Stay up to date with our latest news
Less than three months. By 1 January 2027, firms licensed under the UAE's old federal regime must have brought their status in line with the new capital markets laws, unless the regulator extends the deadline. Six weeks later, the new conduct rules for virtual asset firms apply in full.
On 13 February 2026, the UAE Capital Market Authority (CMA) issued Decision No. 4/R.M/2026, also referred to as Resolution No. 04/Chairman of 2026. It replaces the 2023 federal VASP framework in full and rewrites the rules for every onshore virtual asset business outside the financial free zones. Two months later, on 13 April 2026, the CMA published its wider Virtual Assets Framework and summed up the approach in one line: "same activity, same risk, same regulatory outcome."
For firms already licensed under the old regime, two dates matter. The first is 1 January 2027, when the one-year transition under Federal Decree-Laws No. 32 and 33 of 2025 ends; the CMA can extend it. The second is 13 February 2027. By then, existing licensees must meet the new Business Regulation and Alternative Trading System requirements: client classification, suitability, AML/CFT, conduct, cybersecurity and record-keeping. For firms still in the licensing pipeline, the clock is even shorter.
This guide sets out what changed, who it affects, what the CMA now expects, and what to do before the deadlines.
What has changed
The CMA took over from the Securities and Commodities Authority on 1 January 2026, under Federal Decree-Laws No. 32 and 33 of 2025. One of its first major acts was to rewrite the federal virtual asset rulebook.
The main changes are:
A full replacement, not an amendment. Decision No. 4/R.M/2026 repeals SCA Decision No. 26/R.M/2023.
Eight licensed activities instead of three. Each is licensed separately, so firms need an authorisation for every activity they carry on.
A modular structure. The Decision has General, Business Regulation and Alternative Trading System modules. The CMA's wider framework adds AML/CFT and Prudential modules.
Higher capital. Minimum capital has gone up for most activities.
Named people, resident in the UAE. The Chief Executive, Compliance Officer and MLRO must live in the UAE.
Hard prohibitions. Activities involving privacy tokens and algorithmic tokens are banned outright. Utility tokens and NFTs are off limits, except for custody and MTF operators with prior CMA approval.
The eight activities are:
Dealing as principal
Dealing as agent, including matched principal
Providing custody
Arranging custody
Operating a multilateral trading facility (MTF)
Providing investment advice
Portfolio management
Arranging investment transactions
Who needs to act
The CMA framework covers onshore virtual asset activity across the UAE. It does not reach the financial free zones, and Dubai keeps its own regulator.
Your business | Regilator | What to do now |
|---|---|---|
Licensed under the old SCA VASP regime | CMA | Regularise your status by 1 January 2027, then meet the Business Regulation and ATS modules by 13 February 2027 |
Holding in-principle approval | CMA | Meet all licensing requirements within six months of approval |
Planning to apply, onshore outside Dubai's VARA perimeter | CMA | Apply under the new eight-activity regime from the start |
Bank, finance company, exchange house or payment service provider licensed by the CBUAE (not insurers) | CMA, with CBUAE approval first | Under CMA Resolution No. 16/Chairman of 2026 (June 2026), you can carry on CMA-regulated virtual asset activities with CMA authorisation, in principle within the same legal entity |
Overseas firm serving UAE clients | Possibly CMA | Check whether your model brings you into scope |
Based in Dubai, outside DIFC | VARA | VARA rules apply; check where CMA rules may also apply |
Based in DIFC or ADGM | DFSA or FSRA | Outside the CMA framework |
Issuing or servicing payment tokens | CBUAE | Payment Token Services Regulation applies instead |
If you are unsure which line applies to you, that is the first question to settle. Getting it wrong means applying to the wrong regulator, or not applying at all.
The dates that matter
Date | What happens |
|---|---|
1 January 2026 | The CMA replaces the Securities and Commodities Authority |
13 February 2026 | Decision No. 4/R.M/2026 is issued; the General Module applies |
13 April 2026 | The CMA publishes its five-module Virtual Assets Framework |
Six months after in-principle approval | Applicants must meet all licensing requirements (one further six-month extension may be granted, at the CMA's discretion) |
July to 30 September 2026 | The CMA consults on its approach to VASPs; the outcome has not yet been published |
1 January 2027 | The one-year transition under Federal Decree-Laws No. 32 and 33 of 2025 ends; existing licensees must have regularised their status (the CMA can extend this) |
13 February 2027 | Existing licensees must comply with the Business Regulation and ATS modules |
Until 13 February 2027, existing licensing conditions stay in force. That is not a grace period for doing nothing. Rebuilding client onboarding, suitability, monitoring and governance takes months, and anything new, such as a resident MLRO or a CMA-approved token list, has its own lead time.
