Point of Sale Merchant Agreement (UAE)

A Point of Sale Merchant Agreement in the United Arab Emirates is the contract between a Central Bank of the UAE-licensed payment service provider (PSP) and a merchant, governing the terms under which the PSP enables the merchant to accept electronic card payments — including credit cards, debit cards, and contactless payments — at physical retail points and through digital channels. The agreement sets out the POS hardware provision, the Merchant Discount Rate (MDR), the settlement timeline, chargeback procedures, compliance obligations, and the circumstances in which the agreement may be terminated.

POS payment services in the UAE are regulated by the Central Bank of the UAE (CBUAE) under the Retail Payment Services and Card Schemes Regulation (2021) — the RPSCS Regulation — which requires all entities providing payment acquisition services to hold a valid CBUAE licence. A PSP without a CBUAE licence cannot lawfully offer POS merchant services in the UAE. Merchants dealing with licensed PSPs indirectly benefit from this regulatory oversight through the prudential standards the CBUAE imposes on PSPs regarding capital adequacy, security, settlement timelines, and consumer protection.

The Card Scheme Rules of Visa and Mastercard — and to a lesser extent American Express and other schemes — are incorporated by reference into UAE Merchant Agreements. These rules govern the technical and operational standards for card acceptance, including PCI DSS security requirements, chargeback procedures, MCC assignment, and transaction routing. Violation of Card Scheme Rules by a merchant can result in the PSP terminating the Merchant Agreement, imposing fines assessed by the card scheme, and in severe cases, the merchant being placed on a MATCH list (Member Alert to Control High-Risk Merchants) that prevents them from obtaining merchant accounts with other PSPs.

Anti-money laundering obligations under Federal Decree-Law No. 20 of 2018, administered by the Executive Office of Anti-Money Laundering and Counter Terrorism Financing (UAE AMLCTF), apply to PSPs and affect merchant onboarding through Know Your Customer (KYC) requirements. The Financial Intelligence Unit (FIU) at goAML portal is the reporting mechanism for suspicious transaction reports.

VAT under Federal Decree-Law No. 8 of 2017, administered by the Federal Tax Authority (FTA), applies to the PSP's service fees (MDR) as a standard-rated supply — the PSP must issue VAT-compliant tax invoices to merchants for its services. Cardholder transactions processed through the merchant's POS are not subject to separate VAT from the PSP; the merchant's own VAT obligations on its sales apply separately.

Data protection under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office, governs the processing of cardholder data and merchant business data by the PSP. The PDPL's obligations supplement — and in UAE legal hierarchy, sit alongside — the PCI DSS requirements for cardholder data security.

A Point of Sale Merchant Agreement in UAE is needed before a merchant activates a POS terminal or integrates a payment gateway to accept card payments. The agreement with a CBUAE-licensed PSP is the contractual foundation for the payment processing relationship.

New UAE retail businesses opening a physical store — in a Dubai mall, an Abu Dhabi street-level unit, or a Sharjah commercial district — need a Merchant Agreement with a PSP before their first day of trading to accept Visa, Mastercard, and contactless payments. Operating a POS terminal without a Merchant Agreement and without a licensed PSP is a breach of the CBUAE regulatory framework.

Online retailers adding a card-present POS capability — for example, a previously online-only store opening a pop-up retail location or participating in a UAE trade event such as GITEX or Beautyworld Middle East — need a separate POS Merchant Agreement for the physical terminal in addition to any existing e-commerce payment gateway agreement.

Existing merchants whose current Merchant Agreement is expiring or who are switching PSPs need a new Merchant Agreement before the old agreement terminates. The transition should include ensuring that the new PSP can replicate the settlement timeline and MDR rates agreed under the previous arrangement.

Merchants whose existing agreement does not cover new payment methods — such as UAEPASS QR payments, Apple Pay, Samsung Pay, or the UAE Instant Payment Platform (IPP) — need an updated Merchant Agreement with their PSP that covers these additional payment channels.

Free-zone businesses — DIFC, ADGM, DMCC, JAFZA — that are expanding their physical retail presence to the UAE mainland or vice versa need a Merchant Agreement appropriate to their operating entity. A DIFC-incorporated entity operating a mainland retail point may need to consider the jurisdictional implications of its PSP agreement.

