Book a Free Consultation
30 minutes. We will assess your case and tell you exactly what you need.
Proxima Eight FZE LLC
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Close
UAE CMA Federal VASP Licensing: The Federal Framework for Virtual Asset Businesses
On 13 February 2026, the UAE Capital Markets Authority (CMA) issued Decision No. 4/R.M/2026 — replacing the entire 2023 VASP framework with a new three-module rulebook. Any firm operating virtual asset activities in the UAE outside DIFC and ADGM must now comply. We manage the full licensing process.
9+ Years of Compliance Expertise
End-to-End Execution
What Is the CMA and How Did We Get Here?
The Securities and Commodities Authority (SCA) was reconstituted as the Capital Markets Authority (CMA) on 1 January 2026 under Federal Law No. 33 of 2025, with an expanded mandate that explicitly includes virtual assets.
On 13 February 2026, the CMA issued Decision No. 4/R.M/2026, which:
On 13 February 2026, the CMA issued Decision No. 4/R.M/2026, which:
- Replaced Decision No. 26/R.M/2023 (the previous VASP framework) entirely
- Established a new three-module rulebook: General Framework Module, Business Regulation Module, Alternative Trading System Module
- Introduced eight distinct licensed activity categories
- Set materially higher capital and governance requirements
- Imposed absolute prohibitions on privacy tokens and algorithmic tokens
- Established compliance deadlines running from 13 February 2026
CMA vs VARA: Who Needs Which?
The CMA framework establishes a federal baseline for virtual asset activities across the UAE. It is not intended to replace VARA — VARA remains the competent authority for firms established in Dubai (excluding DIFC). The practical implications:
Source: CMA Decision 4/R.M/2026; Clyde & Co 'The UAE Capital Markets Authority replaces the federal VASP framework', April 2026.
Eight Licensed Activity Categories
- VA Advisory Services — providing investment advice on virtual assets
- VA Brokerage Services — executing VA transactions on behalf of clients
- VA Portfolio Management — discretionary management of client VA portfolios
- VA Custodian Services — safekeeping of client virtual assets
- VA Exchange / Platform Services — operating a multilateral trading platform
- VA Transfer and Settlement — processing VA transfers on behalf of clients
- VA Dealer Services — buying and selling VAs on own account
- VA Issuance Services — issuing virtual assets (tokens)
Capital Requirements
Activity Category
Minimum Paid-Up Capital
VA Advisory Services
AED 500,000
VA Brokerage Services
AED 2,000,000
VA Portfolio Management
AED 3,000,000
VA Custodian Services
AED 4,000,000 + 6-month OPEX buffer
VA Exchange / Platform (platform only)
AED 1,000,000 + 6-month OPEX buffer
VA Exchange / Platform
(platform + other activities)
(platform + other activities)
AED 5,000,000 + 6-month OPEX buffer
VA Dealer Services
AED 30,000,000
VA Transfer and Settlement
AED 500,000
Note: Capital figures are based on analysis of Decision No. 4/R.M/2026 by multiple independent legal commentators (Cryptoverse Lawyers, NeosLegal, Mielogroup). The CMA may require additional capital based on 25–35% of annual expenses or risk-based calculation, whichever is higher. These figures are floors, not ceilings.
Governance Requirements
Decision 4/R.M/2026 sets a structured governance model. Licensed firms must appoint six defined senior roles:
- Chief Executive Officer (CEO) — must reside in UAE
- Senior Executive Officer (SEO)
- Compliance Officer — must reside in UAE
- Money Laundering Reporting Officer (MLRO) — must reside in UAE
- Finance Director
- Internal Auditor
Prohibited Assets
Privacy tokens
any asset using obfuscation technology (e.g. Monero, Zcash)
Algorithmic stablecoins
tokens without 1:1 fiat reserve backing
Fiat-backed tokens
must prove 1:1 backing with high-quality liquid reserves, subject to monthly CMA audits
CMA-VARA Mutual Recognition
In August 2025, the CMA and VARA signed a cooperation agreement establishing:
- Mutual recognition of VASP licences issued by either authority
- Joint application review processes
- Coordinated compliance monitoring
- Shared enforcement framework
What We Do for You
- Activity classificationEight categories, each with different capital, governance, and compliance obligations. Correct classification from day one prevents costly restructuring.
- Capital structuringAED 500K to 4M+ depending on category. We advise on optimal capital structure and liquidity buffer requirements.
- Governance designSix mandatory senior roles, UAE residency requirements for CEO/CO/MLRO. We structure and onboard your governance team.
- Full application managementCMA licensing process: 3–6 months, longer for Platform and Dealer categories.
- AML/CTF frameworkCMA requires robust AML/CTF controls as a foundational licensing requirement, not a supplementary obligation.
- CMA-VARA alignmentFor firms holding or pursuing both licences, we manage the alignment of governance and compliance frameworks across both regulators.
Frequently Asked Questions
VARA remains the primary regulator for Dubai-based firms. The CMA-VARA mutual recognition agreement (August 2025) aims to reduce duplication, but the practical implementation is still developing. We assess your specific situation and advise on whether CMA licensing is required in addition to your VARA authorisation.
Decision 4/R.M/2026 replaced the 2023 framework entirely. The Business Regulation and ATS Modules have a one-year compliance window ending 13 February 2027. We manage the transition gap analysis and migration for existing licence holders.
The CMA has 45 working days to decide on preliminary approval. After preliminary approval is granted, applicants have six months to fulfil all requirements and submit the full licence application. Total process including preparation: typically 4–8 months. Platform and Dealer categories take longer due to systemic risk assessment.
Yes. Foreign ownership is permitted. A UAE-incorporated entity is required as the licensed operating vehicle.
Related
Start Your CMA VASP Licensing Process
By submitting this form, I acknowledge that I have read and agree to the Privacy Policy, and I consent to the processing of my personal data.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.