Many UAE businesses sell the whole way through WhatsApp. A customer asks about a dress, a sofa, a cake for Friday or a course for their child; the team answers, sends photos, agrees the price, and then, too often, asks for a bank transfer screenshot or reads a card number out of the chat.
In April 2026 the Central Bank of the UAE (CBUAE) told the institutions it licenses to stop handling customers’ financial matters on messaging apps. Merchants were not the addressees, but the payment step of a chat sale touches banks and payment providers, and that is where the change reaches you. This guide explains what was reported, what a merchant can keep doing, and how to set up a journey where the conversation stays on WhatsApp and the payment happens on a licensed provider’s page.
It is a summary to plan with, not legal advice. We could not find the circular’s own text; everything below comes from the reports we cite.
What the circular says, as reported
Gulf News reported on 29 April 2026 that the CBUAE ordered all licensed financial institutions (banks, insurers, exchange houses and finance companies) to stop using instant messaging platforms, WhatsApp included, to communicate with customers. According to the report, institutions may not use messaging apps to:
- request or share customer data;
- initiate or process transactions;
- authenticate customers, for example with one-time passwords or verification codes;
- start new interactions that rely on instant messaging.
The report adds that customer data and transaction records must be stored securely within the UAE, that institutions had to confirm compliance by 30 April, and that the CBUAE cited fraud, identity theft, account takeovers and social engineering, as well as the risk that customer information “could be accessed or stored outside the UAE”. Banks then began telling customers by SMS, email and app alerts that they would no longer use messaging platforms for correspondence or service requests.
Hadef & Partners, a UAE law firm, wrote on 8 May 2026 that, according to media reports, the directive was issued on 17 April and took effect on 1 May, and that “all such activities must be conducted through secure, auditable, bank-controlled channels.”
What it means for a merchant
The law firm’s reading for e-commerce retailers is the useful part:
“Retailers may continue to use WhatsApp as a sales and engagement channel, but the financial leg of any transaction must now be completed outside that environment.”
It also expects that “banks and payment service providers will inevitably impose stricter controls” on merchants, and sums up the model as “conversational commerce at the front end; regulated financial infrastructure at the back end.”
In practice, for a shop, a salon, a clinic or a tour operator:
| Keep doing in the chat | Move out of the chat |
|---|---|
| Answering questions, sending photos, catalogues and prices | Asking for card numbers, CVVs or bank logins |
| Taking the order details and the delivery address | Asking customers to send one-time codes |
| Sending a link to your payment provider’s checkout page | Accepting bank statement or card photos as “proof” |
| Confirming the order once the provider reports the payment | Confirming a bank transaction on a bank’s behalf |
| Sending the receipt and delivery updates | Storing payment details in chat notes |
Hadef & Partners lists six steps for retailers: audit the customer journeys where payment data passes through messaging apps; separate financial processing from conversation and write that down in your policies; review your payment providers and contracts; update your terms, privacy notices and checkout disclosures; train sales and support teams so nobody falls back on informal workarounds; and design a “chat-to-checkout” journey.
The last two are where a messaging platform helps.
How a chat-to-checkout journey works
- The customer asks and decides in the chat.
- Your team, your flow or your AI assistant sends a payment link.
- The customer opens the link and pays on the payment provider’s own page, with the provider’s own card checks and the payment methods your account there offers.
- The provider tells your system the payment went through.
- The chat continues: a confirmation, the receipt, the delivery time.
Nothing financial is typed into the conversation, and the payment record lives with the licensed provider.
What MonoChat does
Every payment provider MonoChat connects to works this way: MonoChat creates the order with the provider and sends the customer a link to the provider’s hosted payment page. For UAE businesses that means N-Genius, MyFatoorah, Telr, PayTabs, Tap, HyperPay and Paymob for cards, Ziina and Mamo for small-business payment links, Tabby and Tamara for instalments, and Stripe and PayPal.
The payment step can then be automated without anyone handling card details.
Set it up, step by step
1. Connect your payment provider. Go to Settings › Payment › Payment Systems and click Create. Choose your provider, give it a Title for your own reference and paste the credentials from your provider’s dashboard (for N-Genius, the API key and outlet reference). Click Create. If you use more than one provider, mark the usual one with Set As Default.
2. Test with a small amount. Use your provider’s test credentials if it has them, pay a small order yourself, then switch to live credentials.
3. Build the payment step into a flow. In Flows, add a Send Payment Request node where the customer has agreed to buy. Choose the payment system (or leave it on the default), enter the amount (a flow variable is allowed) and the currency. Keep Send the payment link in the chat on, and write your own message text if you like: {{paymentLink}} is replaced with the link. If the amount is not a positive number or no payment system is set up, the node takes its failed output and nothing is sent.
4. Keep the link for later. Since MonoChat 3.8.38, turn on Save Flow Variable in the same node, so later messages and conditions can use the order ID and the link, for example in a reminder an hour later.
5. Continue once the money arrives. Start the next part of the flow from the New Payment Received event: a thank-you, the receipt, the delivery time, a tag for your team.
6. Or let an app do it. Several MonoStore apps send the link for you when a payment system is connected: Hotel & Travel Assistant sends the deposit request with Pay now, Garage Assistant sends the total when the car is ready, and Real Estate Assistant sends rent reminders with Pay now. Without a payment integration, they send your payment instructions instead. For Shopify stores, Shop Assistant shows products with a link to your own Shopify checkout.
7. Write the rule down for your team. A short saved reply helps agents say no politely when a customer offers to send card details in the chat.
Message examples
Payment link after the customer decides
Thank you, {{1}}. Your total is AED {{2}}. You can pay securely on our payment provider’s page here: {{paymentLink}} Please do not send card details in this chat. We will confirm here as soon as the payment is received.
When a customer offers card details
Thank you for your trust. For your security we never take card numbers or codes in WhatsApp. Please use this secure payment page instead: {{paymentLink}}
Confirmation after New Payment Received
Payment received, thank you! Your order {{1}} is confirmed and will reach you on {{2}}. We will send the tracking details here.
Instalments
You can split this order into instalments with Tabby. Open this link to check your options and pay on Tabby’s page: {{paymentLink}}
Questions to settle with your provider
- Does the provider have its own rules for payment links sent in chat apps, such as link expiry or amount limits?
- Which payment methods does the link page show for your account (cards, Apple Pay, instalments)?
- How are refunds made? Handle them in the provider’s dashboard, and tell the customer in the chat when it is done.
- What does the provider need in your terms and checkout disclosures?
Where your data is stored
The circular is about financial institutions, but it also reflects a wider concern about where customer data is stored. On the WhatsApp Cloud API you can choose the UAE as the storage region for a connected number; read what the setting covers and what it does not before you rely on it. MonoChat can also run on your own servers when a business needs that.
The short version
Keep selling on WhatsApp. Take the money on a licensed provider’s page. Tell your team, write it in your terms, and let a flow or an app send the link and continue once the provider confirms. That keeps the speed of a chat sale without asking anyone to type a card number into a conversation.
MonoChat’s Basic plan is free and Growth is AED 440.70 a month, taxes included; payment providers charge their own fees. See pricing for the full plans.