Marketplace sellers operating from platforms like Noon or Amazon.ae who wish to open standalone physical stores need an independent Merchant Agreement, as marketplace-facilitated payments are handled by the marketplace's own PSP arrangement and do not extend to standalone merchant POS operations.

A UAE Point of Sale Merchant Agreement must contain the following elements. The forms-legal.com UAE POS Merchant Agreement template covers each component.

Party identification must name the PSP with its CBUAE licence number — confirming the PSP is lawfully authorised to provide payment services — and the merchant with its UAE trade licence number. The trade licence confirms the merchant is conducting a lawful commercial activity in the UAE.

POS services description must specify the exact payment methods enabled — Visa, Mastercard, American Express, contactless, Apple Pay, QR payments — the transaction types supported (card-present, card-not-present, refunds), and the settlement account details.

POS hardware terms must address whether terminals are sold or rented, the rental fee, the merchant's responsibility for hardware damage, and the return obligation on termination.

Merchant Discount Rate (MDR) must state the exact percentage fee for each card type, whether the rate is blended or interchange-plus, and confirm that the MDR is subject to 5% VAT under Federal Decree-Law No. 8 of 2017 as a standard-rated service supply.

Settlement timeline must specify the T+1 or other settlement cycle, the settlement currency (AED), the designated bank account, the rolling reserve mechanism, and the circumstances in which settlement may be withheld.

Chargeback process must describe the notification timeline, the merchant's response window, the documentation required, and the consequences of exceeding the card scheme's acceptable chargeback ratio.

PCI DSS compliance level must state the merchant's PCI DSS level and the associated compliance requirements — SAQ, quarterly network scans, or QSA audit — as required by Card Scheme Rules.

AML obligations must address the PSP's KYC requirements, the merchant's UBO disclosure obligation under the Commercial Companies Law (Federal Decree-Law No. 32 of 2021), and the suspicious transaction reporting framework under Federal Decree-Law No. 20 of 2018.

Prohibited transactions must list categories of transactions that cannot be processed through the merchant's POS, consistent with UAE law and Card Scheme Rules.

Termination provisions must address the PSP's right to terminate for regulatory direction from the CBUAE or card scheme instruction, as well as commercial and compliance-based termination rights.

Completing this UAE Point of Sale Merchant Agreement requires the PSP to verify the merchant's business information and compliance status, and the merchant to understand the financial and regulatory obligations it is accepting.

For the PSP, enter the full legal name, CBUAE licence number (which should be verifiable on the CBUAE's licensed entities register), and registered address. The CBUAE licence number is the merchant's primary verification that the PSP is lawfully authorised to offer payment services.

For the merchant, enter the legal entity name, UAE trade licence number, and the licensed business address where POS services will be provided. For multi-location merchants, the Merchant Agreement should list all locations or provide a mechanism for adding new locations, as each location's activity affects the overall MDR and chargeback ratio assessment.

For POS services, describe all payment methods the merchant requires — including contactless NFC, QR code payments, Apple Pay/Google Pay tokenised payments, and any international card types frequently used by the merchant's customer base. International tourists in Dubai, Abu Dhabi, and Sharjah frequently use UnionPay cards; merchants in tourist-heavy locations should consider adding UnionPay acceptance.

For the MDR, negotiate rates based on the merchant's expected monthly volume and MCC. Higher-volume merchants have more negotiating leverage. Confirm whether the quoted rate is blended or interchange-plus, and check the FTA invoice treatment for MDR VAT.

For the settlement timeline, confirm the T+1 cycle applies on all UAE business days (Sunday to Thursday plus Saturday in some PSPs) and that the settlement account is in the same name as the merchant's trade licence to satisfy AML requirements.

For PCI DSS, most UAE SME merchants (Level 4) only need to complete an annual SAQ. Confirm which SAQ type applies to the merchant's processing environment — SAQ A for fully outsourced e-commerce, SAQ C-VT for merchants using a virtual terminal, SAQ B for imprinter-only merchants. The PSP's technical team can guide SAQ selection.

