UAE crypto licensing 2026: From SCA to CMA - How the UAE Just Redrew the Regulatory Map for Digital Assets

What the CMA’s expanded federal mandate means for VARA, free-zone operators, and every crypto business in the UAE.

1. What Happened: The SCA Becomes the CMA

On 1 January 2026, two federal decree-laws came into force that fundamentally restructured the UAE’s capital markets architecture. Federal Decree-Law No. 32 of 2025 (FDL32) reconstitutes the Securities and Commodities Authority (SCA) as the Capital Market Authority (CMA) — a federal public authority with legal personality, financial and administrative independence, and broad executive and regulatory powers reporting directly to the UAE Cabinet.

Federal Decree-Law No. 33 of 2025 (FDL33) replaces and codifies the licensing regime for financial activities, expands the scope of regulated financial products, and brings virtual assets explicitly within the federal capital markets perimeter.

This is not a rebrand. The CMA is the legal successor to the SCA, but it carries a significantly expanded statutory mandate — including, for the first time at the federal level,

explicit authority over virtual assets used for investment purposes, extraterritorial reach over activities conducted from outside the UAE or from a financial free zone targeting clients within the country, broad resolution powers over systemically important licensed entities, and an enhanced enforcement toolkit with criminal penalties of up to AED 250 million for unlicensed activity.

2. The CMA’s Digital Asset Powers

Under Article 39 of FDL33, the CMA is now explicitly responsible for regulating virtual asset trading, associated financial activities and services, and supervising licensed virtual asset trading platforms. The definition of “Financial Products” has been expanded to include virtual assets used for investment purposes, placing crypto assets on the same regulatory footing as traditional securities.

A key provision: trading of any virtual asset within the UAE is now prohibited unless the asset has been accepted onto the official list maintained by a CMA-licensed virtual asset platform operator and registered with the CMA.

The CMA is also building a federal recognition architecture that may include a “CMA Green List” of recognised virtual assets — a federal gateway for asset admission, listing, and market access.

Then, on 13 February 2026, the CMA issued Decision No. 4/R.M/2026, which replaced the entire 2023 federal VASP framework with a new three-module rulebook: the General Framework Module, the Business Regulation Module, and the Alternative Trading System Module.

The new framework establishes eight distinct licensed activity categories, sets minimum capital requirements ranging from AED 500,000 to AED 4 million, imposes absolute prohibitions on privacy tokens and algorithmic tokens, and introduces compliance deadlines that are already running.

3. The Regulatory Perimeter: Who Regulates What in UAE crypto licensing 2026

The UAE now operates five concurrent regulatory regimes for digital assets. Understanding how these overlap — and where they don’t — is essential for any business operating in or targeting the UAE market.

Regulator	Jurisdiction	Core Focus	Legal Foundation
CMA	Mainland UAE (federal); extraterritorial reach to free zones and cross-border	Virtual asset investment services, exchanges, brokers, custody, platform operators	FDL 32 & 33 of 2025; Cabinet Res. 111/2022; Decision 4/R.M/2026
VARA	Emirate of Dubai (mainland + free zones, excluding DIFC)	Virtual asset issuance, exchange, custody, advisory, lending, broker-dealer	Dubai Law No. 4 of 2022; VARA Rulebook V2.0 (May 2025)
DFSA	Dubai International Financial Centre (DIFC)	Crypto token regime; institutional and governance-led framework	DFSA Rulebook; Crypto Token amendments (Jan 2026)
FSRA (ADGM)	Abu Dhabi Global Market	Accepted Virtual Assets; institutional custody, trading, asset management	FSMR 2015; FRT Framework (Jan 2026)
CBUAE	Federal (all UAE)	Payment tokens, stablecoins, payment services using virtual assets	FDL 6/2025; Payment Token Services Regulation (Sep 2026 deadline)

A critical point: compliance with one framework does not substitute for compliance with another. A UAE virtual asset business may be subject to multiple regulators simultaneously, depending on its activities, structure, and geographic footprint.

An exchange licensed by VARA in Dubai that also serves clients on the mainland or processes payment tokens is potentially subject to CMA, CBUAE, and VARA obligations concurrently.

4. CMA and VARA: Federal Overlay, Not Replacement

The question on every operator’s mind: does the CMA’s expanded mandate render VARA redundant?

The short answer is no — not yet. But the power dynamics have shifted materially.

5. What Keeps VARA Relevant

• Cabinet Decision 111 of 2022 remains in force to the extent it does not conflict with the new legislation, until replaced by new implementing resolutions. This is the legal instrument that designates the SCA (now CMA) as the federal authority and enables delegation to local licensing authorities — including VARA.

  
  

• VARA’s Rulebook V2.0 continues to govern virtual asset activities in Dubai (excluding DIFC). VARA’s activity-specific rulebooks — covering exchange, custody, broker-dealer, lending, advisory, and issuance services — provide granular operational requirements that the CMA’s federal framework does not yet replicate at the same level of detail.

