The UAE’s New VASP Framework: A Comprehensive Revision Of The CMA’s Regulations

KEY TAKEAWAYS

• The CMA has introduced a unified and comprehensive licensing regime for VASPs, requiring firms to clearly map their business models to specific regulated activities.
• The framework identifies eight distinct virtual asset activities, each requiring a separate licence, making licensing strategy a key consideration for service providers. 
• The new framework introduces risk-based capital requirements, with significantly higher thresholds for entities that hold client assets.
• Certain activities are restricted or prohibited, particularly those involving privacy tokens, algorithmic tokens, and, in some cases, utility tokens and NFTs.
• The licensing process remains two-staged, allowing firms to achieve full operational and regulatory readiness within 6 months of in-principle approval. 
• Firms must meet specific governance and staffing requirements, with flexibility in role combinations but clear expectations on substance and UAE-based personnel.
• The licence, once granted, is valid for a year, and is subject to a yearly licence fee. No separate supervision fee is imposed by the CMA on licensed entities. 

INTRODUCTION

The Capital Market Authority of the United Arab Emirates (“CMA“) has issued the CMA’s Board of Directors Resolution No. (04/Chairman) of 2026 Concerning the Regulation of Virtual Asset Service Providers and the Alternative Trading System Operator (the “Resolution“), accompanied by three dedicated rulebooks governing the conduct, licensing, and operations of Virtual Asset Service Providers (“VASPs“) in the UAE. This Resolution marks a significant regulatory milestone in the UAE’s evolving virtual assets landscape, consolidating and modernising the existing framework into a more robust and comprehensive regime tailored to the growing complexity of the virtual asset ecosystem.

WHAT THE RESOLUTION REPEALS

The issuance of the Resolution includes a deliberate and structured repeal of the previous regulatory architecture governing VASPs under the CMA’s remit. Specifically, the Resolution repeals and supersedes the following:¹

• All provisions relating to VASPs and their employees contained in the CMA’s Board of Directors’ Decision No. (13/Chairman) of 2021 on the Regulations Manual of the Financial Activities and Status Regularisation Mechanisms Rule Book (“Financial Activities Rulebook”). ²
• CMA’s Board of Directors Resolution No. (26/R.M) of 2023 Concerning the Regulation of the Virtual Asset Platform Operator.³ 

The Resolution now provides a dedicated and self-contained regulatory framework for VASPs, supported by the following three accompanying modules:⁴

1. General Module: This module addresses general licensing requirements including the licensing process, applicable capital requirements, required personnel, and mandatory systems and controls.
2. Business Regulation Module: This module addresses conduct of business obligations and operational standards.
3. Alternative Trading System Module: This module addresses the regulation of operators of alternative trading systems, which includes multilateral trading facilities and organised trading facilities.

LICENSING UNDER THE NEW REGIME

A. Overview of Licensed Activities

Under the previous regime, virtual asset activities required a Category 7 licence from the CMA, with the following three licensed activities: (i) operation of virtual asset platforms; (ii) brokerage services in virtual assets; and (iii) custody of virtual assets. 

Article 12 of the General Module now enumerates eight distinct financial activities for virtual asset service providers, each with its own defined scope, licensing category and capital requirement. The eight licensed virtual asset activities have been defined below:

1. Dealing in Virtual Assets as Principal: buying, selling, subscribing, or underwriting any virtual assets in the capacity of principal.⁵
2. Dealing in Virtual Assets as Agent: buying, selling, subscribing, or underwriting any virtual assets in the capacity of agent, including as a matched principal.⁶
3. Providing Custody: safeguarding, administering, and managing virtual assets belonging to another person, including through control of cryptographic keys or digital wallets.⁷
4. Arranging Custody: facilitating and organising the process by which custody services are provided by licensed entities, without providing those services directly.⁸
5. Operating a Multilateral Trading Facility (“MTF”): operating a system that matches buy and sell orders of multiple third parties in virtual assets on a non-discretionary basis.⁹
6. Providing Investment Advice: giving personalised advice to a person in their capacity as an investor or a potential investor, or as an agent for either, on the merits of buying, selling, holding, subscribing, or underwriting a specific virtual asset.¹⁰
7. Portfolio Management: managing clients’ virtual assets on a discretionary or non-discretionary basis within an investment portfolio.¹¹ 
8. Arranging Investment Transactions: making arrangements to enable another person to buy, sell, subscribe, or underwrite a virtual asset.¹²

In addition to those activities which were regulated under the previous regime, the new regime introduces dedicated regulatory treatment for provision of investment advice, portfolio management, and arranging of investment transactions as standalone VASP activities. It also introduces the concept of the operation of a Multilateral Trading Facility as a specifically regulated activity under the VASP framework, replacing the broader “platform operator” concept with a more technically precise construct aligned with international standards.

