What founders need to know
Key Takeaways
- The CMA licenses federal onshore VASPs under Cabinet Decision No. 111 of 2022 and CMA Decision No. 4/R.M/2026 (13 February 2026), which replaced the 2023 framework.
- The CMA VASP perimeter covers federal onshore mainland business.
- The CMA and VARA have a cooperation agreement that provides for mutual recognition of VASP licences.
- The 2026 framework establishes eight licensed activity categories with minimum capital from AED 500,000 to AED 4,000,000.
- NeosLegal recommends mainland Abu Dhabi for federal entity formation in most CMA mandates, based on our practical experience.
- CMA timelines typically run 5 to 9 months for well-prepared applications.
- The CMA has extraterritorial reach: it applies to any business targeting UAE clients, even when operating from outside the country.
Regulatory Framework
The CMA Federal Regulatory Framework
The CMA (Capital Market Authority), the federal regulator that replaced the Securities and Commodities Authority (SCA) on 1 January 2026 under Federal Decree-Laws 32 and 33 of 2025, with Federal Decree-Law 33 bringing virtual assets into the federal capital-markets perimeter, is the UAE federal regulator for onshore virtual asset service providers outside Dubai’s VARA perimeter, ADGM and DIFC. Federal onshore CMA licensing is governed by Cabinet Decision No. 111 of 2022 on the Regulation of Virtual Assets and Related Service Providers, SCA Board Decision No. 26 of 2023, and CMA Decision No. 4/R.M/2026 (13 February 2026), which replaced the 2023 framework with an updated structure.
For which firms currently hold licences under each regulator, see the live UAE VASP Licence Tracker , updated monthly.
Licensed Activities
What Are the Eight CMA Activity Categories?
Under CMA Decision No. 4/R.M/2026, the CMA licenses eight virtual asset activities, defined in Article 12 of the General Framework Module, with minimum capital set in Article 21 ranging from AED 500,000 to AED 4,000,000:
- Dealing in Virtual Assets as Principal. Trading on the firm’s own account and balance sheet, bearing market risk. Covers proprietary desks and market makers. A business that advertises its readiness to buy or sell is treated as a principal dealer. Minimum capital AED 4,000,000.
- Dealing in Virtual Assets as Agent. Executing client orders as intermediary, without taking principal risk. Minimum capital AED 1,000,000.
- Providing Custody. Safeguarding client virtual assets through control of cryptographic keys or registration on a distributed ledger. Minimum capital AED 3,000,000.
- Arranging Custody. Facilitating client access to a licensed custodian without holding the assets. Minimum capital AED 1,000,000.
- Operating a Multi-Party Trading Platform. Running an automated, non-discretionary marketplace matching buy and sell orders, the CMA’s primary permitted route for crypto trading. Discretionary organised trading facilities are prohibited. Minimum capital AED 500,000.
- Providing Investment Advice. Personalised recommendations to a specific investor on a particular virtual asset. General market commentary is excluded. Minimum capital AED 1,000,000.
- Portfolio Management. Managing a client’s virtual asset holdings on a discretionary or non-discretionary basis. Minimum capital AED 1,000,000.
- Arranging Investment Transactions. Creating arrangements that let another person buy or sell a virtual asset without the arranger being party to the trade. Minimum capital AED 1,000,000.
Choose CMA for: federal onshore VASPs; tokenised securities and commodity-linked products on the federal mainland; and broker-dealers and exchanges serving the mainland UAE.
What Changed in 2026
CMA Decision No. 4/R.M/2026 took effect on 13 February 2026, replacing the entire 2023 federal VASP framework. The new framework establishes eight licensed activity categories, sets minimum capital from AED 500,000 to AED 4,000,000 by category, hard prohibitions on privacy tokens and algorithmic stablecoins, and explicit extraterritorial reach. NeosLegal tracks Decision 4/R.M/2026 implementation and advises existing licensees on the transition.
Federal Onshore Licensing
Who Needs a CMA Federal Crypto Licence?
A CMA federal VASP licence is required for businesses providing virtual asset services on federal onshore UAE territory, outside Dubai’s VARA zone and outside the financial free zones of ADGM and DIFC. Typical use-cases:
| Use-case | Activity | Minimum capital |
|---|---|---|
| Exchanges | Operating a multi-party trading platform that matches buy and sell orders. | AED 500,000 |
| Market makers | Dealing in virtual assets as principal on the firm’s own account. | AED 4,000,000 |
| Brokers and OTC desks | Dealing as agent for client order flow. | AED 1,000,000 |
| Custody providers | Providing custody and safeguarding of client assets. | AED 3,000,000 |
| Asset management and funds | Portfolio management on a discretionary or non-discretionary basis. | AED 1,000,000 |
| Investment advisers | Providing personalised investment advice on virtual assets. | AED 1,000,000 |
Regulator Comparison
CMA, VARA or ADGM: Which UAE Regulator Should You Choose for Crypto Licensing in 2026?
