Capital Market Authority — formerly the Securities & Commodities Authority (SCA)
Reach the onshore UAE market, under the new CMA, formerly the SCA.
In January 2026 the SCA became the Capital Market Authority — a wider federal remit, tougher supervision, and the one licence that opens ADX, DFM and the national investor base. We place your business in the right activity category and carry the application through the CMA's new framework, so the reform works for you instead of against you.
Confidential & non-binding · Same-day response in UAE hours
Speak With a CMA Licensing Expert
ACTIVITIES
Activities define the category — the category sets the capital.
The CMA — the Capital Market Authority, successor to the SCA since 1 January 2026 — is the UAE's federal regulator of securities and commodities activity across the onshore market, outside the DIFC and ADGM free zones.
It doesn't licence by label; the activities you carry out determine which of five financial-activity categories you fall into, and the heavier the activity, the heavier the capital and scrutiny. Picking the right category, then evidencing the controls behind it, is where most applications succeed or fail.
Dealing as Principal
Trading securities and commodities on the firm's own account and market-making — the top-tier permission.
Dealing as Agent
Executing and arranging trades for clients on ADX, DFM and Nasdaq Dubai, on a discretionary or advisory basis.
Management & Investment
Managing portfolios and collective investment funds on a discretionary or advisory basis for clients.
Custody, Clearing & Registration
Safekeeping and administration of financial instruments, with clearing and registry services.
Arranging & Advisory
Financial consultancy, investment advice, issuance & listing advisory and findings — no client money held. The most popular entry point.
Virtual Assets & Tokenised Instruments
Security and asset-backed tokens, exchange and custody services — layered on the core category that best matches your model, with proof-of-reserves and technology-governance obligations.
MARKET
You'd be licensed for the UAE's onshore capital markets.
The CMA is the UAE's federal capital-markets regulator, overseeing the Abu Dhabi Securities Exchange (ADX), the Dubai Financial Market (DFM) and Nasdaq Dubai, and every broker, dealer, fund and market intermediary operating onshore. Its 2026 reconstitution from the SCA came with an expanded mandate — covering virtual assets, ESG products and market infrastructure — and broader supervisory and enforcement powers. This is the licence that opens the full onshore UAE market and its national investor base.
WHY ONSHORE
Free zone or onshore? This is the door to the national market.
The UAE has federal and free-zone regulators, and the right choice depends on who you serve and where. The DFSA (DIFC) and ADGM's FSRA are common-law free-zone regulators; VARA covers Dubai's virtual assets. But if you need the onshore UAE market — ADX, DFM and retail and institutional clients nationwide — the CMA is the regulator that gives it to you. Here's how it sits against the alternatives.
CAPITAL
Capital is set by your activity — and held on an ongoing basis.
The CMA sets minimum paid-up capital by activity category, then requires you to hold it — plus risk-based and liquidity resources — on an ongoing basis, not just at filing. Client-money and client-asset activities carry the heaviest requirements; arranging and advice the lightest. Select a category to see the layers.
*Capital requirements are set by activity category. We confirm the figures applicable to your specific activities against the CMA's current published framework during scoping.
PROCESS
The CMA route front-loads the scrutiny.
CMA authorisation runs in two stages: you earn initial approval before you build and deposit capital, then satisfy the conditions to get the final licence — so problems surface early, not after you've committed.
Perimeter
We confirm your activities fall within the CMA's remit and map them to the correct financial-activity category before a dirham is spent.
Plan & Application
Submit the business plan, financial projections, AML/CFT and risk frameworks, and fit-and-proper questionnaires for shareholders and approved persons.
Initial Approval
The CMA reviews the file, holds meetings, and issues In-Principle approval setting the conditions you must satisfy. No financial services yet.
Build-out
Incorporate onshore in the UAE, secure a physical office, put systems and controls in place, make key hires, and deposit the required paid-up capital.
Review
The CMA confirms your approved persons, controls and capital are genuinely in place, and every condition has been met.
Licence
Final Authorisation is issued for your category and permitted activities — and your live supervisory obligations begin.
You're authorised to operate — live supervisory obligations begin from day one.
Most applicants lose months in Stage 2 — underestimating the systems, controls and approved-person evidence the CMA expects to see genuinely in place. Preparing that package properly, the first time, is the core of what we do.
The four things the CMA pushes back on most — and the four we harden before you file.
Boards and approved persons without genuine financial-services track record.
Evidence that doesn't cleanly meet base capital, the risk-based figure and liquidity together.
Off-the-shelf policies not tailored to your specific category and risk profile.
Infrastructure and controls below the CMA's technology and resilience expectations.
WHAT IT TAKES
What a CMA licence actually asks of you.
The category sets your capital. But authorisation turns on a wider set of requirements — the ones applicants most often underestimate. Here's the full checklist, in the CMA's own terms.
Legal entity in the UAE
A UAE-incorporated company — mainland, or a recognised free-zone entity where the free-zone law permits — holding a commercial licence. Financial activities must be carried on onshore under the CMA's remit.
Capital, held the right way
The paid-up capital for your category, plus risk-based and liquidity resources held on an ongoing basis. Client-money and client-asset activities carry the heaviest floors; figures are confirmed per activity in scope.
Approved persons
Fit-and-proper approved persons — a general manager resident in the UAE, plus a Compliance Officer and MLRO. A CISO and dedicated finance function are expected for tech-intensive and client-asset firms.
Physical office in the UAE
Genuine local substance is expected: a real UAE office, secured as part of satisfying your initial-approval conditions — not a flexi-desk afterthought.
