On 1 January 2026 the UAE’s federal securities regulator, the Securities and Commodities Authority (SCA), was reconstituted as the Capital Market Authority (CMA) under two new federal decree-laws – Federal Decree-Law No. 32 of 2025 (establishing the CMA) and Federal Decree-Law No. 33 of 2025 (regulating the capital market), both in force on that date. The CMA regulates the UAE’s onshore capital markets – the Dubai Financial Market and the Abu Dhabi Securities Exchange, public offerings, investment funds and their promotion, and licensed intermediaries – and now brings virtual assets used for investment within the federal perimeter. The financial free zones – the DIFC (regulated by the DFSA) and the ADGM (regulated by the FSRA) – sit outside the CMA’s onshore remit. The new regime is more enforcement-focused and, for the first time, asserts extraterritorial reach over those who target UAE investors. The framework is new and still bedding in – confirm the current law and rulebooks at the time of use.
How the UAE’s reconstituted federal securities regulator affects offerings, funds and virtual assets onshore.
At a glance
- Regulator: The Capital Market Authority (CMA) – formerly the SCA – the UAE federal securities and commodities regulator
- Law: Federal Decree-Law No. 32 of 2025 (the CMA) and No. 33 of 2025 (capital-market regulation), in force 1 January 2026
- Perimeter: Onshore UAE – the DFM and ADX, public offerings, funds and their promotion, licensed intermediaries, and investment virtual assets
- Outside scope: The DIFC (DFSA) and ADGM (FSRA) financial free zones, which have their own regulators
- New reach: Extraterritorial – catches persons targeting UAE clients, even from offshore or from a free zone
- Posture: Broader supervisory, enforcement and resolution powers; serious penalties for unlicensed activity
1. From the SCA to the CMA
The UAE’s federal securities regulator was first established as the Emirates Securities and Commodities Authority by Federal Law No. 4 of 2000 (amended in 2006). With effect from 1 January 2026 it was reconstituted as the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025, while a companion statute – Federal Decree-Law No. 33 of 2025 – re-codified the regulation of capital-market activity. Commentators have described the change as more than a rebrand: it consolidates the federal regime, sharpens its enforcement orientation, strengthens the regulator’s independence and aligns the framework more closely with international standards. Transitional provisions generally preserve existing regulations and decisions to the extent they are not inconsistent with the new laws until they are replaced, but because instruments are still being issued under the new framework through 2026, the position for any specific authorisation or rulebook should be confirmed rather than assumed.
2. What the CMA regulates – the onshore perimeter
The CMA is the regulator for the UAE’s onshore capital markets. Its remit covers the licensed exchanges – principally the Dubai Financial Market (DFM) and the Abu Dhabi Securities Exchange (ADX) – together with public securities offerings and listings, collective investment funds (both the establishment of domestic funds and the promotion of funds to UAE investors), and the licensed intermediaries that operate in those markets: brokerage, portfolio management, financial advisory, custody, arranging and similar activities. Layered over these is a body of market-conduct, disclosure and market-abuse regulation designed to protect investors and market integrity, and the regulation of commodities activity. The unifying idea is that anyone offering securities to the public, managing or promoting investments, or intermediating in UAE markets onshore is operating within the CMA’s perimeter.
3. The free-zone carve-out – CMA, DFSA and FSRA
A recurring source of confusion for cross-border clients is the assumption that a single “UAE regulator” governs all financial activity. It does not. The two financial free zones each have their own regulator and their own body of law: the DIFC is regulated by the Dubai Financial Services Authority (DFSA), and the ADGM is regulated by the Financial Services Regulatory Authority (FSRA). Both sit outside the CMA’s onshore perimeter. A fund manager licensed in the DIFC answers to the DFSA, not the CMA; an ADGM brokerage answers to the FSRA. Identifying the correct perimeter – onshore (CMA) or free zone (DFSA or FSRA) – is therefore the first question in any UAE financial-services matter, because it determines the applicable law, the licensing route and the supervisor. The one important bridge between these worlds is the CMA’s new extraterritorial reach, addressed next.
4. Extraterritorial reach – the new cross-border test
The 2025 framework introduces, for the first time at federal level, an explicit extraterritorial dimension. The capital-market law extends to any person targeting clients within the UAE, even where the activity is carried on from outside the UAE or from a financial free zone. In practical terms, an offshore manager or a free-zone firm that actively solicits onshore UAE investors can be drawn within the CMA’s perimeter notwithstanding that it is not itself onshore-licensed. This changes the analysis for marketing and distribution: the location of the firm is no longer decisive; what matters is whether UAE clients are being targeted. Firms that promote securities, funds or investment services into the UAE – including from the DIFC, the ADGM or overseas – should take advice on whether their activity engages the CMA regime before they begin.
5. Licensing and the promotion of funds
Carrying on a regulated capital-market activity onshore generally requires a CMA licence, approval or registration, and the CMA holds broad powers to set the perimeter and to grant exemptions. Of particular relevance to cross-border managers is the promotion of funds: marketing collective investment schemes to UAE investors is a regulated activity, and the rules governing the promotion of foreign funds onshore have been tightened in recent years and carried into the CMA framework. A manager – whether based overseas, in a UAE free zone, or onshore – that wishes to raise capital from UAE investors must work out the route by which it may lawfully promote, which may involve appointing a locally licensed promoter, relying on a private-placement basis, or another permitted channel. Because the promotion rules are detailed and have changed, the current route should be verified for the specific fund and investor base rather than assumed from earlier practice.
