UAE CMA Crypto Licence: The 1 January 2027 Deadline for Onshore Virtual Asset Firms
By Harry Khan, Founder · Published 2 November 2026 · Last reviewed 2 November 2026
WhatsApp and Telegram +44 7563 115980
[email protected]
The UAE rebuilt its federal financial markets law at the start of 2026. Federal Decree-Law No. 32 of 2025 reconstituted the federal regulator as the Capital Market Authority, and Federal Decree-Law No. 33 of 2025 on the regulation of the capital market set the activities it licenses. Both took effect on 1 January 2026. Article 83 of Decree-Law No. 33 gives every entity and person within its scope one year from that date to adjust their status. The year ends on 1 January 2027.
Virtual assets are inside the new federal perimeter. A firm that deals in, exchanges, holds or advises on virtual assets for clients in the UAE, outside the financial free zones and outside the Central Bank's remit, needs a CMA licence once the period ends. Many firms serving the UAE today rely on a VARA licence in Dubai, a licence in a free zone, or nothing at all. Each of those positions needs checking against the federal law before the new year.
Article 2 of Decree-Law No. 33 sets the scope. It covers financial activities carried on in the UAE and, in Article 2(1)(d), any person targeting clients within the State, even if the activity is conducted outside it. A foreign exchange that markets to UAE residents is therefore within reach of the law without having an office in the country.
Article 2(4) sets three exclusions that matter for virtual asset firms:
Ordinary commercial free zones are not financial free zones. A virtual asset business set up in a non-financial free zone and serving UAE clients is within the federal perimeter.
The UAE now has five regulators that can touch a virtual asset or payment business. The table shows where each activity usually sits; the answer for a given firm depends on where it is established, where its clients are and what it does.
| Activity or location | Usual regulator | Point to check |
|---|---|---|
| Virtual asset services onshore in the UAE, outside Dubai's VARA regime | Capital Market Authority | Adjust status by 1 January 2027 under Article 83 |
| Virtual asset services in or from Dubai, outside the DIFC | VARA | Clients in other emirates or new activities may bring CMA scope |
| Virtual asset services in the DIFC | DFSA | Excluded from Decree-Law No. 33 as a financial free zone |
| Virtual asset services in ADGM | ADGM FSRA | Excluded from Decree-Law No. 33 as a financial free zone |
| Payment services, stored value and payment tokens | Central Bank of the UAE | Excluded from Decree-Law No. 33 when Central Bank licensed |
| Foreign firm targeting UAE clients | Capital Market Authority | Article 2(1)(d) reaches activity conducted outside the UAE |
Commentary on the new law says the CMA regime does not replace VARA and that the two are meant to run side by side. A firm licensed by VARA whose business stays within Dubai generally stays with VARA. A VARA licensee that serves clients across the other emirates, or adds activities outside its VARA licence, needs a case by case analysis of the federal perimeter. Our guide to payment and crypto licences in Dubai and the UAE covers the VARA, DFSA, ADGM and Central Bank routes in detail, and the VARA licence page sets out that application.
Stablecoins used for payments sit with the Central Bank of the UAE, not the CMA. The Central Bank's Payment Token Services Regulation, in force since 31 August 2024, licenses the issue of dirham payment tokens and the conversion, custody and transfer of payment tokens. Because Article 2(4) of Decree-Law No. 33 excludes activities licensed by the Central Bank, a payment token business licensed there does not also need a CMA licence for that activity.
The boundary matters for platforms. An exchange that lists payment tokens alongside other virtual assets is a CMA matter for the trading activity, while the issuer of a dirham token is a Central Bank matter. A firm that does both needs to show each regulator where one activity ends and the other begins. Our comparison of stablecoin licences by country sets out the Central Bank's capital and redemption rules for token issuers.
Article 39(2) provides that trading in any virtual asset within the State is prohibited unless the asset is admitted. Admission means listing on a virtual asset platform licensed by the CMA and registration with the CMA. The rule applies subject to the Central Bank law, which keeps its own regime for payment tokens.
Two consequences follow. A platform serving onshore clients needs a CMA licence and must run a listing process that meets the CMA's admission rules. And an issuer or project that wants its token traded onshore depends on that platform's admission and the CMA's registration, not on a listing abroad.
