CBUAE's 2026 Telemarketing Rules: What Banks and Insurers Must Know About AI Calls

What is the CBUAE Telemarketing Regulation?

It is a sector-specific telemarketing regulation issued by the Central Bank of the UAE, taking effect on 19 February 2026. It sits alongside, not instead of, the economy-wide framework in Cabinet Resolution No. 56 of 2024 and Cabinet Resolution No. 57 of 2024. Article 9(2) of Resolution 56 already reserved this ground: it assigns telemarketing oversight for banks, financial institutions, and insurance companies to the Central Bank, “in the manner stipulated in this resolution and the regulations issued by the Central Bank in this regard.” The 2026 circular is the Central Bank exercising that reserved power for the first time.

One honest caveat before going further: secondary legal sources don't agree on the circular's exact instrument number. CMS Law cites it as Circular 3/2026. Gulf News cites it as Circular No. 2032/2026. The Central Bank's own Rulebook portal wasn't accessible to independently confirm which is correct at the time of writing, so this guide cites the regulation by name and effective date rather than asserting a single circular number as settled.

Who does the CBUAE regulation apply to?

Only CBUAE-licensed financial institutions: banks, insurance and reinsurance companies, and other activities licensed by the Central Bank. It does not touch the general economy. A clinic, a real-estate brokerage, or an e-commerce business making outbound calls is still governed purely by the original Cabinet Resolution 56 of 2024 and Cabinet Resolution 57 of 2024. No amendment to those two resolutions themselves has been found as of this writing. For the full economy-wide framework that still applies to everyone else, see our 2026 UAE telemarketing rules reference.

When must banks and insurers comply?

The regulation took effect on 19 February 2026, but licensed institutions were given a runway to implement it: full compliance is required by 29 June 2026. That deadline lines up with a 90-day implementation period counted from the regulation's Official Gazette publication on 31 March 2026, which is consistent with how the Central Bank has phased in comparable rules before.

What does Article 16 require for automated and AI dialing systems?

Article 16 is the provision most relevant to AI voice agents specifically. It requires that when a bank or insurer uses an automated or AI-driven dialing system, the call must connect the customer to a human telemarketer within two seconds of the customer answering. In practice, this rules out a fully autonomous AI-only sales conversation for outbound telemarketing calls placed by CBUAE-licensed institutions. An automated system can initiate the dial, but the handoff to a person has to happen almost immediately once the customer picks up.

This is a narrower rule than it might first sound. It governs outbound telemarketing dialers specifically, the kind of system that places large volumes of sales calls and connects answered ones to a live agent. It says nothing about inbound AI receptionists, which is a separate use case entirely, or about AI used for non-marketing purposes like fraud alerts or service notifications.

For any AI voice vendor building outbound systems for the UAE financial sector, Article 16 is a design constraint, not a footnote. A dialer built for a bank or insurer client needs a handoff mechanism that reliably completes within two seconds of answer detection, a materially tighter latency budget than most AI voice platforms are built to guarantee for a full speech-to-text, reasoning, and text-to-speech turn. In practice, this pushes CBUAE-compliant automated dialing toward a hybrid architecture: an automated system identifies and connects the call, and a human telemarketer takes the conversation from the first spoken word, rather than an AI agent conducting any part of the sales conversation itself on a CBUAE-regulated outbound telemarketing call.

What must consent capture under the new rules?

The regulation raises the bar on what “consent” has to record. Rather than a blanket opt-in, the consent mechanism must capture specific preferences:

“The customer's preferred language, chosen communication channels, preferred method of contact (whether by a human agent, an AI based agent, or a robocall).”

— CBUAE Telemarketing Regulation, as reported by CMS Law

That parenthetical is the detail worth sitting with: as far as this research can confirm, this is the first UAE regulatory text to name AI-based calling agents explicitly as a distinct, customer-selectable contact method, on equal footing with a human agent or a robocall. Whatever else changes about UAE telemarketing law in the coming years, this circular is the marker of when AI agents stopped being a hypothetical and started being a defined category in the rulebook.

What are the training and record-keeping requirements?

Two operational requirements round out the regulation. Marketers must complete a minimum of 15 hours of training before making telemarketing calls on behalf of a licensed institution. And institutions must retain telemarketing records, call logs, consent records, and related documentation for a minimum of 5 years. Neither figure is unusual by financial-sector standards; both are stricter than anything the general Cabinet Resolution 56/57 framework specifies for non-financial businesses.

Why does this matter if your business isn't a bank or insurer?

Because it is a signal, not a footnote. This is the first time a UAE regulator has written AI-based calling agents into a binding rule by name, and it did so by imposing real constraints: a hard latency limit on automated handoffs, granular consent capture that treats contact method as a customer preference, and sector-specific training and retention duties. Financial services regulators tend to move first and set the pattern that other sectors eventually follow. A business outside CBUAE's remit today has a reasonable basis to expect the direction of travel, not the specific rule, to eventually reach the general economy.

This is also exactly the posture MAJ Leads builds around by default, regardless of which sector a client sits in. Our AI voice agent services are built with disclosure, consent handling, and human-handoff paths designed in from the start rather than retrofitted once a regulator asks for them. An AI receptionist answering inbound enquiries for a bank's retail branch, or an AI appointment-booking agent scheduling a mortgage or insurance consultation, already operates as a named, consented contact method rather than an ambiguous one. For the compliance architecture that applies across every UAE business regardless of sector, see our TDRA-compliant AI voice agent guide.