The UAE's Federal CMA: What Decree-Laws 32 and 33 of 2025 Change for Virtual Assets

What actually happened

Two federal decree-laws, issued in 2025, entered into force on 1 January 2026:

Federal Decree-Law No. 32 of 2025 (the CMA Law) reconstitutes the Securities and Commodities Authority as the Capital Market Authority, its legal successor for all rights, obligations and contracts. The 2000 law that established the SCA is repealed in its entirety.
Federal Decree-Law No. 33 of 2025 (the Capital Market Law) rewrites the scope of regulated financial activity, and expands the definition of financial products to include virtual assets explicitly.

Implementing rules followed quickly. The CMA's Virtual Asset Regulation, Decision No. 4/R.M of 2026, supersedes the 2023 framework and gives the federal perimeter operational detail.

Why it matters for Web3 teams in Dubai

Dubai teams have been used to a clean question: are we in VARA's perimeter (Dubai, outside DIFC), or in ADGM's or DIFC's? The CMA laws add a federal layer over that map. Three practical consequences:

Two levels of reading. Activity analysis in Dubai now runs against the VARA rulebooks and the federal financial-activities list under Law 33. The definitions do not perfectly mirror each other, and the boundary questions (which regulator, for which activity, in which venue) are exactly the kind of scoped questions a legal opinion exists to answer.
Marketing and solicitation discipline matters more. A federal perimeter over financial products, including virtual assets, means promotion into the UAE gets read at two levels too. Teams that treated marketing rules as a Dubai-only question should revisit that.
Transitions create dated questions. Anything analyzed under the pre-2026 framework should be re-checked against the new perimeter. An opinion speaks as of its date; the date just became load-bearing for UAE work.

The corridor angle

For India-UAE teams the sequencing is familiar: India's regime crystallizing through FIU registration, tax treatment and the DPDP Act on one side, and the UAE professionalizing fast on the other, now with a federal capital-markets spine. The gap between "we moved to a friendly jurisdiction" and "we are actually covered where our users are" keeps widening. That gap is the reason LEXI exists: one flow, scoped opinions per jurisdiction, and a credential your counterparties can verify instead of a memo they have to trust. VARA remains the V0 anchor; the VARA compliance page covers where an opinion fits in that journey.

Sources

This briefing is educational commentary, not legal advice, and it speaks as of its published date. For questions about your own structure, obtain advice from licensed counsel in the relevant jurisdictions.

Request early access VARA compliance on LEXI