The United Arab Emirates' central bank has ordered all banks and licensed financial institutions to immediately stop using instant messaging platforms such as WhatsApp to deliver financial services or collect customer information, according to Khaleej Times.
In a notice, the central bank of the UAE said the directive is intended to strengthen consumer protection and maintain high standards of data security across the country's financial system.
The order applies to all licensed institutions regulated under the Consumer Protection Regulation and Standards. It covers banking transactions, customer communication and data handling.
The central bank said it had identified growing use of instant messaging applications as service channels, creating multiple risks.
Those risks include fraud, impersonation, account takeovers and social engineering attacks. The regulator also cited concerns over confidentiality and the possible unauthorized disclosure or storage of sensitive customer data.
It further warned about "data residency" risks, saying customer information sent through such platforms could be processed or stored outside the UAE.
That, the regulator said, could violate rules requiring all consumer and transaction data to remain within the country.
Under the directive, financial institutions are barred from using messaging apps to request or share customer data and information.
They also may not use such apps to initiate or confirm transactions including transfers, payments, credit or loan instructions, disputes or account changes.
Banks are also prohibited from sending authentication details such as passwords, PINs or one-time passwords through messaging platforms.
The restrictions also cover exchanging documents containing customers' personal or financial information.
The central bank said the use of VPNs or similar tools would not exempt institutions from the new requirements.
Banks and financial institutions were instructed to stop launching any new services through messaging apps and identify and shut down existing uses.
They must move customers to approved and controlled channels such as mobile banking apps, online platforms, call centers or physical branches.
Institutions were also ordered to strengthen internal controls, including staff training and monitoring, to prevent further use of messaging systems for restricted activities.
Banks must confirm compliance and detail corrective measures taken by April 30, 2026.
The central bank said noncompliance could lead to supervisory action or financial sanctions.
It said the measures are necessary to ensure customers are provided a "safe, secure and confidential environment" and to protect the integrity of the UAE financial sector.
Comments
See what people are discussing