By FSCL Director Riaz Patel The future of payments may be increasingly cardless, but the real test of a payment system will remain unchanged: Can people trust it with their money, their identity and their personal information? The Central Bank of the UAE’s announcement on 28 January 2026 of a biometric-payment proof of concept using facial and palm recognition brings that question into sharper focus.
Developed through the Central Bank’s Sandbox Programme and Innovation Hub at the Emirates Institute of Finance, in collaboration with Network International and using technology powered by PopID, the initiative is being demonstrated at the Dubai Land Department. It is intended to enable customers to authenticate payments without presenting a physical card or using a mobile device. The initiative is still in its proof-of-concept phase, and that distinction matters when assessing both its promise and its limitations.
I regard biometric payments as an important development in the evolution of financial services. The possibility of authenticating a transaction through a person’s face or palm could make certain payment experiences faster and more convenient. It may reduce dependence on physical payment instruments and create new options for people who find conventional payment processes cumbersome. For merchants, a well-designed system could streamline checkout procedures; for payment providers, it could create opportunities to develop services around identity verification, customer experience and transaction processing. These are credible possibilities, but they should be treated as objectives to be tested rather than benefits that have already been established at scale.
The distinction between a technological demonstration and a dependable public payment service is fundamental. A proof of concept can show that a system works under defined conditions. A mature payment arrangement must demonstrate that it remains reliable across different users, devices, environments, transaction values and operational pressures. It must also explain what happens when recognition fails, a customer disputes a transaction, a service becomes unavailable or a payment is incorrectly attributed. These are not peripheral questions to be resolved after a product becomes popular. They are part of the basic design of a system that asks customers to entrust their money to an identity-based process.
The central proposition is simple: Biometric recognition can help establish who is attempting to transact, but recognition alone does not settle every question about whether a payment should be authorised. A payment system must connect identity verification with a valid customer mandate, the correct account, an accurate transaction amount and an appropriate authorisation process. It must also provide clear evidence of what was approved and a workable mechanism for investigating disputed transactions. A person’s face or palm should never become a substitute for the broader controls that make a financial transaction legitimate.
A payment card can generally be cancelled and replaced if its credentials are compromised. A password can be changed. A person cannot realistically replace their face or palm in the same way. This makes the collection, storage, processing and protection of biometric information a particularly important part of the debate. If biometric identifiers are compromised, the consequences may extend beyond a single payment account because the underlying physical characteristic remains associated with the individual.
It would be premature to assume that the UAE proof of concept stores biometric information in any particular way or that it is exposed to a specific vulnerability. The public announcement does not, by itself, establish the full technical architecture, the location and duration of data storage, the precise matching process or the controls governing access to the information. Those details need to be assessed from the system documentation and applicable safeguards. My concern is not that biometric payments are inherently unsafe. It is that the permanence and sensitivity of biometric data require a level of discipline proportionate to the consequences of misuse.
Customers should know what information is collected, for what purpose it is used, who is responsible for handling it and whether it is shared with other participants in the payment chain. They should also be told how long information is retained, how it is protected, whether it can be used for purposes beyond payment authentication and what happens when they withdraw their consent or stop using the service. These explanations should be understandable to ordinary customers, not buried in technical documentation or lengthy contractual terms that few people can realistically interpret.
Consent deserves particular attention. A customer may be willing to use facial or palm recognition because it is convenient, but that willingness must be informed and meaningful. Where practical, customers should have a reasonable alternative payment method, so that declining biometric participation does not unnecessarily exclude them from a service. The commercial appeal of a frictionless transaction should not lead providers to treat agreement to biometric processing as an automatic condition of ordinary financial participation when alternatives are feasible.
There is also a question of purpose limitation. Information collected to authenticate a payment should not quietly become a resource for unrelated profiling, marketing or other uses without an appropriate legal basis and clear customer understanding. The public should not have to speculate about how their identity data might be used after enrolment. Providers and their partners should be able to explain the boundaries in plain language, and those boundaries should be reflected in enforceable policies and operational controls.
