TL;DR

• The CMA’s jurisdiction has been extended to oversee the trading of virtual assets both within onshore and offshore UAE, placing all UAE free zones within the CMA’s jurisdictional oversight. VASPS must obtain additional approvals despite validly operating under the rules of the free zone they are affiliated with.
• The definition of Financial Products has been broadened to include virtual assets. This places VASPS offering or facilitating investment services within or targeting the UAE on par with traditional securities companies mandating compliance with licensing, conduct, and prudential requirements.
• International VASPs that market, promote or provide access to UAE clients are caught within the CMA’s enforcement perimeter given the law’s extra-territorial reach.
• VASPs are advised to conduct a gap analysis against the CMA’s virtual asset regulations (within the 6 month transitional period) to identify compliance steps that need to be undertaken to comply with FDL32 and FDL33.

---

The UAE has undergone a major overhaul to its capital markets law in which the Securities and Commodities Authority has been reconstituted as the Capital Market Authority (the CMA) as per Federal Decree Law No. 32 of 2025 (FDL32). A key aspect of the legislative reforms is the expanded jurisdiction and authority of the newly formed CMA, particularly in its oversight of virtual asset service providers (VASPs) and regulated financial products.

---

Expansion of the Definition of Regulated Financial Products

The definition of financial products has been expanded to include securities, foreign securities, virtual assets for investment purposes, and any other financial product falling within the CMA’s jurisdiction (Financial Products). This means that virtual assets used for investment purposes are classified as a Financial Product and thus fall within the purview of the CMA. This carries a number of implications for VASPs: 

1. Whereas previously, VASPS dealing in investment focussed digital assets in onshore UAE could operate without express CMA licensing, VASPs must now be either licensed (for performing financial activities) or registered (for virtual asset listing/offering) before offering or facilitating investment services within or targeting the UAE. 
2. Platforms and exchanges enabling secondary trading of virtual assets which previously operated under unclear classifications must now comply with licensing, conduct, and prudential requirements equivalent to those of securities firms. 
3. The expanded definition of Financial Products subjects VASPs to promotion and marketing rules when offering virtual assets for investment purposes, meaning that engaging in such conduct without the CMA’s approval/licence results in a raft of regulatory penalties. 

CMA’s Jurisdiction Over Virtual Assets and Trading Platforms

The CMA’s jurisdiction has been extended to oversee and supervise the activities, transactions and trading of virtual assets both within onshore and offshore UAE, placing all UAE free zones within the CMA’s jurisdictional oversight. This introduces more onerous compliance obligations on VASPs operating within free zones given that they must not only adhere to free zone regulations, but must now follow CMA rules and regulations as well.

According to Federal Decree Law No. 33 of 2025 (FDL33), a VASP is prohibited from trading virtual assets in the UAE even if registered in a free zone unless it obtains additional approvals which require the asset to be (a) included in the official list of virtual assets; (b) registered with the CMA authority; and (c) operated by a licensed virtual asset platform. 

This arguably places VASPs in a more difficult position as they will have to obtain additional approvals despite validly operating under the rules of the free zone they are affiliated with. 

Territorial Scope and Extra-Territorial Reach 

FDL33 brings within scope all persons targeting UAE clients, regardless whether their activity is conducted within or outside the UAE. This places any international VASP that markets, promotes or provides access to UAE clients within the CMA’s enforcement perimeter.

An additional layer of compliance is now introduced to a DIFC or ADGM VASP which targets clients in mainland UAE as onboarding these clients or marketing Financial Products to them will be subject to the CMA’s marketing and promotion rules stipulated in FDL33. It is noted that a VASP’s place of incorporation or server location is not determinative, rather what matters is that UAE clients are solicited through the VASP’s promotional reach or the VASP allows UAE IP addresses to access a trading platform. 

While FDL32 envisages entry into mutual recognition arrangements with free zones to reduce compliance obligations on VASPs, at present it is premature to anticipate potential arrangements that might be entered into with UAE free zones.

Strategic Considerations for VASPs

The introduction of the CMA as a centralised regulator, combined with the formal recognition of virtual assets as regulated Financial Products fundamentally alters the compliance landscape for VASPs in the UAE. VASPs are advised to: 

1. Conduct a gap analysis against the CMA’s virtual asset regulations to identify compliance steps that need to be undertaken to comply with FDL32 and FDL33. 
2. Ensure that all activities/assets caught within the regulatory perimeter are registered and that trading occurs through CMA approved platforms. 
3. Take the above actions within the 6 month transitional period* which commences as of the date of publication on the Official Gazette being 1 January 2026.

*While implementing regulations are still expected to be published, FDL32/33 do not condition enforceability on the issuance of implementing regulations, i.e. they are in full force and effect and the six-month transitional period has already kicked in.