The UAE Capital Markets Authority replaces the federal VASP framework

Following the enactment of Federal Law No. 33 of 2025, the newly constituted Capital Markets Authority (CMA) has issued Decision No. 4/R.M/2026, introducing a comprehensive new framework for virtual asset activities and service providers. This decision does not amend the previous SCA regime, it replaces it in full.

The new framework establishes a modular, activity based licensing model supported by materially higher capital, governance and compliance thresholds. It is intended to operate alongside emirate level regimes, including VARA in Dubai, while expressly excluding the financial free zones of the DIFC and ADGM. Together, these changes signal a shift away from market access led regulation towards a model focused on institutional resilience and supervisory discipline.

What has changed?

1. Decision 4/R.M/2026 introduces eight licenced virtual asset activities, replacing the broader categories under the prior framework. These include dealing in virtual assets (as principal and as agent), custody, operation of multilateral trading facilities, portfolio management, investment advice and arranging investment transactions. Each activity is licensed on a standalone basis, with firms required to hold authorisation for every activity they conduct. 
2. The most immediate impact of the new framework is its revised capital architecture. Minimum capital requirements have increased across most activities, particularly where firms assume balance sheet or trading risk. Dealing as principal now attracts one of the highest capital floors under the regime, while platform operators are subject to graduated requirements depending on whether they operate on a standalone or combined basis.
3. In addition to fixed capital thresholds, firms must maintain liquid financial resources sufficient to cover at least six months of operating expenses, reflecting a deliberate recalibration of risk tolerance, designed to ensure that only well capitalised and operationally mature firms are able to participate at federal level.
4. Decision 4/R.M/2026 sets out a more structured governance model than its predecessor. Licensed firms must appoint defined senior roles covering executive management, compliance, AML/CFT oversight, finance and internal audit. Certain key positions must be held by UAE resident individuals, underscoring the CMA’s focus on local accountability and effective on shore oversight.
5. For firms that previously relied on offshore management or heavily outsourced compliance functions, these requirements will require material restructuring. 
6. The framework embeds virtual asset activities firmly within the UAE’s broader AML/CFT regime. Firms are expected to demonstrate robust client due diligence, transaction monitoring and risk management arrangements proportionate to their licenced activities. AML/CFT compliance is positioned as a foundational licensing requirement, rather than a supplementary obligation.

Interaction with other UAE regimes

The CMA framework is not intended to displace other regulatory regimes. VARA remains the competent authority for virtual asset businesses established in Dubai outside the DIFC, while the DIFC and ADGM continue to operate under their own rulebooks. Decision 4/R.M/2026 instead establishes a federal baseline for onshore virtual asset activities, operating alongside emirate specific frameworks.

Firms operating across jurisdictions will need to carefully map regulatory scope and ensure consistency across overlapping licensing, capital and governance requirements.

Who should care?

The new regime is directly relevant to existing SCA licensed VASPs, firms currently in the licensing pipeline, and international operators considering entry into the UAE market. Transitional arrangements apply, but migration to the new framework will require a detailed gap analysis across capital, governance and compliance.

Institutional exchanges, custodians, intermediaries and service providers will be particularly impacted by the enhanced substance requirements. Traditional financial services firms exploring virtual asset activities should also take note of the CMA’s recalibrated expectations.

What to watch for next

While the transitional period provides formal time to adapt, the scale of the changes introduced by Decision 4/R.M/2026 means early engagement will be critical. Capital restructuring, senior appointments and compliance uplift exercises are unlikely to be straightforward.

Further supervisory guidance and early enforcement signals from the CMA will be key in shaping how the framework operates in practice. Firms that engage early and invest in governance and substance will be best placed as the regime matures.

Our team advises clients on UAE federal and emirate level virtual asset regulation, licensing strategy and transition planning. If you would like to discuss how the CMA’s new framework may affect your business, please get in touch with Tom Bicknell and Barkha Doshi.