UAE Telemarketing Rules: When Banks and Sellers May Call You, and How to Complain

Direct answer. The CBUAE Telemarketing Regulation, issued as circular C 3/2026, has been in force since 31 March 2026, and every bank, insurer and finance company had to comply with it in full by 29 June 2026. Under it, a bank may call you to sell only with your prior express consent, only between 9:00 AM and 6:00 PM UAE time, no more than once a day and twice a week, and never if your number is on the national Do Not Call Registry (DNCR). If you tell the caller to stop, the bank must stop immediately. If it keeps calling, complain to the bank first and give it at least 30 complete business days to send a final written answer. If it does not answer in that time, or its answer leaves the complaint unresolved, take it to Sanadak, the independent ombudsman unit for banking and insurance, which is free to use. Sellers that are not banks fall under Cabinet Resolution No. 56 of 2024, are policed by the authority that licensed them, and face fines under Cabinet Resolution No. 57 of 2024.

Two rulebooks, depending on who is calling

The rules that apply, and the place you complain, depend on the kind of business behind the call.

Banks, insurance companies and other financial institutions licensed by the Central Bank follow the CBUAE Telemarketing Regulation. The Central Bank issued it under Federal Decree-Law No. 6 of 2025, the current Central Bank law, and to meet the requirements of Cabinet Resolution No. 56 of 2024. It took effect on publication, on 31 March 2026, and gave institutions 90 days to comply (Art. 24.2), which ran to 29 June 2026. It also repealed the Central Bank's 2011 notice on marketing loans and other services to individual customers.

Every other company licensed in the UAE, including free-zone companies, follows Cabinet Resolution No. 56 of 2024, in force since 27 August 2024. Its penalties sit in Cabinet Resolution No. 57 of 2024.

Both rules define telemarketing widely. The bank rule covers calls, texts, chat windows, emails, and messages on digital platforms, websites and social media, whether a person, an automated system or artificial intelligence makes contact. A call you asked for is not an unwanted call.

The Capital Market Authority took over from the Securities and Commodities Authority on 1 January 2026 under Federal Decree-Law No. 32 of 2025, which replaces the old name wherever it appears in legislation, including Resolution 56.

What a bank must do before and during a sales call

Your consent comes first

A bank needs your prior express consent before it markets to you (Art. 7.1). The consent must record your preferred language, the channels you accept, how you may be contacted (a human agent, an AI-based agent or a robocall) and the types of products you want to hear about (Art. 7.2). The bank must also verify your age.

Online, consent must be explicit and written, such as a checkbox or a text reply. A paper form needs your signature. If you ask for a call by phone, the bank needs explicit verbal consent and must keep the recording (Art. 8.1.3). For telemarketing calls, the bank must also send you an immediate written confirmation of the terms and conditions (Art. 8.2.1).

Consent must be voluntary and free of pressure. You can withdraw it at any time, at no cost and without adverse consequences, and it cannot be a condition of buying a product. Once you withdraw, the bank must stop contacting you immediately and remove your details from its telemarketing list (Art. 8.3).

The DNCR bar in Article 9.2 contains no exception for consent or for existing customers. It covers anyone who has opted out of or rejected telemarketing "in any form", and anyone whose number is on the registry.

When and how often a bank may call

• Hours: only between 9:00 AM and 6:00 PM UAE time (Art. 15.1). If you named a preferred time, the bank must keep to it.
• Frequency: no more than once a day and twice a week, unless you showed clear interest and asked for a follow-up (Art. 15.3 to 15.4).
• Rejected or unanswered: no further marketing of a product you rejected on an earlier call, or did not answer an earlier attempt about (Art. 14.2).
• Stopping: the call must end immediately when you ask, verbally or in writing (Art. 14.1).

What the caller must tell you

At the start of every call, the caller must say who they are, name the institution and what it does, and state the purpose. They must tell you about your right to complain to the institution and, where applicable, to the Ombudsman Unit, and your right to register on the DNCR. They must ask if it is a convenient time, say how long the call will take, and ask whether you want to continue before selling anything (Art. 13). The bank must tell you the call is recorded (Art. 10.5).

