.png)
1. Executive summary
The UAE's insurance regulatory framework changed fundamentally on 16 September 2025. For motor claims operations, the implications are structural, the timeline is short, and the compliance perimeter is wider than a first reading of the law suggests.
THE THREE THINGS TO KNOW
One law replaces two. Federal Decree-Law No. (6) of 2025 consolidates the Central Bank law (14/2018) and the Insurance Law (48/2023) into a single 188-article framework under the CBUAE.
Three instruments operate together. Law 6/2025 sits alongside the CBUAE Consumer Protection Regulation and the UAE Personal Data Protection Law (FDL 45/2021). The CBUAE examines all three in the same supervisory review.
September 2026 closes the window. Article 184 grants a one-year reconciliation period; Article 168 sanctions and Article 170 criminal penalties apply from entry into force, not from the end of the transition.
This paper maps ten operational areas where motor claims compliance is most likely to be tested:
- Audit trail integrity
- Role segregation
- Decision provenance
- Structured data reporting
- Statutory claims timelines
- Customer protection and fair treatment
- Complaint resolution
- Outsourcing governance and TPA accountability
- Personal data and automated decisioning
- Fraud prevention
The intended audience for this whitepaper is motor insurance leadership, claims directors, compliance officers, and operations managers responsible for ensuring that claims handling meets CBUAE standards before the transition window closes.
2. The regulatory shift
Law 6/2025 did three things to the regulatory architecture:
- Repealed both predecessor laws. Article 185 explicitly repeals Law 14/2018 (Central Bank) and Law 48/2023 (Insurance Activities). One framework, one enforcement toolkit.
- Brought the full insurance value chain inside the perimeter. Article 60 prohibits any Licensed Financial Activity without a license. Article 61(1)(j) lists insurance as a Licensed Financial Activity. Article 1 includes Insurance-Related Professions (third-party administrators, loss adjusters, actuaries, brokers) within the scope.
- Raised the evidence standard. Article 122 requires periodic information submissions. Articles 90 and 91 impose data and disclosure obligations on Insurance-Related Professions. Article 133 grants the CBUAE examination powers extending to any person suspected of conducting Licensed Financial Activities. The model is demonstrate-compliance-through-documentation, not assert-compliance-through-policy-statements.
Existing regulations issued under the predecessor laws stay in force under Article 183 until the CBUAE replaces them. Circular 24/2022 on claims settlement timeframes continues to apply during the transition.
Three instruments operating simultaneously
Law 6/2025 is one of three instruments motor claims operations must satisfy together:
COMPLIANCE HIERARCHY
No instrument supersedes the others. All three must be satisfied at the same time. A breach of one does not mitigate or excuse a breach of another. A claim that breaches a Law 6/2025 timeline may simultaneously breach the Consumer Protection Regulation if the policyholder is treated unfairly, and the PDPL if data has been retained or processed without lawful basis.
3. Ten requirements that define motor claims compliance
The expanded framework integrates three new requirements alongside the original seven. The originals are retained without dilution.
The ten are not independent. Audit trails support fraud detection and decision provenance. Role segregation strengthens both. Statutory timelines depend on the audit trail. Customer protection evidence draws on the same logs. PDPL alignment runs through every stage. An operation that designs them as an integrated system finds they reinforce each other; one that treats them as isolated checkboxes finds the gaps between them.
4. Statutory claims timelines: the end of aspirational SLAs
Under the predecessor framework, claims timelines were a mix of regulatory guidance, soft circulars, and commercially negotiated SLAs. Under Law 6/2025 and its implementing standards, claims timelines are statutory obligations with enforceable, per-incident or per-day penalties.
Three rules that change everything
- Each stage is separately clocked. A late acknowledgement is a breach even if the final decision is on time. A decision issued on the deadline but paid late is a second, independent breach.
- The clock cannot be paused with rolling documentation requests. A single complete documentation list at the start is permitted; iterative top-up requests that pause the clock are not. Front-loaded documentation discipline is required per claim type.
- TPA delays are insurer regulatory liability. Article 142(3) extends the CBUAE's early intervention powers to Insurance-Related Professions. The licensee retains accountability for outsourced functions regardless of who caused the delay.
