What Boards, Islamic Banks, Finance Companies, Takaful Operators and Compliance Leaders Need to Understand
The UAE has taken an important step in strengthening the legal and regulatory architecture of Islamic finance.
The Central Bank of the UAE (CBUAE) has issued Regulation No. 1/2026, concerning the controls and rules governing commercial transactions of Islamic Financial Institutions and Takaful Companies.
The regulation implements Article 471 of Federal Decree-Law No. 50 of 2022 concerning the Commercial Transactions Law and provides detailed provisions governing Islamic financing, investment accounts, contractual obligations, partnership arrangements and Takaful transactions.
Its significance goes beyond codifying Islamic financial contracts.
It creates a more explicit legal framework against which the substance, execution and enforceability of Islamic financial transactions can be assessed.
For financial institutions, the practical challenge is to ensure that Sharia principles are reflected consistently across product design, contracts, technology, accounting, risk management, customer treatment and operational execution.
A Sharia-compliant contract is not necessarily evidence of a Sharia-compliant end-to-end transaction.
- The Legal Foundation: From Sharia Principles to Enforceable Commercial Obligations
Articles 2–5: Scope, Sharia Compliance and Contractual Validity
Article 2 establishes the regulation’s scope across Islamic commercial transactions, including deposits, investment accounts, financing, investments, Takaful and retakaful.
It also establishes an important hierarchy for matters not specifically addressed in the Commercial Transactions Law.
Relevant requirements include:
- The provisions of Regulation No. 1/2026.
- Standards and requirements approved by the Higher Sharia Authority and issued through the applicable regulatory framework.
- Contractual agreements, provided they do not contradict Islamic Sharia.
Article 3 recognises the role of the Higher Sharia Authority and the Internal Sharia Control Committee in determining Sharia compliance, subject to the applicable legal hierarchy.
Article 5 addresses contractual validity and the potential rectification of certain defective contractual provisions.
Why this matters
Financial institutions should no longer assess Islamic products solely against their existing internal Sharia approvals.
They should establish a documented mapping between:
- Applicable commercial law.
- CBUAE regulations.
- Higher Sharia Authority standards and decisions.
- Internal Sharia Control Committee decisions.
- Product documentation and operational processes.
Compliance implication: A previous internal Sharia approval should not be treated as automatic confirmation that a product satisfies every applicable provision of the new regulation.
- Debt Obligations, Late Payments and Prohibited Financial Benefits
Article 6: Financial Obligations and Debt Treatment
One of the most commercially significant areas concerns the treatment of monetary obligations.
Article 6 establishes that monetary or commodity debts must be clearly determined.
It prohibits extending an established debt’s maturity in exchange for an absolute increase in the amount owed.
The regulation also distinguishes prohibited debt increases from certain permissible arrangements, including:
- Commitments to donate amounts to charity following delayed payment, where the creditor receives no direct or indirect benefit.
- Recovery of actual direct debt-collection expenses, subject to applicable Higher Sharia Authority requirements.
The regulatory challenge
Institutions should review whether their systems distinguish between:
- Contractual profit.
- Outstanding principal.
- Charitable late-payment amounts.
- Actual recovery expenses.
- Prohibited additional financial benefits.
This distinction must exist in operational systems, not merely in contractual language.
Example
An Islamic finance company cannot simply extend a customer’s overdue financing obligation and increase the outstanding debt as compensation for the additional time.
A compliant treatment requires examination of the underlying contract, the permissible recovery mechanisms and the relevant Sharia requirements.
What Compliance and Risk should review
- Late-payment fee configuration.
- Debt restructuring arrangements.
- Collections and recovery policies.
- Automated profit calculations.
- Charity account governance.
- Accounting and reconciliation treatment.
- Customer communications concerning overdue obligations.
Key question: Can the institution demonstrate that its collections platform does not generate prohibited financial benefits?
- Islamic Deposits and Investment Accounts: A Fundamental Distinction
Articles 10–17: Deposits, Mudaraba and Investment Accounts
The regulation establishes important distinctions between ordinary Islamic cash deposits and funds allocated for investment.
