On 1 January 2026, the UAE's onshore capital markets regulator changed its name, and a great deal more. Federal Decree-Law No. 32 of 2025 reconstituted the Securities and Commodities Authority (SCA) as the Capital Market Authority (CMA). Federal Decree-Law No. 33 of 2025 introduced a new capital market law, and Federal Decree-Law No. 32 of 2025 repealed Federal Law No. 4 of 2000.
For licensed firms, the headline date is 1 January 2027. That is when the one-year window to regularise status under the new law closes, unless the CMA extends it. If you manage, promote or advise on funds onshore, three months is not long.
More than a rebrand
The CMA takes over all of the SCA's rights, obligations and contracts. But the new laws give the regulator a broader toolkit:
- Power to designate firms as systemically important, with early intervention, recovery and resolution powers
- Power to establish an Investor Protection Fund, and to approve a Settlement Guarantee Fund set up by the central clearing entity
- Power to settle violations before criminal proceedings begin
- A mandate to mitigate systemic risk and support financial stability in the capital market
- Protection, and potential rewards, for whistle-blowers
Penalties have also moved up. Administrative fines can reach AED 200 million or ten times the profit made or loss avoided. Criminal penalties include imprisonment of at least one year and fines of AED 1 million to AED 250 million.
The scope question: who is caught
Regulated activities under the new law expressly include fund establishment and management, portfolio management, financial advice, promotion and introducing. Virtual assets held for investment purposes fall within the definition of financial products.
The law also reaches across borders. It applies to anyone targeting clients in onshore UAE, even where the activity is carried on from outside the country or from a financial free zone such as DIFC or ADGM. Activity carried on entirely within DIFC or ADGM remains with the DFSA and FSRA. Financial activities licensed or supervised by the Central Bank generally sit outside the CMA's scope, subject to limited exceptions.
This is where we expect the most questions. A DIFC or ADGM manager marketing a fund to onshore investors, or an overseas adviser with a UAE client base, should not assume the old perimeter still applies.
A fund can be established either by a CMA licensing decision or as a company with the CMA's prior approval. For managers planning a launch in 2027, the choice of structure is now a regulatory decision as much as a commercial one, and it should be made before fund documents are drafted, not after.
What carries over
Existing Cabinet and SCA/CMA decisions remain in force to the extent they do not conflict with the new laws, until replaced. In practice, current fund rules and conduct requirements continue for now, but they may be replaced by new CMA decisions. The first major replacement has already landed: CMA Decision No. 4/R.M/2026 introduced a new virtual assets framework in April 2026, with eight separately regulated virtual asset activities.
The CMA also continues to act as an AML/CFT supervisory authority. The joint guidance on the CO/MLRO function issued by UAE supervisors now names the CMA among the participating authorities.
Your update checklist
Licensing and perimeter
- Map every activity you carry on against the new list of regulated activities. Pay particular attention to promotion, introducing and advice.
- Map your client base. If you target onshore clients from a free zone or from abroad, confirm whether you need a CMA licence or can rely on an exemption.
- Diarise 1 January 2027. If your status needs regularising, start the conversation with the CMA now.
Governance
- Check whether board and senior appointments need fresh CMA approval under the new framework.
- Put a whistle-blowing procedure in place that reflects the new statutory protections.
- If you could be designated systemically important, start thinking about a recovery plan.
Documents and disclosures
- Update references to "SCA" and Federal Law No. 4 of 2000 in fund documents, offering memoranda, client agreements, terms of business, risk disclosures, websites and marketing materials.
- Review complaint-handling wording and regulator contact details given to clients.
Compliance framework
- Update your compliance manual, AML/CFT policy and monitoring plan so they reference the CMA, Federal Decree-Laws No. 32 and 33 of 2025, and Federal Decree-Law No. 10 of 2025 on AML/CFT.
- Review your compliance monitoring programme against the new penalty levels. An AED 200 million ceiling changes the risk calculus for board reporting.
- If you touch virtual assets, run a separate gap analysis against Decision No. 4/R.M/2026.
Updating the name on your letterhead is the easy part. The perimeter, the governance changes and the new enforcement ceiling are where the risk sits.