For AML, prepare the merchant's documents at onboarding: valid UAE trade licence, Emirates ID of beneficial owners, UBO register if applicable, and confirmation of expected monthly transaction values by product category.

A UAE Point of Sale Merchant Agreement must comply with the Central Bank of the UAE's Retail Payment Services and Card Schemes Regulation (2021), which governs the licensing and conduct of payment service providers, including acquiring PSPs. The PSP must hold a valid CBUAE licence; a Merchant Agreement with an unlicensed PSP exposes both parties to regulatory sanctions.

The Anti-Money Laundering Law (Federal Decree-Law No. 20 of 2018) and Cabinet Decision No. 10 of 2019 require the PSP to conduct KYC on merchants and to report suspicious transactions to the UAE FIU. Merchants must cooperate with KYC requirements and provide UBO disclosures consistent with the Commercial Companies Law (Federal Decree-Law No. 32 of 2021) and Cabinet Decision No. 58 of 2020 on UBO registers.

Card Scheme Rules of Visa, Mastercard, and other applicable schemes are incorporated by reference into the Merchant Agreement and impose binding obligations on merchants regarding PCI DSS compliance, MCC accuracy, prohibited transaction categories, chargeback response procedures, and proper use of card scheme marks.

Federal Decree-Law No. 8 of 2017 (UAE VAT) requires that the PSP's MDR fees be invoiced with 5% VAT as a standard-rated supply of payment services, with a VAT-compliant tax invoice issued monthly. The FTA's guidance on financial services VAT exemptions does not generally exempt PSP merchant services.

The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) governs the processing of cardholder data by both the PSP and the merchant, requiring appropriate security measures and limiting data use to the purpose of transaction processing.

Consumer Protection Federal Decree-Law No. 15 of 2020 governs the merchant's obligations to UAE consumers in transactions processed through the POS, including refund rights, which must be operationally supported by the POS terminal's refund functionality under the Merchant Agreement.

Federal Decree-Law No. 14 of 2020 on Banking and Finance governs bounced cheque liability and electronic payment disputes, providing the framework for consumer chargeback rights that generate merchant chargebacks.

UAE merchants and PSPs frequently encounter the following issues in POS Merchant Agreements.

1. Merchant operating with an unlicensed PSP. A merchant who enters a Merchant Agreement with a company that is not licensed by the Central Bank of the UAE to provide payment services is operating outside the CBUAE regulatory framework. If the PSP subsequently encounters regulatory problems, the merchant's settlement funds may be frozen or lost. Always verify PSP licence status on the CBUAE licensed institutions register.

2. MCC misclassification. A merchant assigned the wrong MCC — either through error or deliberate misclassification to attract lower interchange rates — violates Card Scheme Rules. Visa and Mastercard actively monitor MCC compliance; merchants found to be misclassified may face scheme fines, back-billing for incorrect interchange, and PSP termination.

3. Failure to comply with PCI DSS. Merchants who store card numbers or CVV codes on their own systems — in spreadsheets, paper records, or point-of-sale software logs — violate PCI DSS and are liable for the full cost of any subsequent data breach, including card scheme forensic investigation fees (typically USD 10,000–50,000), re-issuance costs for compromised cards, and chargeback losses.

4. Not reviewing the rolling reserve terms. A rolling reserve that withholds 10% of monthly transactions for 120 days effectively creates a significant float of the merchant's funds held by the PSP. Merchants must understand the reserve amount, duration, and release mechanism before signing.

5. Unaware of chargeback ratio thresholds. Merchants who do not monitor their chargeback ratio against the card scheme threshold (typically 1%) risk being placed in a card scheme chargeback monitoring programme, which imposes additional fees and may ultimately result in loss of card acceptance rights — a catastrophic outcome for any retail business.

6. VAT not addressed on MDR fees. Merchants who are VAT-registered must claim input tax credit on the VAT component of the MDR fees, which requires the PSP to issue a proper monthly tax invoice. A Merchant Agreement that does not require the PSP to issue VAT-compliant invoices leaves the merchant unable to recover input VAT, increasing the effective cost of payment acceptance.