Cash deposits
Under Article 17, an ordinary cash deposit constitutes a debt owed by the Islamic Financial Institution to the depositor.
The institution must return the equivalent amount according to the applicable contractual conditions.
Interest on such deposits is prohibited.
Investment accounts
Under Article 11, funds deposited for investment are treated differently.
The institution does not automatically acquire ownership of those funds, and the investment amount is not ordinarily treated as a debt owed by the institution.
The institution is generally not permitted to guarantee investment capital or investment returns, except where liability arises from misconduct, negligence or breach of applicable conditions.
Article 12 addresses investment structures based on Mudaraba and Wakalah Bil Istithmar.
Why this distinction is critical
An Islamic investment account should not be marketed or operated as a guaranteed-return deposit where the underlying contractual structure does not permit such a guarantee.
Institutions should review:
- Investment account classifications.
- Capital protection representations.
- Profit allocation methodologies.
- Investment loss treatment.
- Customer risk disclosures.
- Asset ownership and segregation arrangements.
- Investment management fees.
- Financial reporting and accounting controls.
Example
A bank offers an Islamic investment account and advertises a fixed, guaranteed annual return.
If the underlying structure is Mudaraba or investment Wakalah, the institution must assess whether that guarantee is permissible under the applicable contractual and Sharia requirements.
A projected or expected profit rate must not be confused with an unconditional contractual guarantee.
Compliance implication: Product classification, legal substance, risk allocation and customer-facing disclosures must remain consistent.
- Murabaha Financing: Ownership, Possession and Contractual Sequence
Article 21: Murabaha Contracts
Murabaha remains one of the most widely used Islamic financing structures.
However, its compliance depends on more than disclosing the purchase cost and profit margin.
Article 21 requires the institution to acquire ownership of the underlying asset before selling it to the customer.
The Murabaha price must be determined and fixed when the sale contract is concluded.
The regulation also addresses circumstances in which a customer has already entered into a contractual relationship with the supplier.
The operational risk
A digital Murabaha product may generate contracts automatically, but the technology must preserve the legally required sequence.
A simplified transaction should follow the appropriate contractual stages:
Customer request → Institution purchases asset → Ownership and possession requirements satisfied → Institution sells asset to customer → Customer repayment obligation arises
If a system records the customer purchase before the institution has acquired the asset, the transaction may raise material Sharia and contractual compliance concerns.
What institutions should test
- Evidence of asset ownership.
- Actual or constructive possession.
- Supplier contract documentation.
- Contract execution timestamps.
- Agency arrangements.
- Asset sale sequencing.
- Fixed selling price.
- Digital contract generation controls.
- Exceptions and failed transactions.
A critical compliance question: Can the institution reconstruct a Murabaha transaction from its system records and prove that every required contractual step occurred in the correct order?
This is particularly relevant to digital Islamic financing, embedded finance and automated product origination.
- Ijarah, Istisna’a and Salam: Different Structures, Different Risks
Articles 22–24
The regulation addresses several financing structures that carry different ownership, delivery and performance obligations.
Istisna’a – Manufacturing and Construction Finance
Article 22 governs manufacturing and construction arrangements.
Key considerations include the agreed specifications, contract price, delivery obligations and treatment of delays or changes.
Institutions should review:
- Contract price certainty.
- Manufacturing specifications.
- Delivery milestones.
- Contractor performance obligations.
- Permissible amendments.
- Treatment of non-conforming assets.
- Compensation for delayed delivery.
Salam – Forward Purchase Arrangements
Article 23 addresses forward-sale arrangements.
Institutions must consider the description of the underlying goods, delivery obligations and treatment of non-performance.
Relevant controls include delivery monitoring, commodity specifications and counterparty performance.
Ijarah – Islamic Leasing
Article 24 addresses leasing arrangements and the contractual right to use an asset.
The institution must ensure that lease terms, asset rights and rental obligations are consistent with the contractual structure.
Risk management implication
These structures require more than conventional credit-risk monitoring.
