Regulatory Updates
Firms holding an SCA license now fall under the Capital Market Authority (CMA), which replaced the SCA on 1 January 2026. The statutory adjustment period runs to 1 January 2027, unless extended by the CMA’s Board.
With approximately three months remaining as of 30 September 2026, the immediate question is what this means for existing permissions, pending applications and planned business changes.
The transition requires firms to establish how the applicable framework affects their operations. A useful assessment identifies which arrangements remain appropriate, which need revision and which questions require regulatory clarification before the deadline.
Federal Decree-Law No. 32 of 2025 establishes the CMA as the SCA’s legal successor, including its rights, obligations and contracts. References to the SCA in legislation are replaced with references to the CMA.
| Area | Previous Framework | Current Framework |
|---|---|---|
| Authority | Securities and Commodities Authority (SCA) | Capital Market Authority (CMA) |
| Principal legislation | Federal Law No. 4 of 2000 | Federal Decree-Laws No. 32 and No. 33 of 2025 |
| Legal status | Former authority and foundational law | CMA succeeds SCA; Federal Law No. 4 of 2000 is repealed |
| Replacement effective date | Framework preceding the transition | 1 January 2026 |
The replacement and repeal are provided for in Decree-Law No. 32; Decree-Law No. 33 governs capital market regulation.
For existing firms, the practical issue is the relationship between their license and their present operating model. That relationship deserves particular attention where the business has evolved since its original application.
New products, client segments, distribution arrangements or delivery channels may introduce questions that the initial licensing assessment did not address.
The legal succession provision does not, by itself, establish a blanket requirement for every existing license holder to submit a fresh application.
The position of an individual firm needs to be assessed against its license, conditions, applicable decisions and regulatory correspondence.
Three situations require different assessments:
| Firm's Position | Question to Resolve |
|---|---|
| Continuing existing activities | Do current operations remain aligned with the firm's permissions and applicable obligations? |
| Changing or expanding activities | Does the proposed change require additional authorization or regulatory engagement? |
| Application already underway | What requirements and outstanding conditions apply at the current submission stage? |
For example, a brokerage planning to add portfolio management needs to assess the proposed service separately from its existing business. Its present authorization should be examined before conclusions are drawn about the additional activity.
A similar review is relevant where a group changes which entity markets, contracts for or delivers a service. The assessment should identify the permissions supporting each entity’s role.
The distinction between license continuity and permission scope is central: an existing authorization and a proposed business change are separate questions.
Article 82 preserves earlier Cabinet and Authority resolutions insofar as they do not conflict with the new law, pending implementing resolutions.
An assessment therefore needs to connect existing arrangements to their current regulatory basis.
For each material obligation, a regulatory register can record:
A previously accepted policy or submission remains useful evidence. Its underlying references still need to be checked against subsequent decisions and the current framework.
Recording the source and interpretation of each requirement also makes unresolved questions more precise. It allows the firm to distinguish a confirmed obligation from an assumption requiring clarification.
The following table provides a practical structure for assessing permissions, operational arrangements and planned changes. It is an analytical checklist, rather than a universal list of new statutory obligations.
| Review Area | Question to Resolve | Evidence to Examine | Assessment Output |
|---|---|---|---|
| Licensed activities | Do permissions match the services being delivered? | License, conditions and correspondence | Activity-to-permission map |
| Expansion plans | What regulatory action does the proposed change require? | Product scope, business plan and target clients | Authorization assessment |
| Governance | Are oversight and responsibilities clearly assigned? | Organization chart, mandates and reporting lines | Accountable owners and escalation routes |
| People and resources | Are relevant roles and resources appropriate? | Appointments, role descriptions and applicable financial requirements | Resource assessment |
| Regulatory commitments | Which conditions, submissions or commitments remain outstanding? | Correspondence and reporting calendar | Prioritized action log |
| Client communications | Do materials accurately describe the entity's permissions? | Website, agreements and marketing | Consistent authorization disclosures |
For a financial group, the activity map should distinguish the UAE entity’s permissions from capabilities held elsewhere in the group.
It should also identify the operational consequence of each unresolved issue. If a proposed product depends on permission clarification, that dependency belongs in the implementation plan.
The related guide to CMA license categories and activities for securities firms examines activity selection in greater detail.
1 January 2027 is the baseline adjustment deadline, calculated from Articles 83 and 85 of Federal Decree-Law No. 33 of 2025. The CMA’s Board may extend the period; firms should confirm any applicable extension or specific directions.