Al Tamimi & Company's reading of Law 6/2025 and the Consumer Protection Regulation sets out the following stage sequence and indicative durations:
Complex or large-loss claims may follow extended timelines, but only where the extension is formally notified to the CBUAE with reasons. These durations derive from Al Tamimi's interpretation of the implementing standards under Article 130 of Law 6/2025 rather than from the text of the law itself; insurers should treat them as the working framework for stage-clock design.
5. The expanded perimeter: customer protection, data, and AI
Three additional perimeters sit alongside Law 6/2025's governance dimension and are examined in the same supervisory review.
5.1 Customer protection: conduct risk is now enforceable
The CBUAE Consumer Protection Regulation establishes Treating Customers Fairly (TCF) as an outcomes-based standard. Insurers must demonstrate, through outcomes data, that policyholders are treated fairly throughout the claim lifecycle.
Four obligations apply:
- Vulnerability identification at FNOL. Communication, timelines, and support adjusted accordingly. Most UAE motor insurers do not yet operate a formal vulnerability framework, which is a structural gap.
- Plain-language communication. Repudiation letters cannot rely on exclusions buried in fine print. Clear, specific, evidence-linked, rights-informing.
- Complaints function with board MI. Designated owner, public policy, root-cause coding, monthly board-level reporting on systemic issues.
- Remediation authority. Where the CBUAE identifies systemic claims-handling failings across a book, it can require redress payments to affected policyholders. The most financially significant enforcement tool short of license action.
5.2 Personal data: claims is a high-risk processing function
A single motor claim may involve medical records, financial data, biometric information, third-party personal data, and location and behavioral data. All within scope of the UAE PDPL.
5.3 AI and algorithmic tools: the explainability standard
AI-assisted decisions are subject to the same audit trail and decision provenance standards as any other claims decision.
EXPLAINABILITY STANDARD
The logic of any AI tool that contributes to a claims decision must be documentable and explainable at a level a CBUAE examiner will accept. "Proprietary algorithm" is not a regulatory defense. Vendor contracts must include explainability warranties and cooperation clauses for regulatory examination.
For each production model, a CBUAE examiner would expect documentation covering:
- Training data scope and provenance
- Decision logic at a level a regulator can interpret
- Human-in-the-loop rules
- Override frequency and rationale
- Drift monitoring
AI as decision support is acceptable. AI as autonomous decision-maker on consequential claims actions is not. No algorithm should approve a payment, authorize a repair, or close a claim without a named human accountable for the decision.
6. Where motor claims operations typically fall short
Most motor claims operations were built to process claims, not to produce regulatory evidence. The gap is architectural.
7. Requirement by requirement
7.1 Audit trail integrity
Article 130 of Law 6/2025 requires every Licensed Financial Institution to maintain a governance framework, with internal controls that withstand regulatory examination. For motor claims, every assessment, authorization, and payment decision must be recorded with enough detail to reconstruct the reasoning afterwards.
The fourth row carries weight for outsourcing arrangements: contracts with third-party administrators must provide the insurer with audit and retrieval rights surviving contract termination. The CBUAE's examination powers under Article 133 do not stop at the insurer's data perimeter.
7.2 Role segregation
Three motor claims functions must be segregated: damage assessment, repair authorization, and payment approval. The segregation must be:
- Documented in the approval hierarchy
- System-enforced, not policy-based alone
- Visible in the audit trail at every decision
Where a single claims handler controls the full cycle from assessment through payment, the operation has no structural check against inflated estimates, unnecessary repairs, or preferred-garage steering. These are the patterns Article 149 fraud controls and Article 130 governance are designed to prevent.
7.3 Decision provenance
Every claims decision carries a number; every number should trace back to a verifiable source. The integrated reading adds three operational requirements at the decision stage:
- Reasoned rejection. A repudiation letter must specify the exclusion relied upon, the evidence applying it to the specific claim, and the policyholder's rights including the path to Sanadak. Reference to a broad exclusion is no longer sufficient.
- Partial settlement. Where a claim has both undisputed and disputed components, the undisputed portion must be paid within the standard window. The full claim cannot be held open over a quantum dispute on a single line item.
- Payment as a separate clock. A decision issued within the deadline but paid late is a second, independent breach.
For motor claims, decision provenance depends on reference data quality. An operation that benchmarks against a verified parts pricing database and documented labor rate schedule can demonstrate provenance; one relying on individual assessor judgment cannot.
7.4 Structured data reporting
Article 122 requires periodic information submissions. Articles 90-91 impose data and disclosure requirements on Insurance-Related Professions. Data must be captured in structured, machine-readable formats from point of entry, not converted afterwards for regulatory submission.