  
  

• The August 2025 CMA-VARA cooperation agreement established mutual recognition of VASP licences, joint application review processes, coordinated monitoring, and a shared enforcement framework. Under this arrangement (building on the earlier SCA-VARA agreement), a VARA licence is intended to confer nationwide authorisation without the need for a separate CMA application.

  
  

• Ministerial Decision No. 336 of 2025 formally designates VARA as a competent authority for corporate tax purposes — recognising its role alongside CMA, CBUAE, DFSA, and FSRA within the federal framework.

6. What Has Changed

Despite these continuity markers, the structural balance has tilted decisively toward the CMA:

• Federal token admission gateway. Under FDL33, no virtual asset can be traded in the UAE unless it is on the CMA’s official list, registered with the CMA, and operated by a CMA-licensed platform. This gives the CMA de facto veto power over which assets can be traded even on VARA-licensed platforms.

  
  

• Extraterritorial and free-zone coverage. FDL33 applies to anyone targeting clients within the UAE, even if operating from outside the country or from a financial free zone. VARA’s jurisdiction, by contrast, is limited to Dubai (excluding DIFC). For multi-emirate operators, the CMA is the only regulator with national reach.

  
  

• Dual compliance is now reality. Free-zone VASPs must not only comply with their free-zone regulator but also follow CMA rules. Additional CMA approvals may be required for virtual asset listing, marketing to onshore clients, and platform operations.

  
  

• Mutual recognition is promised, not yet delivered. FDL32 envisages mutual recognition arrangements with free zones, but these have not yet materialised. Until they do, the transitional period imposes cumulative obligations.

7. The Trajectory: Subordination, Not Extinction

VARA is unlikely to be dissolved overnight. Dubai has invested significant political and commercial capital in positioning VARA as the flagship regulator for its digital asset ambitions. Over 20 entities hold VARA licences, and the authority continues to issue substantive regulatory guidance — including the updated Exchange Services Rulebook effective 31 March 2026.

But the direction of travel is clear.

VARA’s role is gradually shifting from that of a sovereign regulator to a delegated local licensing authority operating within, and ultimately subordinate to, the CMA’s federal framework.

This trajectory mirrors the original architecture envisaged by Article 15 of Cabinet Decision 111 of 2022, which always provided for the Cabinet to delegate CMA functions to local licensing authorities.

The practical implication is that over time, the CMA’s rulebook will become the primary standard. VARA’s rulebook will increasingly align with or defer to federal requirements. Large institutional players and multi-emirate operators will gravitate toward CMA licensing directly, while VARA retains relevance for Dubai-specific retail crypto, Web3, and innovation use cases — as a local implementation arm, not an independent regulator.

8. What Operators Should Do Now

The transitional period is running. Entities have until 1 January 2027 to regularise their status under the new CMA framework, with CMA Decision 4/R.M/2026 imposing a one-year compliance window for the Business Regulation and ATS Modules (ending 13 February 2027).

The following steps are time-sensitive:

• Conduct a gap analysis against FDL32, FDL33, and CMA Decision 4/R.M/2026 — irrespective of whether you hold a VARA, DFSA, FSRA, or mainland licence.

• Map your regulatory perimeter. Determine which regulators apply to your specific combination of activities, geography, and client base. A Dubai-based exchange serving UAE-wide clients now sits under both VARA and CMA.

• Review your token listing. Ensure every virtual asset you offer is, or will be, on the CMA’s official list. Tokens not approved at the federal level may become untradeable once the transitional period ends.

• Reassess your licensing strategy. For new market entrants, the choice between a VARA licence, a CMA licence, or both is now a strategic decision with long-term implications for scope, scalability, and compliance cost.

• Monitor the mutual recognition negotiations. The outcome of CMA-free zone arrangements will determine whether dual compliance remains permanent or is streamlined through reciprocal recognition.

About Pnyx Hill

Pnyx Hill advises digital asset businesses across all five UAE regulatory regimes — CMA, VARA, DFSA, FSRA, and CBUAE. We support exchanges, custodians, brokers, fund managers, and token issuers through regulatory licensing, compliance framework design, and ongoing supervisory alignment.

Our work spans federal and free-zone structures, helping clients navigate overlapping obligations, align with evolving regulatory expectations, and build operating models that stand up to regulatory scrutiny across jurisdictions. 

If you are navigating the CMA transition, reassessing your licensing position, or planning a UAE market entry, our team can support you in mapping the regulatory perimeter and building a compliance strategy aligned with the evolving landscape of UAE crypto licensing 2026, ensuring your structure, approvals, and operations are positioned for the new federal framework.

Assess your regulatory exposure under the new CMA framework