AECB Credit Bureau Integration in Dubai (2026): Consent, Credit Score 3.0 and Real AED Build Costs
Pulling an AECB credit report without written consent risks AED 50,000 and two years. Real integration costs, per-report fees, Credit Score 3.0 and the July 2026 BNPL data change.
- PUBLISHED
- 24 SEPT 2026
- READ TIME
- 12 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Short answer: If your Dubai platform lends, leases, sells on instalments or scores customers, an Al Etihad Credit Bureau integration is a regulated build, not a data subscription. Under Federal Law No. 6 of 2010, obtaining credit information or accessing a credit record without the required approvals carries a minimum AED 50,000 fine and a minimum two years imprisonment, and any other breach of the Credit Information Law draws AED 10,000, imprisonment, or both. CBUAE-licensed finance companies must also request AECB credit information before extending credit to an individual borrower and submit borrower data at least monthly. Budget AED 45,000 to AED 220,000 for a production-grade integration, plus AED 10.50 to AED 157.50 per report pulled.
Here is what catches good product teams. Nobody gets fined for a bad API call. They get exposed because a sales agent pulled a report from a shared login "to check if the client qualifies" before the customer signed anything, or because the consent record lived in a PDF folder with no link to the pull that used it. The API is the easy half. The consent ledger is the half regulators ask about.
The numbers behind why this is suddenly a 2026 project
Credit data in the UAE stopped being a bank-only utility. It is now the default risk layer under lending, BNPL, leasing, telecom and increasingly B2B trade credit.
- Annual volume of AECB credit reports and scores went from 1 million in 2015 to more than 17 million by the end of 2025.
- The bureau database now holds over 32.6 million bank accounts, 22 million credit facilities and credit information on 18 million individuals and companies, sourced from 119+ information providers including banks, government entities, telecom operators, utilities and courts.
- Gross credit across the UAE banking sector reached AED 2.7989 trillion by the end of July 2026, growing AED 41.2 billion (1.5%) in that month alone, with credit to individuals up 2.3% and the single largest contributor to domestic credit growth.
- Personal borrowing rose 19% year on year to roughly USD 158 billion, and major UAE banks are forecasting 15% to 20% loan growth for 2026.
- Asset quality is still excellent, with non-performing loans at 2.3% in Q2 2026 across the ten largest listed banks. That low number is the product of disciplined bureau-driven underwriting, not of a forgiving market.
Volume grew 17x in ten years while default rates stayed near record lows. That is the whole argument for building the integration properly: in this market, credit data discipline is the moat.
Three things changed in 2026, and they all affect your data model
1. Credit Score 3.0 arrives in H1 2026. Built with the Central Bank and the banking sector, it replaces the current model, which already calculates a 300 to 900 score from more than 2,000 variables. The change is structural: scores move to quarterly adjustments, and a customer who today sits in the delinquency category for 24 months after missing more than three consecutive payments will be able to exit the red zone in about six months and materially improve inside a year. The bureau will also expose the precise reasons a score moved.
If you cache a score and treat it as stable for a year, your risk engine is about to be wrong in both directions: you will keep declining customers who have recovered, and you will miss deterioration. Score freshness becomes a product requirement, with a re-pull policy and a stored as-of date on every decision.
2. BNPL data is now in the report. Effective July 2026, AECB expanded credit reports to include Buy Now Pay Later account information from Tabby and Tamara. That matters because the UAE BNPL services market is worth about USD 5.02 billion in 2026 and is forecast to reach USD 11.49 billion by 2031 at an 18.03% CAGR, with transaction volume growing over 40% year on year through 2025. B2B BNPL alone is around USD 1.97 billion in 2026. Commitments that were invisible to underwriters last year are now on the file, so affordability calculations built before July 2026 are systematically understating exposure.
3. Company reports now carry conduct signals, not just debt. Through a partnership with MOHRE, AECB introduced company-level behavioural indicators covering delays in settling administrative fines, non-compliance with Emiratisation requirements, non-payment of WPS wages, failure to meet GPSSA pension contribution obligations, and the classification of entities including fake establishments. If you extend trade credit or B2B instalments in Dubai, the company report has become a far better predictor than a balance sheet a client emails you.
The consent layer: the part that actually gets audited
A consent under the Credit Information Law is a signed, written approval from the individual or company allowing a lending institution or other authorised entity to obtain their report. Three engineering consequences follow, and most teams miss at least two.
- Consent must be bound to the pull, not to the account. Every API call needs a stored reference to the specific consent artefact that authorised it: who consented, to what purpose, when, by what method, and which request consumed it. Shared credentials and unattributable pulls are the classic failure.
- Purpose limitation is real. A consent captured for a car finance application does not authorise a marketing propensity score next quarter. Your system should refuse the second pull rather than rely on staff judgement.
- Corrections have clocks. Data providers are required to respond to correction requests raised through the bureau within 10 working days, and the bureau verifies disputed information with the institution within about 20 days. If you are a data provider submitting monthly files, you need a dispute inbox and an owner, not an email alias.
Layer the UAE PDPL obligations for websites and apps on top, because credit data is about as sensitive as personal data gets: purpose records, retention limits, access logging and breach timelines all apply to the same pipeline. Reports carry a 24-month payment history window, which is a useful anchor for how long your derived decisions need to stay explainable.