If you continue, the caller must explain the product's features, risks, charges and full terms, in simple and accurate language. False claims, deception and unjustified pressure are prohibited (Art. 12.1), and banks must follow the applicable laws when telemarketing to People of Determination and people who lack full legal capacity (Art. 12.2).

Caller ID, automated diallers and AI agents

The caller must use the bank's complete registered name, not hidden, with the designation "Telemarketing" next to it (Art. 6.3 to 6.4). The number must come from a UAE-licensed telecom company and be registered under the bank's commercial licence (Art. 6.5). A card or loan offer from an unidentified personal mobile does not meet that standard.

If the bank uses automated dialling equipment, the dialler must let an unanswered call ring for at least 15 seconds or four rings before it hangs up. Once you answer, you must be connected to a telemarketer within two seconds (Art. 16.1). Under the regulation's definition, that telemarketer can be an automated system or artificial intelligence (Art. 1.29). The use of AI is subject to the applicable laws (Art. 16.2), and a bank may reach you through an AI agent or a robocall only where your consent covers that method (Art. 7.2).

Duties you never see

These duties give a complaint something concrete to point at:

• written board approval before any telemarketing, and the Central Bank may require its own prior approval as well (Art. 2);
• at least 15 hours of training per telemarketer, plus refresher training at least once a year (Art. 3.2 to 3.3);
• a log of every call (date, time, duration, telemarketer or AI identifier, your name, purpose) kept for at least five years (Art. 10);
• an annual telemarketing report to the Central Bank within 30 days of the end of the year, and an annual compliance audit (Art. 11.1 and 19.3);
• no sharing or trading of your personal data with third parties without your explicit consent (Art. 18.2);
• full compliance by any outside agency the bank uses, and an updated list of its authorised telemarketers and channels so customers can check a call (Art. 6.2 and 19.2);
• a published guide on how to complain and how to register on the DNCR (Art. 9.3).

For compliance teams: the core controls are consent before contact (Arts. 7 to 8), the DNCR bar (Art. 9.2), the 9 AM to 6 PM window and the once-a-day, twice-a-week cap (Art. 15), the dialler rules (Art. 16.1) and Central Bank enforcement (Art. 20.1). The 90-day transition in Art. 24.2 ended on 29 June 2026.

How to stop the calls

1. Say stop on the call. The bank must cease immediately. Note the date, time, number and the caller's name.
2. Withdraw consent in writing. Use the bank's app, email or a branch, and keep a copy. The bank must then remove you from its telemarketing list.
3. Register on the national DNCR. The Telecommunications and Digital Government Regulatory Authority (TDRA) runs the national DNCR, which lets you opt out of marketing calls from specific sectors or from all sectors. The registration method is set by TDRA and can change, so confirm the current steps with TDRA or your telecom provider (e& or du).
4. Block marketing texts. Per the TDRA FAQs, send the sender ID followed by B (for example "AD-SenderName B") to 7726 to block one sender, "B" followed by a sector name to block a sector, or "BALL" to block all promotional texts. Send "GET" to 7726 to see what you have blocked. This works only for senders and sectors whose names start with AD. TDRA allows marketing texts only between 7 AM and 9 PM, and only with your prior explicit consent. Complaints about spam texts go to your telecom provider, which must log the complaint, give you a reference number, investigate it and tell you the outcome.
5. Check the caller ID. TDRA's Kashif service shows the caller's registered name even when the number is not saved (u.ae telecommunications page). It is applied compulsorily to business numbers and is not applied to individuals' private numbers. A genuine bank sales call should show the bank's registered name with "Telemarketing" beside it (Art. 6.4), so a sales call that shows no name is a warning sign.

How to complain about a bank or insurer

The bank must log any complaint about unwanted telemarketing (Art. 17.2). Give it your name and contact details, the name and number of the caller or institution, and supporting documents such as call-log screenshots, the texts, or your written opt-out. The bank must handle it under the Central Bank's consumer protection rules, and must tell you that you can go to the Ombudsman Unit if it does not resolve the complaint within the prescribed period (Art. 17.5).

