---

name: prompt-pack-digital-wallet-terms
description: Use when a FinTech or payments company needs to draft Terms of Service for a digital wallet application — covering account setup, funding methods, transaction limits, security features, unauthorized transaction liability, data privacy, and dispute resolution. MENA-aware: UAE (CBUAE Stored Value Facility licensing, DFSA/ADGM), KSA (SAMA), and addresses consumer protection requirements that apply to e-money and digital wallet products across MENA, EU (PSD2), and UK.
license: MIT
metadata:
id: prompt-pack.digital-wallet-terms
category: prompt-pack
practice_area: fintech-payments
priority: P2
intent: [drafting, digital-wallet-terms, e-money, stored-value, payments, consumer-protection]
related: [prompt-pack-cryptocurrency-exchange-terms, prompt-pack-cross-border-payment-compliance-review, prompt-pack-data-processing-agreement, prompt-pack-privacy-policy]
source: Louis — HAQQ Legal AI (github.com/sboghossian/mini-claude-for-legal)
version: "1.0"

Digital Wallet Terms

Digital wallet Terms of Service are both a consumer contract and a regulated product disclosure. In MENA, the Central Bank of UAE, SAMA, and equivalent regulators require specific consumer disclosures and protections for stored value and e-money products; omitting them is not just a contractual gap but a regulatory violation.

When to use this

• A FinTech company is launching a digital wallet app and needs compliant Terms of Service.
• An existing wallet's terms need to be updated following regulatory guidance from CBUAE, SAMA, DFSA, or ADGM FSRA.
• A bank or financial institution is adding a digital wallet feature to its mobile banking app.
• An e-commerce platform is adding a stored-value wallet feature for stored credit or refunds.
• A company is offering a loyalty points wallet that accumulates and can be redeemed as currency — this may constitute a stored value facility requiring a license.

Required inputs

Input	Why it matters	Sensible default
Company name and entity type	The terms identify the regulated entity	Ask the user
Jurisdiction of operation and regulatory license	Determines mandatory content and consumer protections	Ask the user
Wallet type (fiat e-money / crypto / loyalty points / multi-currency)	Different rules apply to different wallet types	Ask the user
Customer types (consumer / SME / both)	Consumer protection obligations are higher for retail consumers	Ask the user
Funding methods (bank transfer / card / cash deposit / crypto)	Must be disclosed with associated fees and limits	Ask the user
Whether the wallet is custodial (company holds funds) or non-custodial	Determines safeguarding obligations	Ask the user

Optional inputs

• Transaction limits (per transaction / daily / monthly).
• Fee schedule details.
• Whether the wallet supports cross-border payments or remittances (adds licensing and FX considerations).
• Whether the wallet is linked to a debit card, virtual card, or physical card.
• Whether the company is part of a regulated banking group.

Document structure

1. Introduction and parties

• Full legal name of the wallet operator, jurisdiction of incorporation, regulatory license number and type, and regulator name.
• The agreement is between the wallet operator ("we"/"us"/"Company") and the user ("you").
• Effective date.
• Statement that by registering, the user agrees to these terms.
• Minimum age (typically 18+; CBUAE rules and most MENA jurisdictions require adults for financial products).

2. Regulatory disclosures (mandatory for regulated entities)

Depending on the jurisdiction, include:

UAE (CBUAE Stored Value Facility):

• The wallet is a Stored Value Facility (SVF) licensed by the Central Bank of the UAE under the Payment Systems and Services Regulation.
• Funds held in the wallet are not bank deposits and are not covered by the UAE Deposit Guarantee Scheme.
• Funds are safeguarded in accordance with CBUAE SVF requirements (segregated client account or equivalent safeguarding).

UAE (DIFC):

• The wallet is regulated by the Dubai Financial Services Authority (DFSA) under a [Category X] license.
• DIFC Client Money Rules apply.

UAE (ADGM):

• The wallet is regulated by the FSRA under the Financial Services and Markets Regulations.