Circular 24/2022 specifies claims settlement timeframes that insurers must report against, requiring claims data timestamped at each lifecycle stage: notification received, inspection completed, estimate approved, repair authorized, payment released.
7.5 Statutory claims timelines
Stage clocks (Section 4) apply at stage level and require evidence at each stage. The operational requirement:
- Each stage clock configured as a regulatory SLA distinct from any commercial SLA
- Tracked per claim, surfaced on dashboards, reported in management information
- FNOL design that issues a single complete documentation list per claim type. Subsequent requests are exception events that trigger named-supervisor review and an audit-trail entry
- Complex and large-loss claims notified to the CBUAE with reasons before extended timelines apply
7.6 Customer protection and fair treatment
The Consumer Protection Regulation operates as a parallel framework to Law 6/2025. Four operational components:
- Vulnerability identification at FNOL with intake mechanism, optional automated indicator detection, mandatory human review at the flag point
- Plain-language communications across all policyholder touchpoints, not only repudiation letters
- Complaints handling with designated owner, public policy, root-cause coding, board-level MI on systemic issues
- Remediation cooperation in outsourcing arrangements, with cost allocation defined upfront for CBUAE-mandated redress
7.7 Complaint resolution
Article 148 establishes a customer complaint resolution framework. Article 148(9) provides for potential expansion to Insurance-Related Professions. The CBUAE's Sanadak platform operationalizes the framework for insurance complaints.
Sanadak's 15-calendar-day rule is an eligibility criterion, not a resolution deadline imposed on the insurer. Once 15 days pass without resolution, the complaint enters CBUAE's formal process and the regulator's documentation, response quality, and resolution timeline expectations apply directly.
Compliant complaint handling requires:
- Documented internal process with defined response timelines
- System that timestamps each stage (receipt, acknowledgment, investigation, resolution)
- Sanadak integration so escalated complaints are received and responded to within the CBUAE's process framework
7.8 Outsourcing governance and TPA accountability
Motor claims operations depend on external parties: repair workshops, towing companies, surveyors, third-party administrators, and parts suppliers. The insurer retains regulatory accountability for outsourced functions regardless of who performs the work.
Article 142(3) extends the CBUAE's early intervention powers to Insurance-Related Professions. The integrated reading: the regulatory perimeter does not stop at the insurer's institutional boundary; it follows the function.
Outsourcing agreements need:
- Statutory SLA flow-down at stage level (not only commercial SLAs)
- Audit and retrieval rights surviving contract termination
- Penalty pass-through for CBUAE penalties attributable to the outsourced function
- PDPL-grade data processing agreement
- Remediation cooperation in the event the CBUAE invokes its authority across the book
Loss adjusting is classified as an Insurance-Related Profession under Article 61(j) of Law 6/2025 and falls within the same governance perimeter as the insurer.
7.9 Personal data and automated decisioning
Motor claims processing engages the UAE PDPL at every stage. Five operational components define a compliant position:
- Lawful basis register maintained as part of the data processing infrastructure, not as a separate compliance document
- Calibrated documentation lists at FNOL, aligned to claim type rather than to a maximalist template
- Right of access (SAR) fulfillment workflow producing a complete dataset including adjuster reports, assessor notes, fraud flags, and internal communications attached to the claim
- Retention and deletion per the regulatory schedule, with deletion at the boundary
- Automated decisioning disclosure with policyholder-facing notice, regulator-grade explainability, and a path to human review
7.10 Fraud prevention
Article 149 addresses fraud prevention directly; Article 130 requires a governance framework whose internal controls address fraud risk. Fraud prevention operates at three levels:
- Transaction level. Automated checks flag anomalies: repeat claims, repair costs exceeding benchmarks, garage or geographic clustering
- Process level. Role segregation (7.2) and decision provenance (7.3) create structural barriers to manipulation
- Governance level. Documented framework defines detection criteria, investigation procedures, and reporting obligations
Fraud prevention is a by-product of operational design, not a bolt-on. An operation with strong audit trails, segregated roles, verified reference data, and structured reporting detects fraud as a natural consequence of its workflow.