Public discussion of biometric payments can place too much emphasis on whether a system accurately recognises a face or palm. That is only one component of security. A payment ecosystem includes enrolment, identity matching, transaction authorisation, merchant systems, communications networks, payment processors, account providers and dispute-handling procedures. Weakness in any critical part of this chain can undermine confidence in the overall service.
Enrolment is especially important. A system must establish that the biometric reference is correctly linked to the person and account concerned. If the original association is inaccurate or fraudulent, a technically sophisticated recognition process may still authenticate the wrong relationship. Providers must therefore explain how identity is established, how duplicate or fraudulent enrolments are detected, and how customers can correct errors. Equally, they must consider whether recognition can be misled by presentation attacks or other attempts to impersonate an enrolled user, and what additional safeguards are appropriate to the risks.
Operational resilience matters just as much. What happens if the camera or sensor fails, a customer’s physical characteristics change, lighting or environmental conditions affect recognition, connectivity is interrupted or the payment platform is unavailable? Customers must have a clear alternative and must not be left uncertain about whether a transaction has succeeded. The system should provide an unambiguous confirmation and prevent technical failure from producing duplicate charges or confusing account records. These are familiar requirements in payments, but a new authentication method makes them no less important.
Dispute resolution must also be designed around the customer’s practical position. If a person denies making a transaction, a provider cannot reasonably rely on the bare assertion that a biometric match occurred as the end of the inquiry. The provider should be able to reconstruct the transaction, establish the authorisation path, examine relevant logs and apply transparent rules for investigating the complaint. Customers need accessible channels to report suspected misuse, secure their accounts and seek correction where a payment is unauthorised or incorrectly processed.
The question of liability should be clear before adoption becomes widespread. Responsibility may be distributed across the technology provider, payment processor, merchant, account provider and other participants. That division may be commercially logical, but it must not leave the customer moving between organisations in search of an answer. Agreements between businesses should allocate operational responsibilities and incident-handling duties; customer-facing arrangements should make clear where complaints begin and how they are escalated.
Biometric payments are sometimes presented as a route to greater financial inclusion. They may contribute to that goal in particular circumstances, but inclusion is not achieved simply by removing a card or phone from the checkout process. People differ in their comfort with biometric identification, their physical circumstances, their access to digital services and their ability to navigate registration and authentication procedures. Some may prefer conventional payment instruments; others may encounter recognition difficulties or have concerns about how their information is used.
A genuinely inclusive service should provide a choice of payment methods, accessible enrolment and clear assistance when the technology does not work. It should be tested with a sufficiently varied range of users and circumstances. Providers should assess whether error rates, abandonment rates, transaction failures or complaint levels differ materially across user groups, while respecting privacy and applicable data-protection requirements. If a system works well only for a narrow set of circumstances, that limitation should be understood and addressed before claims of broad accessibility are made.
Affordability also deserves attention. A new payment method may require investment in sensors, software, merchant integration, security controls and customer support. The commercial model should explain who bears these costs and whether they affect merchants, consumers or service providers. If biometric payments are to deliver wider value, the benefits should be assessed against the cost of implementation and ongoing oversight, rather than assumed from the novelty of the technology.
It is equally important to distinguish the Central Bank’s initiative from the broader history of biometric payments. Commercial face-payment deployments have existed in the UAE before this 2026 proof of concept. The significance of the Central Bank-backed initiative is its development through the regulator’s sandbox and innovation framework, with facial and palm recognition demonstrated at a government service location. That is a meaningful institutional development, but it should not be interpreted as proof that all previous barriers to adoption have been resolved or that the technology is already ready for universal deployment.
Regulatory sandboxes can play a useful role in allowing new products to be tested within a defined framework. They can help regulators and participating firms identify practical issues, examine consumer responses and understand risks before a broader rollout is contemplated. Their value depends on the quality of the questions asked, the evidence gathered and the conditions applied to any subsequent expansion. A sandbox should be treated as a disciplined learning environment, not as a badge that automatically settles every question about safety or suitability.