KSA (SAMA):

• The wallet is licensed by the Saudi Arabian Monetary Authority under the Payment Services Regulations.
• Funds held in the wallet are segregated from the company's own funds.

EU (PSD2):

• The wallet is an Electronic Money Institution (EMI) licensed under PSD2 in [member state]; funds are safeguarded per PSD2 Art. 7.

UK:

• The wallet is a regulated e-money product authorised by the FCA.

3. Account setup and eligibility

• Eligibility requirements: age, country of residence, and confirmation that the user is not subject to sanctions.
• Identity verification: mandatory KYC before wallet activation; documents required (ID, proof of address, source of funds for high-value use).
• Account types: personal vs. business; standard vs. premium.
• One wallet per user (unless the product design permits multi-wallet).

4. Funding the wallet

• Accepted funding methods: bank transfer (IBAN), debit card, credit card, cash deposit (if applicable), crypto (if applicable).
• Minimum and maximum deposit amounts.
• Processing times for each method.
• Fees associated with funding (if any; many wallets offer free bank transfer but charge for card funding).
• Currency: State the default currency and whether multi-currency is supported.
• FX rates: If conversion is involved, state how the exchange rate is determined and any spread or FX fee applied.

5. Transaction limits

Publish limits clearly — ambiguity on limits is a frequent source of customer complaints and regulator scrutiny:

Limit type	Standard tier	Verified tier	Business tier
Per transaction (send/receive)	[Amount]	[Amount]	[Amount]
Daily	[Amount]	[Amount]	[Amount]
Monthly	[Amount]	[Amount]	[Amount]
Maximum balance	[Amount]	[Amount]	[Amount]

These limits must comply with applicable AML regulations. CBUAE SVF Regulation specifies tiered limits for different KYC levels.

6. Sending and receiving funds

• How to send: by mobile number / email / account number / QR code.
• Processing time: real-time vs. T+1.
• Irrevocability: once a payment is processed, it cannot be reversed unless the recipient consents or the company has grounds to intervene (fraud, error).
• Error and misdirected payments: procedure for reporting and recovering misdirected payments (note: recovery is not guaranteed; the company will make reasonable efforts).

7. Withdrawals

• Methods: bank transfer, debit card, cash withdrawal (if ATM-linked).
• Processing times.
• Minimum withdrawal amounts.
• Fees (if any).
• Right to request refund of the e-money balance at any time (mandated by PSD2 and equivalent regulations); state any fees for redemption.

8. Security features

• Two-factor authentication (2FA): required for registration and high-value transactions; state the method (SMS OTP / authenticator app / biometric).
• PIN / password requirements.
• Device binding: the wallet may be restricted to registered devices.
• Transaction notifications: real-time push notifications for every transaction (this is both a user experience feature and a fraud-detection enabler).
• User's security responsibilities: keep credentials confidential; report lost or compromised devices immediately.

9. Unauthorized transactions and liability

This section is heavily regulated in jurisdictions with consumer protection for payment services:

EU (PSD2) and UK:

• User is liable for unauthorized transactions only up to EUR/GBP 50 (standard) unless the user acted fraudulently or with gross negligence.
• The company must reimburse unauthorized transactions immediately pending investigation.

UAE (CBUAE):

• CBUAE Consumer Protection Regulation requires that unauthorized transactions are investigated promptly; reimburse pending investigation for consumer accounts.

KSA (SAMA):

• SAMA consumer protection rules apply; zero-liability for genuinely unauthorized transactions subject to timely notification.

General approach:

• The user must report unauthorized transactions as soon as they become aware (and in any event within [30/60] days of the statement date).
• The company will investigate and respond within [X] business days.
• If the unauthorized transaction is confirmed, the company will reimburse the amount (subject to any applicable deductible or liability cap).
• If the user contributed to the unauthorized transaction by negligently disclosing their credentials, the liability cap may not apply.