The rules are already in force, but the CMA is still refining its approach. It ran a further consultation on VASPs that closed on 30 September 2026. Plan to the current rules and both 2027 deadlines, and watch for any changes the CMA publishes.
What the CMA now expects
Capital
Minimum capital now depends on the activity, and it has gone up for most of them. Firms that deal or hold client assets face the highest floors. The minimums are a floor: licensees must also meet the Capital Adequacy Module of the Financial Activities Rulebook on an ongoing basis. Where activities are combined, the highest requirement applies.
Holding client assets is not automatic. It needs a separate CMA endorsement, on top of the licence.
People and governance
Mandatory roles, including a Chief Executive, a Compliance Officer, an MLRO, finance and internal audit. Roles can be combined only where there's no conflict and the people are competent.
UAE residency for the Chief Executive, Compliance Officer and MLRO.
A three-year business plan submitted at the in-principle stage.
Conduct and controls
Client classification as retail, professional or counterparty, reviewed every three years.
Suitability assessments for advice and portfolio management.
AML/CFT due diligence, transaction monitoring and risk management proportionate to the business.
Cybersecurity, including a board-approved framework, regular penetration testing, and reporting of material incidents.
Records kept for the full retention periods the rules set.
Token assessment: virtual assets must be assessed and, where required, registered with the CMA before they are offered to clients.
What happens if you miss it
Carrying on a licensed virtual asset activity without the right CMA authorisation is prohibited. Firms that operate without a licence, or that fail to comply within the transition window, face administrative sanctions under Cabinet Resolution No. 99 of 2024.
The fine is only part of the cost. A firm that misses the window may have to stop offering an activity, unwind client positions, or explain to banking partners and investors why its licence no longer covers what it does. In a market where counterparties check licence status before they onboard you, that reputational damage can last longer than any penalty.
Your readiness checklist
Work through these now, in this order:
Map your activities to the eight categories. List everything you do for clients, and check that each one has its own authorisation under the new regime.
Recalculate your capital. Check your current capital against the new minimum for each activity you carry on.
Check your people. Confirm that the Chief Executive, Compliance Officer and MLRO are UAE-resident, and that every mandatory role is filled without conflicts. All senior personnel must also be individually accredited by the CMA before they take up their roles, so build that time into any hiring plan.
Review client onboarding. Reclassify clients as retail, professional or counterparty, and build suitability checks where you advise or manage portfolios.
Test your AML/CFT framework against the new module: due diligence, monitoring, escalation and reporting.
Audit your token list. Remove anything prohibited, and plan CMA assessment or registration for the rest.
Close cybersecurity gaps. Get board approval for the framework, schedule a penetration test, and set up an incident reporting process.
Book time with the regulator. Raise open questions with the CMA early, not in January.
How j. awan & partners can help
The new regime rewards firms that prepare early and penalises those that wait. At j. awan & partners, our dedicated VASP specialists work with virtual asset businesses across the UAE on exactly this transition, from first scoping to a licence that holds up under supervision.
Where you are | How we help |
|---|---|
Already licensed | Compliance advisory and outsourced compliance. We run a gap analysis against the new modules, deliver the remediation plan before 13 February 2027, and then operate your compliance function day to day alongside your named Compliance Officer and MLRO. |
Holding in-principle approval | Project management of every outstanding licensing requirement inside the six-month window |
Planning to apply | Activity mapping, the three-year business plan, policies, and the full CMA application |
Unsure which regulator applies | A clear view of whether you fall under the CMA, VARA, DFSA, FSRA or CBUAE, and what that means for your structure |
A CBUAE licensee adding virtual assets | Structuring advice and support with the CBUAE and CMA approvals needed to offer virtual asset services from your existing entity |
We have seen how regulators across the region examine virtual asset firms, and we bring that experience to every engagement. You get practical advice on what the CMA will ask for, and a compliance framework we can build for your team or run for you.
The first deadline is less than three months away. Speak to our VASP team about where your business stands today.
Frequently asked questions
What is CMA Decision No. 4/R.M/2026? It is the UAE Capital Market Authority's regulation of virtual asset service providers and alternative trading system operators. It was issued on 13 February 2026 and replaces the 2023 federal VASP framework in full. It is also referred to as Resolution No. 04/Chairman of 2026.
