Ongoing Compliance Under RPSCS:

Governance, AML & Supervisory Reporting Requirements (2026 Edition)

By CRYPTOVERSE Legal Consultancy
Advising Payment Institutions, Remittance Operators & Fintech Platforms on CBUAE Post-Licensing Compliance & Supervisory Strategy

Licensing Is the Beginning — Supervision Is the Reality

Many fintech founders celebrate the moment they receive a licence under the Retail Payment Services and Card Schemes (RPSCS) regime.

But under the Central Bank of the UAE (CBUAE), licensing is not the finish line.

It is the starting point of continuous supervision.

Once licensed, payment institutions enter an environment defined by:

• Governance accountability
• AML/CFT vigilance
• Operational resilience expectations
• Prudential capital monitoring
• Regulatory reporting discipline
• The possibility of inspection

Ongoing compliance under RPSCS is not static.

It is dynamic.

It scales with:

• Transaction volume
• Cross-border exposure
• Merchant risk
• Corridor concentration
• Systemic importance

This article provides a comprehensive breakdown of:

• Governance obligations
• AML/CFT ongoing requirements
• Risk management architecture
• Supervisory reporting expectations
• Inspection readiness
• Escalation and enforcement exposure
• Best practices for maintaining supervisory confidence

If you operate under RPSCS, this is your operational survival manual.

Part I — The Post-Licensing Mindset Shift

Before licensing, your focus is:

“How do we get approved?”

After licensing, the focus shifts to:

“How do we remain compliant at scale?”

Under RPSCS, ongoing compliance is anchored in three pillars:

1. Governance & Internal Control
2. AML/CFT & Sanctions Compliance
3. Regulatory Reporting & Supervisory Engagement

Each pillar carries structural obligations.

Failure in any one area may result in:

• Remediation notices
• Restrictions on activity
• Fines
• Licence suspension

Supervisory trust is cumulative.

Part II — Governance Architecture Under RPSCS

The CBUAE expects licensed PSPs to maintain a governance framework proportional to their category and risk profile.

1️. Board Oversight

The board must:

• Approve risk appetite
• Oversee compliance framework
• Review capital adequacy
• Monitor AML reporting
• Approve new corridors or major expansions
• Review internal audit findings

Quarterly board reporting is standard expectation for Category II and I institutions.

High-growth PSPs may require more frequent oversight.

2️. Senior Management Accountability

Senior management must ensure:

• Effective implementation of policies
• Adequate compliance staffing
• Escalation of material incidents
• Resource allocation aligned with risk

Supervisors expect documented accountability matrices.

3️. Key Control Functions

At minimum:

• Compliance Officer
• MLRO
• Risk Management Function
• Internal Audit (independent review)

Category I operators may require expanded compliance teams.

Role clarity is critical.

Part III — AML/CFT Ongoing Obligations

AML is the most scrutinised component of RPSCS supervision.

Customer Due Diligence (CDD)

Ongoing obligations include:

• Periodic customer risk reviews
• Trigger-based reviews
• Enhanced Due Diligence (EDD) where risk escalates
• Sanctions re-screening

Risk-based frequency is expected.

High-risk customers require more frequent reassessment.

Transaction Monitoring

Monitoring must:

• Scale with volume
• Reflect corridor risk
• Adapt to behavioural changes
• Detect structuring patterns
• Capture mule networks

Monitoring effectiveness must be periodically tested.

Alert backlogs are red flags.

Sanctions Compliance

Ongoing obligations include:

• Daily list updates
• Screening of customers and beneficiaries
• Tuning governance
• Quality assurance sampling
• Escalation protocols

Sanctions governance must be documented and board-visible.

Suspicious Transaction Reporting (STR)

The MLRO must:

• Assess escalated alerts
• File STRs promptly
• Maintain documentation
• Report trends to board

Supervisors review:

• STR volume
• Quality
• Timeliness
• Thematic consistency

Low STR volumes in high-volume PSPs raise suspicion.

Part IV — Risk Management Framework

Beyond AML, risk management under RPSCS includes:

• Operational risk
• Settlement risk
• Fraud risk
• Technology risk
• Business continuity risk

Risk Appetite Statement

The board should formally define:

• Corridor risk thresholds
• Transaction limits
• Merchant concentration limits
• Exposure caps
• Incident tolerance levels

Risk appetite should be reviewed annually.

Risk Committee

Category II and I PSPs typically maintain:

• Monthly risk committee meetings
• Incident review sessions
• Risk metric dashboards
• Action tracking

Supervisors expect documented minutes.

