CBUAE Consumer Protection Regulation: What Automated Outbound Calls Must Do
The CBUAE Consumer Protection Regulation (Circular 8/2020) requires every automated outbound call in the UAE — reminders, collections, and marketing — to identify the institution, treat the consumer fairly, avoid coercion, respect contact limits, and keep auditable records. Whether a human or an AI voice agent places the call, the same conduct standards apply.
- Governing instrument: CBUAE Consumer Protection Regulation, Circular 8/2020, plus the accompanying Consumer Protection Standards. Source: CBUAE Rulebook.
- Who it covers: all Licensed Financial Institutions, including the outsourced agents and technology vendors that call on their behalf.
- Core conduct duties: fair treatment, clear disclosure, no coercive collection pressure, and protection of consumer data.
- Related affordability rule: the DBR cap limits monthly debt repayments to 50% of gross monthly income for individuals (CBUAE Rulebook).
- This is a general explainer, not legal advice.
The UAE's retail-banking base is heavily expatriate and salary-transfer driven, so outbound calling here is bilingual by default — the same reminder often needs an Arabic and an English version, and the caller may be reaching a customer whose salary lands through the Wage Protection System (WPS) with a security cheque and salary-transfer letter on file. When a repayment slips, the institution's first contact is frequently a phone call, and the AECB credit report keeps a record of how that account is ultimately conducted. That combination — multilingual borrowers, salary-linked lending, and a shared credit bureau — is exactly why the CBUAE holds automated outbound calls to a documented conduct standard rather than leaving tone and frequency to chance.
What is the CBUAE Consumer Protection Regulation?
The Consumer Protection Regulation, issued as Circular 8/2020 by the Central Bank of the UAE (CBUAE), sets the conduct baseline that Licensed Financial Institutions must meet when they deal with retail consumers. It is supported by the more detailed Consumer Protection Standards, which translate the regulation's principles into operational expectations. Together they cover disclosure and transparency, fair treatment, responsible financing, complaint handling, and the protection of consumer data.
Crucially, the regulation follows the activity, not the channel. A collections reminder is subject to the same fair-treatment and anti-coercion duties whether it is delivered by a branch officer, an outsourced call centre, or an automated voice agent. The CBUAE also makes the licensed institution responsible for the conduct of the third parties acting on its behalf, so a bank cannot outsource away its accountability for what an automated dialler or AI agent says.
What must an automated outbound call actually do?
An automated call has to satisfy the same conduct obligations as a live agent, plus the practical duty of making its automated nature and purpose clear. In plain terms, a compliant automated outbound call in the UAE should:
- Identify the institution and purpose at the start of the call, so the consumer knows who is calling and why.
- Treat the consumer fairly and without coercion — no threats, no harassment, no misleading statements about consequences.
- Respect reasonable contact hours and frequency, avoiding repeated or excessive calling that amounts to pressure.
- Communicate clearly in a language the customer can understand, which in the UAE usually means Arabic or English.
- Handle personal data lawfully, consistent with the regulation's data-protection duties and the UAE PDPL (Federal Decree-Law 45/2021).
- Offer a route to a human and to complain, so the consumer is never trapped in an automated loop.
- Keep an auditable record of what was said, when, and to whom.
The following table maps the regulation's conduct themes onto concrete outbound-call behaviours.
Regulatory duty | What it means on an automated call | Practical control |
|---|---|---|
Disclosure and transparency | State the institution's name and the reason for the call up front | Scripted, logged opening line |
Fair treatment | No coercion, threats, or misleading pressure | Approved language; blocked phrases |
Responsible contact | Sensible hours; no excessive repeat calls | Contact-frequency caps per customer |
Language and clarity | Reach the customer in Arabic or English | Bilingual scripts and voice models |
Data protection | Use and store call data lawfully | Consent flags; access controls; retention rules |
Complaint handling | Easy escalation to a human and to complaints | Live-agent handover; complaint prompt |
Record-keeping | Evidence of what was said and when | Full call logs, transcripts, timestamps |
How does this apply to collections calls specifically?