When do existing licensees need to comply? There are two dates. The one-year transition under Federal Decree-Laws No. 32 and 33 of 2025 ends on 1 January 2027, unless the CMA extends it. Existing licensees then have until 13 February 2027 to meet the Business Regulation and Alternative Trading System modules of the Decision. The General Module applies already.
Does the CMA regime apply in DIFC, ADGM or Dubai? The CMA framework does not apply in DIFC or ADGM, which have their own regulators. In Dubai outside DIFC, VARA remains the virtual asset regulator.
Which roles must be UAE-resident? The Chief Executive, the Compliance Officer and the MLRO.
Are the new rules final? They are in force, and the 1 January and 13 February 2027 deadlines apply. The CMA also ran a consultation on its approach to VASPs, which closed on 30 September 2026, so further changes are possible.
Sources
The UAE Capital Markets Authority replaces the federal VASP framework, Clyde & Co, April 2026
The UAE's New VASP Framework: A Comprehensive Revision of the CMA's Regulations, TLP Advisors via Mondaq, 16 April 2026
New Virtual Asset Regulations: A Summary of CMA Decision No. 4/R.M/2026, Horizlaw
UAE's New 2026 Federal Crypto Law Explained, NeosLegal
UAE's CMA issues virtual assets framework, Gulf Business, 13 April 2026
UAE Central Bank Licensees Permitted to Conduct CMA-Regulated Virtual Asset Activities, Clyde & Co, September 2026
Blockchain & Crypto-Assets 2026: UAE, Trends and Developments, Chambers and Partners (1 January 2027 transition)
UAE CMA opens consultation on virtual assets framework, Pinsent Masons, 30 July 2026
CMA Dubai Federal VASP Law 2026, IncHub, and CMA Crypto License UAE 2026, Neo Legal (briefing links)
UAE VASP Rules 2026: CMA Deadline Guide for Crypto Firms
The UAE’s new federal rules for crypto firms are in force, and licensed firms face two deadlines. They must regularise their status by 1 January 2027 and meet the CMA’s new conduct rules by 13 February 2027. This guide sets out what changed, who it affects and what to do first.
UAE VASP Rules 2026: CMA Deadline Guide for Crypto Firms
The UAE’s new federal rules for crypto firms are in force, and licensed firms face two deadlines. They must regularise their status by 1 January 2027 and meet the CMA’s new conduct rules by 13 February 2027. This guide sets out what changed, who it affects and what to do first.
Less than three months. By 1 January 2027, firms licensed under the UAE's old federal regime must have brought their status in line with the new capital markets laws, unless the regulator extends the deadline. Six weeks later, the new conduct rules for virtual asset firms apply in full.
On 13 February 2026, the UAE Capital Market Authority (CMA) issued Decision No. 4/R.M/2026, also referred to as Resolution No. 04/Chairman of 2026. It replaces the 2023 federal VASP framework in full and rewrites the rules for every onshore virtual asset business outside the financial free zones. Two months later, on 13 April 2026, the CMA published its wider Virtual Assets Framework and summed up the approach in one line: "same activity, same risk, same regulatory outcome."
For firms already licensed under the old regime, two dates matter. The first is 1 January 2027, when the one-year transition under Federal Decree-Laws No. 32 and 33 of 2025 ends; the CMA can extend it. The second is 13 February 2027. By then, existing licensees must meet the new Business Regulation and Alternative Trading System requirements: client classification, suitability, AML/CFT, conduct, cybersecurity and record-keeping. For firms still in the licensing pipeline, the clock is even shorter.
This guide sets out what changed, who it affects, what the CMA now expects, and what to do before the deadlines.
What has changed
The CMA took over from the Securities and Commodities Authority on 1 January 2026, under Federal Decree-Laws No. 32 and 33 of 2025. One of its first major acts was to rewrite the federal virtual asset rulebook.
The main changes are:
A full replacement, not an amendment. Decision No. 4/R.M/2026 repeals SCA Decision No. 26/R.M/2023.
Eight licensed activities instead of three. Each is licensed separately, so firms need an authorisation for every activity they carry on.
A modular structure. The Decision has General, Business Regulation and Alternative Trading System modules. The CMA's wider framework adds AML/CFT and Prudential modules.
Higher capital. Minimum capital has gone up for most activities.
