UAE bans WhatsApp use by banks for financial services, data

Where Diplomacy Meets News

UAE bans WhatsApp use by banks for financial services, data

April 22, 2026

ABU DHABI,— The Central Bank of the United Arab Emirates has instructed all banks and licensed financial institutions in the country to stop using instant messaging platforms such as WhatsApp for financial services and for collecting customer information.

The decision was issued in a supervisory notice to the sector, and is aimed at strengthening consumer protection and raising data security standards across the UAE financial system.

It applies to institutions regulated under Consumer Protection Regulation and Standards and covers banking transactions, customer communication and data handling.

Regulators said instant messaging apps were increasingly used as informal service channels, exposing systems to fraud, impersonation, account takeover and social engineering risks, along with concerns over confidentiality and unauthorized disclosure of sensitive customer data.

They also cited data residency risks, noting that customer information could be stored or processed outside the UAE, which would conflict with rules requiring consumer and transaction data to remain inside the country.

Under the directive, banks must not use messaging apps to request or share customer data, initiate or confirm transactions such as transfers, payments, credit or loan instructions, or account changes.

They are also barred from sending authentication details such as passwords, PINs or one-time passwords, or exchanging documents containing personal or financial information.

The central bank said use of VPNs or similar tools does not exempt institutions from compliance requirements.

Institutions must stop launching new messaging app services, shut down existing use cases and move customers to approved channels such as mobile banking apps, online platforms, call centers and branches.

They are required to strengthen internal controls, including staff training and monitoring systems to prevent further use of unregulated communication channels.

Financial institutions are required to report compliance and provide details of corrective actions by April 30, 2026. Failure to comply may lead to supervisory action or financial penalties.

The central bank said the measures are needed to ensure a safe, secure and confidential environment for customers and to protect the integrity of the UAE financial sector.

Several local media outlets reported the directive and said it reinforces a broader shift toward regulated digital banking channels across the country.

Authorities emphasized continued oversight of communication practices within financial institutions to ensure adherence to national data protection requirements.

Implementation begins immediately across all regulated entities in United Arab Emirates.

(With files from khaleejtimes.com, gulfbusiness.com)