8. The structural insight
THE ARGUMENT IN ONE PARAGRAPH
The ten requirements form an integrated compliance architecture where each element strengthens the others. Audit trails make fraud detection possible. Role segregation removes single points of failure. Decision provenance creates the evidence base for structured reporting. Statutory timelines depend on the same timestamped, documented process. Customer protection and complaint resolution share evidence with the rest. PDPL alignment runs through every stage. AI explainability extends decision provenance into the algorithmic layer. Outsourcing governance extends the same standards to external parties. Fraud prevention emerges from the interaction of all of the above.
An operation that bolts compliance onto an existing process (adding audit logging here and segregation controls there) produces a fragile result that is expensive to maintain. One that designs compliance into the operational architecture from the start finds each requirement reinforces the others, reducing the marginal cost of every additional layer.
The CBUAE's consolidated approach reflects this logic. By placing insurance within the same regulatory framework as banking and integrating conduct and data dimensions into the same supervisory review, the law signals an expectation that insurance operations will meet the same governance, reporting, and accountability standards as the rest of the financial sector. The transition period under Article 184 provides the window. The enforcement toolkit in Article 168, paired with the remediation authority under the Consumer Protection Regulation, provides the incentive.
The architecture described in the next section can be built within an insurer's internal claims function or accessed through a specialist provider. The structural logic holds either way; the choice between internal build and external partnership turns on capability, capacity, and time-to-readiness against the September 2026 horizon, not on which path the regulation prefers.
9. Practical compliance architecture
A compliant motor claims operation is built so that compliance evidence is generated as a by-product of normal operations. Five layers, each depending on the one below:
IMPLEMENTATION SEQUENCE
Fix the audit trail first. Then enforce segregation and stage clocks. Then standardize reference data. Then build the conduct and data layer. Then build reporting on top of a clean foundation. Operations that start with reporting before fixing the underlying data capture produce reports that look compliant but cannot withstand examination.
10. Timeline and priorities
Law 6/2025 took effect on 16 September 2025. The Article 184 reconciliation window closes approximately September 2026. Existing regulations under the predecessor laws stay in force under Article 183 until replaced. The Consumer Protection Regulation and the PDPL operate from their own effective dates, separate from the Law 6/2025 transition clause.
Priority sequence for the transition period:
- Audit trail and data infrastructure. Foundational, longest to implement correctly. Start here.
- Statutory stage clocks. Configured in parallel, drawing on the same data infrastructure.
- Governance structures. Role segregation, approval hierarchies, outsourcing agreements formalized alongside.
- Conduct and data layer. Vulnerability framework, complaints handling, retention schedules, AI explainability.
- Sanadak integration. Verified, gaps closed.
- Fraud prevention framework. Documented, drawing on the operational controls established above.
- Regulatory reporting. Built on the structured data foundation; the last layer, not the first.
WHY THE TRANSITION PERIOD IS NOT A DEFERRAL PERIOD
- Article 168 sanctions apply from entry into force, not from the end of the transition. Up to AED 1 billion on Licensed Financial Institutions, AED 5 million on Authorized Individuals.
- Article 170 criminal penalties for conducting Licensed Financial Activities without authorization apply from entry into force. AED 50,000 to AED 500 million.
- Remediation authority under the CPR operates separately and can require restitution payments across an insurer's book.
The transition period is for reconciliation, not for deferral.
11. What compliance looks like in practice
A CBUAE-compliant motor claims operation, in daily practice, looks structurally different from a conventional one. The differences are visible at every stage of the lifecycle.
None of this requires exotic technology. It requires an operational architecture designed with compliance as a structural property rather than an afterthought.
References
[1] Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. Issued 8 September 2025, effective 16 September 2025. Key provisions referenced: Article 1 (definitions, Insurance-Related Professions), Articles 60-61 (licensing), Articles 63-73 (licensing framework), Articles 90-91 (provision of data and information; disclosure and transparency, both applying to Insurance-Related Professions), Article 120 (supervisory authority), Article 122 (providing the Central Bank with information and reports), Article 130 (governance of Licensed Financial Institutions), Article 131 (Rulebook), Article 133 (examination powers), Article 142 (early intervention, including 142(3) for Insurance-Related Professions), Article 148 (protection of customers), Article 149 (fraud prevention), Article 168 (sanctions), Article 170 (criminal penalties), Articles 183-185 (transitional and repeal provisions). Anti-money-laundering and counter-terrorist-financing obligations sit outside this law, under Federal Decree-Law No. 20 of 2018 (as amended) and its implementing decisions.
[2] CBUAE Circular 24/2022 on claims settlement timeframes. Remains in force under Article 183 of Law 6/2025 until replaced.
