The UAE's federal CMA in 2026: Decree-Laws 32 and 33, the April framework and Resolution 16

October 2026 update

The July edition of this briefing covered the two decree-laws. Since then the CMA has issued its virtual-asset instrument, announced a framework and widened the perimeter once. Each item below carries its effective date where a primary source states one, and what it does to an opinion.

Decree-Laws 32 and 33 of 2025

In force 1 January 2026¹³. The SCA became the CMA; virtual assets became a Financial Product and "Activities and services related to Virtual Assets" a licensable Financial Activity. Scope: a UAE-federal opinion dated on or after 1 January 2026 names the CMA. Date: anything analysed under the 2023 regime needs a re-read.

Resolution No. (04/Chairman) of 2026

The CMA's regulation of virtual-asset service providers and the alternative trading system operator, also cited as 4/R.M. Issued 13 February 2026, published in the Official Gazette on 27 February 2026 and in force from 28 February 2026, as the CMA Rulebook records¹². It approves three modules and repeals Decision No. (26/Chairman) of 2023 (Arts. 1 and 6), with one year from the effective date to meet the module requirements (Art. 3). Scope: the instrument a UAE-federal VASP opinion reads. Date: 28 February 2026.

The Virtual Assets Framework, 13 April 2026

Announced by press release: five modules, eight regulated activities, no decision number and no effective date⁷. The eight activities carry the same names as the eight in Art. 12 of the General Module approved by Resolution 04/2026¹². Scope: the activity list an opinion maps a project against. Date: 13 April 2026 is a publication date; the regulation itself has been in force since 28 February 2026.

Resolution No. (16/Chairman) of 2026

Issued 25 June 2026, in force on issuance⁴. Entities licensed by the Central Bank, other than insurers, may practise the Resolution 04/2026 activities. Scope: the set of possible UAE reliers widens toward banks and payment firms. Date: 25 June 2026.

Cross-border reach and finfluencers

Decree-Law 33 Art. 2(1)(d), in force 1 January 2026, reaches any person targeting clients within the State even from outside it, and Art. 3(1)(i) lists "Promotion" as a licensable activity³. Finfluencers sit under Resolution No. (10/R.M) of 2025; the CMA's authorised-finfluencer list page is stamped last updated 04/05/2026 (5 April 2026, read month-first as the site's other English dates are) and its table was empty when read⁸. Scope: whether a given promotion into the UAE sits inside the perimeter is a scope question for counsel, not a conclusion LEXI gives.

What changed on 1 January 2026

Two federal decree-laws, issued in 2025, entered into force on 1 January 2026².

• Federal Decree-Law No. (32) of 2025 on the Capital Market Authority makes the Capital Market Authority the legal successor of the Securities and Commodities Authority and replaces the old designation wherever it appears in legislation (Art. 2(2) and 2(3)). Federal Law No. 4 of 2000, which created the SCA, is repealed (Art. 29). In force 1 January 2026 (Art. 30)¹. The English copy leaves its issue date blank, so this briefing gives none.
• Federal Decree-Law No. (33) of 2025 on the Regulation of the Capital Market, issued 1 October 2025, rewrites the scope of regulated financial activity and puts virtual assets inside it. In force 1 January 2026 (Art. 85)³.

sca.gov.ae now redirects to uaecma.gov.ae, so every citation in this briefing uses the new domain.

What Decree-Law 33 puts inside the federal perimeter

Art. 1 of Decree-Law 33 defines the asset the federal law now reaches, and the definition decides which regulator an opinion must name³:

The same article lists "Virtual Assets for investment purposes" among Financial Products. Four more articles build the perimeter; each is a scoping fact for an opinion, not a conclusion about any one project:

• Art. 3(1) lists the Financial Activities that need a CMA licence or approval. Item (i) is "Promotion" and item (y) is "Activities and services related to Virtual Assets". Art. 3(2) says no person may carry out any of them within the State without a CMA licence or approval.
• Art. 2(1)(d) applies the law to any person targeting clients within the State, even if the activity is conducted outside the State or from a Financial Free Zone. This is the statutory basis for cross-border exposure.
• Art. 2(4) carves out activities licensed by the Central Bank and the Financial Free Zones, where the DIFC and ADGM sit.
• Art. 39 gives the CMA the regulation of virtual-asset trading and the procedures for registering virtual assets. Trading in a virtual asset within the State is prohibited unless the asset is admitted to the official list of a CMA-licensed platform and registered with the CMA. That rule sits in the decree-law itself.

