Answers to the questions Middle East banking leaders most commonly ask about digital banking, Banking-as-a-Service, regulatory frameworks, and the above-core deployment model.
Banking-as-a-Service (BaaS) is a model where a licensed bank provides its regulated infrastructure to third parties via APIs. In the region, it enables traditional banks to distribute their products through partner platforms or power new digital brands without requiring a separate banking licence.
BaaS changes the economics of digital banking. Instead of building every product internally, a bank becomes the infrastructure provider for an ecosystem of partners. The bank retains the regulatory licence, the customer relationship, and the ledger. The partner provides distribution. In the Middle East and Africa, this model is particularly relevant as central bank Open Finance mandates create structured frameworks for API-based product distribution.
A Digital Innovation Layer is a cloud-native platform deployed above a bank's existing core system, adding new product capabilities without replacing the core. It allows banks to launch modern digital products in months rather than the 3-5 years and $20M-$50M+ a full core replacement requires.
The critical distinction is additive versus replacement. A core replacement touches every system, every product, and every customer simultaneously. It is a complete operational overhaul with significant risk of disruption during the transition period. A Digital Innovation Layer adds capabilities on top of what already works. The core continues operating as normal. New products, new channels, and new payment rails run on the innovation layer while existing products run on the existing core.
Yes. The above-core deployment model allows traditional banks to launch neobank-grade products, including virtual accounts, multi-currency wallets, virtual cards, and embedded finance capabilities, above their existing core infrastructure. Time to market is typically under six months.
Neobanks have a technology advantage, not a fundamental banking advantage. They hold no balance sheets, have no branch networks, and carry no customer trust built over decades. What they have is speed and user experience. The above-core model gives traditional banks that same speed and experience capability without surrendering their structural advantages.
A bank-controlled ledger means the authoritative record of every transaction sits inside the bank's own infrastructure, not on a third-party platform. The bank retains full visibility, full audit capability, and full regulatory accountability at all times, regardless of which partners or channels distribute its products.
This is the critical difference between a genuine BaaS model and a sponsored banking arrangement where the ledger sits with a fintech partner. When regulators audit a bank's embedded finance programmes, they require evidence of oversight and control. A bank-controlled ledger satisfies that requirement. A partner-held ledger does not.
PTSR (Payment Token Services Regulation, CBUAE Circular 2/2024) governs third-party payment tokens and stablecoins in the UAE. The transitional period ended 14 June 2025. The regulation is now fully in force, creating two instrument categories: Dirham Payment Tokens and Foreign Payment Tokens.
Dirham Payment Tokens are AED-denominated digital payment instruments requiring a full CBUAE licence, appropriate only for entities with banking or payment institution authorisation. Foreign Payment Tokens are non-AED stablecoins requiring CBUAE registration. Banks that have not assessed their exposure to both categories should treat this as an urgent compliance review.
Federal Decree-Law No. 6 of 2025 (CB Law 2025) is the UAE's expanded central banking framework, effective 16 September 2025. It broadens the regulatory perimeter to include DeFi, tokenised real-world assets, enabling technology providers, and AED 1 billion penalty exposure. Full compliance deadline is 16 September 2026.
FDL 6/2025 and PTSR are two separate frameworks with two separate deadlines. PTSR governs payment tokens specifically. FDL 6/2025 governs the broader financial system perimeter including technology providers that enable regulated financial activities. Banks whose technology partners may fall within the expanded FDL 6/2025 perimeter need to assess that exposure before September 2026.
A tokenised deposit is a bank's own liability on a distributed ledger. A stablecoin is a licensed issuer's liability pegged to a fiat currency. A CBDC (Central Bank Digital Currency) is a central bank's liability issued digitally. These are three legally distinct instruments with different issuers, different regulatory frameworks, and different risk profiles.
For a licensed bank, the tokenised deposit is the most defensible starting point. It requires no new licence, it is the bank's own liability, and it is legally equivalent to a traditional deposit. Stablecoins require a separate PTSR approval. CBDCs (the Digital Dirham) are issued by CBUAE and distributed through licensed banks. Banks participate as distributors, not issuers.
The Digital Dirham is the UAE's Central Bank Digital Currency (CBDC), a two-tier model where CBUAE issues and licensed banks distribute. As of July 2026, it is in advanced pilot stage with pilot transactions executed and gradual expansion planned through 2026, with full commercial launch targeted for late 2026.
Banks should not conflate the Digital Dirham with private stablecoins or tokenised deposits. These are three distinct instruments. The Digital Dirham is a CBUAE liability. Banks participate as distributors via CBUAE-approved wallets, not as issuers. Preparing the technology infrastructure now to integrate with Digital Dirham distribution rails is the relevant strategic move.