Named people, resident in the UAE. The Chief Executive, Compliance Officer and MLRO must live in the UAE.
Hard prohibitions. Activities involving privacy tokens and algorithmic tokens are banned outright. Utility tokens and NFTs are off limits, except for custody and MTF operators with prior CMA approval.
The eight activities are:
Dealing as principal
Dealing as agent, including matched principal
Providing custody
Arranging custody
Operating a multilateral trading facility (MTF)
Providing investment advice
Portfolio management
Arranging investment transactions
Who needs to act
The CMA framework covers onshore virtual asset activity across the UAE. It does not reach the financial free zones, and Dubai keeps its own regulator.
Your business | Regilator | What to do now |
|---|---|---|
Licensed under the old SCA VASP regime | CMA | Regularise your status by 1 January 2027, then meet the Business Regulation and ATS modules by 13 February 2027 |
Holding in-principle approval | CMA | Meet all licensing requirements within six months of approval |
Planning to apply, onshore outside Dubai's VARA perimeter | CMA | Apply under the new eight-activity regime from the start |
Bank, finance company, exchange house or payment service provider licensed by the CBUAE (not insurers) | CMA, with CBUAE approval first | Under CMA Resolution No. 16/Chairman of 2026 (June 2026), you can carry on CMA-regulated virtual asset activities with CMA authorisation, in principle within the same legal entity |
Overseas firm serving UAE clients | Possibly CMA | Check whether your model brings you into scope |
Based in Dubai, outside DIFC | VARA | VARA rules apply; check where CMA rules may also apply |
Based in DIFC or ADGM | DFSA or FSRA | Outside the CMA framework |
Issuing or servicing payment tokens | CBUAE | Payment Token Services Regulation applies instead |
If you are unsure which line applies to you, that is the first question to settle. Getting it wrong means applying to the wrong regulator, or not applying at all.
The dates that matter
Date | What happens |
|---|---|
1 January 2026 | The CMA replaces the Securities and Commodities Authority |
13 February 2026 | Decision No. 4/R.M/2026 is issued; the General Module applies |
13 April 2026 | The CMA publishes its five-module Virtual Assets Framework |
Six months after in-principle approval | Applicants must meet all licensing requirements (one further six-month extension may be granted, at the CMA's discretion) |
July to 30 September 2026 | The CMA consults on its approach to VASPs; the outcome has not yet been published |
1 January 2027 | The one-year transition under Federal Decree-Laws No. 32 and 33 of 2025 ends; existing licensees must have regularised their status (the CMA can extend this) |
13 February 2027 | Existing licensees must comply with the Business Regulation and ATS modules |
Until 13 February 2027, existing licensing conditions stay in force. That is not a grace period for doing nothing. Rebuilding client onboarding, suitability, monitoring and governance takes months, and anything new, such as a resident MLRO or a CMA-approved token list, has its own lead time.
The rules are already in force, but the CMA is still refining its approach. It ran a further consultation on VASPs that closed on 30 September 2026. Plan to the current rules and both 2027 deadlines, and watch for any changes the CMA publishes.
What the CMA now expects
Capital
Minimum capital now depends on the activity, and it has gone up for most of them. Firms that deal or hold client assets face the highest floors. The minimums are a floor: licensees must also meet the Capital Adequacy Module of the Financial Activities Rulebook on an ongoing basis. Where activities are combined, the highest requirement applies.
Holding client assets is not automatic. It needs a separate CMA endorsement, on top of the licence.
People and governance
Mandatory roles, including a Chief Executive, a Compliance Officer, an MLRO, finance and internal audit. Roles can be combined only where there's no conflict and the people are competent.
UAE residency for the Chief Executive, Compliance Officer and MLRO.
A three-year business plan submitted at the in-principle stage.
Conduct and controls
Client classification as retail, professional or counterparty, reviewed every three years.
Suitability assessments for advice and portfolio management.
AML/CFT due diligence, transaction monitoring and risk management proportionate to the business.
Cybersecurity, including a board-approved framework, regular penetration testing, and reporting of material incidents.
Records kept for the full retention periods the rules set.
Token assessment: virtual assets must be assessed and, where required, registered with the CMA before they are offered to clients.
What happens if you miss it
Carrying on a licensed virtual asset activity without the right CMA authorisation is prohibited. Firms that operate without a licence, or that fail to comply within the transition window, face administrative sanctions under Cabinet Resolution No. 99 of 2024.
