Which regulator you deal with depends on two things: what the business does and where it is based. A bank or payment company answers to the Central Bank of the UAE (CBUAE), and an onshore broker or fund manager to the Capital Market Authority (CMA). Inside the DIFC and ADGM, the two financial free zones, their own regulators take over. Virtual asset businesses in Dubai have a regulator of their own, VARA.
One change matters if you are reading older material. The Securities and Commodities Authority (SCA) became the Capital Market Authority on 1 January 2026, when Federal Decree-Laws No. 32 and No. 33 of 2025 came into force. Plenty of websites, contracts and licence certificates still say SCA. They mean the same regulator.
This is general information, not legal or investment advice. Almahira does not provide regulated financial services, brokerage or investment advice.
The regulators at a glance
| Regulator | Where | What it covers |
|---|---|---|
| Central Bank of the UAE (CBUAE) | Onshore UAE | Banks, finance companies, exchange houses, payment services, insurance |
| Capital Market Authority (CMA, formerly SCA) | Onshore UAE | Securities, funds, brokers, advisers, virtual assets held as investments |
| Dubai Financial Services Authority (DFSA) | DIFC | Financial and related services in or from the DIFC |
| Financial Services Regulatory Authority (FSRA) | ADGM | Financial services in ADGM |
| Virtual Assets Regulatory Authority (VARA) | Dubai, except the DIFC | Virtual asset activities |
The Central Bank: banks, payments and insurance
The CBUAE licenses, governs and supervises financial institutions. Its register covers conventional and Islamic banks, finance companies and exchange houses, and its licences extend to payment businesses such as retail payment services, stored value facilities and card schemes. It also supervises the insurance sector, now under Federal Decree-Law No. 6 of 2025, and publishes a separate list of licensed insurance entities.
Crypto used for payments sits here too. The virtual asset guidelines the CMA issued while it was still the SCA say that virtual assets used for payment purposes, including stored value facilities, fall under the Central Bank. So a payments product built on virtual assets and a crypto trading app can end up with different regulators, even when the technology looks similar.
The Capital Market Authority: securities and investment firms
The CMA supervises the onshore capital market: the exchanges and their members, investment funds, brokers, portfolio and fund managers, financial consultants and firms that introduce or promote financial services. Its public list of licensed companies can be filtered by activity, and the activities are narrow. "Introduction", "Trading broker" and "Trading broker of OTC derivatives and currencies in the spot market" are separate permissions, and a firm holds only the ones listed against its name.
The 2025 decree-laws introduced new regulated activities and gave the CMA stronger supervisory powers, including powers over early intervention and the resolution of failing firms.
For virtual assets, the CMA's framework covers virtual assets held as investments across the UAE outside the financial free zones, and its register already includes activities such as virtual asset dealing and custody. It issued a new Virtual Assets Framework in April 2026. In Dubai, VARA is the licensing regulator, and VARA's public register shows a CMA registration number against each licensed firm.
DFSA and FSRA: the financial free zones
The DIFC in Dubai and ADGM in Abu Dhabi are financial free zones with their own laws and their own financial regulators.
The DFSA is the independent regulator of financial and related services conducted in or from the DIFC. Its powers come from the DIFC Regulatory Law, DIFC Law No. 1 of 2004. It keeps a public register of authorised firms, individuals and funds, including firms whose authorisation has been withdrawn, and an alerts page about scams and false claims of DFSA regulation.
The FSRA is ADGM's financial services regulator. It authorises and supervises firms operating in ADGM and keeps its own public register of firms, individuals and funds.
A licence from either covers activity in or from that centre. It is not a CMA or Central Bank licence, and founders who plan to serve customers elsewhere in the UAE should take advice on what that allows before they build the business around it.
VARA: virtual assets in Dubai
VARA was established in 2022 under Law No. 4 of 2022 and regulates virtual assets across Dubai's mainland and free zones, except the DIFC. A firm offering a regulated virtual asset activity in or from Dubai needs a VARA licence before it starts, whether its customers are in Dubai or abroad. The licensed activities are advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and token issuance.
VARA's register separates fully licensed firms from those holding only an in-principle approval, and VARA states that holders of an in-principle approval are strictly prohibited from starting operations. It also publishes a list of unlicensed firms. Our VARA licensing guide covers the process for founders.
Which regulator applies to your business?
Start with the activity, then the location, then the customers. Some illustrations:
- A payments or remittance business onshore will usually be dealing with the Central Bank.
- An onshore brokerage, fund manager or investment adviser goes to the CMA.
- A crypto exchange or broker run from a Dubai free zone such as DMCC needs VARA. Run the same business from the DIFC and the regulator is the DFSA.
- An asset manager targeting international clients may look at the DIFC or ADGM, and should budget for the capital, staff and compliance functions those regulators expect.
- A software company building trading or wallet technology for licensed firms should get a written view on whether its own activity is regulated before it launches.
A frequent mistake is to start with the trade licence. A licence from DET or a free zone that says consultancy or IT services does not authorise a regulated financial activity, and it will not satisfy a bank asking who supervises you. Settle the regulator first, then build the company and the business setup around that answer.
Common misunderstandings
- Regulated somewhere is not licensed here. A licence from a regulator in another country does not make a firm licensed in the UAE.
- In-principle approval is not a licence. VARA is explicit that approval holders may not operate.
- SCA references are not out of date in substance. They point to the regulator now called the CMA.
- A licence covers listed activities only. An introducer is not a broker, and an adviser is not a fund manager.
Almahira works on the unregulated side of this: company setup, technology and introductions to licensed firms and advisers. Our pages on investing in Dubai, forex education and broker introductions and blockchain development explain what we do and what we don't. If you are checking a firm before handing over money, read how to check whether a broker is regulated.
Sources
- Capital Market Authority: the new CMA law
- Capital Market Authority: guidelines on regulating virtual assets and their service providers (PDF)
- Central Bank of the UAE: licensing and register
- DIFC: laws and regulations, including the DFSA's role
- ADGM: Financial Services Regulatory Authority
- VARA: about the Virtual Assets Regulatory Authority
Frequently asked questions
Is the SCA still the regulator for brokers in the UAE?
Does the Central Bank regulate cryptocurrency?
Who regulates insurance companies in the UAE?
Do I need a financial licence to build trading or wallet software?
Found this useful? Pass it on.