New Telemarketing Rules Issued for UAE Financial Institutions

{getToc} $title={Table of Contents}

UAE Central Bank's new telemarketing rules: 2-second AI call rule and June 2026 compliance deadline

The CBUAE has issued Circular No. 2032/2026, establishing new telemarketing standards for all licensed financial institutions, effective from March 31, 2026.
Outbound marketing calls are restricted to between 9am and 6pm UAE time, with a maximum frequency of once per day and twice per week per customer.
Automated dialling systems must connect customers to a live agent within two seconds of answering; unanswered calls must disconnect within 15 seconds or four rings.
Customers must be offered a choice between a human agent, a robocall, or an AI-based agent before any telemarketing outreach begins.
Telemarketers must complete a minimum of 15 hours of training; board-level approval is required before any campaign can proceed.
The compliance deadline is June 29, 2026, with fines ranging from AED 10,000 to AED 150,000 depending on the nature and frequency of the breach.

A New Consumer Protection Framework for UAE Financial Telemarketing

The Central Bank of the UAE (CBUAE) has issued a comprehensive Telemarketing Regulation through Circular No. 2032/2026. Published in the Official Gazette on March 31, 2026, it sets minimum standards for all licensed financial institutions conducting telephone marketing activities. The regulation builds on Cabinet Resolution No. 56/2024, which established the broader UAE telemarketing framework in August 2024, but goes substantially further on technology-driven outreach and consumer consent requirements.

The regulatory impetus is clear. Data from Truecaller shows that banking-related calls account for 19.4 percent of all unwanted call reports in the UAE - nearly double the share of general marketing calls. When insurance and other financial services are included, the financial sector accounts for almost 30 percent of all spam call complaints nationally. Licensed financial institutions have a 90-day compliance window, expiring on June 29, 2026.

Calling Hours, Consent, and the Do Not Call Registry

Under the new rules, outbound marketing calls may only be made between 9am and 6pm UAE time. Calls are prohibited on official UAE public holidays, and institutions must respect any preferred contact times individually designated by customers. Frequency is capped at once per day and no more than twice per week per customer. If a customer declines a product, does not answer, or terminates the call, re-contact is not permitted for the remainder of that permitted period.

Prior explicit consent is mandatory before any call is made. That consent must be granular, covering the customer's preferred language, authorised contact channels, and the specific product categories they agree to receive marketing about. Terms presented for consent must be clear, unambiguous, and in the customer's preferred language. All contact lists must be screened against the national Do Not Call Registry (DNCR), managed by the Telecommunications and Digital Government Regulatory Authority (TDRA), before any campaign launches - and institutions must stop contact immediately upon any customer's request.

The Two-Second Rule and Requirements for AI Agent Outreach

Article 16 of the CBUAE Telemarketing Regulation introduces technically specific requirements for automated dialling systems. Where such systems are used, customers must be connected to a live agent or system within two seconds of answering the call. Unanswered calls must be automatically disconnected within 15 seconds or four rings - whichever comes first. Automated systems must also generate statistical records of all call activity to support the auditable compliance trail the regulation requires.

Equally significant is the requirement for customer choice in contact methodology. Before any outreach begins, customers must be offered the option of speaking with a human agent, receiving a robocall, or being contacted by an AI-based agent. This requirement sits directly alongside the CBUAE's February 2026 guidance on responsible AI use in financial services, which equally stresses consumer transparency and the right to request human interaction.

Pinsent Masons partner Martin Hayward described the change as a material regulatory step, noting that institutions "now need granular consent, down to language, channel, product type and whether AI agents are used, and need to be able to report on meeting these consent requirements." Alexandra Bertz of Pinsent Masons also flagged that the regulation's interplay with existing rules on unsolicited SMS under Administrative Decision No. 17/2022 "is currently unclear" and may require further guidance from the CBUAE.

Board Approval, Training Requirements, and the Penalty Structure

Before any telemarketing programme can begin, institutions must obtain written approval from their board of directors. In certain circumstances, direct prior approval from the CBUAE itself is also required. All personnel authorised to conduct telemarketing calls must complete a minimum of 15 hours of structured training, covering ethical conduct, data protection, product knowledge, and use of the DNCR - and cannot make calls until that standard is met.

All marketing calls must be recorded in full, with customers informed of the recording at the start of the call. Records must be retained for at least five years, and periodic activity reports submitted to the CBUAE. Outsourcing does not reduce regulatory responsibility: institutions remain fully liable for third-party compliance. The regulation applies on a group-wide basis, including to affiliated entities outside the UAE that conduct telemarketing targeting UAE customers.

Penalties under Cabinet Decision No. 57/2024 are calibrated to the violation. Calling a DNCR-registered number attracts fines of AED 50,000 for a first offence, AED 75,000 for a second, and AED 150,000 for a third. Running a telemarketing programme without prior board approval generates fines of AED 75,000 rising to AED 150,000. Failing to record calls, using unregistered phone numbers, or conducting excessive follow-up contact each carry their own graduated penalty bands.

What This Means for Financial Advisors and Compliance Teams

For licensed advisors, IFAs, banks, and insurance firms, June 29 is the operational deadline that matters most. Consent management systems will need to be enhanced or rebuilt to capture granular customer preferences by language, channel, and product type. Automated dialling infrastructure must be assessed and potentially upgraded to meet the two-second connection and 15-second disconnection thresholds. Any firm that has used AI agents in outreach should review whether existing consent records specifically address that contact method - and update them if not.

Compliance teams should ensure board-level approvals are formally documented and that telemarketer training programmes are underway well ahead of the deadline, not at it. Record retention obligations will require updates to data governance policies, and outsourcing agreements should be reviewed to confirm third-party compliance coverage. Advisors managing multiple regulatory streams will find parallels with the recent CBUAE risk profiling update for financial advisors, which offers a useful model for structuring a systematic review of customer-facing compliance obligations in the current regulatory cycle.

What Clients are Asking their Advisors

What are the new calling hours for financial telemarketing in the UAE?

Under CBUAE Circular No. 2032/2026, licensed financial institutions may only make telemarketing calls between 9am and 6pm UAE time. Calls are prohibited on official UAE public holidays, and institutions must observe any specific preferred contact times designated by individual customers.

What is the 2-second rule in UAE's new financial telemarketing regulation?

Article 16 of the CBUAE Telemarketing Regulation requires that automated dialling systems connect the customer to a live agent or system within two seconds of the call being answered. Unanswered calls must also be disconnected automatically within 15 seconds or four rings - whichever comes first.

What are the fines for breaching UAE financial telemarketing rules?

Penalties under Cabinet Decision No. 57/2024 are graduated by offence. Contacting a consumer on the Do Not Call Registry carries fines of AED 50,000 for a first offence, rising to AED 150,000 for a third. Operating without prior board approval attracts fines of AED 75,000 for a first offence and up to AED 150,000 for a third.

Do the new UAE telemarketing rules apply to financial advisors as well as banks?

Yes. The regulation applies to all financial institutions licensed by the CBUAE, including banks, insurance companies, and licensed financial advisory firms. It also extends group-wide, meaning affiliated companies outside the UAE that conduct telemarketing targeting UAE customers must also comply.