded by UAE banks in 2024, according to Central Bank data, and the ratio has barely moved in years. That gap between how many companies count as SMEs and how much credit actually reaches them is exactly what the Central Bank of the UAE (CBUAE) is now trying to close from the regulatory side. On February 17, 2026, the CBUAE issued Circular No. 2/2026, introducing a new SME Customer Protection Regulation that replaces the far lighter 2021 SME Market Conduct Regulation. It comes into force on September 13, 2026, and it changes, in concrete terms, how every bank and finance company in the country is allowed to sell, price, and collect on SME lending.
What the CBUAE Actually Changed
The old 2021 rule was a market conduct code, essentially a set of principles about fair dealing. The new regulation is longer, more prescriptive, and enforceable article by article. It runs to thirteen articles covering governance, disclosure, responsible financing, complaints handling, data protection, Shari'ah compliance and reporting to the Central Bank, and financial institutions had a six-month runway to prepare rather than the 30 days given under the old rule, according to a client note from law firm CMS.
The regulation defines an SME the same way the Cabinet already does, by headcount and revenue, which means it covers everything from a five-person trading company turning over AED 3 million a year up to a 250-employee manufacturer with AED 250 million in revenue. Sole proprietors are explicitly included.
Six Things Every Bank and Finance Company Must Now Do
UAE banks held AED 81.2 billion in outstanding SME loans and facilities by June 2024, about 9.5 percent of total commercial and industrial lending, per CBUAE data reported by Arab News. SMEs make up more than 95 percent of all UAE companies and employ around 86 percent of the private sector workforce, per the same CBUAE figures. A 2020 CBUAE survey found 75 percent of SMEs described themselves as financially constrained, but only 17 percent had actually approached a bank for credit, and only about half of those succeeded. Emirates Development Bank extended AED 3.1 billion in direct SME financing and AED 747 million through its credit guarantee scheme in 2025.
The regulation is dense, but for a founder or a fintech lender, six changes matter most in practice.
- Key Facts Statement before signing. Banks must give SMEs a plain-language summary of a product's costs, risks and terms, and get acknowledgment of receipt, before the SME enters a contract, not after.
- A three-day clock on account opening. For low money-laundering-risk applicants with complete paperwork, the bank account must open within three business days, or the bank has to document and explain the delay.
- No penalty for switching banks. Institutions cannot charge extra fees or throw up friction when an SME wants to move its account, credit history or data to a competitor.
- A hard complaints timeline. Banks must acknowledge a complaint within two business days and issue a final written response within 30 business days, with a clear path to escalate unresolved cases to the Sanadak ombudsman.
- Affordability checks before lending. Financial institutions cannot extend credit beyond what a Customer can reasonably service, and must check the borrower's history with a Credit Information Agency such as Etihad Credit Bureau first.
- Bilingual, plain-language disclosure. All terms, fees and risk disclosures must be available in both English and Arabic and written in language an SME owner, not a lawyer, can actually follow.
Why This Matters Beyond Compliance Departments
Marie Chowdhry, a UAE-based financial regulation and fintech partner at Pinsent Masons, described the shift as the Central Bank treating SMEs as a distinct, protected customer segment for the first time, rather than folding them into general commercial banking practice. She and colleague Lana Akkad noted that the change moves the UAE from broad conduct principles toward what they called a prescriptive, customer-outcomes-focused framework with much tighter operational requirements.
Practically, that means banks will need to revisit how SME loan products are designed and priced, not just how they are disclosed. Dubai-based financing specialist Seya Rahnema, also of Pinsent Masons, pointed out that the rules place clear accountability on bank boards and senior management for the design and ongoing oversight of SME products, and require structured frameworks for supporting SME borrowers who fall into financial difficulty rather than moving straight to collections.
The timing lines up with a broader push into digital and embedded SME finance. The CBUAE's Open Finance Regulation, which took effect in July 2025, already lets licensed fintechs pull consented SME transaction data to build faster credit-scoring and lending tools. Read alongside the new customer protection rules, the direction of travel is clear: regulators want more SME credit flowing, but through channels with tighter disclosure, fairer fees and enforceable complaint rights than the market has offered so far.
Timeline: From Circular to Compliance Deadline
| Date | Milestone |
|---|---|
| January 26, 2021 | Original SME Market Conduct Regulation (Circular 1/2021) takes effect |
| February 17, 2026 | CBUAE issues Circular No. 2/2026, the new SME Customer Protection Regulation |
| March 2026 | Six-month implementation clock begins for banks and finance companies |
| September 13, 2026 | New regulation takes effect; 2021 rule is formally cancelled |
What Founders and SME Lenders Should Do Before September 13
- Ask your relationship bank whether it has issued you a Key Facts Statement for any facility you are about to sign, and if not, request one before proceeding.
- If you have been waiting more than three business days on a straightforward account opening with all documents submitted, ask the bank to document the reason for the delay in writing.
- Keep a written record of any complaint you raise with a lender. Institutions must now acknowledge complaints within two business days and resolve them within 30.
- If your bank has not resolved a dispute to your satisfaction after 30 business days, you can escalate to the Sanadak ombudsman unit.
- Fintechs building SME lending or account-aggregation products should map their onboarding, pricing and collections flows against the regulation now, since enforcement includes financial sanctions and restrictions on senior management.
Read Also
DFSA Strengthens DIFC's Global Standing With New Crypto Rules and an Agentic AI Push
Emirates NBD Partners With Dubai Future District Fund to Fast Track AI and FinTech Innovation
Dubai SME Folds Hi2 Incubator Into Founders HQ, Opens New Track for Emirati Founders