They may also introduce:
- Asset ownership risk.
- Delivery risk.
- Construction and completion risk.
- Operational risk.
- Contractual performance risk.
- Sharia non-compliance risk.
Risk assessments should reflect the actual economic and legal characteristics of each financing arrangement.
- Mudaraba, Musharaka and Wakalah: Profit and Loss Allocation
Articles 26–29
Investment and partnership arrangements present particularly important governance considerations.
Unlike conventional debt financing, the allocation of profits and losses depends on the underlying contractual relationship.
The regulation addresses banking Mudaraba, investment Wakalah, Musharaka and promises to purchase assets.
Areas requiring particular attention
Profit allocation
Institutions should confirm that profit-sharing and investment incentive mechanisms comply with the applicable contract and regulatory provisions.
Capital guarantees
Contractual arrangements must not improperly transfer investment losses to a party that is not permitted to guarantee them.
Investment management
The responsibilities of the Mudarib, investment agent or partners must be clearly established.
Purchase undertakings
Promises to purchase investment assets require careful review to avoid arrangements that undermine the relevant risk-sharing principles.
Governance implication
Legal, Treasury, Finance, Risk and Sharia functions should jointly assess whether investment arrangements reflect the intended contractual allocation of rights, obligations and risks.
A contract labelled as a partnership should not be treated as compliant merely because the document uses Islamic finance terminology.
- Takaful: Contractual Governance and Participant Protection
Article 32: Takaful Insurance
The regulation also addresses Takaful transactions.
For Takaful operators, regulatory implementation should be considered alongside the wider CBUAE insurance and Sharia governance framework.
A practical review should examine:
- Takaful contractual structures.
- Participant fund arrangements.
- Operator remuneration.
- Surplus and deficit treatment.
- Investment of Takaful funds.
- Retakaful arrangements.
- Customer disclosures.
- Internal Sharia governance.
- Related-party arrangements and conflicts of interest.
The key challenge is ensuring that contractual rights, fund governance and operational practices are consistent with the applicable Sharia structure.
For Takaful Boards, this should be treated as a governance and operational assurance exercise, not solely as a legal documentation review.
- Sharia Non-Compliance Risk Must Be Integrated into Enterprise Risk Management
This is one of the most important practical implications for Chief Risk Officers.
Sharia non-compliance risk should be recognised as a distinct risk driver within the institution’s broader risk management framework.
Potential consequences include:
- Financial losses.
- Contractual disputes.
- Income purification requirements.
- Customer remediation.
- Operational disruption.
- Regulatory findings.
- Reputational damage.
- Loss of stakeholder confidence.
A mature framework should include:
Risk Identification
Identify Sharia non-compliance scenarios across products, operations, technology, outsourcing and customer interactions.
تقييم المخاطر
Assess inherent risk, control effectiveness and residual exposure.
Risk Appetite
Establish appropriate risk appetite statements, escalation thresholds and governance expectations.
Key Risk Indicators
Examples include:
- Number of Sharia non-compliance incidents.
- Value of income requiring purification.
- Unresolved Sharia audit findings.
- Transactions processed outside approved structures.
- Delays in implementing Sharia committee decisions.
- Products operating with outdated documentation.
Incident Management
Establish clear procedures for investigation, impact assessment, escalation, remediation and reporting where required.
Important distinction: These are recommended risk management practices. They should not all be presented as newly prescribed requirements under Regulation No. 1/2026 itself.
- The Three Lines Model: Who Owns Sharia Compliance?
A recurring governance weakness is treating Sharia compliance as the exclusive responsibility of the Internal Sharia Control Committee.
That approach is insufficient for effective institutional control.
The Sharia committee provides specialist independent Sharia oversight, but operational accountability must be allocated across the institution.
First Line – Business and Operations
Responsible for implementing approved products, maintaining contractual sequencing, executing transactions correctly and identifying operational exceptions.
Second Line – Compliance and Risk
Responsible for regulatory interpretation, compliance monitoring, risk assessments, control challenge and escalation.