For biometric payments, a responsible evaluation should examine the quality of authentication, the protection of biometric data, the security of connected systems, the clarity of customer consent, the handling of failures and the effectiveness of complaint resolution. It should also assess the arrangements for incident reporting, recovery and responsibility when several organisations participate in the service. The findings should inform the next stage of development, and material limitations should be addressed openly.
I would also place considerable weight on transparency. Customers need accessible information about the service, while regulators and relevant oversight bodies need sufficient technical and operational detail to assess how it performs. Public confidence is strengthened when providers can explain not merely what a technology is intended to do, but how its safeguards work, what its limitations are and what remedies are available when things go wrong.
For financial institutions and payment businesses, the wider lesson is that innovation and governance must develop together. Product teams may be focused on speed, adoption and user experience; technology teams may concentrate on performance and integration; legal and compliance teams may assess permissions and obligations. The customer experiences the combined result. The institution must therefore ensure that these functions work from a common understanding of risk and accountability rather than treating each as a separate exercise.
I welcome experimentation that can make payments more convenient and accessible. The UAE’s biometric-payment proof of concept is a useful opportunity to test how facial and palm recognition can fit within a regulated payment ecosystem. Its long-term value, however, will depend on evidence of reliable performance, proportionate data handling, informed consent, accessible alternatives and effective remedies. A successful demonstration is a beginning; sustained public confidence is the more demanding test.
My view is that biometric payments should be judged by the standards that apply to every responsible financial service, with additional care where a person’s physical identity becomes part of the transaction process. The system should work accurately, explain itself clearly and protect customers when circumstances depart from the expected path. Those principles are more important than the appeal of a futuristic checkout experience.
The financial sector has learned that convenience can accelerate adoption, but trust determines whether adoption endures. If providers and regulators treat biometric information as a serious responsibility, make accountability visible and allow independent scrutiny of performance, the technology may earn a lasting place in the payments landscape. If those foundations are weak, speed at the point of sale will not compensate for uncertainty about privacy, liability or customer protection. The real innovation will be a payment system in which the ease of paying is matched by the confidence that the transaction is secure, fair and accountable.
By FSCL Director Riaz Patel The future of payments may be increasingly cardless, but the real test of a payment system will remain unchanged: Can people trust it with their money, their identity and their personal information? The Central Bank of the UAE’s announcement on 28 January 2026 of a biometric-payment proof of concept using facial and palm recognition brings that question into sharper focus.
Developed through the Central Bank’s Sandbox Programme and Innovation Hub at the Emirates Institute of Finance, in collaboration with Network International and using technology powered by PopID, the initiative is being demonstrated at the Dubai Land Department. It is intended to enable customers to authenticate payments without presenting a physical card or using a mobile device. The initiative is still in its proof-of-concept phase, and that distinction matters when assessing both its promise and its limitations.
I regard biometric payments as an important development in the evolution of financial services. The possibility of authenticating a transaction through a person’s face or palm could make certain payment experiences faster and more convenient. It may reduce dependence on physical payment instruments and create new options for people who find conventional payment processes cumbersome. For merchants, a well-designed system could streamline checkout procedures; for payment providers, it could create opportunities to develop services around identity verification, customer experience and transaction processing. These are credible possibilities, but they should be treated as objectives to be tested rather than benefits that have already been established at scale.
The distinction between a technological demonstration and a dependable public payment service is fundamental. A proof of concept can show that a system works under defined conditions. A mature payment arrangement must demonstrate that it remains reliable across different users, devices, environments, transaction values and operational pressures. It must also explain what happens when recognition fails, a customer disputes a transaction, a service becomes unavailable or a payment is incorrectly attributed. These are not peripheral questions to be resolved after a product becomes popular. They are part of the basic design of a system that asks customers to entrust their money to an identity-based process.
The central proposition is simple: Biometric recognition can help establish who is attempting to transact, but recognition alone does not settle every question about whether a payment should be authorised. A payment system must connect identity verification with a valid customer mandate, the correct account, an accurate transaction amount and an appropriate authorisation process. It must also provide clear evidence of what was approved and a workable mechanism for investigating disputed transactions. A person’s face or palm should never become a substitute for the broader controls that make a financial transaction legitimate.
