Do I need a CMA licence?

The legal starting point

Federal Decree-Laws No. 32 and 33 of 2025 reconstituted the Securities and Commodities Authority as the Capital Market Authority (CMA) with effect from 1 January 2026, and on 13 April 2026 the CMA issued its Virtual Assets Framework, building on Decision No. 4/R.M/2026 and replacing SCA Decision No. 26/RM of 2023 in full. The framework runs to five modules (General Requirements, Conduct of Business, Alternative Trading System, AML/CFT and Prudential Requirements) and regulates eight virtual asset activities. The question "do I need a CMA licence?" reduces to one test:

Am I conducting a regulated virtual asset activity, or dealing in tokens that are securities in substance, in or from the UAE outside the VARA, DFSA, FSRA and CBUAE perimeters, or directing such activity at UAE mainland investors?

Walk through the six questions below in order. Full framework background is in our CMA virtual asset regulations explainer and on the CMA virtual asset licence page.

Question 1: where do you actually operate from?

The UAE allocates virtual asset regulation by geography first, activity second:

Two practical notes. First, "operating from" follows the people and the decision-making, not just the trade licence: a company incorporated in a northern emirates free zone but run day to day from Dubai raises a VARA question too, and the same substance logic applies in reverse. Second, if you are in Dubai the perimeter test is VARA's, which we cover in do I need a VARA licence?; the CMA question then only arises for activity beyond Dubai. The four-regulator map is compared in our regulator comparison.

Question 2: is your token a security in substance?

The CMA does not assess virtual assets by their label. The test is whether the token exhibits the economic substance of a security or other regulated financial instrument. The factors:

• Profit-sharing or yield rights: entitlement to a share of issuer revenues, profits or staking rewards beyond a pure utility-fee model.
• Equity-like rights: ownership, voting, claims on residual value, governance rights with economic consequence.
• Debt-like characteristics: promised capital return, fixed yield, redemption rights.
• Investment of money with an expectation of profit from the efforts of others: the Howey-style analysis applied through a UAE lens.
• Asset backing: fractional interests in real-world assets such as real estate, commodities or private credit.

A token passing one or more of these tests is likely a security under CMA principles and needs federal-level authorisation, or an appropriate exemption, to be offered in or from the UAE mainland. This is the trap that catches VARA- and ADGM-licensed operators: an exchange licence in Dubai does not authorise a securitised token offering to mainland investors.

Question 3: are you conducting one of the eight virtual asset activities?

The framework regulates eight activities: Dealing as Principal, Dealing as Agent, Providing Custody, Arranging Custody, Arranging Investment Deals, Providing Investment Advice, Portfolio Management, and Operating an MTF. If your business does any of these for clients in or from CMA territory, you are inside the perimeter. The Alternative Trading System module also makes the CMA the onshore venue home for tokenised-securities trading platforms, a role previously assumed to belong only to the financial free zones. We break each activity down, with VARA equivalents, in the eight activities explained.

Question 4: are you marketing into the UAE?

Solicitation aimed at UAE mainland investors is inside the federal perimeter even where the operator has no UAE entity at all. UAE-targeted advertising campaigns, referral programmes onboarding UAE residents, Arabic-language landing pages and UAE roadshows have all been treated as the relevant indicators in practice. Each regulator polices marketing within its own perimeter as well, so a campaign that reaches Dubai users engages VARA's marketing rules while the mainland leg engages the CMA. Offshore platforms should map their funnels against every UAE perimeter before spending on acquisition, not after the first regulator letter.

Question 5: are you a bank, finance company, exchange house or PSP?

Until 2026 the answer for Central Bank licensees was simple: virtual assets were off the table. CBUAE Resolution No. 16 of 2026 changed that, admitting banks, finance companies, exchange houses and payment service providers into CMA-regulated virtual asset activity, including custody, dealing and alternative trading systems. Insurers are carved out. The resolution is a gateway, not an authorisation: the institution still needs the CMA licence for the activity itself, layered on top of its Central Bank licence. Our full analysis is in the Resolution 16 article.

Question 6: are you holding your own assets, or serving clients?

Buying, holding and selling virtual assets for your own account is not one of the eight regulated activities: a personal portfolio, or a company treasury position, does not of itself require a CMA licence. The perimeter is crossed when clients appear: holding assets for others is custody, executing for others is dealing, advising others is investment advice, and pooling or managing others' assets is portfolio management. The recurring failure mode is drift, a proprietary holder who starts taking friends' money, or a treasury desk that begins quoting third parties. The classification is factual and runs trade by trade.

What if you already hold a VARA licence?

Under a September 2024 arrangement between the SCA and VARA, Dubai VASP licensees benefited from default registration with the federal regulator. Whether that arrangement carries over unchanged under the CMA regime had not been confirmed at the time of review. Until it is, the prudent reading for a VARA licensee planning multi-emirate reach is to treat the federal position as open and confirm it directly, a point we develop in CMA vs VARA.

The consequences of getting it wrong

Under Article 71 of Federal Decree-Law No. 33 of 2025, carrying on financial activity in the UAE without a licence, approval, registration or accreditation from the CMA carries a fine of up to AED 250 million and imprisonment of not less than one year. The enforcement toolkit extends to premises closure and website blocking, and Article 71 applies to natural persons, so directors and managers who directed or knowingly permitted the activity are personally exposed. The CMA has already used these powers in 2026. Full analysis, including the remediation path, is in our CMA fines article; the wider reform context is in the new UAE capital markets law explained.

What to do once you have your answer

If the perimeter applies, the next steps are activity selection, entity setup in CMA territory and the application programme, with budget detail in our CMA licence cost guide. If it does not, document why: a short perimeter opinion recording where you operate from, what your token is and who your clients are is inexpensive insurance against an Article 71 conversation. And if activity may already be over the line, voluntary engagement with the regulator, on advice, consistently beats detection.

This article is general information as at September 2026 and is not legal advice. The CMA framework is new and evolving; the treatment of VARA licensees' federal registration under the CMA regime was unconfirmed at the review date. Take advice on your specific facts before acting.