In one line

A CMA licence application runs through six working stages: perimeter and activity selection, entity and onshore presence, pre-application engagement, the application file (business plan, policies, prudential evidence and fit-and-proper documentation for accredited roles), review rounds to an in-principle decision, and conditions clearance to go-live. Published summaries suggest roughly six to twelve months end to end for a well-prepared applicant, and the single biggest variable is the quality of the first submission.

Stage zero: perimeter and activity selection

Every avoidable month lost on a CMA application traces back to a classification decision made carelessly at the start. The first questions are jurisdictional: is the activity onshore and federal at all, or does it belong to VARA in Dubai, the FSRA in ADGM, the DFSA in the DIFC, or the CBUAE for payment tokens? Then, within the CMA's remit, which regime and which activities: for virtual asset businesses, the eight regulated activities under the Virtual Assets Framework issued on 13 April 2026 (building on Decision No. 4/R.M/2026); for marketing and referral models, the securities-side categories, where Promotion and Introducing sit in the Fifth Category. The output of this stage should be a written perimeter analysis naming the exact activities applied for, because everything downstream, capital, policies, roles and conditions, is sized against that selection. If you are still unsure whether you need the licence at all, start with our perimeter guide.

Stage one: entity and onshore presence

The CMA authorises a UAE entity, not an idea. Before the file can be credible you need the applicant vehicle settled: a UAE-incorporated company (foreign groups typically apply through a UAE subsidiary), disclosed ultimate ownership, a board the regulator can assess, and a plan for premises and staffing that amounts to genuine onshore substance rather than a plaque on a door. Two practical points from the coalface. First, settle the shareholding before submission: ownership changes made mid-review reopen the fit-and-proper assessment. Second, plan the capital injection mechanics early, because the regulator will want evidence that the money is real, in place and unencumbered, not a promise that it will arrive at approval.

Stage two: pre-application engagement

The CMA process rewards applicants who arrive introduced rather than unannounced. Pre-application engagement is where you align with the regulator on scope and classification before formal submission: what the model is, which activities are sought, and any novel features that will need explaining, such as tokenised products or group structures spanning several perimeters. Published summaries put this stage at around two to four weeks. It is also the stage where an application that should not proceed gets stopped cheaply: if the regulator signals that the model as described sits in a different perimeter or needs restructuring, hearing that before drafting forty policies is a gift.

Stage three: the application file

The file is the application. In substance it must establish four things:

  • A licensable and coherent business model. The regulatory business plan: activities, products, target clients, distribution, revenue model and financial projections that reconcile with the capital plan. The initial disclosure package, reviewed per published summaries over roughly four to eight weeks, is the first formal test of this.
  • Financial soundness. Prudential evidence sized against the operative requirements for the selected activities. For virtual asset activities the operative numbers sit in the framework's Prudential Requirements module and vary by sub-category, so budget from the module rather than from indicative summaries; the published indicative ranges and the caveats that go with them are in our cost guide. On the securities side, some figures are fixed: Fifth Category applicants, for example, need paid-up capital of AED 500,000 held as the company's own equity.
  • Fit-and-proper people in the accredited roles. The CMA expects named, qualified individuals seated in the roles it accredits, with the documentation to prove integrity, competence and financial soundness. The exact roster depends on the licence: in the Fifth Category, for instance, the minimum accredited roles are a Category Manager, a Head of Compliance and a Promotion Manager, with compliance outsourceable with CMA consent. Whatever the category, recruiting these people late is one of the classic sources of delay.
  • A compliance framework that matches the activity. The policy suite: governance, conduct of business, client asset handling and segregation, AML/CFT aligned to the federal regime, technology, custody arrangements and business continuity. The test is not volume but fit: a reviewer can tell within pages whether a policy describes your business or a template's.

Stage four: review rounds and the in-principle decision

After submission the file enters substantive review: rounds of regulator queries, requests for clarification and supplementary documents, and assessment of the offering structure and the people behind it. Published summaries put the full application and in-principle stage at around eight to sixteen weeks, and the honest gloss on that range is that the applicant controls much of it. Each query round has a clock, and slow, partial or defensive answers reset it. The discipline that works: answer every question asked, in the regulator's structure, with documents rather than assurances, and volunteer the awkward point before it is discovered. An in-principle decision, where granted, is approval of the model subject to conditions, not permission to trade.

