The regulator, renamed: SCA is now the CMA

If you have searched for "UAE CMA fines" and found conflicting information, the explanation is recent. With effect from 1 January 2026, the long-standing Securities and Commodities Authority (SCA) was reconstituted as the Capital Markets Authority (CMA) under Federal Decree-Law No. 32 of 2025. The substantive rules — how the UAE's onshore capital markets are organised, who must be licensed, and what happens to those who are not — sit in the companion statute, Federal Decree-Law No. 33 of 2025 on the Organisation and Regulation of Capital Markets.

This is more than a change of name. The CMA is the federal regulator for capital-markets activity conducted onshore in the UAE — that is, outside the DIFC and ADGM financial free zones, which are regulated separately by the DFSA and FSRA. For the precise scope of the new statute and how it differs from the prior framework, see our note on the new UAE capital markets law for 2026. Existing SCA decisions and rulebooks continue to apply until replaced, and historic SCA enforcement actions carry over to the CMA.

What requires a CMA licence

The offence of "unlicensed activity" only arises if what you do actually falls inside the CMA's regulated perimeter. Broadly, CMA authorisation — a licence, approval, registration or accreditation — is required to carry on the following for onshore (mainland) UAE investors:

  • Establishing or managing investment funds.
  • Financial advisory and consultancy on securities and investments.
  • Portfolio and asset management.
  • Promotion — marketing or offering financial products and securities to investors in the UAE.
  • Introducing — arranging or referring clients to financial services.
  • Brokerage and dealing in securities and commodities.

The perimeter is fact-sensitive. A common trap is promotion: a firm licensed for one activity (or licensed in a free zone, or not at all) markets a fund or investment to UAE-onshore investors and crosses into CMA-regulated territory without realising it. Another is the firm that believes it is "only introducing" when, on the facts, it is advising or dealing. Where the activity genuinely sits inside the DIFC or ADGM, the CMA is not the regulator — but the territorial line must be drawn carefully and documented.

The penalty framework — Article 71

Article 71 of Federal Decree-Law No. 33 of 2025 is the headline provision. A person who carries on a financial activity in the UAE without the required CMA licence, approval, registration or accreditation faces:

  • A fine of up to AED 250 million (approximately USD 68 million); and
  • Imprisonment of not less than one year.

Two points matter for reading that figure correctly. First, AED 250 million is a statutory ceiling reserved for the most serious conduct — large-scale, deliberate, or fraud-adjacent activity. The administrative fines actually imposed for ordinary breaches scale well below it. Second, the penalty is assessed per offence, and a course of unlicensed conduct can be characterised as many separate offences, so cumulative exposure for a sustained operation can be very large even where each individual fine is modest.

Beyond the fine — the measures that bite hardest

For most operating businesses, the monetary penalty is not the worst part. The CMA's enforcement toolkit also includes:

  • Suspension of the activity and a cease-and-desist order.
  • Cancellation of any existing licence and a bar from future authorisation.
  • Closure of premises — physically shutting the headquarters.
  • Website blocking in the UAE.
  • Public investor warnings that name the firm or individual, which are widely reported and effectively permanent.
  • AML/CFT overlay. Most unlicensed financial activity also engages Federal Decree-Law No. 20 of 2018 on anti-money laundering, which carries its own fines and imprisonment of up to ten years, and referral to the UAE Public Prosecution.

A naming-and-shaming investor warning and a blocked website do lasting commercial damage that a fine, paid quietly, does not.

What CMA enforcement looks like in 2026

The CMA has moved quickly under the new regime. The clearest recent example is an enforcement action announced on 3 June 2026: the CMA fined a group of companies a total of AED 5.5 million for carrying on unlicensed financial and investment activity, and in addition closed their headquarters and blocked their websites. The authority did not name the firms in that release, but it used the occasion to urge investors to verify the licensing status of any financial entity before dealing with it.

That action sits on top of the enforcement pattern inherited from the SCA. Across 2025 the authority imposed fines totalling roughly AED 1.15 million — including penalties on companies for promoting activities outside the scope of their licence, a textbook perimeter breach. The throughline is consistent: the regulator detects unlicensed or out-of-scope activity through market intelligence, investor complaints and inter-regulator referrals, then combines a fine with operational measures (closure, blocking, warnings) designed to protect the public.

Personal liability — directors and managers

The corporate form is not a shield. Because the imprisonment penalty in Article 71 applies to natural persons, the directors, managers and individuals who directed, authorised or knowingly permitted the unlicensed activity are personally exposed — not only the company. Where the conduct also engages the federal AML/CFT regime, that personal exposure increases, and an individual found "not fit and proper" can be barred from future authorisation across the UAE's financial regulators. For founders building a long-term financial-services presence in the UAE, that bar is frequently more damaging than the fine itself.

The remediation pathway

If there is any doubt about whether your business needs a CMA licence, the worst option is to wait and hope. A structured remediation path is materially cheaper than enforcement:

  1. Pause the activity. Voluntarily stop the conduct that may be unlicensed, and document the stop.
  2. Get a perimeter opinion. A written analysis of whether your activity actually falls inside the CMA's regulated perimeter — and, if so, which licence applies — is the foundation for every decision that follows.
  3. License or restructure. Either apply for the correct CMA authorisation, or re-house the activity in an appropriate vehicle — including a DIFC or ADGM free-zone entity regulated by the DFSA or FSRA — where that is the better fit.
  4. Engage voluntarily. Where activity has already occurred, a pre-emptive, well-prepared approach to the CMA with a credible remediation plan reduces exposure far more effectively than waiting for a detection-led investigation.
  5. Build AML readiness. Because the AML/CFT regime sits alongside the CMA framework, remediation should include AML controls, not just the licence question.

The principle is the same one we set out for VARA penalties for operating without a licence in Dubai's virtual-asset sector: voluntary, early engagement resolves in the lowest penalty tier; detection-led enforcement does not.

What we do

Neo Legal advises companies and individuals on CMA (formerly SCA) perimeter questions, federal capital-markets licensing, and enforcement response — including perimeter opinions, voluntary-disclosure strategy, and restructuring activity into the right onshore or free-zone vehicle. If you are unsure whether your activity needs a CMA licence, an early conversation costs a fraction of a published penalty.

This article is general information on UAE law as at June 2026 and is not legal advice. Penalty figures are statutory maximums; outcomes depend on the specific facts. Speak with qualified counsel about your situation.