Last updated: 15.09.2026

Following the Federal Decree-Law No. 32 of 2025 (the Capital Markets Authority Law) and Federal Decree-Law No. 33 of 2025 (the Capital Markets Law) entered into force on 1 January 2026, the Capital Markets Authority (CMA) published Decision No. 4/R.M/2026 in February 2026 concerning the Regulation of Virtual Assets Service Providers (VASPs) and the Alternative Trading System Operator.

The introduction of these Laws and new framework established by the CMA marked an important development in the UAE’s Virtual Assets regulatory system, with which the CMA’s mandate has been strengthened, and its role has been expanded within a more integrated system. It was not only a rebranding from the former SCA (Securities and Commodities Authority) to CMA, but also a significant shift, including extraterritorial reach, new licensing requirements, and tougher enforcement.

The logic behind this development is understood as confirmed by H.E. Waleed Saeed Al Awadhi, Chief Executive Officer of the Capital Market Authority, in an interview with Middle East Economy[1], with the words:

“Virtual assets are reshaping how financial markets operate, and regulation must evolve at the same pace. The Virtual Assets Framework establishes clear and comprehensive foundation for virtual asset activities in the UAE, enabling innovation to develop within a trusted environment that safeguards investors and upholds market integrity.”

Table of Contents:

1.       The CMA Virtual Assets Framework: Navigating the UAE’s Evolving Compliance Landscape

2.       The UAE’s Several Regulators with Focused Areas under Their Governance

3.       CMA-VARA Mutual Recognition Framework

4.       The New Framework’s Major Effects

5.       The Clock Is Running to Become Compliant Within the Transition Period

The CMA Virtual Assets Framework: Navigating the UAE’s Evolving Compliance Landscape

The CMA’s comprehensive framework[2] applies to all VASPs and serves as a specialized regulatory umbrella consisting of three core modules and eight licensed activities:

Three core modules, the General Framework Module (the foundation)[3], the Business Regulation Module (daily operational compliance)[4], and the Alternative Trading System Module (multi-party platforms and their technology requirements)[5].

Eight distinct licensed activity categories, including dealing in virtual assets as principal, dealing in virtual assets as an agent, providing custody, arranging custody, operating a multilateral trading facility, providing investment advice, portfolio management, arranging investment deals, with minimum capital requirements ranging from AED 500,000 to AED 4 million.

The UAE’s Several Regulators with Focused Areas under Their Governance

There are five separate regulators governing at the federal level, emirate level, and within financial free zones.

Federal authority: The UAE’s Capital Market Authority (former SCA) and the Central Bank of the United Arab Emirates (CBUAE) set the overarching policy and regulatory framework.

Emirate authority: The Virtual Assets Regulatory Authority (VARA) has the authority to regulate virtual assets in Dubai and oversees all virtual asset activities within the emirate.

The financial free zones: Abu Dhabi Global Markets (ADGM) and Dubai International Financial Centre (DIFC), have also developed their own regulatory frameworks based on common law principles, with the FSRA regulating ADGM and the DFSA regulating DIFC.

The table below answers the questions of which regulator governs what and in which jurisdiction.

CMA-VARA Mutual Recognition Framework

Dubai is the only emirate with a dedicated regulatory body for virtual assets, namely the Virtual Assets Regulatory Authority (VARA). VARA is responsible for overseeing virtual assets and Virtual Asset Service Providers (VASPs), licensing approvals, compliance, and operational requirements for entities, and VARA’s Rulebook continues to govern virtual asset activities in Dubai (excluding DIFC) — covering exchange, custody, broker-dealer, lending, advisory, and issuance services.

In August 2025, a cooperation agreement between the CMA and VARA was established for mutual recognition of VASP licences, joint application review processes, coordinated monitoring, and a shared enforcement framework. Under this arrangement (building on the earlier SCA-VARA agreement), a VARA licence is intended to confer nationwide authorisation without the need for a separate CMA application.

The CMA-VARA mutual recognition framework represents the first concrete step toward a unified UAE digital asset market that transcends emirate-level jurisdictional boundaries. While the framework preserves VARA’s specialized regulatory authority over virtual asset activities within Dubai, the mutual recognition mechanism effectively extends the commercial reach of VARA-licensed entities to the entire federation. 

The New Framework’s Major Effects

The CMA is the only regulator with national reach for multi-emirate operators, and the Capital Markets Law applies to anyone targeting clients within the UAE, even if operating from outside the country or from a financial free zone.

VARA’s jurisdiction is limited to Dubai (excluding DIFC), and free-zone VASPs must not only comply with their free-zone regulator but also follow CMA rules. Additional CMA approvals may be required for marketing to onshore clients, and platform operations.

Under the Capital Markets Law, no virtual asset can be traded anywhere in the UAE unless it appears on the CMA’s official list, is registered with the CMA, and is operated by a CMA-licensed platform. This gives the CMA effective veto authority over which assets can be traded - even on VARA-licensed platforms in Dubai.

The main effect is that VARA’s role is gradually shifting from that of a sovereign regulator to a delegated local licensing authority operating within, and ultimately subordinate to, the CMA’s federal framework.

The Clock Is Running to Become Compliant Within the Transition Period

Entities have a one-year compliance window for the Business Regulation and Alternative Trading System Modules under the new CMA framework, which ends on 13 February 2027.

Several chapters and the glossary of the previous Rule Book of Financial Activities have been repealed immediately, while the conditions relating to application, licensing, approval, and job accreditations are subject to the one-year grace period mentioned above.

As a final comment, it is understood from the CEO’s speech that the objective seems very clear: it is not only a matter of regulatory cooperation for virtual asset products and services within the UAE, but also a commitment to cross-border coordination and alignment with leading international markets, with the strategic aim of establishing leadership in the Africa and Middle East region and attracting foreign investment to the UAE as a hub for virtual assets.

References:

[1] Capital Market Authority: Towards a more competitive financial ecosystem

[2] the-chairman-of-the-authoritys-board-of-directors-resolution-no4of-2026-concerning-the.aspx

[3] general-framework-module.aspx

[4] business-regulation-module-en.aspx

[5] alternative-trading-system-module-en.aspx