Collections is where the conduct duties bite hardest, because that is where pressure is most likely to appear. The regulation's stance is that recovering a debt never justifies coercion, intimidation, or contacting the consumer in a way designed to embarrass or harass them. An automated collections call must therefore stay factual and respectful: it can remind, inform, and offer to discuss options, but it must not threaten consequences that are inaccurate or unlawful.
The UAE's wider legal backdrop reinforces this. Following Federal Decree-Law 14/2020, a bounced security cheque is largely decriminalised and partial payment must be accepted, so an automated script that implies imminent criminal jail for a missed instalment would be both inaccurate and non-compliant. Keeping automated collections language calm, correct, and free of manufactured urgency is not just good practice — it is how the call stays inside the regulation.
Who is responsible when a vendor or AI makes the call?
Under the Consumer Protection Regulation, the Licensed Financial Institution remains accountable for calls made in its name, even when an outsourced provider or an automated system places them. This aligns with the CBUAE's broader supervisory approach to outsourcing and, more recently, to artificial intelligence: in February 2026 the CBUAE issued guidance on the use of AI and machine learning by licensed FIs, emphasising governance, explainability, human oversight, and third-party AI risk (CBUAE Rulebook).
For automated outbound calling, the message is consistent. The bank must be able to explain what its voice system says, evidence that consumers were treated fairly, and demonstrate oversight of the vendor supplying the technology. An AI voice agent does not dilute accountability — it raises the bar for documentation and control.
How AI helps
Meeting these duties at scale — across thousands of bilingual reminders and collections calls a month — is where a purpose-built voice platform earns its place. YuVoice runs automated outbound calls in Arabic and English from approved, versioned scripts, so every call opens with the required institution and purpose disclosure and stays within the fair-treatment language the compliance team has signed off. Contact-frequency caps, consent flags, live-agent handover, and full call logging are built in, which means the qualitative outcome banks care about most — consistent, auditable, non-coercive conversations — becomes the default rather than something to police after the fact.
FAQ
Does the CBUAE Consumer Protection Regulation apply to automated and AI voice calls? Yes. The regulation follows the activity, not the technology, so an automated or AI-driven call must meet the same fair-treatment, disclosure, and data-protection duties as a call made by a human agent.
Can a bank in the UAE use a third party to make collections calls? Yes, but the Licensed Financial Institution stays accountable for the conduct of that third party. The bank must oversee the vendor and be able to evidence that consumers were treated fairly.
What must an automated collections call avoid saying? It must avoid coercion, threats, harassment, and misleading claims — including implying criminal consequences for a bounced security cheque, which is largely decriminalised under Federal Decree-Law 14/2020.
Do outbound calls need to be in Arabic? Communications must be clear and understandable to the customer, which in the UAE typically means Arabic or English. Serving the customer's preferred language supports the regulation's clarity duty.
Where is the CBUAE Consumer Protection Regulation published? It sits in the CBUAE Rulebook as Circular 8/2020, alongside the Consumer Protection Standards that set out the detailed operational expectations.
Does this regulation affect how call recordings are stored? Yes. Call data is personal data, so it must be handled lawfully and retained under appropriate controls, consistent with the regulation and the UAE PDPL (Federal Decree-Law 45/2021).
Explore more UAE banking and compliance explainers on the YuVerse UAE hub.
This is a general explainer, not legal advice.
References
- Central Bank of the UAE — Consumer Protection Regulation (Circular 8/2020): https://rulebook.centralbank.ae/en/rulebook/consumer-protection-regulation
- Central Bank of the UAE — Consumer Protection Standards: https://rulebook.centralbank.ae/en/rulebook/consumer-protection-standards
- Central Bank of the UAE — Rulebook (AI/ML guidance for licensed FIs, Feb 2026): https://rulebook.centralbank.ae/
- Central Bank of the UAE — Article (3) Important Ratios (DBR): https://rulebook.centralbank.ae/en/rulebook/article-3-important-ratios
- UAE Government — Federal Decree-Law 45/2021 (Personal Data Protection Law): https://u.ae/
