CMA Virtual Asset Licence (formerly SCA)
On 1 January 2026 the Securities and Commodities Authority (SCA) was replaced by the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025, alongside Federal Decree-Law No. 33 of 2025 on regulating the capital market. The CMA's mandate now explicitly covers virtual assets used for investment purposes, at federal level. Dubai remains under VARA for virtual assets, and ADGM and the DIFC keep their own regulators. VAF Global helps firms work out whether the CMA regime applies to them and builds the compliance framework it expects.
Who needs this licence?
- Virtual asset service providers based onshore outside Dubai
- Securities and virtual asset brokers serving clients across the UAE
- Trading platforms for virtual assets or tokenised securities
- Free zone firms whose activities extend to mainland UAE clients
- Asset managers and advisers in virtual assets for investment
What changed in 2026
SCA became the CMA
The CMA is the legal successor to the SCA, with all its rights and obligations, effective 1 January 2026.
Virtual assets in federal scope
Virtual assets for investment purposes are now financial products within the CMA's competence. VARA continues to regulate virtual assets in Dubai (outside the DIFC) under Cabinet Resolutions 111 and 112 of 2022, which the new law keeps in force. ADGM and the DIFC keep their own regulators.
New virtual asset rulebook
CMA Decision No. 4/R.M/2026 sets out a new rulebook for virtual asset activities, covering licensing, conduct of business and trading venues, with transitional arrangements for existing firms.
Wider reach
Firms licensed elsewhere may need to consider CMA obligations where they target onshore UAE clients.
Key requirements
- Typically, a UAE-incorporated entity with a physical head office and real substance
- Fit and proper controllers and key persons, including a Compliance Officer and AML reporting officer
- AML/CFT framework in line with UAE federal legislation and goAML reporting
- Minimum capital set by the CMA according to the activity
- Cybersecurity, technology governance and incident reporting
- Client classification, suitability, client asset protection and disclosures
- Registration or admission of virtual assets before offering them to clients
The licensing process
- 1
Confirm jurisdiction
Check whether CMA, VARA, DFSA or FSRA applies to your location, activities and clients.
- 2
Gap analysis
Compare your current framework against the CMA's rulebook, especially if you were previously SCA-licensed.
- 3
In-principle approval
Submit the business plan, governance framework and supporting documents.
- 4
Full licence
Provide the full policy suite, technology documentation, key person approvals and capital evidence.
- 5
Go-live and supervision
Meet all conditions, then operate under CMA supervision.
How VAF Global helps
We prepare and run the compliance side of your licence, so your application meets the regulator's expectations from day one.
- Regulator mapping across CMA, VARA, DFSA and FSRA
- Gap analysis for firms moving from the SCA regime
- AML/CFT and KYC frameworks with goAML readiness
- Risk assessments, policies and compliance manuals
- Outsourced MLRO and compliance officer services
- KYT transaction monitoring
CMA Licence (formerly SCA): FAQ
Is the SCA still the UAE's securities regulator?
+
No. Since 1 January 2026 the Capital Market Authority (CMA) has replaced the SCA under Federal Decree-Law No. 32 of 2025. The CMA is the SCA's legal successor.
Do I need a CMA or VARA licence for my crypto business?
+
If you operate in or from Dubai (outside the DIFC), VARA is generally the regulator. Businesses elsewhere onshore generally fall under the CMA, and ADGM and DIFC have their own regulators. Firms serving clients across the UAE may need to consider more than one regime.
What happens to firms licensed by the SCA before 2026?
+
The CMA is the SCA's legal successor, and SCA-era resolutions remain in force until replaced. Existing licensees must bring themselves into line with the new laws and the CMA's 2026 virtual asset rules within the transition periods. Confirm your own status with the CMA; a gap analysis is the best place to start.
Related insights
VARA, ADGM, DIFC or CMA? Choosing Your UAE Crypto Regulator in 2026
A plain-English comparison of the UAE's crypto regulators (VARA, ADGM's FSRA, the DFSA and the CMA) and how to choose the right one.
Read articleSCA Is Now the CMA: What the 2026 Change Means for Crypto Firms
On 1 January 2026 the UAE's Securities and Commodities Authority became the Capital Market Authority. What changed for crypto and securities firms.
Read articleOther UAE licensing guides
Last reviewed October 2026. This guide is general information for compliance planning, not legal advice. Regulatory requirements change; always confirm current rules with the regulator. VAF Global is a compliance consultancy and does not provide legal services.