| CMA (Federal) | VARA (Dubai) | ADGM (FSRA) | |
|---|---|---|---|
| Legal system | UAE federal law | Dubai law plus VARA Rulebook 2.0 | English common law |
| Geographic scope | UAE federal onshore outside Dubai VARA and the financial free zones | Dubai (excluding DIFC) | ADGM financial free zone |
| Typical activity set | Federal onshore VASP | Dubai VASP activity | Institutional crypto, digital securities, FRT |
| Min. capital | AED 500,000 to 4,000,000 by category | AED 100,000 to 3,000,000 | USD 50,000 to 4,000,000 |
| Retail Dubai market access | No. Requires separate VARA authorisation or ARVA-approved distribution | Yes, direct as the Dubai regulator | Limited, professional focus |
| Extraterritorial reach | Yes (any UAE-targeting business) | Yes (any Dubai-targeting business) | Limited to ADGM activity |
| Typical timeline | 5 to 9 months | 9 to 12 months | 8 to 14 months |
| Typical Year 1 all-in cost (legal plus regulator) | AED 1,000,000 to 8,000,000+ | AED 800,000 to 3,000,000 | USD 350,000 to 900,000 |
| Best suited for | Federal onshore VASPs outside Dubai | Dubai exchanges, brokers, custodians | Institutional crypto, digital securities, FRTs |
Cost and Timeline
What Does a CMA Federal Licence Cost and How Long Does It Take?
All-in first-year cost is driven primarily by the category capital tier, which ranges from AED 500,000 to AED 4,000,000 under Article 21 of Decision No. 4/R.M/2026.
Why timeline and cost are connected
A 6-month CMA process and a 12-month CMA process do not cost the same. The difference is typically driven by pre-application preparation and senior-person readiness rather than CMA bandwidth.
CMA timeline by application readiness
| Application readiness | Time from pre-application to licence |
|---|---|
| Well-prepared | 5 to 9 months |
| Standard | 9 to 12 months |
| Poorly prepared | 12 to 18 months |
CMA federal licensing: capital and Year 1 cost by category
| Activity | Minimum capital (Article 21) | Year 1 all-in cost (excl. capital) |
|---|---|---|
| Operating a Multi-Party Trading Platform | AED 500,000 | From AED 4,500,000 |
| Dealing in Virtual Assets as Agent | AED 1,000,000 | AED 2,500,000 to 3,000,000 |
| Portfolio Management | AED 1,000,000 | From AED 2,000,000 |
| Custody, advice and arranging (combined) | AED 1,000,000 | From AED 2,000,000 |
| Providing Custody | AED 3,000,000 | From AED 4,000,000 |
| Dealing in Virtual Assets as Principal | AED 4,000,000 | From AED 3,500,000 |
Where multiple activities are combined, the highest applicable requirement governs. The Article 21 figures are floors, not ceilings: the CMA may additionally require capital based on projected or audited annual expenses, typically 25% to 35% of annual expenses, or a risk-based calculation, whichever produces the higher number. Capital adequacy must be maintained on an ongoing basis after licensing, not only at the point of application.
Year 1 all-in cost figures include CMA application and annual fees, NeosLegal fees, entity setup in the chosen emirate, senior-person hires and first-year compliance tooling.
Legal fees
NeosLegal works on fixed-fee, milestone-based engagements. Fees depend on category, business model complexity, application readiness at engagement start, and scope of ongoing post-authorisation support.
Engagement Model
How Does NeosLegal Structure a CMA Engagement?
Across 20+ VASP licence applications advised, the single most expensive mistake we see is founders applying to the wrong regulator, or applying to the right one in the wrong shape. The CMA runs its own six-stage review once an application reaches its desk. The NeosLegal engagement model below is what we do before and around that review: confirming the CMA is genuinely the right regulator, then getting your application to the authorisation team in a shape that clears queries quickly rather than stalling in them.
NeosLegal has advised on federal CMA VASP engagements since the framework came into force in 2022, through the Decision No. 4/R.M/2026 overhaul, and maintains direct working contact with authorisation teams.
- 01
Federal fit assessment
Before any investment, we confirm the CMA route actually suits the venture and pressure-test whether VARA or ADGM would fit better. This is the stage that protects the largest spend. The CMA’s own pre-application engagement runs in parallel here: an initial scope discussion with the authorisation team that surfaces category-classification and capital-sizing issues before the application clock starts. Output: written assessment memo signed by Irina.