6. Virtual assets onshore – the CMA crypto regime
The 2025 reforms bring virtual assets used for investment purposes within the federal capital-market perimeter, and the CMA has moved quickly to operationalise this. By Decision No. 4/R.M/2026 (issued 13 February 2026) the CMA replaced the previous 2023 federal framework for virtual-asset service providers with a consolidated rulebook organised into three modules – a General Framework, a Business Regulation module and an Alternative Trading System module. The rulebook is reported to establish eight licensed activity categories, minimum capital requirements ranging from roughly AED 500,000 to AED 4,000,000 depending on the activity, and prohibitions on privacy tokens and algorithmic tokens, with a compliance window running into 2027. This onshore regime is distinct from Dubai’s VARA regime and from the free-zone virtual-asset frameworks; a business may need to consider more than one. Given how recent these rules are, the live rulebook and its thresholds should be checked at the time of use.
7. Enforcement, penalties and resolution powers
A defining feature of the new framework is its enforcement orientation. The CMA has enhanced investigative powers and a wider range of administrative measures and sanctions, together with resolution powers over significant licensees. The penalties for operating without authorisation are serious: the capital-market law provides for imprisonment of not less than one year and fines that can reach AED 250 million for engaging in a regulated activity in the UAE without the necessary licence, approval or registration, alongside administrative penalties for regulatory breaches. These figures signal the seriousness with which unlicensed activity and serious misconduct are now treated. As with all penalty provisions, the precise thresholds should be confirmed against the current law, but the direction of travel is unmistakable – a more interventionist, better-resourced federal regulator.
8. The India–UAE dimension
For India-facing businesses the onshore regime matters in several recurring situations. Indian issuers and sponsors contemplating an onshore UAE offering or a DFM/ADX listing engage the CMA’s offering and disclosure regime. Indian asset managers and funds seeking capital from UAE investors fall within the CMA’s promotion rules – and, under the new extraterritorial test, may be caught even when marketing from outside the UAE or from a free zone. Indian-founded virtual-asset and Web3 businesses servicing onshore UAE clients must map the CMA’s 2026 crypto rulebook alongside the VARA and free-zone options. In each case the onshore CMA route sits alongside the free-zone alternatives (the DIFC and the ADGM), and selecting the right perimeter – with its different law, cost and timeline – is a threshold commercial and legal decision rather than an afterthought.
Key points at a glance
| Topic | Position |
|---|---|
| Regulator | The CMA (formerly the SCA) – UAE federal |
| Governing law | Federal Decree-Law No. 32 and No. 33 of 2025, in force 1 Jan 2026 |
| Onshore markets | DFM and ADX; offerings, funds, intermediaries, market conduct |
| Free zones | DIFC (DFSA) and ADGM (FSRA) – outside the CMA’s onshore perimeter |
| Extraterritorial reach | Catches targeting of UAE clients from offshore or a free zone |
| Virtual assets | Investment VAs onshore; CMA Decision No. 4/R.M/2026 |
| Unlicensed activity | Imprisonment of not less than 1 year; fines up to AED 250m (verify) |
Frequently asked questions
Is the SCA still the UAE’s securities regulator?
No. With effect from 1 January 2026 the Securities and Commodities Authority was reconstituted as the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025 and No. 33 of 2025. References to the “SCA” should now be read as the CMA.
Does the CMA regulate the DIFC or the ADGM?
No. The DIFC is regulated by the DFSA and the ADGM by the FSRA. Both financial free zones sit outside the CMA’s onshore perimeter and have their own laws and supervisors.
We market a fund from outside the UAE – can the CMA regime still reach us?
Possibly. The capital-market law extends to persons targeting clients within the UAE even from outside the country or from a free zone. The location of the firm is not decisive; targeting UAE investors is. Take advice before promoting.
Do I need a CMA licence to promote a foreign fund to UAE investors?
The promotion of funds to UAE investors is a regulated activity, and the rules for foreign-fund promotion are strict and have been tightened. The lawful route – a locally licensed promoter, a private-placement basis, or another permitted channel – should be confirmed for the specific fund.
How does the CMA treat crypto and virtual assets?
Virtual assets used for investment are within the federal perimeter. By Decision No. 4/R.M/2026 the CMA issued a consolidated virtual-asset rulebook with eight licensed activity categories, capital requirements (broadly AED 500,000 to AED 4,000,000 by activity) and prohibitions on privacy and algorithmic tokens. Verify the live rulebook.
What is the difference between the CMA and VARA?
VARA regulates virtual-asset activity in the Emirate of Dubai (excluding the DIFC); the CMA is the federal securities regulator. Both can be relevant to the same business, and a VARA licence is recognised for wider-UAE servicing through a federal arrangement. See our VARA page.
What are the penalties for unlicensed activity?
The capital-market law provides for imprisonment of not less than one year and fines up to AED 250 million for carrying on a regulated activity without authorisation, alongside administrative sanctions. The current figures should be confirmed against the law in force.
Do existing SCA approvals and rules still apply?
Transitional provisions generally continue existing instruments to the extent they are not inconsistent with the new laws, until they are replaced. The position for a particular authorisation, fund approval or rulebook should be checked, as the CMA is still issuing new instruments.
We are an Indian company planning a UAE listing – who regulates that?
An onshore listing on the DFM or ADX falls under the CMA; a listing through Nasdaq Dubai / the DIFC engages the DFSA. The choice of venue and perimeter – with different rules, costs and timelines – is a threshold decision to take early.
Is the new framework final?
The primary laws are in force, but the CMA is continuing to issue rulebooks and decisions through 2026. Cite the live instruments and verify the current position at the time of use rather than relying on earlier guidance.