Stage five: conditions and go-live

The final stage is clearing the conditions attached to approval: evidencing the capital injection, seating any remaining accredited roles, completing premises and systems readiness, and satisfying any matter-specific conditions the regulator has attached. Published summaries suggest around four to eight weeks. The licence then issues with ongoing obligations attached from day one: reporting, prudential monitoring, marketing restrictions and any bespoke conditions. Treat the first year of supervision as part of the application in spirit: the file you promised is the business the regulator now expects to inspect.

The timeline, honestly stated

Adding the published stage ranges gives roughly six to twelve months from first engagement to licence for a well-prepared applicant. Two caveats belong next to that number. First, these are ranges from published summaries, not commitments: the CMA regime is young, its virtual asset framework dates only to April 2026, and processing practice is still settling. Second, the range assumes a clean file; the variables that stretch it are almost all within the applicant's control.

What slows applications down

  • Misclassification discovered mid-review. The most expensive error: an applicant that filed for the wrong activity, or missed one, effectively starts again.
  • Template policies. A policy suite that describes a generic firm rather than yours generates query rounds by itself.
  • Unevidenced capital and unfilled roles. Promises where the regulator wants proof: money not yet injected, accredited roles not yet recruited, premises not yet secured.
  • Slow query responses. The applicant's own response time is usually the largest single component of a stretched timeline.
  • Structural changes after submission. New shareholders, a changed group structure or a pivoted product reopens completed workstreams.
  • Trading before authorisation. Worst of all: activity that starts before the licence lands converts an application into an enforcement file. Article 71 of Federal Decree-Law No. 33 of 2025 carries fines up to AED 250 million and imprisonment of not less than one year, and the CMA showed in June 2026 that it will fine, close premises and block websites. See our enforcement guide.

One further note for banks, finance companies, exchange houses and PSPs watching this space: Resolution No. 16 of 2026 admits CBUAE-licensed institutions into CMA-regulated virtual asset activity in principle, but the authorisation mechanics are not yet defined, so there is no operable application route for them today. Our analysis is in Resolution 16 explained.

Frequently asked questions

How long does the CMA licence application process take?
Published summaries suggest roughly six to twelve months from first engagement to licence for a well-prepared applicant, across four broad stages: pre-application scoping (around two to four weeks), initial disclosure review (around four to eight weeks), the full application and in-principle decision (around eight to sixteen weeks), and final conditions and go-live clearance (around four to eight weeks). None of these are guaranteed: the file's quality and the applicant's responsiveness drive the real timeline.
What are the stages of a CMA licence application?
Six in practice: perimeter and activity selection; entity establishment and onshore presence; pre-application engagement with the regulator; the application file itself (business plan, policy suite, prudential evidence, fit-and-proper documentation for accredited roles); review rounds through to an in-principle decision; and conditions clearance to go-live. Treating the application as a programme across all six, rather than a single form-filling event, is what separates smooth files from stalled ones.
What must a CMA application file contain?
The file must establish four things: a licensable business model (activity classification, regulatory business plan, financial projections), financial soundness (capital sized to the applicable prudential requirements, with liquid-resources planning), fit-and-proper people (documentation for the accredited roles the CMA expects to see seated), and a compliance framework that matches the activity (governance, conduct of business, client asset handling, AML/CFT, technology and custody arrangements).
Do I need a UAE entity before applying for a CMA licence?
The CMA is the federal regulator for onshore UAE activity, and the authorisation attaches to a UAE-incorporated entity with real substance: disclosed ownership, a board, premises and staff in the roles the regulator expects. Foreign groups typically incorporate a UAE subsidiary as the applicant. Entity form, ownership disclosure and substance planning should be settled during scoping, because changing them mid-application restarts parts of the review.
What slows a CMA licence application down?
Five things, in Neo Legal's experience across UAE regulators: activity misclassification discovered mid-review; template policies that do not describe the actual business; capital and staffing that are promised rather than evidenced; slow or partial responses to regulator queries, since each round resets the clock; and ownership or structural changes made after submission. Most of these are avoidable by settling the perimeter, the people and the money before the file goes in.
Does a VARA licence carry over to the CMA?
Not automatically, and the current position should be checked before relying on it. VARA licensees previously benefited from a default federal registration arrangement agreed with the SCA in September 2024. Whether that arrangement survives in the same form under the CMA regime, which replaced the SCA framework from 2026, is not yet confirmed. A Dubai-licensed business planning mainland or multi-emirate activity should take specific advice on its federal position.

This article is general information as at September 2026 and is not legal advice. Stage durations are ranges from published summaries and are not guaranteed; CMA prudential figures for virtual asset activities were not fully confirmed at the review date and should be checked against the Prudential Requirements module before budgeting.