- 02
Emirate and entity selection
Mainland entity structured in the right structure for substance and commercial reality, with activity codes aligned to the target CMA category. The Department of Economic Development in the chosen emirate issues the trade licence; CMA authorisation is separate and sits on top.
- 03
Category and capital mapping
Activity mapped to the correct CMA category under Decision No. 4/R.M/2026, with capital, senior-person and compliance plan documented. The 2026 framework specifies documentation requirements category by category, so getting the classification right at this stage determines the entire policies pack that follows.
- 04
Application and policies pack
Full CMA application drafted to the 2026 framework: activity scope, shareholders, senior persons, business plan, capital, category-specific policies and procedures, and AML programme. This is where pattern recognition from 20+ applications pays off: the documentation goes in built to answer the questions the CMA asks, not to invite them.
- 05
Submission and coordination
Submission to the CMA and active management of the review-and-query stage, including coordination with VARA, ADGM, DFSA or CBUAE where activity intersects multiple regulators. Cross-regulator coordination adds time but ensures the licence covers your actual activity scope rather than a narrower slice.
- 06
Licence issuance and go-live
Subject to capital funding and senior-person approvals, the CMA issues the VASP licence and the business launches. Ongoing retainer available for updates to the federal framework and for marketing-perimeter management.
“Decision No. 4/R.M/2026 changed the CMA from a federal regulator that mattered for a small number of mainland firms into one that matters for any business globally that touches UAE clients. Founders who built their structures pre-2026 are reassessing whether they are still in scope. Most are. The extraterritorial reach is the part most founders miss.”
WHY CHOOSE NEOSLEGAL
Why Founders and Institutions Choose NeosLegal
NeosLegal has worked only on crypto and Web3 since 2016, before VARA existed, before ADGM had a crypto framework, and before most UAE firms understood what Bitcoin was. That head start shows in the track record, the recognition, and the way engagements run.
Track Record
- 300+ UAE Web3 and crypto projects structured and 700+ founders advised since 2016, with zero client enforcement actions in ten years.
- USD 500 billion in transactions advised and deals closed.
- 20+ VASP licence applications advised across the UAE regulators.
- 250+ Tier-1 exchange legal opinions at a 100% acceptance rate, a commercially verifiable outcome across hundreds of submissions.
Independent Recognition
- Best UAE Crypto Law Firm 2026, UAE Business Awards Middle East.
- Middle East Technology Legal Team of the Year, The Oath Middle East, November 2025.
- Authors the UAE chapters of the Chambers Blockchain and Crypto Assets guide, 2025 and 2026.
- Irina Heaver ranked as Recommended Blockchain Lawyer in the UAE 2025 and 2026, Lexology.
Regulatory Coverage
- All five UAE regulatory pathways, VARA, ADGM (FSRA), DIFC (DFSA), the federal CMA and CBUAE, handled within a single firm, with no coordination overhead between separate advisers.
- 60+ jurisdictions covered in total for cross-border structuring since 2016.
- Federal CMA Category RWA Tokenization Exchange, broker-dealer and OTC dealing desk licences delivered end to end, including the full policy suite, AML risk and controls register, and Approved Persons submissions the regulator requires.
Every engagement is fixed-fee with defined milestones confirmed before work begins. Direct access to Irina Heaver and senior associates throughout, not associates managing the relationship.
Founder differentiator
Founded by Irina Heaver, a former co-founder of a UAE crypto exchange (later exited), NeosLegal operates with founders’ commercial realities in mind. Irina has also drafted crypto laws and advised on virtual asset policy for multiple regulators and governments, including UAE regulators, helping shape the frameworks her clients are now licensed under, a perspective no other crypto lawyer in the UAE can offer.
Track record
Representative CMA Cases
-
CMA Federal Licensing
Federal VASP Licensing (CMA/SCA)
Advised a virtual-asset platform on the federal licensing route under the CMA/SCA regime, mapping its activities to federal categories and coordinating with the mainland or free-zone setup.
-
CMA Federal Licensing
Federal vs Free-Zone Route Selection
Advised a client comparing a CMA federal licence against VARA licensing regimes, weighing market access, scope and cost to select the optimal licensing path.
-
VASP Licensing & Regulatory
Global Payment Network – All Five UAE Regimes
Advised a leading global payment network across all five UAE VASP regimes (VARA, ADGM, DIFC, CMA/SCA and CBUAE), benchmarking each against the client's activities and delivering a jurisdiction-selection matrix that anchored a multi-entity licensing strategy.
-
Market Entry & Advisory
EU-Regulated Exchange – UAE Entry
Managed the UAE market entry of an EU-regulated crypto exchange, handling corporate structuring, federal regulatory submissions and preparation for full operational rollout.
Browse 100+ Representative Case Studies
View All Case Studies