Art. 83 gives everyone subject to the law one year from entry into force to adjust their status, and lets the Board extend that period. No instrument names a calendar deadline, so this briefing does not either. Whether a particular site, offer or campaign falls inside Art. 2(1)(d) and Art. 3(1)(i) is a scope question for counsel, not a conclusion LEXI gives. An opinion says which articles it read, as of which date, and for which activity.

Resolution 04/2026: the VASP regulation, in force since 28 February 2026

The CMA's virtual-asset instrument is the Chairman of the Board's Resolution No. (04/Chairman) of 2026 Concerning the Regulation of Virtual Assets Service Providers and the Alternative Trading System Operator, also cited as 4/R.M. Its text is published on the CMA Rulebook at legislation.uaecma.gov.ae, which records it as issued on 13 February 2026, published in the Official Gazette on 27 February 2026, effective 28 February 2026 and in force¹². The Board approved it at its meeting of 26 December 2025. Art. 1 approves the attached Regulation in three modules: a General Framework Module, a Business Regulation Module and an Alternative Trading System Module. Art. 3 gives licensed entities and accredited persons one year from the effective date to meet the Business Regulation and Alternative Trading System modules, and Art. 6 repeals Decision No. (26/Chairman) of 2023 on the virtual-asset platform operator and the VASP provisions of the 2021 Rulebook, keeping their licensing and accreditation conditions until the regularisation period ends. Art. 7 brings the resolution into force on the day after gazette publication. Art. 12 of the General Module deems the VASP activities financial activities and regulates eight of them: dealing as principal, dealing as agent, providing custody, arranging custody, operating a multilateral trading facility, providing investment advice, portfolio management and arranging investment deals. Resolution 16/2026 cites the same title in its recitals, in English and, as 04/ر.م, in Arabic⁴⁵.

The resolution does not appear on the CMA's Latest Regulations page, which listed only Decisions 11 and 13 and Resolutions 16 and 18 of 2026 when read on 16 October 2026⁶; it sits in the Rulebook instead. The 11 October edition of this briefing said the text, issue date and effective date were not published at source. That was wrong: they were on the Rulebook, and this edition corrects it. The July edition's phrase "supersedes the 2023 framework" is now a sourced fact in the narrower form Art. 6 gives it: the 2023 platform-operator decision is repealed, with its licensing conditions kept through the regularisation period.

What the CMA announced on 13 April 2026

On Monday 13 April 2026 the CMA published a press release titled "The CMA Issues the Virtual Assets Framework, Establishing an Integrated Regulatory Regime Comprising Five Core Modules and Eight Regulated Activities"⁷. The five modules are General Requirements, Conduct of Business, Alternative Trading System, Anti-Money Laundering and Counter-Terrorist Financing, and Prudential Requirements. The eight regulated activities, expanded from three, are Dealing in Virtual Assets as Principal, Dealing in Virtual Assets as Agent, Providing Custody, Arranging Custody, Arranging Investment Deals, Providing Investment Advice, Portfolio Management, and Operating a Multilateral Trading Facility. The release says the framework is aligned with IOSCO and FATF and states its principle in seven words⁷.

"same activity, same risk, same regulatory outcome"UAE Capital Market Authority, press release, 13 April 2026

The release names no decision number, no effective date and no transition period, and does not mention VARA, the DIFC or ADGM. It does not say which instrument it describes. The eight activities it names are, name for name, the eight in Art. 12 of the General Module that Resolution 04/2026 approved¹²; the release's five modules do not match the three that the resolution's Art. 1 lists, and this briefing does not reconcile the two. For an opinion, the eight activities are the list a project's activities get mapped against. Art. 12 has carried them since 28 February 2026, and the release restated them on 13 April 2026.

What Resolution 16/2026 does

Resolution No. (16/Chairman) of 2026 Concerning the Permission for Entities Licensed by the Central Bank to Practice Activities Licensed by the Authority was approved by the Board on 9 June 2026, issued in Abu Dhabi on 25 June 2026 and entered into force on the date of its issuance (Art. 2)⁴. It does one thing: Art. 1 permits entities licensed by the Central Bank, other than insurance companies, to practise any of the activities under Resolution 04/2026.

