The CBUAE messaging prohibition and UAE data residency rules

What the CBUAE actually said

On 24 April 2026 the Central Bank of the UAE issued a notice instructing all licensed financial institutions to stop using instant messaging platforms — WhatsApp, Telegram and comparable consumer applications — to deliver financial services or handle customer information. Institutions were given until 30 April 2026 to comply.

The notice was not a warning about phishing. It was a prohibition on a category of channel. The reasoning reported alongside it centred on three things: institutions cannot control where a consumer app stores and processes data, they cannot produce a complete and tamper-evident record of what was communicated, and they cannot verify identity on a channel where a phone number is the only credential.

Two details matter for anyone planning remediation. First, the CBUAE stated that using a VPN or similar tooling does not exempt an institution — routing traffic through a local endpoint does not change where the platform vendor stores the data. Second, the regulator warned that non-compliance may lead to supervisory action or financial penalties, which puts this in the enforcement column rather than the guidance column.

Where the data residency rule comes from

The obligation to keep customer data in the UAE is older than the messaging notice. The CBUAE Consumer Protection Regulation and its accompanying Consumer Protection Standards — specifically the article on protection of consumer data and assets — require licensed financial institutions to hold and store all consumer and transaction data within the UAE.

That obligation extends past the primary database. The Standards also require that:

• outsourced technology that uses or retains personal data meets the highest standards of security and encryption;
• that technology is regularly audited and verified for vulnerabilities, rather than assessed once at contract signature;
• on termination of an outsourcing contract, all personal data is retrieved or destroyed;
• third parties given data under customer consent have no further right to share it or use it for other purposes.

In February 2026 the CBUAE reinforced the direction with infrastructure rather than rules. On 25 February 2026 it announced, with Core42 (a G42 company), a sovereign financial cloud services infrastructure under the Financial Infrastructure Transformation Programme — a centralised, isolated environment built for UAE licensed financial institutions and framed explicitly around data sovereignty. When a regulator builds the compliant infrastructure itself, the expectation about where regulated workloads belong stops being ambiguous.

The part most teams get wrong

Residency is usually implemented for the production database and forgotten everywhere else. In practice we routinely find UAE customer data sitting outside the country in:

• backup and disaster-recovery copies replicated to a cheaper offshore region;
• log aggregation, error tracking and application performance monitoring tools;
• CRM, helpdesk, e-signature and marketing platforms with offshore default regions;
• content delivery and caching layers holding personal data in edge nodes;
• analytics and session-replay scripts sending identifiable data to overseas processors;
• encryption keys held in a key management service outside the UAE.

A residency claim that covers the database and not the backups is not a residency claim. This is the bulk of what our data residency and data management work actually consists of.

What is prohibited in practice

Translating the notice into engineering terms, a licensed institution should no longer be using consumer messaging platforms to:

• request, receive or share customer information;
• initiate, confirm or discuss transactions;
• send authentication credentials — one-time passwords, PINs or passwords;
• deliver statements, contracts or any document containing personal or financial data;
• conduct onboarding, KYC collection or document exchange;
• handle complaints or service requests that require access to account data.

The hardest part of this is rarely the official corporate account. It is the relationship manager who has been running a client book from a personal handset for eight years, the branch group chat, and the broker who forwards documents because it is faster. If your remediation only closes the corporate WhatsApp Business number, the exposure has not moved.

Beyond banking: PDPL and sector rules

If you are not CBUAE-licensed, the messaging notice does not bind you — but the residency question does not go away. Federal Decree-Law No. 45 of 2021, the UAE Personal Data Protection Law, restricts cross-border transfer of personal data under Articles 22 and 23. The primary lawful route is a transfer to a jurisdiction offering an adequate level of protection, and the UAE Data Office has not published an adequacy list. The Executive Regulations that were expected to detail the transfer mechanics remain unpublished, with Cabinet Resolution No. 33 of 2024 providing the implementing detail currently available.

The practical consequence is that exporting UAE personal data sits in unresolved legal territory, while processing it in-country does not. For most organisations that is the whole argument: residency is the option that does not require you to bet on how an unpublished regulation will read.

Two further points of context. The DIFC and ADGM operate their own data protection regimes, so a group with entities inside and outside the free zones may be managing more than one framework at once. And healthcare has separate, long-standing UAE health data residency requirements that predate the PDPL entirely.