The CMA set out the detailed virtual asset rules in Decision No. 4/R.M/2026, issued in April 2026. Published summaries of the decision describe:
| Area | What summaries of the decision report |
|---|---|
| Activities | Eight licensable virtual asset activities, including dealing as principal or agent, custody, operating a trading facility, portfolio management and advice |
| Financial resources | Minimum capital by activity and liquid resources equal to six months of operating costs |
| People | Key positions, including senior management, compliance and AML, held by people resident in the UAE |
| Governance | Defined roles for executive management, compliance, AML oversight, finance and internal audit |
| Assets | Systems for listing and registering virtual assets; restrictions on privacy tokens and algorithmic tokens |
These points come from law firm and adviser summaries rather than the decision's text, and summaries differ on detail. Capital figures in particular should be taken from the CMA's rulebook before a business plan is fixed. We confirm each requirement against the CMA's own text when we prepare an application.
The federal timetable runs alongside VARA's own rulebook changes and the Central Bank's payment token rules.
| Date | What happens |
|---|---|
| 31 August 2024 | Central Bank Payment Token Services Regulation in force |
| 1 January 2026 | Federal Decree-Laws No. 32 and No. 33 of 2025 in force; the CMA takes over from the Securities and Commodities Authority |
| April 2026 | CMA Decision No. 4/R.M/2026 sets the virtual asset rules |
| 1 January 2027 | End of the Article 83 period for firms in scope to adjust their status |
| 13 February 2027 | Reported end of a compliance window for two modules of the CMA decision, not yet confirmed on the CMA's rulebook |
A firm that needs a CMA licence and has not started should count back from 1 January 2027: a business plan, financial model, resident staffing plan and AML programme take several weeks to prepare even before the CMA reviews them.
Article 71 of Decree-Law No. 33 makes it an offence to engage in or practise any financial activity subject to the law without a licence, approval, registration or accreditation from the CMA. The penalty is imprisonment of at least one year and a fine of AED 50,000 to AED 250 million, or either of them.
Article 83 does not create a general safe harbour. It gives firms a year to adjust their status; after 1 January 2027, a firm in scope that has not done so is carrying on an unlicensed activity. The practical exposure also includes banks and payment partners, which will ask for evidence of the firm's regulatory position before continuing to serve it.
Article 83 lets the CMA's board extend the one year period as it deems appropriate. By 2 November 2026 no general extension had been announced. Some law firm commentary also refers to a separate compliance window to 13 February 2027 for two modules of Decision No. 4/R.M/2026; sources disagree on its scope and it should be confirmed on the CMA's rulebook before anyone relies on it.
The safer plan treats 1 January 2027 as the date by which a firm in scope has either applied, stopped onshore activity or obtained a written view from the CMA on its position.
We map each client's UAE activities against the CMA, VARA, DFSA, FSRA and Central Bank perimeters, then prepare the application for the regulator that applies: business plan, financial resources model, governance and staffing plan, AML programme and token listing policy. For groups that need more than one UAE licence, we keep the files consistent so that each regulator sees the same ownership, systems and controls. Our UAE payment licence and DFSA licence pages cover the neighbouring routes.
The Capital Market Authority, the federal financial markets regulator reconstituted under Federal Decree-Law No. 32 of 2025. It replaced the Securities and Commodities Authority and licenses financial activities, including virtual asset services, under Decree-Law No. 33 of 2025.
Article 83 of Decree-Law No. 33 of 2025 gives firms in scope one year from 1 January 2026 to adjust their status, so by 1 January 2027. The CMA's board may extend the period.
Not automatically. A VARA licensee whose business stays within Dubai generally stays with VARA, but serving clients in other emirates or adding activities can bring a firm within the federal perimeter. Each case needs its own analysis.
No. Article 2(4) excludes the financial free zones, so firms regulated by the DFSA in the DIFC or the FSRA in ADGM stay with those regulators for activity carried on there.
Yes, where they target clients in the UAE. Article 2(1)(d) applies the law to any person targeting clients within the State, even if the activity is conducted outside it.
Under Article 71, imprisonment of at least one year and a fine of AED 50,000 to AED 250 million, or either penalty.
No. Article 39(2) prohibits trading a virtual asset in the UAE unless it is admitted, meaning listed on a CMA licensed platform and registered with the CMA.
Buckingham Capital Consulting has handled payments, e-money and cryptoasset licensing since 2013, obtaining authorisations for firms including Nexpay, Orbital, Dzing Finance and Hryze. The firm prepares UAE licence applications to the Capital Market Authority, VARA, the DFSA, the ADGM FSRA and the Central Bank, starting from a perimeter map of each client's activities and clients by emirate.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.