and The Central Bank of the UAE (CBUAE) has instructed all banks and licensed financial institutions in the country to stop using instant messaging platforms such as WhatsApp to provide financial services or collect customer information.

The regulator issued the notice, according to Khaleej Times.

The move aims to strengthen consumer protection and maintain data security standards across the financial system.

The directive applies to all institutions under the Consumer Protection Regulation and Standards, covering banking transactions, customer communication, and data handling.

The central bank said banks and financial institutions increasingly use messaging apps as service channels.

This practice introduces risks such as fraud, impersonation, account takeovers, and social engineering attacks.

Concerns also include confidentiality breaches, unauthorised disclosure or storage of sensitive customer data, and data residency issues. In these cases, third parties may process or store information outside the UAE.

Under the directive, institutions must not request or share customer information through messaging apps. They must not initiate or confirm transactions, including transfers, payments, credit or loan instructions, disputes, or account changes.

They must not send authentication details such as passwords, PINs, or one-time passwordsmust also not exchange documents containing personal or financial data.

The central bank stated that VPNs or similar tools do not exempt institutions from compliance. Banks and financial institutions must stop launching new services via messaging platforms.

Banks and financial institutions must identify and discontinue existing use cases. They must move customers to approved channels, including mobile banking applications, online platforms, call centres, or branches.

Internal controls must be strengthened. This includes staff training and monitoring to prevent further use of messaging apps for these purposes.

Institutions must confirm compliance and submit corrective actions by 30 April 2026. The central bank warned that non-compliance may lead to supervisory action or financial penalties.

Featured image credit: Edited by Fintech News UAE, based on image by Grant Davies via Unsplash