Read this first
This regulation sets conduct, transparency and complaint-handling standards for banks and finance companies serving SME customers. It does not guarantee that an account will be opened, that credit will be approved, that funds will be released, or that a compliance decision will be reversed. Matters involving anti-money laundering, sanctions, source of funds, or a court or enforcement step are governed by different rules, and a bank may be unable to disclose the full reason.
The Central Bank of the UAE's Small to Medium Sized Enterprises (SME) — Customer Protection Regulation, C 2/2026, came into effect on 13 September 2026 and replaces the previous SME Market Conduct Regulation, Circular 1/2021. The text is published in the official CBUAE Rulebook.
What follows is an explanation written for SME owners, founders, directors and finance teams. It is commentary on a published regulation, not legal advice, and not a statement of how any institution or authority will act in a particular case. Where the regulation is described, the wording stays close to the official text; readers should consult the Rulebook directly.
Who is covered
The regulation applies to CBUAE-licensed Banks and Finance Companies providing covered products and services to SME customers. Institutions operating in compliance with Islamic Shari'ah provisions are within scope on the same basis.
Its stated objectives include SME customer protection, transparency, access to banking facilities, complaint redress, responsible financing, and support and communication for customers experiencing financial difficulty.
What changed for SME customers
The practical shifts fall into a few areas that business owners are most likely to encounter.
- Disclosures should be accurate, transparent and understandable, and provided in English and Arabic.
- A Key Facts Statement should be provided before the contract is entered into, so that pricing and principal terms are visible in advance.
- At least 60 calendar days' written notice is expected before changes to terms or fees.
- Where an application for a product or service is rejected, the reason should be given in writing — except where it relates to Financial Crime risks, or where disclosure is prohibited by law or regulation.
- Financial difficulty provisions contemplate support frameworks that may involve restructuring, modification of a credit product or adjusted payment plans, together with access to impartial credit counselling and controls against excessive debt-collection pressure.
How the SME complaint process works
Complaint management and resolution is addressed directly in the regulation. The article text is published as Article 6 — Complaint Management and Resolution, and the effective date is recorded in Article 13 — Publication and Effective Date.
| Stage | What the regulation provides for |
|---|---|
| Making the complaint | The complaint process must be accessible and free of fees. Submit in writing and keep a copy of what was sent and when. |
| Acknowledgement | Written acknowledgement within 2 business days, with a unique reference number for the complaint. |
| Final response | A final written response within 30 business days, or another time limit prescribed by the Central Bank. |
| If unresolved | The institution should inform the customer about available external resolution routes, including Sanadak. |
| Records | Complaint records are to be retained for at least five years. |
Summary prepared for explanation only. The official Rulebook text governs.
The practical mechanics of the route — raising the complaint with the institution first, the acknowledgement and reference number, the waiting period, and the eligibility criteria that Sanadak applies to an escalated matter — are set out on our page on making and escalating a bank complaint in the UAE.
What to document when a banking problem arises
Most SME banking disputes are decided on the quality of the record rather than on the force of the complaint. A clear, dated, consistent file is the single most useful thing a finance team can prepare.
- The complaint reference number issued by the bank, and the date of acknowledgement.
- A dated chronology of what happened: when the account, facility or payment was affected, and what was said by whom.
- Written correspondence only — branch conversations and call-centre assurances are difficult to rely on later.
- The Key Facts Statement, the signed contract and any notice of changes to terms or fees.
- For a payment that has not arrived, the transfer reference, value date, currency, and the identity of the sending, receiving and any intermediary bank.
- For a document request, exactly what was asked for, in what form, and by what date.
Where the issue is a single payment rather than the relationship as a whole, our page on a bank transfer held or delayed in the UAE sets out normal timing expectations and how to put the questions in writing. Where the bank has asked for documentation, the page on a source of funds request from a UAE bank covers how such requests are usually framed. Where the account itself is restricted, the page on a frozen or restricted UAE bank account is the closer fit.
Service complaints versus financial-crime and legal matters
This distinction matters more than any other, because the complaint process is well suited to one category and largely unsuited to the other.
An ordinary conduct or service issue — an unexplained fee, a change made without the expected notice, a missing Key Facts Statement, an unanswered application, poor handling of a financial-difficulty discussion — is precisely what the complaint route exists for.
A matter driven by anti-money laundering procedure, sanctions screening, a source of funds or source of wealth review, or a court, enforcement or regulatory restriction is different. The regulation itself recognises this: where a rejection relates to Financial Crime risks, or where disclosure is prohibited by law or regulation, the reason need not be given. In those cases a complaint will not produce the explanation the business is looking for, and escalating tone rarely helps. Preparing a complete and consistent documentary record usually does more.
What the regulation does not guarantee
It is worth being explicit. C 2/2026 does not guarantee that an SME account will be opened or maintained. It does not guarantee that credit will be granted or a facility renewed. It does not require funds to be released, a restriction to be lifted, or a compliance decision to be reversed. It does not guarantee that a complaint will be decided in the customer's favour, and it is not evidence that a bank has acted improperly in any particular case. It sets standards of conduct, transparency and process — which is valuable, and different.
Primary sources
The regulation is published in full by the Central Bank of the UAE. Readers should consult the CBUAE Rulebook section for the SME Customer Protection Regulation, the article on complaint management and resolution, and the publication and effective date article, together with the Central Bank of the UAE website, in preference to secondary summaries, including this one.