The CMA virtual asset license: the federal layer.

What the CMA is, and why the name changed

With effect from 1 January 2026, the Securities and Commodities Authority (SCA) was reconstituted as the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025. The substantive regime, how the UAE's onshore capital markets are organised, who must be licensed and what happens to those who are not, sits in the companion statute, Federal Decree-Law No. 33 of 2025. This is succession, not duplication: the CMA inherits the SCA's remit, rulebooks and enforcement history, and existing SCA decisions continue to apply until replaced. The CMA regulates onshore UAE activity, meaning everything outside the DIFC and ADGM financial free zones, which keep their own regulators. Background on the statutes is in our notes on the new UAE capital markets law and the CMA virtual asset regulations.

The Virtual Assets Framework: 13 April 2026

On 13 April 2026 the CMA issued its Virtual Assets Framework, building on Decision No. 4/R.M/2026 and replacing SCA Decision No. 26/RM of 2023 in full. It is a complete regulatory architecture in five modules:

The practical consequence: the UAE mainland now has a virtual asset regime of the same institutional weight as VARA's, and operators can no longer treat the federal layer as an afterthought to a free-zone licence.

The eight regulated activities, and indicative capital

The framework regulates eight virtual asset activities. Published summaries give indicative capital for the main categories; where no figure has been published we say so rather than guess:

The mandatory caveat: these figures are indicative only. The operative requirements sit in the framework's Prudential Requirements module and vary by sub-category, projected assets under custody or management, and operational risk profile. Published summaries also point to a liquid-resources buffer of around six months' operating expenses. Never budget from a summary table, this one included: budget from the module, or from advice on the module. Our full breakdown is in the CMA virtual asset licence cost guide, with the activity-by-activity walkthrough in the eight CMA virtual asset activities.

Alongside the virtual asset framework, the CMA also runs its securities-side licence categories: promotion and introducing sit in the Fifth Category with paid-up capital of AED 500,000. If your model is marketing or referral rather than dealing, that is often the right licence: see our Category 5 guide.

Who needs the CMA, versus VARA, ADGM and DIFC

The UAE runs five virtual asset perimeters, and the licence follows the territory and the product:

• Activity in or from the Emirate of Dubai (outside the DIFC)? VARA. See our VARA practice.
• Activity from within the ADGM? The FSRA.
• Activity from within the DIFC? The DFSA.
• Payment tokens and dirham-referenced stablecoins? The CBUAE.
• Onshore activity outside those four perimeters, multi-emirate reach, mainland public offerings and tokenised securities? The CMA.

For most operators the live question is CMA or VARA, and the answer turns on where the clients are: Dubai-concentrated models point to VARA, mainland and multi-emirate models point federally, and some structures need both. One point deserves a flag rather than an assertion: VARA licensees previously benefited from a default federal registration arrangement agreed with the SCA in September 2024, and whether that arrangement continues in the same form under the CMA regime is not yet confirmed. The full comparison is in CMA vs VARA and do I need a CMA licence, with the four-regulator map in our regulator comparison.

Tokenised securities: the onshore ATS venue

The most strategically significant part of the framework is the Alternative Trading System module. It covers multilateral trading facilities for both conventional securities and tokenised securities, which means tokenised securities now have an onshore federal trading venue rather than only the ADGM and DIFC free-zone routes. For issuers of tokenised funds, tokenised debt and real-world-asset structures aimed at mainland investors, the CMA is where the venue, the offering rules and the intermediation licences all sit. Classification still comes first: the CMA assesses substance, not labels, and a token carrying equity-like, debt-like or profit-sharing rights is a security however it is wrapped.

Banks and PSPs: Resolution 16 of 2026

Resolution No. 16 of 2026 opened a second door into the framework: Central Bank licensed institutions, meaning banks, finance companies, exchange houses and payment service providers, may in principle undertake CMA-regulated virtual asset activities such as custody, dealing and operating an ATS. Insurers are carved out. The authorisation mechanics are not yet defined, so this is a green light to scope and design rather than an operable pathway today. Our analysis is in Resolution 16 explained.

The application: what the file must contain

A CMA virtual asset application is a regulatory submission, not a form. In broad terms the file must establish four things: a licensable and coherent business model, financial soundness, fit-and-proper people, and a compliance framework that actually matches the activity. In practice that means:

• Perimeter and activity classification: which of the eight activities you are applying for, and why the combination matches what the business actually does.
• A UAE entity and onshore presence: incorporation, ownership disclosure, board composition and physical substance.
• The regulatory business plan: model, markets, clients and financial projections.
• The policy suite: governance, conduct of business, client asset handling, AML/CFT aligned to the framework's AML module, technology and custody arrangements.
• Prudential evidence: capital sized against the Prudential Requirements module for your sub-category, with liquid-resources planning.
• Fit-and-proper documentation for the accredited roles the CMA expects to see seated and qualified.

Stage-by-stage detail, including review rounds, conditions and what slows applications down, is in our CMA licence application process guide.

Enforcement: the cost of skipping the licence

Carrying on a regulated financial activity in the UAE without a CMA licence, approval, registration or accreditation is an offence under Article 71 of Federal Decree-Law No. 33 of 2025, with fines of up to AED 250 million and imprisonment of not less than one year. The ceiling is reserved for the most serious conduct, but the regulator is active: in June 2026 the CMA fined a group of companies AED 5.5 million for unlicensed financial and investment activity, closed their headquarters and blocked their websites. The non-monetary measures, premises closure, website blocking and named investor warnings, often do more lasting damage than the fine. There is a remediation path, and early voluntary engagement is consistently cheaper than detection: see our CMA fines guide.

Why Neo Legal for CMA work

Three verifiable reasons. First, cross-perimeter depth: Neo Legal practises across the CMA, VARA, the ADGM, the DIFC and the CBUAE in one team, so the regulator-selection question is answered on the merits rather than by whichever licence the adviser happens to know. Our Director of Licensing and Regulatory Compliance, Manpreet Kaur, previously served inside VARA itself, so applications are built the way regulators actually read them. Secondly, named public work: Neo Legal advised Animoca Brands on its VARA VASP licence, announced February 2026, covering VA Broker-Dealer and VA Management and Investment Services, the first regulated VASP licence in the Animoca Brands group globally, working alongside Animoca's internal legal and compliance team and the group's other advisers. Thirdly, published depth: the firm has practised in virtual assets since 2015, including the world's first cryptocurrency IPO, and maintains a live UAE licensing tracker across all five regulators. Every engagement is partner-led, and Neo Legal is the UAE practice of Cornwalls, the Australian firm established in 1891.