Notably, this approach aligns with the model adopted by the Financial Services Regulatory Authority of the Abu Dhabi Global Market and the Virtual Asset Regulatory Authority in Dubai, with clearly delineated activity-specific virtual asset services, instead of subsuming virtual asset services under existing securities framework. This granular classification accounts for the particularities of virtual assets, while allowing the regulator to licence virtual asset services with the rigors of the traditional securities framework.

It is also significant to note what the new framework expressly excludes from licensed activity. The Resolution prohibits, without exception, all activities relating to privacy tokens and privacy devices¹³ as well as activities relating to algorithmic tokens.¹⁴ The Resolution also restricts activities involving utility tokens and non-fungible tokens, permitting only entities licensed to provide custody or operate an MTF to provide services related to such tokens, and only with prior approval from the CMA.¹⁵

B. Capital Requirements

The CMA has organised the eight activities enumerated above into six licensing categories, with capital requirements calibrated to the nature and risk profile of each activity.¹⁶ Crucially, the framework distinguishes between entities that do not hold client assets and those that do, imposing materially higher capital requirements on the latter. Where multiple activities or categories are combined, the highest applicable capital requirement prevails. The full capital structure under the new regime is set out in the table below:

Two important additional points bear mention. First, Article (21)(3) of the General Module clarifies that holding client assets is not automatically permitted by virtue of a licence, as it mandates a separate prior endorsement from the CMA for holding client assets, in addition to fulfilling the detailed client asset obligations set out in Business Regulation Module. Second, Article (21)(5) confirms that the minimum capital thresholds set out above are a floor only. Licensed entities must, on a continuing basis, satisfy all capital adequacy requirements prescribed under the Capital Adequacy Module under the CMA’s Financial Activities Rulebook.

C. Required Personnel

All VASPs are required to appoint designated persons to perform the required regulatory functions at all times.¹⁷ The table below outlines the required positions (including technical personnel), along with the corresponding regulatory requirements. Further, these roles may be combined, provided that the staffing remains appropriate to the nature, size and complexity of the business, the persons possess the competence to perform their role(s), and there is no conflict of interest. 

In practice, the role combination rules mean a VASP can be staffed with as few as four individuals to satisfy all mandatory positions applicable to all licensed entities. Additional personnel are required depending on the VASP’s licensed activities (see table below). Role combinations are permitted only where staffing remains appropriate to the nature, size and complexity of the business, individuals possess the competence to perform all relevant roles, and no conflict of interest arises.

★ Role must be held by a UAE resident. ✓ Subject to accreditation approval by the CMA. ✗ Accreditation not required.

D. Licensing Process

The new regime follows the same two-stage licensing process as the old regime.

• Stage 1: The applicant entity submits a request for an in-principle approval from the CMA, specifying the activity that they wish to conduct.¹⁸ At this stage, the applicant must demonstrate financial eligibility, prior experience in the relevant field, and the ability to comply with applicable legislation. In addition to the relevant documentation to demonstrate this, the applicant must submit a business plan for carrying out the activity, with detailed revenues and expenses for the first three years of operation.¹⁹ 
• Stage 2: Upon obtaining the preliminary approval, the applicant must fulfil all licensing requirements under the Resolution and the accompanying modules within six (6) months before it can carry out the financial activity. As part of the licensing application, the applicant must submit evidence to demonstrate compliance with all licensing requirements.²⁰ 

For operators of alternative trading systems, the process for licensing under the Alternative Trading System Module remains the same.²¹ They are, however, largely exempt from the General Module and are required to demonstrate compliance with the extensive obligations under the Alternative Trading Systems Module.

E. Fees and Timeline

The timeline for the licensing application under the new VASP regime is as follows:²²

The applicant entity must pay a non-refundable fee for the in-principle approval application²³ and the licensing application,²⁴ as determined by the CMA. Once the license is issued, the licensed entity must pay a license fee for each financial activity that it wishes to conduct. The licence will be valid for one year, and upon its expiration, it can be renewed for a subsequent period of one year by paying the renewal fee, as stipulated by the CMA.²⁵

CONCLUSION

The Resolution, together with its accompanying rulebooks, establishes a renewed and detailed licensing and supervisory framework for VASPs operating within the CMA’s jurisdiction. It represents a decisive shift towards a more mature, structured, and risk-sensitive regulatory regime for VASPs in the UAE. It reflects the UAE’s continued commitment to positioning itself as a leading global hub for digital finance and virtual asset innovation, one that balances market development with investor protection and systemic integrity.

By replacing a fragmented framework with a comprehensive, standalone system, the CMA has clarified licensing categories, expanded the scope of regulated activities, and strengthened prudential and operational requirements. This reform not only enhances investor protection and market integrity but also reinforces the UAE’s ambition to position itself as a leading global hub for virtual asset innovation, grounded in regulatory clarity and institutional robustness.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.