A payment card can generally be cancelled and replaced if its credentials are compromised. A password can be changed. A person cannot realistically replace their face or palm in the same way. This makes the collection, storage, processing and protection of biometric information a particularly important part of the debate. If biometric identifiers are compromised, the consequences may extend beyond a single payment account because the underlying physical characteristic remains associated with the individual.
It would be premature to assume that the UAE proof of concept stores biometric information in any particular way or that it is exposed to a specific vulnerability. The public announcement does not, by itself, establish the full technical architecture, the location and duration of data storage, the precise matching process or the controls governing access to the information. Those details need to be assessed from the system documentation and applicable safeguards. My concern is not that biometric payments are inherently unsafe. It is that the permanence and sensitivity of biometric data require a level of discipline proportionate to the consequences of misuse.
Customers should know what information is collected, for what purpose it is used, who is responsible for handling it and whether it is shared with other participants in the payment chain. They should also be told how long information is retained, how it is protected, whether it can be used for purposes beyond payment authentication and what happens when they withdraw their consent or stop using the service. These explanations should be understandable to ordinary customers, not buried in technical documentation or lengthy contractual terms that few people can realistically interpret.
Consent deserves particular attention. A customer may be willing to use facial or palm recognition because it is convenient, but that willingness must be informed and meaningful. Where practical, customers should have a reasonable alternative payment method, so that declining biometric participation does not unnecessarily exclude them from a service. The commercial appeal of a frictionless transaction should not lead providers to treat agreement to biometric processing as an automatic condition of ordinary financial participation when alternatives are feasible.
There is also a question of purpose limitation. Information collected to authenticate a payment should not quietly become a resource for unrelated profiling, marketing or other uses without an appropriate legal basis and clear customer understanding. The public should not have to speculate about how their identity data might be used after enrolment. Providers and their partners should be able to explain the boundaries in plain language, and those boundaries should be reflected in enforceable policies and operational controls.
Public discussion of biometric payments can place too much emphasis on whether a system accurately recognises a face or palm. That is only one component of security. A payment ecosystem includes enrolment, identity matching, transaction authorisation, merchant systems, communications networks, payment processors, account providers and dispute-handling procedures. Weakness in any critical part of this chain can undermine confidence in the overall service.
Enrolment is especially important. A system must establish that the biometric reference is correctly linked to the person and account concerned. If the original association is inaccurate or fraudulent, a technically sophisticated recognition process may still authenticate the wrong relationship. Providers must therefore explain how identity is established, how duplicate or fraudulent enrolments are detected, and how customers can correct errors. Equally, they must consider whether recognition can be misled by presentation attacks or other attempts to impersonate an enrolled user, and what additional safeguards are appropriate to the risks.
Operational resilience matters just as much. What happens if the camera or sensor fails, a customer’s physical characteristics change, lighting or environmental conditions affect recognition, connectivity is interrupted or the payment platform is unavailable? Customers must have a clear alternative and must not be left uncertain about whether a transaction has succeeded. The system should provide an unambiguous confirmation and prevent technical failure from producing duplicate charges or confusing account records. These are familiar requirements in payments, but a new authentication method makes them no less important.
Dispute resolution must also be designed around the customer’s practical position. If a person denies making a transaction, a provider cannot reasonably rely on the bare assertion that a biometric match occurred as the end of the inquiry. The provider should be able to reconstruct the transaction, establish the authorisation path, examine relevant logs and apply transparent rules for investigating the complaint. Customers need accessible channels to report suspected misuse, secure their accounts and seek correction where a payment is unauthorised or incorrectly processed.
The question of liability should be clear before adoption becomes widespread. Responsibility may be distributed across the technology provider, payment processor, merchant, account provider and other participants. That division may be commercially logical, but it must not leave the customer moving between organisations in search of an answer. Agreements between businesses should allocate operational responsibilities and incident-handling duties; customer-facing arrangements should make clear where complaints begin and how they are escalated.