Fit & Proper test
Shareholders, directors and approved persons must pass the CMA's fit-and-proper assessment — competence, experience, financial soundness and integrity. The CMA screens the people, not just the paperwork.
Governance, systems & controls
An adequate governance framework, clear division of responsibility, conflicts-of-interest management and internal controls proportionate to your scale and complexity — evidenced, not asserted.
AML/CFT & conduct
Compliance with UAE federal AML/CFT law and the CMA's market-conduct rules: AML/CFT procedures, the FATF Travel Rule, sanctions screening, client-money and client-asset segregation, and — for virtual assets — proof-of-reserves.
Technology & cyber resilience
The CMA expects technology risk, resilience and cyber controls proportionate to your business — penetration testing, business-continuity and incident-response — with professional indemnity and other insurance on top.
THE KOLL GROUP DIFFERENCE
Most advisors stop at the application. We don't.
Getting the licence is one thing. Staying licensed — with compliance that holds up to supervision and security that holds up to attack — is another. We're the only Dubai advisor that carries all three in-house.
End-to-end application handling
We don't coach from the sidelines. We run the whole file — category selection, entity structuring, the full application and every round of regulator questions — through to authorisation.
VerifiX — our RegTech
Client-money reconciliation, market-conduct monitoring and regulatory reporting on our own platform — so the controls you're approved on are the controls you actually run.
ITSEC — security assurance
Trading systems and client-asset custody live or die on security. Our sister firm ITSEC delivers the penetration testing, cyber controls and audit evidence in-house.
Three disciplines competitors outsource to three vendors. With KOLL Group it's one engagement, one accountable team — advisory, RegTech and cybersecurity under one roof.
END TO END
From perimeter analysis to authorisation.
CMA authorisation runs in two stages — initial approval before capital and controls are deployed, then final authorisation once every condition has been verified.
Scope & category
We map your business to the correct CMA category and confirm what is — and isn't — in scope before you commit capital or time.
Application, policies & live obligations
We prepare the business plan, AML/CFT policy pack and approved-person documentation, defend it through review — then keep you compliant after authorisation: AML, KYC, governance, reporting and audit.
Cybersecurity built in, not bolted on
The CMA expects technology risk and cyber resilience proportionate to your business. As part of ITSEC, we bring penetration testing, CISO and incident-response into the application from day one — where others outsource it later.
LIGHTER ENTRY
Not every model needs a full category licence.
Two routes sit outside the full category framework — lighter registration for narrower activities, worth checking before you scope a full application.
Referring clients to a licensed CMA firm without executing trades, advising or holding client money — a materially lighter registration than a full dealing category.
Providing investment advice on a non-discretionary basis, tied to a single principal firm — a narrower permission than independent discretionary management.
STAYING LICENSED
A licence is the start of an obligation.
Authorisation isn't the finish line — it's the start of ongoing supervision. Here's what continues after your licence is issued.
- Ongoing capital & liquidity monitoring
- Periodic regulatory reporting
- AML/CFT and conduct-of-business supervision
- Client-money and client-asset audits
Refusals, conditions and enforcement decisions can be challenged through the CMA's internal grievance process, and beyond that through the UAE courts. We prepare the file and represent your case at every stage.
Where KOLL takes it from here
Licensing is one part of the engagement. We also handle regulatory and compliance advisory across the application, RegTech implementation for KYC, transaction monitoring and reporting, cybersecurity assurance for licensed firms, and ongoing compliance after your licence.
FAQ
CMA licensing questions.
Which CMA category do I need?
Brokerage, advisory, fund management, custody, market-making and related securities and commodities activities. We confirm your category up front.
Is there a minimum capital requirement?
Capital requirements vary by activity. We size them against your model as part of the structuring work before you apply.
What is the difference between the CMA and the SCA?
The CMA is the SCA's direct successor — reconstituted as the federal capital-markets regulator on 1 January 2026 with an expanded mandate covering virtual assets, ESG products and market infrastructure. Existing SCA licences carried over automatically, with no re-application required.
What happens after approval?
Conduct, reporting and AML obligations begin. We stay on as your compliance partner so nothing slips after go-live.
Does the CMA regulate virtual assets?
Yes — since its 2026 expansion, the CMA's mandate covers virtual-asset and tokenised-instrument activity onshore, layered on top of the core category that best matches the underlying model, with proof-of-reserves and technology-governance obligations attached.
How long does CMA authorisation take?
Typically 6–12 months end to end — in-principle approval first, once your application, capital and controls are in order, then final authorisation once build-out is verified and every condition is met.
THE FULL PICTURE
Six UAE regulators. One framework.
Every regulated business in the UAE fits under one of these six regimes. Here's the full picture, and where CMA sits within it.
Federal regulator for securities, commodities and onshore capital markets.
The world's first dedicated virtual-asset regulator, covering all of Dubai.
Read the guide →Financial services in the DIFC — common-law, institution-facing, firm-led crypto.
Read the guide →Abu Dhabi's common-law free zone with a pioneering virtual-asset framework.
Read the guide →Banking, payments, e-money and exchange — the Central Bank of the UAE.
Read the guide →GO FURTHER
Beyond a single licence.
Some models span more than one framework, or need support that goes beyond the licence itself.
If your CMA activity carries a virtual-asset or tokenised-instrument component, VARA may also come into scope. We map both frameworks together.
Explore virtual assets →Advisory, RegTech and cybersecurity in one engagement — the same team that built your licence keeps you compliant after.
See the ecosystem →Building trust in a regulated market
Map your CMA licence in one conversation.
Tell us your goals. In one confidential call we'll confirm the activities you need, the right structure, a realistic timeline and the exact next steps.