Product
Trade licences, free-zone structures, layered ownership and Arabic documents are the everyday file here, not edge cases. What to require of an origination layer, and where these projects overrun.
White-label loan origination software is the application, document intake and credit-policy layer a lender runs under its own brand and domain, without building it in-house. For a Middle East lender the question is rarely whether the software can capture an application. It is whether it can handle a trade licence, a memorandum of association, an Arabic-language document, a UBO structure that runs through three entities, and a credit policy that changes twice a year without a vendor change request.
This page covers what to require of that layer if you lend to businesses in the UAE or the wider region, and where these projects usually go wrong.
It is the front half of lending, delivered as configurable software under your brand.
The borrower sees your colours and your domain. Behind that, the software runs the eligibility questions, collects company and shareholder data, takes in the documents, checks them for completeness, applies your credit rules at intake, and hands your credit team a structured pack instead of an inbox full of PDFs.
What it is not: a core banking system, a decision on the credit, or a source of funds. Origination stops where your credit committee starts.
Six things that generic global platforms tend to treat as edge cases, and that are the everyday file here.
Corporate documents that are not a company registration number. A UAE application arrives as a trade licence, a memorandum of association, shareholder passports and Emirates IDs, and often an establishment card. The licence carries the activity list, the jurisdiction and the expiry date. Software that cannot read a trade licence is asking your analyst to re-key it.
Mainland and free zone as different objects. They are licensed by different authorities, they carry different documents, and lender policy frequently treats them differently. A single "jurisdiction" dropdown is not enough.
Ownership through layers. Beneficial-ownership data has to be captured and kept current, and UAE companies are required to maintain and file that information with the registrar under the UAE government's business guidance (opens in a new tab). Ownership that runs through a holding company is normal here, not exotic.
Bank statements as the primary financial record. Many good SME borrowers file limited management accounts. The statements are the evidence, so ingestion and analysis of them is not a nice-to-have module.
Tax records that now exist. VAT has been in place since 2018 at 5% (opens in a new tab), and corporate tax applies at 9% on taxable income above AED 375,000 (opens in a new tab) for financial years starting on or after 1 June 2023. VAT returns and corporate tax filings are now a real, checkable data source on an SME. Software that cannot extract them is leaving verification on the table.
Arabic. Documents arrive in Arabic, in English, and frequently in both on the same page.
The SME Customer Protection Regulation (opens in a new tab) (Circular C 2/2026) comes into force on 13 September 2026 and replaces the SME Market Conduct Regulation that has governed this since Circular 1/2021. It applies to all banks and finance companies licensed by the Central Bank of the UAE, including those operating in compliance with Islamic Sharia provisions.
Read the objectives and it is largely a description of what origination software either does or fails to do. The regulation sets requirements on the quality and timing of disclosure to the customer before they decide, on transparency of information, on governance over how products are designed and sold, on responsible financing practices, and on clear mechanisms for handling complaints.
That has a practical consequence. Disclosure you cannot evidence is disclosure you did not make. If your intake journey cannot show what a borrower was told, when they were told it, and which version of the terms they saw, the audit trail is being reconstructed by hand later. This is the single most useful question to put to any origination vendor selling into the UAE this year, and none of the pages currently ranking for white-label origination in the Middle East mention the regulation at all.
It means the bank-statement problem is being solved at the infrastructure layer, and origination software should be built to consume that.
The CBUAE's Open Finance Regulation (opens in a new tab) was issued as Circular 7/2023, updated by Circular 3/2025, and came into force on 10 July 2025. Participation is mandatory for licensed financial institutions, which have to maintain a dedicated interface providing access to account and product information through the central API hub. It is arriving in phases, with banks and insurance companies in the first.
Two things follow for a lender choosing software now. Consented account data will increasingly come through an API rather than a PDF upload, so an origination layer whose only input is a scanned statement is buying a shrinking capability. And parallel to that, credit information from Al Etihad Credit Bureau (opens in a new tab), established under Federal Law No. 6 of 2010, is already a structured feed rather than a document. Design the intake for both, and keep the document path for the cases that still need it.
Three routes, and the honest trade-offs.
Build it in-house. You get exactly what you specified and you own the roadmap. You also own document extraction, Arabic handling, policy versioning and the audit trail, forever. Teams reliably underestimate the second half of that list, because the application form is the easy part and the document layer is where the years go.
