UAE CMA Crypto Framework: What the 1 January 2027 Regularisation Date Means

What Changed When the SCA Became the CMA?

Something big happened to UAE capital-markets law on 1 January 2026. A new regulator took over from an old one, two federal decree-laws came into force, and virtual assets ended up inside the federal perimeter. Anyone following UAE CMA crypto regulation has probably noticed the catch. It isn't rebranding, and it doesn't wipe out Dubai's own regime. Instead, a second layer now sits beside VARA, with a date attached: 1 January 2027. Plenty of firms haven't marked it in the diary yet. Below, we look at what that date covers, who is exposed and how to get ready without panic.

Federal Decree-Laws No. 32 and No. 33 of 2025

The reform rests on two instruments, both in force since 1 January 2026. Federal Decree-Law No. 32 of 2025 reconstituted the Securities and Commodities Authority (SCA) as the Capital Market Authority, and Federal Decree-Law No. 33 of 2025 contains substantive rules on financial activities, products and enforcement. The CMA's mandate is now wider, with resolution powers over systemically important firms and fines of up to AED 200 million, so the SCA to CMA transition UAE law introduces is not a matter of letterhead. One practical point follows: older Cabinet decisions plus SCA resolutions survive only where they don't clash with new laws, though only until replacements arrive.

Virtual Assets within the Federal Regulatory Framework

Decree-Law No. 33 lists virtual assets for investment purposes among regulated financial products, empowering the CMA to regulate their trading along with related activities and services. Article 39 bars trading of any virtual asset in this country unless it sits on an official list run by a licensed platform approved by the CMA, and unless it has been registered with that regulator. Implementing rules followed in April 2026 via CMA Decision No. 4/R.M/2026, also cited as Resolution No. 04/Chairman of 2026, which replaced earlier SCA arrangements for virtual asset service providers. The resulting UAE CMA virtual asset framework is activity-based. It licenses eight activities on a standalone basis, including dealing as principal or agent, custody, operating a multilateral trading facility, portfolio management and investment advice.

How Does the CMA Framework Interact with VARA?

VARA’s Role in Dubai outside the DIFC

VARA covers virtual asset activity in or from Dubai; the Dubai International Financial Centre sits outside its remit. A firm needs VARA's licence before it starts. Operating first and applying later isn't an option. Applications run in two stages, an Approval to Incorporate first, then full licensing, and they go through Dubai Economy and Tourism or a Dubai free zone.

Commentary on federal rules agrees on one point: VARA stays the competent regulator for Dubai-established businesses. 

Federal CMA Requirements and Their Applicability

Is it CMA vs VARA? Wrong question. One rulebook is federal, reaching across UAE territory; the other belongs to a single emirate. Law-firm analyses describe the federal regime as a baseline for onshore activity, sitting alongside emirate regimes instead of cancelling them.

How both behave together in daily supervision of Dubai-based firms is still taking shape.

What is clear is that UAE Capital Market Authority crypto regulations ask for more substance than before: published summaries mention higher minimum capital, liquid resources equal to six months of operating costs, plus key positions held by UAE residents.

Financial Free Zones and Central Bank Jurisdiction

Two boundaries limit the CMA's reach. Decree-Law No. 33 does not apply to financial free zones, so the DIFC and ADGM keep their own regulators, while ordinary free zones fall within the federal perimeter. Financial activities licensed by the Central Bank are excluded too, apart from securities issuance and activities listed in Article 3, and the asset definition leaves payment methods and value-preservation instruments with that bank. During 2026 it opened a route for licensed banks and payment providers wishing to undertake CMA-regulated virtual asset activities, although mechanics await further rules. Classification is accordingly the first question for any product blending investment with payment features.

What Does the 1 January 2027 Regularisation Date Mean?

The Legal Basis in Articles 83 and 85

Article 85 of Decree-Law No. 33 sets 1 January 2026 as its effective date. Under Article 83, every entity or individual within its scope has one year from that day to adjust status, which leads to the CMA regularisation deadline 1 January 2027. The same article allows CMA to extend that year if it considers an extension appropriate, and it says nothing more on how. A statutory baseline of this kind binds only persons inside this law's scope.

Statutory Regularisation and Separate Transition Periods

It has been observed that the statutory date should be kept apart from timelines contained in implementing rules. According to law-firm commentary, a separate one-year compliance window, ending on 13 February 2027, is granted by Decision No. 4/R.M/2026 to its Business Regulation and Alternative Trading System modules, which means that a later date exists beside the statutory one. Regarding a single UAE crypto regularisation deadline 2027, some observers combine both dates, yet different instruments are involved and identical firms are not necessarily covered. A transition of its own was also provided by Central Bank legislation, Federal Decree-Law No. 6 of 2025, and this period ran until 16 September 2026. Lawyers always emphasize that secondary sources differ on details, therefore every date must be confirmed against published rulebooks or notices of the CMA.

Possible Extensions and Regulatory Directions

An extension is legally available, since Article 83 allows lengthening. At the time of writing, no extension of 1 January 2027 has surfaced in the material reviewed, so planning around postponement would be a gamble rather than a strategy. Should one be granted, the text does not say whether it would be general or limited to particular categories. Looking further ahead, some commentators expect the CMA rulebook to become the principal federal standard, with VARA rules drifting towards alignment; that view is analysis, not official policy.