[3] CBUAE Rulebook, published under Article 131 of Law 6/2025. Available at rulebook.centralbank.ae.
[4] CBUAE Sanadak complaint management platform. The 15-calendar-day period is the eligibility criterion for escalation from insurer-level handling to CBUAE oversight.
[5] CBUAE Consumer Protection Regulation (Circular No. 8 of 2020) and accompanying Consumer Protection Standards, in force under Article 183 of Law 6/2025 until replaced. Provisions backing the obligations cited in this paper: Article 4 (disclosure and transparency), Article 5 (institutional oversight and responsible business conduct, including vulnerable-consumer treatment), and Article 8 (complaint management and resolution). The vulnerable-consumer and remediation detail sits in the accompanying Consumer Protection Standards.
[6] Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL). Governs lawful basis for processing, data subject rights, retention, cross-border transfers, and automated decisioning.
[7] Al Tamimi & Company, "The Real Impact of Federal Decree Law No. 6 of 2025 on Insurance Claims Operations." Presentation by Anand Singh, Legal Director (2026). Cited for the integrated three-instrument framing, the stage sequence and indicative stage-clock durations, the single-documentation-request rule, the audit-trail standard comparison, the TPA accountability doctrine, and the AI explainability standard. These reflect Al Tamimi's interpretation of the implementing standards under Article 130 of Law 6/2025.
[8] CBUAE Insurance Brokers' Regulation 2024. 10-year retention requirement for insurance records.
About Axxion
Axxion Claims Settlement Services L.L.C. is the UAE's first dedicated motor third-party administrator. From Dubai, Axxion manages the full motor claims lifecycle for insurance partners: first notification of loss, surveying, repair coordination, quality control, recovery, and settlement. The company serves UAE insurers across both large and small-to-medium carriers and is preparing to extend into Saudi Arabia and the wider GCC.
Compliance by design. Axxion was built to operate inside a tightening regulatory environment. The Central Bank of the UAE absorbed insurance regulation in 2020 and consolidated the framework under Federal Decree-Law No. 6 of 2025, which brings TPAs and loss adjusters explicitly inside the CBUAE perimeter. Every claim Axxion handles passes through formal compliance gates covering UAE PDPL data protection, policyholder-consent requirements, settlement-authority bands, sanctions screening, and audit-trail completeness. Compliance is not an overlay; it is the operating substrate.
The Axxion Intelligent Operating System (AIOS). The Claims OS that Axxion presents to insurer partners runs on the AIOS, a unified operating layer orchestrating a seven-stage claims pipeline across surveying, estimation, repair coordination, quality control, recovery, settlement, and reporting. The AIOS integrates human operators with structured AI-assisted decision points at every stage. Insurers receive cleaner data, faster cycle times, lower per-claim cost, and a complete audit trail, without giving up control over their portfolio.
Axxion is led by Managing Director and Co-Founder Frederik Bisbjerg. Frederik has spent over two decades in international insurance in operating and transformation roles, with a particular focus on motor claims, distribution, and AI-enabled insurance models. He has been a public voice on insurance modernization in the GCC and writes regularly on the operational shifts reshaping motor underwriting. Axxion is the operating expression of his thesis: that disciplined claims operations, built on AI-enabled but human-led decisioning, will define the next decade of competitive advantage in motor insurance.
More information:
Managing Director and Co-Founder Frederik Bisbjerg | f@axxion.co | www.axxion.co
This document is produced by Axxion Claims Settlement Services L.L.C., a Dubai-based motor claims third-party administrator. The analysis covers regulatory developments that affect both insurer in-house claims operations and outsourced TPA arrangements; readers should note the publisher's perspective when weighing the operational recommendations. The regulatory analysis itself rests on cited primary and secondary sources.
This document is for informational purposes. It does not constitute legal advice, regulatory guidance, or a substitute for professional compliance assessment. The analysis is based on the text of Federal Decree-Law No. (6) of 2025, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), publicly available CBUAE regulatory materials including the Consumer Protection Regulation, and third-party legal commentary from Al Tamimi & Company. Organizations should consult qualified legal and compliance professionals for advice specific to their circumstances.
Regulatory requirements may change as the CBUAE issues new regulations, decisions, and guidelines under the consolidated framework. Article citations were confirmed against the CBUAE Rulebook (rulebook.centralbank.ae) in May 2026.