Biometric payments are sometimes presented as a route to greater financial inclusion. They may contribute to that goal in particular circumstances, but inclusion is not achieved simply by removing a card or phone from the checkout process. People differ in their comfort with biometric identification, their physical circumstances, their access to digital services and their ability to navigate registration and authentication procedures. Some may prefer conventional payment instruments; others may encounter recognition difficulties or have concerns about how their information is used.
A genuinely inclusive service should provide a choice of payment methods, accessible enrolment and clear assistance when the technology does not work. It should be tested with a sufficiently varied range of users and circumstances. Providers should assess whether error rates, abandonment rates, transaction failures or complaint levels differ materially across user groups, while respecting privacy and applicable data-protection requirements. If a system works well only for a narrow set of circumstances, that limitation should be understood and addressed before claims of broad accessibility are made.
Affordability also deserves attention. A new payment method may require investment in sensors, software, merchant integration, security controls and customer support. The commercial model should explain who bears these costs and whether they affect merchants, consumers or service providers. If biometric payments are to deliver wider value, the benefits should be assessed against the cost of implementation and ongoing oversight, rather than assumed from the novelty of the technology.
It is equally important to distinguish the Central Bank’s initiative from the broader history of biometric payments. Commercial face-payment deployments have existed in the UAE before this 2026 proof of concept. The significance of the Central Bank-backed initiative is its development through the regulator’s sandbox and innovation framework, with facial and palm recognition demonstrated at a government service location. That is a meaningful institutional development, but it should not be interpreted as proof that all previous barriers to adoption have been resolved or that the technology is already ready for universal deployment.
Regulatory sandboxes can play a useful role in allowing new products to be tested within a defined framework. They can help regulators and participating firms identify practical issues, examine consumer responses and understand risks before a broader rollout is contemplated. Their value depends on the quality of the questions asked, the evidence gathered and the conditions applied to any subsequent expansion. A sandbox should be treated as a disciplined learning environment, not as a badge that automatically settles every question about safety or suitability.
For biometric payments, a responsible evaluation should examine the quality of authentication, the protection of biometric data, the security of connected systems, the clarity of customer consent, the handling of failures and the effectiveness of complaint resolution. It should also assess the arrangements for incident reporting, recovery and responsibility when several organisations participate in the service. The findings should inform the next stage of development, and material limitations should be addressed openly.
I would also place considerable weight on transparency. Customers need accessible information about the service, while regulators and relevant oversight bodies need sufficient technical and operational detail to assess how it performs. Public confidence is strengthened when providers can explain not merely what a technology is intended to do, but how its safeguards work, what its limitations are and what remedies are available when things go wrong.
For financial institutions and payment businesses, the wider lesson is that innovation and governance must develop together. Product teams may be focused on speed, adoption and user experience; technology teams may concentrate on performance and integration; legal and compliance teams may assess permissions and obligations. The customer experiences the combined result. The institution must therefore ensure that these functions work from a common understanding of risk and accountability rather than treating each as a separate exercise.
I welcome experimentation that can make payments more convenient and accessible. The UAE’s biometric-payment proof of concept is a useful opportunity to test how facial and palm recognition can fit within a regulated payment ecosystem. Its long-term value, however, will depend on evidence of reliable performance, proportionate data handling, informed consent, accessible alternatives and effective remedies. A successful demonstration is a beginning; sustained public confidence is the more demanding test.
My view is that biometric payments should be judged by the standards that apply to every responsible financial service, with additional care where a person’s physical identity becomes part of the transaction process. The system should work accurately, explain itself clearly and protect customers when circumstances depart from the expected path. Those principles are more important than the appeal of a futuristic checkout experience.
The financial sector has learned that convenience can accelerate adoption, but trust determines whether adoption endures. If providers and regulators treat biometric information as a serious responsibility, make accountability visible and allow independent scrutiny of performance, the technology may earn a lasting place in the payments landscape. If those foundations are weak, speed at the point of sale will not compensate for uncertainty about privacy, liability or customer protection. The real innovation will be a payment system in which the ease of paying is matched by the confidence that the transaction is secure, fair and accountable.