As of 30 September 2026, approximately three months remain.
A deadline assessment needs to distinguish completed work from actions awaiting information, internal decisions or regulatory responses. The following sequence makes those dependencies visible:
Sending a clarification request and resolving the underlying question are different milestones. A matter awaiting a response should remain visible as an open dependency.
That distinction gives the board a more accurate picture of the firm’s position before the deadline.
For an application already underway, the starting point is the submission record: what has been provided, what has been accepted and what remains outstanding.
The CMA’s published financial activity licensing process distinguishes initial approval from the subsequent licensing stage. These are separate stages and should be reflected accurately in application reporting.
The review should cover:
A pending application should not be assumed to require a restart solely because the regulator has changed. Equally, its continued suitability needs to be established against the requirements applicable to that application.
An accurate status report identifies the stage reached, unresolved issues and next submission or decision required.
A new application begins with a defined operating model.
The CMA’s published requirements address financial eligibility, competence and integrity, business plans and resources, management suitability, capital or guarantees, legal form and accredited roles. Applicable requirements depend on the proposed activity.
Four elements need to be consistent across the application:
These elements connect the proposed permissions to the business that will actually operate.
Where different documents describe different operating models, the inconsistency needs to be resolved before submission. An overview of CMA licensing in the UAE provides context on the securities activities relevant to this assessment.
Article 2 can capture firms targeting UAE clients from abroad or a financial free zone where the activity falls within the law and relevant legislation. It also contains financial-free-zone and Central Bank exclusions.
DIFC, ADGM and overseas firms therefore need to assess intended mainland client activity alongside their existing authorization.
For an international group, the analysis should trace the service arrangement:
The incorporation address alone does not resolve those questions. The assessment needs to reflect the actual client relationship, services and entity responsibilities.
Within the applicable statutory scope, Article 39 addresses Virtual Asset trading, CMA registration and admission to a CMA-licensed platform’s official list, without prejudice to Central Bank law.
The CMA also announced a dedicated Virtual Assets Framework covering eight regulated activities and five modules, including conduct, prudential and AML/CFT requirements.
A securities firm considering Virtual Asset services needs a separate assessment of the proposed activity. Existing securities permissions should not be assumed to settle the authorization question.
The related CMA Virtual Assets Framework guide examines that regime. Any framework-specific transition period should be checked independently of the general January 2027 adjustment date.
Teams building in this space can see how KOLL supports Web3 and DeFi firms and tokenization and real-world asset issuers. For a recent example of how platform rules and VARA permissions interact, read our guide to the Binance P2P UAE AED merchant rules.
Article 71 covers unlicensed regulated activity and provides imprisonment of at least one year, fines of AED 50,000 to AED 250 million, or either penalty.
These are statutory penalties for specified offences, rather than the automatic consequence of every documentation gap.
The distinction matters when assessing an issue. An incomplete internal record, an unresolved interpretation and activity conducted without the required authorization should not be described as interchangeable circumstances.
Material permission questions need to be resolved before implementing the affected activity. Where the regulatory position remains uncertain, that uncertainty should be recorded in the relevant management decision.
The legacy Category 5 label relates to arranging and advisory permissions, which may include introduction or financial advisory services depending on the license.
The CMA’s register warns that a Category 5 license does not authorize the trading, portfolio management or order-execution activities identified in its notice concerning derivatives, unregulated commodity contracts and spot FX. The entity’s specific permissions should be checked rather than relying on its category label. Firms active in this area can see how KOLL supports FX and forex businesses.
The CMA’s Licensed Companies register is the official starting point for verifying an entity’s authorization. Compare its recorded activities with the service being offered.
A group brand or license held by another entity should not replace verification of the contracting entity.
Use the official register and compare the legal entity, license details and authorized activities with the firm’s documents. Review relevant regulatory warnings and seek clarification where information is inconsistent or incomplete.
Start with the license, conditions and latest regulatory correspondence. Map actual and proposed activities against that evidence, then identify required actions and unresolved questions.
A documented regulatory position, a prioritized gap assessment and an execution plan showing owners, resources and dependencies.
By the end of the assessment, leadership should have a clear record of the permissions supporting current operations, changes requiring action and questions awaiting regulatory clarification.
The most useful output is a decision record connecting each conclusion to its evidence. This gives the board a basis for monitoring completion and evaluating any affected business plans before the adjustment deadline.
To discuss your firm’s position, speak with a CMA licensing expert. Contact KOLL — UAE Licensing & Compliance Advisory