Which Businesses Need to Review Their Regulatory Status?

Working out which UAE crypto firms need CMA licensing comes down to three questions: what a business does, which assets it handles, where it operates or whom it targets.

Entities and Individuals within the Federal Framework

Decree-Law No. 33 covers financial products dealt with in this country, financial activities carried on here or by anyone in a non-financial free zone, plus licensed persons, issuers and their connected parties. Exchanges, custodians, brokers, dealers, advisers and portfolio managers handling investment-related virtual assets are obvious candidates. Individuals are caught too: Article 3 prohibits any individual from engaging in a listed financial activity locally without a licence or approval, while Article 4 requires prior approval for natural persons performing approved functions. Businesses confined to payment instruments, or licensed by the Central Bank, should test themselves against the carve-outs described earlier.

Overseas Businesses Targeting UAE Clients

Being based abroad offers limited protection. Article 2 extends this decree-law to any person targeting clients within UAE territory, even if activity is conducted outside it or from a financial free zone, provided that activity is otherwise regulated. Practitioners read this as deliberate extraterritorial reach, advising review of cross-border marketing, solicitation, onboarding flows. An offshore exchange with a UAE-facing website, Arabic-language promotions or local sales agents deserves documented analysis.

Businesses Expanding beyond Their Existing Permissions

A licence held today settles nothing for tomorrow. Article 12 requires licensed persons to stay within their licence scope plus any attached conditions, while Article 6 demands prior CMA approval before an entity is licensed for an additional financial activity. A VARA-licensed exchange adding custody, or an ADGM-authorised firm starting to serve onshore clients, can slip into another perimeter without meaning to. Product changes matter as well. A new token, staking feature or derivative may alter how an offering is classified.

How Should Businesses Prepare for Regularisation?

Assessing Activities, Asset Types and Jurisdiction

Where does the work start? With a list. Every activity a group runs goes on it, next to the asset involved and where clients sit. Dealing in an investment-related virtual asset onshore lands with CMA, payment instruments with Central Bank, activity in or from Dubai with VARA, and anything inside DIFC or ADGM with that free zone's authority. Published summaries also report prohibitions on privacy tokens and algorithmic tokens, so each token needs its own line on that list.

Reviewing Existing Licences and Approvals

A valid licence proves less than it seems. A VARA licence answers to VARA, an FSRA authorisation to ADGM, and a mainland trade licence is an ordinary commercial permit.

None was issued under Decree-Law No. 33, so none can be assumed to satisfy it. Each document should be held against what a business really does: conditions, named activities, approved individuals, constitutional documents. One trap sits in Article 66, which lists amendments to articles of association made without CMA approval among grounds for suspension or revocation.

Identifying Compliance Gaps and Preparing an Action Plan

Business experts claim that gap analysis begins when the enterprise is measured against the main UAE CMA crypto compliance requirements, which include minimum capital, liquid resources, defined senior roles for executive management, compliance, AML/CFT oversight, finance and internal audit, key personnel resident in the UAE, and systems for listing and registering assets. An owner and a date are assigned to every shortfall that is discovered.

Practical matters outside the regulator are frequently forgotten, because a bank account must be secured for a newly licensed entity, tax advantages of the selected structure must be reviewed, and VAT/VIES registration must be settled where clients from the European Union are served. It is already clarified that licensing in the UAE commonly takes many months, so a plan started in December 2026 is unlikely to be completed by January 2027.

Frequently Asked Questions

Has the CMA Replaced VARA in Dubai?

The short answer to the question "does CMA replace VARA" is no. The CMA replaced the SCA at federal level, while VARA continues licensing virtual asset activity in or from Dubai outside the DIFC. Both regimes are designed to operate side by side.

Who Does the 1 January 2027 Regularisation Date Apply To?

Anyone subject to Decree-Law No. 33 plus related legislation, overseas businesses targeting clients here included. Financial free zones and Central Bank-licensed activities sit outside this law, subject to exceptions in Article 2.

Do All VARA Licensees Need a Separate CMA Licence?

Not automatically. A firm established in Dubai, limited to Dubai activity, generally stays with VARA; a licensee serving clients elsewhere in this country or adding new activities needs case-by-case analysis of the federal perimeter.

Does the Regularisation Period Permit Unlicensed Operations?

Article 83 describes no general safe harbour for unlicensed activity; it speaks only of adjusting status. Article 71, meanwhile, attaches imprisonment of at least one year, with fines from AED 50,000 to AED 250 million, to regulated activity without a licence. A firm's transitional position needs confirming with counsel or CMA.

Can the CMA Extend the Regularisation Period?

Yes, Article 83 allows it, and no extension has been identified at the time of writing. Official CMA announcements remain the only reliable way to learn of one.

Final thoughts

This federal reset leaves Dubai's regime where it was but adds a second set of expectations, with a date attached. How much work that means depends on scope, classification and existing permissions. Businesses weighing structure, licensing route and timing can turn to an advisory team such as icon.partners to map each activity to the right regulator well before 1 January 2027.