It widens the perimeter and says nothing about promotion, finfluencers or cross-border activity. For a relier it matters because the UAE counterparties able to hold a CMA-regulated virtual-asset activity now include banks and payment firms, and an opinion addressed to such a relier names the licence under which it acts. The other 2026 instruments on the CMA's regulations page, Decisions 11 (30 April 2026) and 13 (2 June 2026), amend capital-adequacy and broker-financing rules and do not concern virtual assets⁶.

What stays in force from 2022

Decree-Law 32 Art. 27(3) keeps Cabinet Resolution No. 111 of 2022 on the regulation of virtual assets and Cabinet Resolution No. 112 of 2022 on delegating virtual-asset competencies in force, with the resolutions issued under them, to the extent they do not conflict with the new law, until repealed, amended or replaced. Art. 27(4) continues earlier Cabinet and CMA resolutions on the same terms¹.

The CMA's older guidelines on virtual assets and their service providers (document code LD-F-23, V1.0) still sit on its circulars page. They were issued under Cabinet Resolution 111 of 2022 and Decision No. (26/Chairman) of 2023 and describe the 2023 regime⁹. They are cited here as lineage, never as current law.

Where VARA sits beside the CMA

VARA describes itself as the sole authority regulating virtual assets across Dubai's free zones and mainland, except within the jurisdiction of the Dubai International Financial Centre¹¹. Decree-Law 33 Art. 2(4)(d) excludes the Financial Free Zones from the federal law³, and the two law-firm summaries that discuss the point agree: Clyde & Co says VARA remains the competent authority for virtual-asset businesses established in Dubai outside the DIFC, and Horizlaw says VARA will still be the governing regulator for Dubai-established virtual-asset entities¹⁰. Dubai teams therefore read two levels of rulebook: VARA's per-activity rulebooks for a Dubai entity, and the federal activity list under Decree-Law 33 for anything that targets clients in the State. How the CMA's eight activities map onto VARA's licensed activities is a scoping question an opinion addresses; no published text settles it.

On LEXI, VARA (Dubai) is the V0 jurisdiction, running on Base Sepolia testnet today. The VARA compliance page sets out where a co-signed opinion fits in that journey. The EU (MiCA) and India (FIU-IND) are V1, next up. Nothing is on mainnet yet.

What this does to an opinion's scope and date

An opinion speaks as of its date. In the UAE the date became load-bearing on 1 January 2026 and moved again on 28 February, 13 April and 25 June. Four consequences follow for anyone who co-signs or relies on a UAE opinion.

• The regulator named. A UAE-federal opinion dated on or after 1 January 2026 names the CMA, not the SCA, and states that Decree-Law 33 lists "Activities and services related to Virtual Assets" and "Promotion" as licensable activities.
• The instruments read. The opinion lists which CMA instruments it read and when, Resolution 04/2026 and its three modules included, with the Rulebook version date it read.
• The reliers named. After 25 June 2026 a Central Bank-licensed entity can practise the Resolution 04/2026 activities, so a relier list that once stopped at VASPs may now include a bank or a payment firm.
• The re-read. Anything analysed under the 2023 regime, or before 28 February 2026, is re-checked against the new perimeter before a relier accepts it.

This is the problem a LEXI credential is built for. It records the opinion's as-of date and expiry, a scope hash and an opinion hash, a status of Live, Expired or Revoked, and the reliers it names, so a relier can check in one call whether the date still stands and whether the scope it holds is the scope the licensed lawyer signed. Clearing a jurisdiction on LEXI means obtaining a co-signed legal opinion covering it; each cleared jurisdiction is one credential. The terms used here are defined in the glossary, and every dated UAE event above also appears, with its source, in the corridor regulation tracker.

A LEXI credential is a co-signed legal opinion committed on-chain. It is not a licence, a registration, or an approval by any regulator, and nothing in it satisfies Decree-Law 33 Art. 39 registration. LEXI is not licensed or endorsed by VARA.

Questions

Sources

Sources, checked at source on 2026-10-16. Regulator texts only, with the documents' own dates. Law-firm summaries are named, not linked.

