BNPL Regulation in the GCC: How SAMA, CBUAE and QCB Are Shaping the Market in 2026

Buy now, pay later has moved from regulatory afterthought to front-line supervisory priority across the Gulf. In the space of eighteen months, all three of the GCC's principal financial regulators have published or enforced operational BNPL frameworks, each reflecting distinct consumer protection philosophies, licensing architectures, and market realities. For payments firms, fintechs, and embedded finance providers active in the region, the question is no longer whether BNPL will be regulated, but how to operate profitably within three divergent rulebooks simultaneously.

Why the GCC Became a BNPL Flashpoint

The structural conditions for rapid BNPL adoption in the Gulf are well documented: a young, digitally fluent population, high smartphone penetration, large unbanked and underbanked segments in certain markets, and a cultural preference for deferred payment that predates fintech by decades. What changed in 2023 and 2024 was the scale. Buy now, pay later volumes across the UAE, Saudi Arabia, and Qatar grew sharply enough to draw regulatory attention, as complaints about undisclosed fees, aggressive collection practices, and debt accumulation among lower-income migrant workers reached supervisory desks. Regulators responded not by suppressing the sector, but by building frameworks designed to formalise and contain it.

The timing also reflects a broader regional pattern. Following the implementation of open banking standards, payment token regulations, and instant payment rails, GCC central banks have demonstrably increased their appetite for proactive consumer credit regulation. BNPL represented a natural extension of this trend.

Saudi Arabia: SAMA's BNPL Licensing Framework

Saudi Arabia's Buy Now Pay Later regulation is administered by the Saudi Central Bank and operates within the Finance Companies Control Law and its implementing regulations. SAMA does not issue a standalone BNPL licence; instead, BNPL providers operate under a Financing Company licence or as a module within an existing payment institution authorisation. Firms offering split-payment or deferred-payment products to Saudi consumers must hold a valid SAMA licence, maintain prescribed minimum capital, and comply with affordability assessment rules that require credit checks via SIMAH for exposures above defined thresholds.

SAMA published updated guidance on BNPL in 2024, clarifying that products with an aggregate of four or fewer instalments and no interest charges do not qualify as consumer credit for the purpose of SIMAH reporting, although the licensing requirement still applies. This distinction is material for firms operating standard split-payment models, as it reduces the compliance burden while reserving fuller credit checking obligations for longer-tenure or interest-bearing facilities.

Licensed BNPL operators in Saudi Arabia include Tamara, which held a SAMA financing licence and has grown to become the largest independent BNPL operator in the GCC by transaction volume, and Tabby, which is licensed in both Saudi Arabia and the UAE and has expanded into a broader consumer finance platform. Additional licensed operators include Split (now part of the SATC group) and several bank-affiliated products offered under existing retail licences.

SAMA has been consistent in signalling that BNPL licences will not be extended to companies without a physical presence in the Kingdom. This has effectively excluded a number of international BNPL providers from the market and supported the dominance of domestically established firms.

UAE: CBUAE's Buy Now Pay Later Regulation

The Central Bank of the UAE published its standalone Buy Now Pay Later regulation in July 2024, making it one of the most explicit BNPF frameworks in the GCC. The regulation applies to all firms offering deferred-payment products to retail consumers in the UAE, regardless of whether they are structured as interest-bearing or fee-based arrangements. Firms must obtain a dedicated BNPL licence from the CBUAE, maintain minimum paid-up capital of AED 10 million, and meet fit-and-proper criteria for shareholders and senior management.

The CBUAE framework includes the most prescriptive consumer protection rules across the three jurisdictions. Licensees must conduct credit assessments and affordability checks for all customers, including those taking zero-interest instalment plans. Total BNPL exposure per consumer is capped at AED 20,000 across all providers, and providers are mandated to report exposures to the Al Etihad Credit Bureau. Late fees are capped in absolute terms, and pre-contractual disclosures must be provided in both Arabic and English.

Licensed BNPL providers in the UAE include Tabby, Postpay, and Spotii, along with several bank-backed instalment products operating under amended retail banking licences. The CBUAE has also confirmed that no-interest instalment plans offered directly by merchants without an intermediary provider fall outside the licensing requirement, although merchant-funded instalment plans remain subject to consumer protection obligations under separate commerce legislation.

Qatar: QCB's Regulatory Approach

The Qatar Central Bank has taken a more gradual approach to BNPL regulation than either SAMA or CBUAE. As of mid-2026, QCB has not published a standalone BNPL regulation, but has issued supervisory guidance incorporating BNPL products within its existing consumer finance and payment services frameworks. BNPL providers seeking to operate in Qatar must hold a QCB-issued payment services licence or a consumer finance licence, depending on the structure of their product.

The QCB maintains a strict posture on foreign ownership in financial services, which has constrained the entry of international BNPL fintechs. The domestic market is largely served by bank-integrated instalment products, with known operators including Tabby (licensed in Qatar as a payment services provider) and select bank partnership models offered through commercial banks holding existing QCB retail licences.

QCB has signalled intent to publish formal BNPL regulations in the second half of 2026, following a consultation process launched in 2025. Expected elements include an exposure cap, mandatory reporting to the Qatar Credit Bureau, and specific guidance on late fee structures. Until such regulations are formalised, the market remains less open to new entrants than either the UAE or Saudi Arabia.

Regulatory Comparison Across the GCC

The three frameworks share a common rationale but differ materially in structure, strictness, and scope. The Cbuae framework is the most explicit and consumer-focused, with a hard exposure cap and mandatory bureau reporting for all products. SAMA' approach is more tiered, permitting simpler products to operate with reduced compliance burdens while applying heavier scrutiny to more complex facilities. QCB's position is still evolving, offering a narrower operating window for new entrants until formal regulations are published.

For multi-market operators, the practical implication is that a single product architecture is unlikely to be fully compliant across all three jurisdictions. Affordability assessment methodologies, exposure cap structures, bureau reporting obligations, and disclosure formats must all be localised. This requires either a modular compliance architecture or separate operational entities in each market.

Strategic Implications for BNPL Operators

For firms already operating in the GCC, compliance with evolving BNPL regulations requires a structured response across several dimensions. Licence analysis is the first priority: firms must confirm that their existing licences cover their product architectures as now defined by each regulator. Products that qualified as payment facilitation under older rules may now fall within a licensed category.

Credit infrastructure requirements are the second key area. All three jurisdictions now require or strongly encourage integration with national credit bureaus. For fintechs without existing bureau relationships, procuring and implementing this capability represents a material upfront cost. In the UAE, reporting to Al Etihad is already mandatory. In Saudi Arabia, SIMAH reporting is required for instalment products above specified thresholds.

Capital and liquidity planning is also affected. As BNPL providers move from payment facilitators to regulated lenders, they become subject to minimum capital requirements and liquidity ratios that were not previously applicable. This affects funding structure and growth planning across all three markets.

For firms evaluating market entry, the frameworks send a clear signal: the GCC BNPL market is maturing and the window for operating in regulatory grey-space has closed. Firms that plan entry in 2026 or later should budget for licensing costs, legal establishment in each market, bureau integration, and localised compliance resources. The firms most likely to succeed are those that treat regulatory compliance as a competitive advantage rather than an operational cost.