Overview
The CMA is the federal regulator for securities and capital markets, and for virtual-asset activity that falls outside the Dubai perimeter held by VARA and outside the two financial free zones, ADGM and the DIFC.
It is the layer most often missed. A business picks an emirate, picks a zone, obtains the licence that zone requires, and never asks whether what it is selling is a security under federal law.
What it regulates
Public offers and listings, licensed market intermediaries, funds marketed in the UAE, commodities trading, and virtual-asset activity in the emirates that have not established their own framework.
The characterisation question is the important one. If an instrument is a security, federal securities law engages regardless of how the business describes it or which free zone issued its trade licence.
The name changed, and so did the statute
Until the end of 2025 this body was the Securities and Commodities Authority (SCA). From 1 January 2026 it is the Capital Markets Authority (CMA), under Federal Decree-Law No. 32 of 2025, alongside a recast capital markets framework in Federal Decree-Law No. 33 of 2025.
Treating that as a rebrand would be a mistake. The reported effect is a wider perimeter, not a new letterhead: virtual assets are brought expressly within scope, and the framework reaches firms targeting clients in the UAE even where the activity is carried on from outside the country or from a financial free zone. A perimeter analysis done before 2026 was done against a different statute and should be redone rather than re-dated.
Which CMA, though
The Gulf now has several, and they are not each other.
The UAE Capital Markets Authority is the subject of this page. The Capital Market Authority of Saudi Arabia, the Capital Market Authority of Oman and the Capital Markets Authority of Kuwait are separate regulators in separate countries under separate law. A UAE-licensed firm that wants to serve clients in Riyadh, Muscat or Kuwait City is dealing with a foreign regulator; there is no passporting into the GCC and none out of it.
Before 2026 the useful thing to say here was that there was no UAE CMA at all. That is no longer true, and the confusion now runs the other way — so we keep a separate comparison of the other regimes under International.
Who needs a licence
Anyone offering securities to the public in the UAE, operating a market or intermediating in one, marketing a fund into the UAE, or carrying on virtual-asset activity in an emirate where the CMA holds the perimeter rather than a local authority.
Interaction with other regulators
Dubai is the complicated case, because VARA holds the Emirate-level virtual-asset perimeter while the CMA retains federal competence. Arrangements exist between them, and a firm operating in Dubai should understand which permission covers which activity rather than assuming one covers everything.
ADGM and the DIFC sit outside the CMA perimeter entirely, under the FSRA and the DFSA respectively.
How we help
We produce reasoned token classification opinions applying the VARA, CMA, FSRA, DFSA and CBUAE tests to the actual mechanics, so the answer survives contact with a regulator, a bank or a buyer. Where the answer is that an instrument is a security, we say so early, while the structure can still be changed cheaply.
Interaction avec les autres régulateurs
Questions fréquentes
Is the UAE federal markets regulator called the SCA or the CMA?
The CMA. The Securities and Commodities Authority was renamed the Capital Markets Authority with effect from 1 January 2026. Documents, filings and older advice still say SCA, and will for some time — if you are reading something that predates 2026, the body it means is this one.
We are licensed by VARA in Dubai. Does the CMA still matter?
Yes, in two ways. Federal capital markets law still applies to anything that is a security rather than a virtual asset, and there are arrangements between the federal regulator and VARA that affect firms operating in Dubai. A VARA licence is not a shield against federal characterisation.
Does anything change beyond the name?
Yes, which is why this is not a rebrand to be noted and filed. The federal framework was recast at the same time, and the reported scope now reaches virtual assets expressly and extends to firms targeting UAE clients from outside the country, including from a financial free zone. If your perimeter analysis predates 2026, it was done against a different statute.
Who decides whether our token is a security?
Ultimately a regulator, applying its own test. The useful work is done in advance — a reasoned classification opinion that applies each relevant test to the actual token mechanics and records why the conclusion follows. That is what a regulator, a bank or an acquirer will ask to see.
Sources
- Federal Decree-Law No. 32 of 2025 (establishing the Capital Markets Authority) and No. 33 of 2025 (Capital Markets Organisation and Regulation), in force 1 January 2026 — Decree numbers, the authority's exact registered name and its current website to be confirmed against the official gazette before reliance
- CMA decisions on the regulation of virtual asset platforms and service providers — Decision numbers, and which SCA-era decisions survive the transition, to be confirmed
- CMA and VARA arrangements on dual licensing and mutual recognition in Dubai — To be confirmed against both regulators' current publications