What you are actually integrating, and what each pull costs
Integration is API-based, and it is not limited to banks: aggregators run real-time score checks against AECB, as Policybazaar UAE does for instant credit card pre-approval indications. Published consumer-facing fees give you the per-transaction cost floor to model against.
| Artefact | Published fee | What it is good for | Design note |
|---|---|---|---|
| Credit score only | AED 10.50 | Pre-qualification, funnel triage, soft eligibility | Cheapest gate. Run it first, decline early, protect the report budget |
| Individual credit report and score | AED 84 (incl. VAT) | Full underwriting, affordability, limit setting | Pull only after consent is captured and the applicant is genuinely in scope |
| Company or establishment report | AED 157.50 | Trade credit, B2B instalments, corporate onboarding | Now includes MOHRE conduct indicators, so re-pull on renewal |
| Monthly data submission (as a provider) | Regulatory obligation | Licensed finance companies and lenders | At least monthly, plus a mandatory pre-lending enquiry per individual borrower |
The cost engineering here is straightforward and almost always skipped: a two-stage gate. Score first at AED 10.50, full report only for applicants who clear it. On a funnel converting 1 in 5, that is roughly AED 84 versus AED 420 in bureau spend per approved customer, before a single line of risk logic changes.
What an AECB integration costs to build in Dubai
Bureau fees are the small number. The build is where budgets go wrong, usually by treating a regulated data pipeline as a one-week API task.
| Scope | Indicative Dubai range | What it includes |
|---|---|---|
| Score-only pre-qualification | AED 45,000–80,000 | Consent capture and ledger, score pull, caching with as-of dates, audit log, sandbox to production cutover |
| Full underwriting integration | AED 90,000–160,000 | Report parsing into a normalised schema, affordability and DBR calculations, decision engine with reason codes, retry and outage handling |
| Two-way provider integration | AED 150,000–220,000 | Monthly submission file generation, validation and reconciliation, dispute workflow, correction tracking against the 10 day provider clock |
| Company and trade-credit module | AED 35,000–70,000 add-on | Establishment reports, MOHRE conduct indicators, limit and renewal policy, portfolio re-pull scheduling |
| Run and support | 15–20% of build per year | Schema changes, Credit Score 3.0 migration, monitoring, audit-ready evidence exports |
Compare that against the downside. A single unauthorised-access finding starts at AED 50,000 with a minimum two-year custodial exposure for the individual responsible, and for a CBUAE-licensed entity the more serious cost is a licence file, not a fine: restricted licences run in three-year renewable terms. Against a portfolio growing at the market’s 15% to 20% lending pace, a build in the AED 90,000 to AED 160,000 band is cheap insurance on the one control that gates every disbursement you make.
How Aquarius builds this so it survives an audit
We build credit-bureau integrations as an evidence system with a risk engine attached, in that order. Concretely: a consent ledger where every pull is immutably linked to the consent artefact, purpose and requesting user, so any single decision can be reconstructed years later. A normalised credit schema that separates raw bureau payload from derived scores, so a model change never rewrites history. A decision engine that stores its inputs, thresholds and reason codes with each outcome. Score freshness policies with as-of dates and automated re-pull windows, which is exactly what Credit Score 3.0 quarterly movement now demands. And graceful degradation, because a bureau timeout must queue and retry, never silently approve.
If you are building the surrounding rails too, our work on e-wallet development and CBUAE SVF licensing covers the payments and licensing side, Open Finance and Al Tareq API integration covers consented bank-data access that pairs naturally with bureau data, and Tabby and Tamara BNPL integration covers the merchant end of the same credit chain. Indicative build ranges sit on our pricing page.
Frequently asked questions
Can a non-bank company in Dubai access AECB credit reports?
Access is limited to lending institutions and other entities authorised to obtain reports, always with the subject’s written consent. Aggregators and platforms do integrate, as the Policybazaar UAE real-time score integration shows, but authorisation and your licensed activity come first. Build the consent and audit layer on the assumption that every pull will be reviewed, because eligibility is a legal question before it is a technical one.
Do we need consent for every single credit report pull?
Treat it that way. Consent is a signed written approval tied to a purpose, so a pull outside that purpose is a new pull needing new authority. Obtaining credit information or accessing a credit record without the required approvals carries a minimum AED 50,000 fine and a minimum two years imprisonment under Federal Law No. 6 of 2010. Enforce it in software rather than in policy documents.
How does Credit Score 3.0 change what we should store?
Scores will adjust quarterly and recovery from delinquency compresses from 24 months to roughly six, so a stored score needs an as-of timestamp, a defined shelf life and a re-pull trigger. Keep the raw payload separate from your derived decision, record the reason codes the bureau exposes, and never let a cached score silently drive a decision months later.
Are BNPL balances visible to lenders now?
Yes. From July 2026, AECB credit reports include BNPL account information from Tabby and Tamara. In a market where BNPL is worth about USD 5.02 billion in 2026 and growing at 18.03% CAGR, affordability models built before that change understate real commitments, so re-baseline your debt burden ratio logic against post-July data.
What happens if a customer disputes data we submitted?
As a data provider you are required to respond to correction requests raised through the bureau within 10 working days, and the bureau verifies disputed records with the institution within roughly 20 days. That means a routed queue, a named owner and a correction resubmission path in your monthly file process, all of which is far cheaper to build once than to handle manually per case.
The move to make before Credit Score 3.0 lands
Audit your existing pulls before you write new code. In most Dubai lending and instalment platforms we review, the technical integration works fine and the gap is evidentiary: shared credentials, pulls with no linked consent record, cached scores with no as-of date, and no way to reconstruct why a specific customer was declined in March. Credit Score 3.0 and the July 2026 BNPL data expansion will both move your decisions, and both will make un-versioned risk logic indefensible.
Aquarius builds regulated data integrations, underwriting engines and lending platforms for Dubai operators. If you want your current AECB setup or underwriting flow reviewed against the consent, audit and score-freshness requirements, send us the flow and we will come back with a plain list of what holds, what does not, and what to fix first. The full range of what we build is on our services page.