Regulator's Profile — CMA (UAE)
CMA is the federal regulator of virtual assets outside financial free zones (ADGM & DIFC): what requires a CMA VASP licence, capital thresholds (incl. AED 30m Dealer), platform & custody standards, AML expectations, and how firms secure authorisation.
End-to-End Delivery
- Licensing scope analysis
- Capital planning (incl. 6-month OPEX)
- Prudential governance frameworks
- AML/Travel Rule controls
- Custody architecture advisory
- Full CMA file management
WHO THE CMA IS
The Capital Market Authority (CMA) is the federal regulator of securities and virtual asset activities in the United Arab Emirates (outside financial free zones such as DIFC and ADGM).
Under the federal virtual assets framework (including Cabinet Resolution No. 111 of 2022 and related implementing decisions), the CMA regulates:
- Virtual Asset Service Providers (VASPs)
- Virtual asset platforms (exchanges)
- Virtual asset custody
- Brokerage and dealing activities
- Portfolio management of virtual assets
- Advisory services in virtual assets
A person may not carry on a regulated virtual asset activity in the UAE (outside financial free zones) without CMA authorisation.
INSTRUMENTS THE CMA USES
|
The CMA framework is capital-intensive and prudentially structured, licensing tiers correspond directly to operational and balance sheet risk. |
SCOPE & WHAT’S COVERED (INCL. CRYPTO)
To carry on a Virtual Asset Service Provider (VASP) activity in the UAE (outside financial free zones), firms must obtain a CMA licence specifying:
- The regulated activity;
- The capital requirement;
- Whether 6-month OPEX coverage applies;
- Any additional prudential conditions.
CMA-regulated virtual asset activities include:
Virtual Asset Dealer (Principal)
Managing Portfolio of Virtual Assets
Financial Consulting in Virtual Assets
Virtual Asset Platform Operation
Safe Custody of Virtual Assets
Virtual Asset Broker (Agency)
THE VIRTUAL ASSET LICENSING TIERS — CAPITAL MATTERS
The CMA framework is structured by capital intensity:
| Activity | Minimum Capital (AED) | Notes |
|---|---|---|
|
Financial Consulting |
500,000 |
Advisory only; no execution |
|
Virtual Asset Broker |
2,000,000 |
Agency execution only |
|
Portfolio Management |
3,000,000 |
Discretionary management |
|
Platform Operator (Standalone) |
1,000,000 + 6-month OPEX |
Exchange/MTF equivalent |
|
Safe Custody |
4,000,000 + 6-month OPEX |
Wallet & key control |
|
Platform + Other Activities |
5,000,000 + 6-month OPEX |
Combined model |
|
Virtual Asset Dealer |
30,000,000 |
Principal trading; market-making |
|
Key distinction:
|
LICENSING IN THE UAE (ONSHORE): HOW FIRMS GET AUTHORISED
Typical pathway:
1
Confirm regulatory classification
2
Conduct capital & prudential assessment
3
Prepare regulatory business plan (RBP)
4
Prepare governance & AML frameworks
5
Submit full application dossier
6
Respond to CMA clarifications
7
Capital confirmation & incorporation
8
Final approval & licence issuance
Capital must be fully paid-up and unencumbered prior to licence grant.
CONDUCT, PRUDENTIAL & TECHNOLOGY — WHAT “GOOD” LOOKS LIKE
Prudential Standards
- Capital Coverage Ratio ≥ 1.25 (internal buffer)
- 6-month OPEX maintained where required
- Quarterly stress testing
- Board-level capital oversight
Conduct Expectations
- Clear and fair client communications
- Client classification framework
- Suitability (where portfolio management applies)
- Transparent fee disclosure
- Conflict of interest controls
Technology & Custody Controls
- Segregated wallet architecture
- Private key lifecycle governance
- Multi-signature controls
- Daily reconciliation
- Incident reporting protocols
- Business continuity & disaster recovery testing
AML, TRAVEL RULE & FINANCIAL CRIME CONTROLS
CMA-supervised VASPs must implement:
AML expectations align with UAE federal AML law and FATF standards.
WHAT THE CMA RESTRICTS OR PROHIBITS
The CMA framework prohibits or restricts:
- Unlicensed custody of client assets
- Principal trading without Dealer licence
- Activities outside approved scope
- Commingling of client and company assets
- Regulatory capital encumbrance
- Marketing beyond licensed activity
|
Dealer classification is heavily scrutinised due to systemic risk implications. |
SUPERVISION & INSPECTIONS
CMA supervises through:
Periodic reporting
Capital adequacy review
AML monitoring
On-site inspections
Thematic reviews
Administrative penalty regime
Material events (e.g., capital deterioration, cyber incidents, breaches) must be escalated promptly.
QUICK FACTS
CMA regulates virtual assets across the UAE (outside financial free zones).
The dealer licence requires AED 30 million capital.
Platform and Custody require 6-month OPEX coverage.
Capital must be fully paid-up and unencumbered.
No principal trading without Dealer licence.
Client assets must be segregated at all times.
What CRYPTOVERSE Legal Delivers
Regulatory perimeter analysis (Broker vs Dealer vs Platform structuring).
Capital planning & prudential modelling (incl. 6-month OPEX and stress testing).
Regulatory Business Plan drafting.
AML/Travel Rule framework implementation.
Custody & wallet governance architecture advisory.
Board governance & capital commitment documentation.
Full CMA file management through licence issuance.
FAQs
Yes, carrying on a regulated virtual asset activity outside financial free zones requires CMA authorisation.
Broker acts as agent (AED 2m). Dealer trades as principal (AED 30m).
No, custody requires separate licensing and capital.
Yes, certain activities (e.g., platform, custody) require 6-month OPEX maintenance.