Part V — Capital Monitoring & Prudential Discipline

Although RPSCS capital is category-based, ongoing monitoring is required.

PSPs must:

• Maintain minimum capital at all times
• Monitor capital adequacy quarterly
• Avoid erosion through losses
• Inform regulator if capital thresholds approach minimum

Unexpected losses from fraud or operational failure can impact capital.

Capital buffers above minimum are prudent.

Part VI — Supervisory Reporting Requirements

The CBUAE requires periodic regulatory reporting.

This may include:

• Financial statements
• Capital adequacy confirmation
• Transaction volume reports
• AML metrics
• Incident reports
• Governance attestations

Timeliness and accuracy are critical.

Repeated late submissions damage supervisory trust.

Incident Reporting

Material incidents must be reported promptly.

Examples:

• Major fraud event
• Sanctions breach
• System outage affecting customers
• Partner failure
• Data breach

Proactive reporting is viewed positively.

Delayed disclosure is not.

Part VII — Inspection & Supervisory Engagement

Licensed PSPs should expect:

• Off-site reviews
• Data requests
• Thematic AML reviews
• On-site inspections

Preparation includes:

• Documentation readiness
• Monitoring logs
• Risk committee minutes
• Audit findings
• Remediation tracking

Inspection readiness is an ongoing discipline, not a reactive scramble.

Part VIII — Common Post-Licensing Weaknesses

Regulators frequently identify:

• Compliance staffing not scaling with volume
• Alert backlogs
• Weak corridor governance
• Merchant risk not monitored
• Incomplete sanctions tuning documentation
• Lack of independent audit
• Governance minutes lacking substance

These weaknesses often appear in fast-growing PSPs.

Part IX — Governance Scaling by Category

Supervisory expectations scale with category.

Part X — The Cost of Weak Ongoing Compliance

Failure to maintain compliance can result in:

• Remediation directives
• Volume caps
• Corridor restrictions
• Fines
• Public enforcement action
• Licence suspension

Reputational damage often exceeds financial penalties.

Part XI — Designing a “Supervisory-Ready” PSP

Best practices include:

1. Build governance before scaling volume
2. Maintain compliance staff-to-volume ratio
3. Implement dashboard reporting
4. Conduct annual independent AML review
5. Stress-test monitoring systems
6. Maintain capital buffer
7. Engage regulator proactively on expansion

Supervisory readiness must be continuous.

Part XII — The Regulator Engagement Strategy

Strong PSPs:

• Notify regulator before launching new corridors
• Inform regulator of capital changes
• Share governance updates
• Provide voluntary risk assessments
• Demonstrate transparency

Supervisors prefer transparency over surprise.

Part XIII — Technology & RegTech Expectations

CBUAE expects:

• Robust transaction monitoring systems
• Audit trails
• Data retention controls
• Access controls
• Cybersecurity safeguards
• Business continuity planning

Technology resilience is part of prudential supervision.

Part XIV — Annual Compliance Health Check

PSPs should conduct:

• AML effectiveness review
• Sanctions tuning audit
• Risk appetite reassessment
• Capital adequacy review
• Governance effectiveness evaluation
• Partner due diligence refresh

This annual review strengthens supervisory posture.

Conclusion: Ongoing Compliance Is Competitive Advantage

Under RPSCS:

Licensing gets you entry.

Ongoing compliance keeps you in the market.

Governance builds credibility.

AML maturity builds trust.

Supervisory transparency builds longevity.

The most successful PSPs in the UAE are not those who grow fastest.

They are those who scale responsibly.

Why CRYPTOVERSE Legal Consultancy

We support payment institutions with:

• Post-licensing compliance audits
• Governance framework design
• AML stress testing
• Regulatory reporting support
• Category escalation planning
• Supervisory engagement strategy
• Internal compliance training

We build regulatory infrastructure that survives inspection.

Key Takeaways

• Ongoing compliance under RPSCS is dynamic.
• Governance must scale with volume and risk.
• AML monitoring must remain effective at scale.
• Regulatory reporting must be timely and accurate.
• Capital adequacy must be monitored continuously.
• Supervisory engagement should be proactive.

Legal Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Ongoing compliance obligations under the CBUAE RPSCS Regulation depend on the specific licence category, transaction scope, governance structure, and supervisory assessment applicable to each licensed institution. Formal legal analysis should be undertaken prior to implementing governance or compliance changes.

FAQs