10. Fees

• Complete fee schedule as a table.
• State clearly whether fees are charged at point of transaction, at end of month, or on a different basis.
• No undisclosed fees — any fee not in the terms is not enforceable and is a regulatory violation.
• Right to change fees: provide 30 days' advance notice for fee increases; users who do not accept new fees may close the wallet and withdraw their balance.

11. Suspension and closure

Company's right to suspend:

• Suspected fraud, money laundering, or unauthorized use.
• Regulatory requirement.
• Technical maintenance (with advance notice where possible).

Company's right to close:

• Repeated breach of terms.
• Negative balance.
• Regulatory requirement.
• Company decision to discontinue the product (with [90] days' notice to users to withdraw funds).

User's right to close:

• At any time, subject to zero balance.
• Process: submit closure request; company closes the account and returns any remaining balance within [5–10] business days.

Effect of closure:

• All pending transactions are cancelled.
• Remaining balance is returned to the user (by bank transfer or as specified).
• Transaction history is retained per the data retention policy.

12. Data protection and privacy

• The company collects personal data as described in the Privacy Policy [link].
• Data is processed for: account management, transaction processing, KYC/AML compliance, fraud prevention, and (with consent) marketing.
• Cross-border transfers: if data is processed outside the user's jurisdiction, state the safeguard (SCCs, adequacy decision, etc.).

13. Dispute resolution

• Internal complaints process: user contacts customer support; complaint acknowledged within [2] business days; resolved within [15] business days.
• Regulatory complaint: user may escalate to the applicable regulator (CBUAE, SAMA, DFSA, ADGM FSRA, FCA) if the internal resolution is unsatisfactory.
• Dispute resolution: for contractual disputes, specify arbitration (preferred) or litigation and the governing jurisdiction.
• Consumer arbitration note: Mandatory arbitration clauses in consumer contracts are unenforceable in some EU jurisdictions and are restricted in the UK; retain the consumer's right to seek judicial remedy.

14. Governing law

State the governing law clearly. For MENA-based wallets, consider:

• DIFC or ADGM as the governing law and jurisdiction for a common-law framework, English language, and access to experienced commercial courts.
• UAE federal law for a UAE-only consumer product.
• KSA law for Saudi domestic products.

Jurisdictional licensing summary

Jurisdiction	License type	Regulator	Key consumer protection rules
UAE (onshore)	Stored Value Facility (SVF)	CBUAE	CBUAE Consumer Protection Regulation; tiered KYC limits
UAE (DIFC)	Authorised Firm (Payment Services)	DFSA	DFSA Client Money Rules; DIFC Employment and Consumer Protection
UAE (ADGM)	Regulated Activity (Payment Services)	FSRA	FSRA Client Money Rules
KSA	Payment Service Provider	SAMA	SAMA Consumer Protection Principles; e-wallet regulations
EU	Electronic Money Institution	National CB / EBA	PSD2; consumer protection; zero-liability for unauthorized transactions
UK	Authorised EMI	FCA	FCA Payment Services Regulations 2017; consumer protection

Common mistakes

• Terms that do not identify the regulatory license — non-disclosure is a regulatory violation in all licensed jurisdictions.
• Unauthorized transaction liability that exceeds the regulatory cap — this is the most common consumer complaint trigger in e-wallet products.
• Fee schedule that is incomplete or buried in the general terms — fees must be prominently disclosed.
• No clear account-closure process or withdrawal procedure — customers need to know how to get their money out.
• Data processing section that does not address the Travel Rule (for cross-border payment wallets) — mandatory disclosure under UAE, EU, and UK AML frameworks.

Related skills

• [[prompt-pack-cryptocurrency-exchange-terms]]
• [[prompt-pack-cross-border-payment-compliance-review]]
• [[prompt-pack-data-processing-agreement]]
• [[prompt-pack-privacy-policy]]
• [[prompt-pack-aml-compliance-program]]