The fine is only part of the cost. A firm that misses the window may have to stop offering an activity, unwind client positions, or explain to banking partners and investors why its licence no longer covers what it does. In a market where counterparties check licence status before they onboard you, that reputational damage can last longer than any penalty.
Your readiness checklist
Work through these now, in this order:
Map your activities to the eight categories. List everything you do for clients, and check that each one has its own authorisation under the new regime.
Recalculate your capital. Check your current capital against the new minimum for each activity you carry on.
Check your people. Confirm that the Chief Executive, Compliance Officer and MLRO are UAE-resident, and that every mandatory role is filled without conflicts. All senior personnel must also be individually accredited by the CMA before they take up their roles, so build that time into any hiring plan.
Review client onboarding. Reclassify clients as retail, professional or counterparty, and build suitability checks where you advise or manage portfolios.
Test your AML/CFT framework against the new module: due diligence, monitoring, escalation and reporting.
Audit your token list. Remove anything prohibited, and plan CMA assessment or registration for the rest.
Close cybersecurity gaps. Get board approval for the framework, schedule a penetration test, and set up an incident reporting process.
Book time with the regulator. Raise open questions with the CMA early, not in January.
How j. awan & partners can help
The new regime rewards firms that prepare early and penalises those that wait. At j. awan & partners, our dedicated VASP specialists work with virtual asset businesses across the UAE on exactly this transition, from first scoping to a licence that holds up under supervision.
Where you are | How we help |
|---|---|
Already licensed | Compliance advisory and outsourced compliance. We run a gap analysis against the new modules, deliver the remediation plan before 13 February 2027, and then operate your compliance function day to day alongside your named Compliance Officer and MLRO. |
Holding in-principle approval | Project management of every outstanding licensing requirement inside the six-month window |
Planning to apply | Activity mapping, the three-year business plan, policies, and the full CMA application |
Unsure which regulator applies | A clear view of whether you fall under the CMA, VARA, DFSA, FSRA or CBUAE, and what that means for your structure |
A CBUAE licensee adding virtual assets | Structuring advice and support with the CBUAE and CMA approvals needed to offer virtual asset services from your existing entity |
We have seen how regulators across the region examine virtual asset firms, and we bring that experience to every engagement. You get practical advice on what the CMA will ask for, and a compliance framework we can build for your team or run for you.
The first deadline is less than three months away. Speak to our VASP team about where your business stands today.
Frequently asked questions
What is CMA Decision No. 4/R.M/2026? It is the UAE Capital Market Authority's regulation of virtual asset service providers and alternative trading system operators. It was issued on 13 February 2026 and replaces the 2023 federal VASP framework in full. It is also referred to as Resolution No. 04/Chairman of 2026.
When do existing licensees need to comply? There are two dates. The one-year transition under Federal Decree-Laws No. 32 and 33 of 2025 ends on 1 January 2027, unless the CMA extends it. Existing licensees then have until 13 February 2027 to meet the Business Regulation and Alternative Trading System modules of the Decision. The General Module applies already.
Does the CMA regime apply in DIFC, ADGM or Dubai? The CMA framework does not apply in DIFC or ADGM, which have their own regulators. In Dubai outside DIFC, VARA remains the virtual asset regulator.
Which roles must be UAE-resident? The Chief Executive, the Compliance Officer and the MLRO.
Are the new rules final? They are in force, and the 1 January and 13 February 2027 deadlines apply. The CMA also ran a consultation on its approach to VASPs, which closed on 30 September 2026, so further changes are possible.
Sources
The UAE Capital Markets Authority replaces the federal VASP framework, Clyde & Co, April 2026
The UAE's New VASP Framework: A Comprehensive Revision of the CMA's Regulations, TLP Advisors via Mondaq, 16 April 2026
New Virtual Asset Regulations: A Summary of CMA Decision No. 4/R.M/2026, Horizlaw
UAE's New 2026 Federal Crypto Law Explained, NeosLegal
UAE's CMA issues virtual assets framework, Gulf Business, 13 April 2026
UAE Central Bank Licensees Permitted to Conduct CMA-Regulated Virtual Asset Activities, Clyde & Co, September 2026
Blockchain & Crypto-Assets 2026: UAE, Trends and Developments, Chambers and Partners (1 January 2027 transition)
UAE CMA opens consultation on virtual assets framework, Pinsent Masons, 30 July 2026
CMA Dubai Federal VASP Law 2026, IncHub, and CMA Crypto License UAE 2026, Neo Legal (briefing links)