Fintech marketing in the UAE: growth inside the regulator's lines

Gulf News reported on 27 July 2026 that Etihad Credit Bureau, the UAE's federal credit agency, will reflect Tabby and Tamara buy now pay later transactions in UAE credit reports from July 2026. How scores move as a result isn't something we can confirm, and this post won't guess. The marketing lesson is narrower: a line that says or implies a product stays out of someone's credit file needs checking against that change before it runs again.

Claims go stale, so every claim needs an owner and a review date. The fix is a claims register that compliance can read quickly, not a better design file.

What goes in a claims register?

Every factual claim in your ads, landing pages, app store listing and emails, with the evidence behind it, the person who checked it, the date, and a review date. Each claim then gets one of three outcomes: proved, softened or removed.

Even big numbers need this discipline. Wamda reported on 14 September 2026 that Tabby, which is headquartered in Saudi Arabia, has 25 million registered users across its markets. Those are group figures, not UAE ones, and registered doesn't mean active. A UAE fintech that puts 'trusted by' beside a number needs to say which kind it is.

Which laws sit under a fintech's claims?

Five that the sources confirm, as of November 2026: misleading prices, misleading content, creator permits, messages and calls, and personal data. Your financial regulator's own promotion rules sit on top, and we haven't verified them. This is a map of the rules, not legal advice.

• Misleading prices. A supplier who advertises misleading prices or false data on goods and services risks up to two years in prison and a fine of up to AED 2 million, according to the consumer protection page on the UAE government portal. It gives no minimum, so treat that as a ceiling.
• Misleading content. Clyde & Co reports that Cabinet Decision No. 42 of 2025 sets fines of AED 10,000 to AED 100,000 for misleading, fake or immoral material. The National Media Authority, created in December 2025, now oversees media.
• Creators and referrers. Promotional posts on social media need an Advertiser Permit, paid or unpaid, and that has been mandatory since 1 February 2026. People who promote their own business are exempt.
• Messages and calls. TDRA says marketing texts need prior explicit consent and can only go out between 7 am and 9 pm UAE time. Clyde & Co's summary of Cabinet Resolutions No. 56 and No. 57 of 2024 limits marketing calls to 9 am to 6 pm, so don't use one window for both.
• Personal data. The federal PDPL's implementing regulations had not yet been issued at Morgan Lewis's report on 15 June 2026, so date any statement about its status. DIFC and ADGM have their own regimes, which matters for firms licensed there.

The financial regulator's own promotion rules depend on your licence, and they're the ones that matter most. Your compliance officer signs every claim, and the marketer's job is to make that quick: send the claims register, not a link to a design file.

How do you measure a funnel that ends after the click?

Count the stages after the click: sign-up, identity verification started, verification completed, first funded transaction, and still active 90 days later. Optimise the ad platforms for the latest stage that happens often enough to learn from, and judge the later stages by cohort.

Suppose a hypothetical app spent AED 40,000 in a month. The sign-up looks cheap and the funded account doesn't.

Google recommends judging Smart Bidding over periods with at least 30 conversions, or 50 for Target ROAS. The app above clears that on funded accounts. An app with, say, 25 funded accounts a month doesn't, so it should optimise on verification completed and judge funded accounts by cohort.

Send the funded event back to the platforms. Meta's documentation presents the Conversions API as a link that carries an advertiser's own marketing data into Meta's systems, and says setups should confirm that events are deduplicated and matched correctly. We haven't sourced a lift figure for it, so don't promise one internally.

The data you send includes customer information, so agree your data protection position with compliance first. Whoever runs your performance marketing should set up the tracking, but the claims register comes first.

Performance Max needs a regulated-sector check of its own. Google's help page says it can replace the final URL with a more relevant landing page, which means a page you haven't approved could carry your ad. Ask whoever runs the account which pages it may use, and make sure every page it could pick carries the required disclaimers.

How do you earn trust before anyone has heard of you?

Publish the page that explains how you make money. Our view is that it's the most persuasive page a fintech can own, because it answers the question every sceptical customer is already asking.

Put fees in a table with a date, show the licence and regulator beside the claim they support, name the people who run the company, and make support reachable on WhatsApp in Arabic and English with its hours stated. Arabic should be written by a native writer, not translated, and the Arabic ad copy guide explains why. The post on third-party mentions covers why outside coverage matters to AI answers.

Can a referral loop stay inside the rules?

A referral loop can stay inside the rules if five questions are answered in writing before launch.

1. 01Do referrers post publicly? The permit covers promotional posts whether or not the poster is paid, and exempts people promoting their own business. A customer sharing your code on a story isn't obviously inside that exemption. Ask the National Media Authority, and ask separately about private one-to-one shares.
2. 02What does the reward depend on? Put the minimum spend, time limit and eligibility in the same line as the headline reward, and show the claim to compliance. The UAE government portal's ceiling for advertising misleading prices and false data is up to two years' imprisonment and a fine of up to AED 2 million.
3. 03Who gets messaged? TDRA says marketing texts need prior explicit consent. A referrer typing in a friend's number is not the friend's own consent, so ask compliance before you text anyone a referrer names.
4. 04What data does the loop collect? Name only the data you need, record consent, and check which data protection regime your licence puts you under.
5. 05How will you catch abuse? Cap rewards per person, and judge the loop by referred accounts that fund and stay active, not by referred sign-ups.

Start with the homepage and the app store page. List the ten most prominent claims, write the evidence next to each, and send the sheet to compliance. Every claim without evidence is either a page to publish or a line to delete.