1. UAE Capital Market Authority, Federal Decree-Law No. (32) of 2025 on the Capital Market Authority: Art. 2(2) and 2(3) (succession and designation), Art. 27(3) and 27(4) (continuation of the 2022 Cabinet Resolutions), Art. 29 (repeal), Art. 30 (in force 1 January 2026). English copy, issue date left blank. uaecma.gov.ae (PDF) (opens in a new tab)
2. UAE Capital Market Authority, The new CMA law: both decree-laws entered into effect on 1 January 2026; the SCA renamed the Capital Market Authority. uaecma.gov.ae (opens in a new tab)
3. UAE Capital Market Authority, Federal Decree-Law No. (33) of 2025 on the Regulation of the Capital Market, issued 1 October 2025: Art. 1 (definitions), Art. 2(1)(d) and 2(4) (scope and carve-outs), Art. 3(1)(i), 3(1)(y) and 3(2) (licensable activities), Art. 39 (virtual assets), Art. 83 (status adjustment), Art. 85 (in force 1 January 2026). uaecma.gov.ae (PDF) (opens in a new tab)
4. UAE Capital Market Authority, The Chairman of the Authority's Board of Directors' Resolution No. (16/Chairman) of 2026 Concerning the Permission for Entities Licensed by the Central Bank to Practice Activities Licensed by the Authority, Board approval 9 June 2026, issued 25 June 2026, in force on issuance; recital citing Resolution No. (04/Chairman) of 2026. uaecma.gov.ae (PDF, English) (opens in a new tab)
5. UAE Capital Market Authority, Resolution No. (16/Chairman) of 2026, Arabic copy, issued 25 June 2026; recital citing Resolution No. (04/ر.م) of 2026. uaecma.gov.ae (PDF, Arabic) (opens in a new tab)
6. UAE Capital Market Authority, Latest Regulations, read 16 October 2026: Decision No. (11/Chairman) of 2026, Decision No. (13/Chairman) of 2026, Resolution No. (16/Chairman) of 2026 and Resolution No. (18/Chairman) of 2026 listed; nothing numbered 4 and nothing on virtual assets. uaecma.gov.ae (opens in a new tab)
7. UAE Capital Market Authority, press release, 13 April 2026: The CMA Issues the Virtual Assets Framework, Establishing an Integrated Regulatory Regime Comprising Five Core Modules and Eight Regulated Activities. uaecma.gov.ae (opens in a new tab)
8. UAE Capital Market Authority, List of authorized finfluencers, under Resolution No. (10/R.M) of 2025; page stamped "Last Update: 04/05/2026" (5 April 2026, month-first), table empty when read on 16 October 2026. uaecma.gov.ae (opens in a new tab)
9. UAE Capital Market Authority (as the SCA), Guidelines Regulation of Virtual Assets and Virtual Assets Services Providers, LD-F-23, V1.0, undated on the circulars page; issued under Cabinet Resolution No. (111) of 2022 and Decision No. (26/Chairman) of 2023. Cited as lineage only. uaecma.gov.ae (PDF) (opens in a new tab)
10. Law-firm summaries, named and not linked, used only for the point on VARA attributed to them above: Horizlaw, New Virtual Asset Regulations, a summary of CMA Decision No. 4/R.M/2026, 14 April 2026; Clyde & Co, The UAE Capital Markets Authority replaces the federal VASP framework, 22 April 2026.
11. Virtual Assets Regulatory Authority (VARA), About VARA: the sole authority regulating virtual assets across Dubai's free zones and mainland, except within the jurisdiction of the DIFC. vara.ae (opens in a new tab)
12. UAE Capital Market Authority, CMA Rulebook, The Chairman of the Authority's Board of Directors' Resolution No. (04/Chairman) of 2026 Concerning the Regulation of Virtual Assets Service Providers and the Alternative Trading System Operator: record No. (04/Chairman)/2026, issued 13/2/2026, Official Gazette 27/2/2026, effective 28/2/2026, status In-Force; Board approval 26/12/2025; Art. 1 (three modules), Art. 3 (one-year regularisation), Art. 6 (repeal of Decision No. (26/Chairman) of 2023), Art. 7 (in force the day after publication); General Module Art. 12 (eight financial activities). Read 16 October 2026. legislation.uaecma.gov.ae (opens in a new tab)