That unit is Sanadak, an independent body that resolves complaints from consumers of licensed financial institutions and insurers, free of charge. The Sanadak regulation sets the rules:

• Complain to the bank first and give it at least 30 complete business days (or another period the Central Bank sets) to send a final written response. If it does not answer in that time, or its final answer does not resolve the complaint, you can take the complaint to Sanadak.
• Sanadak can reject a complaint that the bank never received, that the bank had fewer than 30 complete business days to answer in writing, or that is or has been before a UAE court (Art. 4.1.2).
• You must file within three years of the conduct or two years of learning about it, whichever is later; for continuing conduct, time runs from when it stopped (Art. 4.4).

File through Sanadak's official website, linked from the government's banking services page. Our guide to bank loan deferral rules walks through the same bank-then-Sanadak route, and this answer covers escalating an insurance dispute to Sanadak.

If the caller claimed to sell a particular bank's product, complain to that bank even if an agency called. The regulation covers outsourced telemarketing, and the bank must keep a list of its authorised telemarketers.

Sellers that are not banks

Cabinet Resolution 56/2024 closely mirrors the bank rule for every other licensed company: prior approval from the competent authority, trained staff, local numbers registered to the company, a call record, no calls to DNCR numbers, and recorded calls with notice to you. The caller must identify the company and the call's purpose at the start and ask whether you want to continue. Pressure and deception are banned, and calls may be made only from 9:00 AM to 6:00 PM. No call-back after you reject a product, and no more than once a day and twice a week if you did not answer or ended the call. Your data may not be disclosed or traded without consent.

Complaints go to the authority that issued the company's licence. For a Dubai mainland company that is the Department of Economy and Tourism; for a free-zone company it is that free zone's licensing authority. The Central Bank covers banks and insurers, and the Capital Market Authority covers securities and capital-market firms. The Ministry of Economy and Tourism (called the Ministry of Economy in the 2024 resolution) has general supervision and lists 800-1222 as its call centre and customer protection line. Include your name and number, the caller's name and number, and any supporting documents. Our consumer complaints guide explains the wider process.

Individuals may not sell from numbers licensed in their own name (Article 3(2)).

The fines under Cabinet Resolution 57/2024

Company penalties escalate from a warning to fines, suspension for 7 to 90 days, licence cancellation, and cutting the phone lines. Selected fines:

Individuals selling from personal numbers face AED 5,000 with their numbers cut until they pay, then AED 20,000 and a three-month cut for a second offence within 30 days, then AED 50,000 and a 12-month bar on telecom services.

These table amounts are not the bank penalty scale. Resolution 57 directs the Central Bank to develop its own penalty regulation, with Cabinet approval, for the companies it supervises (Art. 3, Third), and the Central Bank collects those fines itself (Art. 5(2)). The Central Bank's telemarketing regulation allows "supervisory action, administrative action and/or financial sanctions as deemed appropriate by the Central Bank" (Art. 20.1) and publishes no amounts. The exact figure is set by the Central Bank and can change; confirm the current position with the Central Bank or a licensed UAE lawyer.

Mistakes that weaken a complaint

• Calling a debt-collection call telemarketing. Chasing a debt is not selling, and different rules apply. See dealing with debt collectors.
• Treating a scam as a sales call. Someone impersonating your bank is committing fraud. See how to report a cybercrime.
• Going straight to Sanadak. Sanadak can reject a complaint the bank never received, or one the bank had fewer than 30 complete business days to answer. Complain to the bank first.
• Keeping no record. The bank keeps a call log with the date, time and telemarketer identifier for five years, and the details you note help it find the call.
• Citing the wrong law. Older guides cite the repealed 2011 notice. The PDPL excludes banking and credit data covered by its own legislation, so cite the Central Bank rule for banks; for other sellers, see our PDPL guide.
• Assuming a consent tick lasts forever. You can withdraw consent at any time, at no cost.

When a lawyer is worth it

Most cases end with a written opt-out and, if needed, a complaint. A lawyer helps when calls continue after a Sanadak complaint, when your data seems to have reached third parties, when a product sold on a call was not what you were told, or when your business needs a compliant telemarketing setup.

Compare banking and finance lawyers, look up the CBUAE in the legal dictionary, and read about your wider consumer rights.

This is general legal information, not legal advice. Confirm current procedure with the relevant authority or a licensed UAE lawyer.