Buy an enterprise origination suite. Mature, proven at bank scale, with implementation teams behind them. The cost tends to show up later and sideways: a policy change becomes a change request, a new product variant becomes a project, and the localisation you need is whatever the vendor built for a different market.
Configure a white-label layer. Faster to launch, and policy stays editable by your own people rather than by a vendor ticket. The trade is that you are fitting your process to a product's shape. Where that shape was built for your market, the fit is good. Where it was not, you are back to change requests with extra steps.
The deciding question is not which is cheapest to start. It is what a credit-policy change costs you in month fourteen, because you will make several.
It depends almost entirely on how settled your credit policy is, and hardly at all on the software.
A lender who can hand over a written policy with defined decline reasons and a fixed document list is doing a configuration exercise. A lender whose policy lives in the heads of two credit officers is doing a policy-writing exercise first, with software configuration waiting behind it. That second project is not slower because of the vendor.
Treat any published launch timeline as the vendor describing their own build under ideal conditions. Ask instead what their last comparable client had ready on day one.
Rarely because the software could not do it. Four causes, in the order we see them.
The policy was never written down. Codifying rules exposes every place where two people at the same lender would decide differently. That is valuable and it takes time, and it is discovered during implementation rather than before.
The document list was aspirational. Asking for everything at intake produces abandoned applications, so the real list has to be cut to what actually decides the case. That negotiation happens with the credit team, not the vendor.
Integration was scoped as one line. Pushing a completed application into a core system, a CRM or a data warehouse is usually where the timeline moves.
Nobody owned the decline path. Most applications do not fund. If the journey has no defined referral or decline route, the operational load lands on the relationship managers and the pipeline data becomes unusable.
GrowthIQ is a UAE SME credit orchestration platform. GiQ Originate is our configurable, white-label credit intake and origination layer, deployed under the buyer's brand, colours and domain. It covers the branded SME application journey, dynamic eligibility questions driven by product and policy, company, shareholder and UBO capture, trade licence and MoA intake with extraction and validation, bank-statement ingestion and analytics, VAT return and certificate extraction, document and completeness checking, lender-specific policy rules applied at intake, automated decline and referral paths, an admin and relationship-manager dashboard, missing-document workflows, status tracking with an audit trail, structured credit-team pack generation, and API, webhook and export integration into downstream systems.
The reason to talk to us rather than a platform vendor is narrow and worth stating plainly: we run this origination layer on live UAE SME applications ourselves through GiQ Match. The trade licence edge cases, the free-zone document variants and the statements that do not reconcile are things we handle rather than things we have specified.
Pricing is quoted per implementation. The structure we normally propose is an implementation and configuration fee, a platform licence, a usage fee, and optional module fees, and we do not quote before scope, product count, expected volume, integrations and hosting are settled. GiQ Rails, our embedded financing API, is coming soon and is not part of an Originate deployment today.
If you want the underlying argument on build versus buy, we wrote that up separately in loan origination systems in the GCC: build vs buy (opens in a new tab). The policy layer that sits beneath origination is covered in what a credit decisioning engine actually does (opens in a new tab) and in codify your policy, decide at intake (opens in a new tab). The product page is GiQ Originate (opens in a new tab).
Apply a lender's policy in seconds, not days across desks. A credit decisioning engine pulls the data, runs the rules, scores the risk, returns a decision. Underwriting at intake, not after.
A loan goes bad in stages, not at once. Credit portfolio analytics catch the drift early. See risk move while it still moves. Act in days, not at write-off.
KYB UAE means verifying a company, its trade license, and its UBOs. An SME proves all of it for one lender, gets declined, then does it again for the next. Verify once. Carry it everywhere.
Compare SME lenders UAE-wide from one application. GiQ Match scores your file against every lender's codified policy, ranked by approval likelihood. Term sheet in days, not weeks.
An SME proves itself from scratch at every lender, assembling the same documents again and again. A financial identity ends that loop: built once, carried forward, recognised across the GCC.
On AED 24 million of credit sales, every 30 days of delay ties up about AED 2 million. Here is the arithmetic, what UAE payment terms really look like, and what the gap costs beyond the cash.
You pay the factory before the goods ship. The retailer pays you 90 or 120 days after they land. That gap is not a sign of a badly run business, it is how UAE distribution works, and it gets wider every time you win something bigger.
A manufacturer pays for materials, freight and labour up front, then waits 60 to 100 days to be paid for what it made. The bigger the order, the longer the money is out and the more of it there is.