FINANCIAL REGULATORY
UAE Capital Markets Authority Issues Landmark New Federal Virtual Asset Framework
On 22 April 2026, the Capital Markets Authority (CMA) – the successor to the Securities and Commodities Authority (SCA) established under Federal DecreeLaw No. 33 of 2025 – issued Decision No. 4/R.M/2026, introducing a comprehensive new framework for virtual asset activities and service providers across the UAE. This decision does not amend the previous SCA regime: it replaces it entirely. The new framework establishes a modular, activity-based licensing model supported by materially higher capital, governance, and compliance thresholds. It is intended to operate alongside emirate-level regimes, including VARA in Dubai, while expressly excluding the financial free zones of the DIFC and ADGM from its scope.
Key Takeaways:
- Eight Licensed Virtual Asset Activities: Decision 4/R.M/2026 introduces eight licensed virtual asset activities, replacing the broader categories under the prior framework. Licensed firms must appoint defined senior roles covering executive management, compliance, AML/CFT oversight, finance, and internal audit. Certain key positions must be held by UAE resident individuals, reflecting the CMA’s focus on local accountability and on-shore oversight.
- Governance and AML/CFT as Foundational Requirements: The framework embeds virtual asset activities firmly within the UAE’s broader AML/CFT regime. Client due diligence, transaction monitoring, and risk management arrangements proportionate to licensed activities are positioned as foundational licensing requirements, rather than supplementary obligations. Firms that previously relied on offshore management or heavily outsourced compliance functions will require material restructuring.
- Interaction with Existing Regimes: VARA remains the competent authority for virtual asset businesses established in Dubai (outside DIFC), while DIFC and ADGM continue to operate under their own rulebooks. Decision 4/R.M/2026 establishes a federal baseline for onshore virtual asset activities, operating alongside — not replacing — emirate-specific frameworks. Firms operating across jurisdictions must carefully map regulatory scope and ensure consistency across overlapping licensing, capital, and governance requirements.
- Transitional Arrangements: Transitional arrangements apply, but migration to the new framework will require a detailed gap analysis across capital, governance, and compliance. Existing SCA-licensed VASPs, firms currently in the licensing pipeline, and international operators considering UAE market entry should engage early, as capital restructuring and compliance uplift exercises are unlikely to be straightforward.
AI in Banking and Finance: The CBUAE Guidance Note and Its Supervisory Implications
The Central Bank of the UAE (CBUAE) issued its Guidance Note on Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in February 2026. The Guidance has come into sharp regulatory focus this month, coinciding with Dubai AI Week 2026 (6–9 April) and the acceleration of AI adoption across the UAE financial services sector.
Scope: Broad Application and High-Impact Decisions
The Guidance applies to all Licensed Financial Institutions (LFIs) supervised by the CBUAE and, although framed through a consumer protection lens, extends into governance, model risk management, outsourcing, and operational resilience.
It supplements — rather than replaces — existing frameworks, including the CBUAE’s Model Management Standards (2022), Consumer Protection Regulation, and outsourcing requirements. The Guidance adopts a broad definition of AI, capturing machine learning systems and generative AI tools, including large language models.
It specifically addresses “high-impact decisions” in areas such as credit scoring, AML monitoring, robo-advisory services, and algorithmic trading.
Supervisory Trajectory
While formally non-binding, the Guidance establishes a clear supervisory trajectory. Institutions that proactively align AI strategy with enterprise risk management and governance frameworks will be better positioned to manage regulatory scrutiny, mitigate legal exposure, and maintain customer trust.
Key Action Points for LFIs
- Maintain a comprehensive AI inventory: Register each system’s purpose, data inputs, architecture, and deployment context.
- Conduct expanded impact assessments: Include AI bias, explainability, and profiling risks within DPIA processes under applicable regimes.
- Establish governance structures: Allocate roles for senior management, Data Protection Officers, and technical leads, with Board-level reporting on AI risk.
- Review vendor and cloud contracts: Ensure robust data processing clauses, security obligations, audit rights, and appropriate liability allocation.
Although not legally binding, institutions should expect the Guidance to form part of supervisory dialogue and regulatory assessments going forward.