Third Line – Internal Audit
Responsible for independent assurance over the effectiveness of the governance and control framework.
The institution’s dedicated Sharia control and audit functions must also retain their responsibilities under applicable CBUAE Sharia governance standards.
The objective is not to replace Sharia governance with the three-lines model, but to integrate Sharia compliance into enterprise-wide accountability.
- Consumer Protection: The Customer Must Understand the Actual Product
Islamic financial products can involve complex contractual structures.
However, complexity does not remove the institution’s responsibility to provide clear, accurate and fair customer disclosures.
Institutions should assess relevant requirements under the CBUAE Consumer Protection Standards alongside their Islamic finance obligations.
Key considerations include:
- Whether expected profits are clearly distinguished from guaranteed returns.
- Whether customer investment risks are appropriately disclosed.
- Whether fees reflect the contractual arrangements.
- Whether early settlement provisions are properly explained.
- Whether late-payment obligations are accurately described.
- Whether customers understand ownership and loss-allocation arrangements.
- Whether product marketing is consistent with the approved legal structure.
A product can be appropriately structured under Islamic finance principles while still creating consumer protection concerns if its risks and obligations are communicated poorly.
Sharia compliance and consumer protection should therefore be assessed together, while recognising their distinct regulatory requirements.
- Digital Islamic Finance: Technology Must Respect the Contract
The rapid growth of digital banking, fintech, embedded finance and automated lending creates an additional challenge.
Islamic contractual requirements must be reflected in system architecture.
For example, automated Murabaha financing should include controls preventing a sale before the necessary ownership and possession conditions are satisfied.
Investment platforms should distinguish expected returns from contractual guarantees.
Collections systems should distinguish permissible recovery amounts from prohibited increases in debt.
Recommended technology controls
- Automated contractual sequencing.
- System-based Sharia compliance validation.
- Digital ownership and possession evidence.
- Contract and transaction audit trails.
- Exception monitoring.
- Approval controls for product changes.
- Automated reporting of potential Sharia breaches.
- Periodic independent testing.
For fintech firms partnering with Islamic banks or finance companies, contractual responsibility and control ownership should be clearly allocated.
Technology outsourcing does not eliminate the licensed institution’s responsibility for complying with applicable regulatory requirements.
- The DIFC Dimension: A Parallel Regulatory Development
The DFSA has separately introduced amendments to its Islamic Finance Rules through:
- Rule-making Instrument No. 440/2026.
- Rule-making Instrument No. 445/2026.
Both are scheduled to commence on 1 January 2027.
These amendments form part of the DIFC’s separate regulatory framework.
Firms conducting Islamic financial business in or from the DIFC should assess the relevant DFSA Islamic Finance Rules, including applicable authorisation, governance and disclosure requirements.
Importantly, CBUAE and DFSA frameworks should not be treated as interchangeable.
A firm’s obligations depend on its jurisdiction, authorisation, activities and the specific transactions concerned.
- What Boards and Senior Management Should Do Now
Rather than treating Regulation No. 1/2026 as a routine legal update, institutions should initiate a structured implementation programme.
Phase 1 – Regulatory Impact Assessment
Identify affected products, business units, contracts and systems.
Phase 2 – Contractual and Sharia Gap Analysis
Map existing arrangements against the Commercial Transactions Law, Regulation No. 1/2026 and applicable Higher Sharia Authority requirements.
Phase 3 – Operational Control Testing
Test whether transactions are actually executed in accordance with approved contractual structures.
Phase 4 – Governance and Risk Framework Enhancement
Review Sharia governance, risk management, compliance monitoring, incident escalation and independent assurance arrangements.
Phase 5 – Remediation and Board Oversight
Prioritise identified deficiencies, assign accountable owners and establish appropriate remediation deadlines.
A practical Board dashboard should report:
- Products assessed and outstanding.
- Material contractual deficiencies.
- High-risk operational control gaps.
- Sharia non-compliance incidents.
- Overdue remediation actions.
- Independent testing results.
- Outstanding regulatory interpretation ma