Buy now, pay later is a mainstream checkout option in the UAE, and since 2023 it has been regulated as short-term credit under the Central Bank’s Finance Companies Regulation, with explicit caps on fees, exposure and tenor. For providers, and for the banks now entering the market, the rules define the systems you need.
This guide covers what the CBUAE requires, how Saudi Arabia’s approach differs, and what a compliant BNPL or embedded-credit platform must be built to do.
UAE: short-term credit under the Finance Companies Regulation
The Central Bank of the UAE brought BNPL into regulation through its Finance Companies Regulation (Circular 3/2023), which created a Restricted Licence Finance Company category for short-term credit. Under it, a provider may offer credit with no interest, fees capped at thirty percent of the principal, a maximum of AED 20,000 outstanding per customer, and a tenor of up to twelve months. Providers that do not want a licence of their own can operate as agents of a licensed bank or finance company, which is how several international BNPL brands structured their UAE operations.
The CBUAE also applies its consumer protection standards to BNPL: affordability assessment, disclosure, cooling-off periods and complaints handling, and reporting to the Al Etihad Credit Bureau.
How Saudi Arabia differs: SAMA’s rules for BNPL companies
The Saudi Central Bank issued its Rules for Regulating Buy Now Pay Later Companies on 17 December 2023, after running the sector through its sandbox and permitting the largest players, Tamara and Tabby, to operate under licence. The rules require a licence from SAMA, a minimum capital of SAR 5 million, fit-and-proper management, and a set of consumer protection obligations: clear disclosure of terms, a limit on the total exposure of a customer across BNPL providers, mandatory credit checks through the credit bureau SIMAH, reporting of BNPL obligations to the bureau, and restrictions on fees and on marketing to minors.
The effect was to turn BNPL into a regulated form of consumer credit with the data obligations that implies. A provider now needs the systems of a lender: credit decisioning connected to the bureau, exposure tracking across products, collections and complaints handling, and regulatory reporting.
What a compliant BNPL platform must do
Regulation in both markets converges on the same system requirements. Real-time credit decisioning at checkout, drawing on bureau data and the provider’s own repayment history, within a latency budget of a second or two so that conversion does not suffer. Exposure management across the customer’s products and, in Saudi Arabia, visibility of exposure at other providers through the bureau. Affordability assessment that can be evidenced to the regulator, not only a score. Fee and tenor rules enforced in the product engine, not in a policy document. Collections that respect consumer protection rules on contact and charges. And reporting: to the bureau, to the regulator and to the merchant.
Identity and fraud are the other half. First-party fraud, synthetic identities and account takeover are the main loss drivers in BNPL, and both regulators now expect identity verification through the national digital identity (Nafath, UAE Pass) rather than a card number and a phone.
Banks are entering the market
The regulatory clarity has drawn banks in. Several Gulf banks now offer instalments at checkout and post-purchase conversion of card transactions, using the same decisioning engines as their card business and competing on cost of funds. For a bank the build is an embedded-credit product: a merchant-facing API or checkout plugin, a customer journey inside the bank app and at the merchant, a decision engine, and integration with the card and core systems for settlement. It reuses most of what a modern digital banking platform already has.
Merchant integration decides adoption
The product is only as good as its distribution. In both markets the winners integrated early with the dominant e-commerce platforms, payment gateways and point-of-sale providers, so that a merchant could switch BNPL on in an afternoon. A provider or bank launching now needs the same: plugins for the major commerce platforms, a clean REST API with sandbox and documentation, and in-store QR or card-linked flows. Merchant onboarding, settlement and dispute handling are a second product that deserves its own team.
How Eurisko helps
Eurisko builds lending and embedded-credit journeys for banks and fintechs in the Gulf: checkout and in-app instalment flows, decision engine integration, bureau connectivity, merchant portals and the back-office tooling regulators expect. If you are a licensed provider adapting to the rules or a bank entering the market, talk to our fintech team about what can be configured on our platform and what needs to be built.
