On 1 January 2026, the UAE’s federal securities regulator changed its name and much of its rulebook. Federal Law No. 32 of 2025 reconstituted the Securities and Commodities Authority (SCA) as the Capital Market Authority (CMA), alongside a new federal law on capital markets. For fintechs, introducing brokers and investment firms on the UAE mainland, from those holding a CMA Category 5 licence for promotion and introduction to full brokerage firms, the change is more than a new logo.
It also matters for international groups that manage financial licensing across multiple jurisdictions. The UAE is increasingly a core market rather than an add-on, and its federal regulator is now setting expectations that look much more like those in other major financial centres.
What actually changed
Most of the attention has gone to the name. The more important changes are in governance and control.
Prior approval of senior appointments. Under the new framework, board and executive appointments at licensed entities need the Authority’s prior approval, and the Authority can reject nominations or renewals. For firms used to notifying changes after the fact, this changes how hiring works. A new CEO, compliance head or board member can’t simply start on Monday.
Licence transfers. The new law introduces a way to transfer a financial activity licence to another person, subject to the Authority’s conditions. That opens a route for restructuring and acquisitions that previously meant applying again.
Temporary suspension. Licensed entities can ask for a temporary suspension of their activity for up to 12 months, which can be extended. If the firm doesn’t resume, the licence can be revoked.
Tougher conduct expectations. A companion law raises conduct and compliance standards across the market. Detailed implementing rules are still arriving, but the direction is clear.
Why fintechs should care
The UAE has three main financial regulatory zones: the federal mainland regime, now under the CMA, and the two financial free zones, DIFC (regulated by the DFSA) and ADGM (regulated by the FSRA). Many fintech and brokerage businesses chose the mainland for direct access to UAE residents and banks. The CMA reforms affect them most.
Three practical consequences stand out.
1. Hiring becomes a regulatory project
If executive appointments need prior approval, the gap between choosing a candidate and having them in post gets longer. UAE employment contracts must already set notice periods of 30 to 90 days, and senior people are usually on the full 90. Add an approval step and a replacement for a departing executive can take a quarter or more.
Firms should identify which roles need approval, keep succession plans for each, and prepare approval documents during the notice period, not after it.
2. Corporate deals get a new tool
The licence transfer mechanism could make acquisitions and group restructurings easier. Instead of applying for a new licence when a business changes hands or moves between group entities, there may now be a route to transfer it, subject to the Authority’s conditions.
Buyers should still expect the CMA to look closely at the new holder, its owners and its management, just as regulators elsewhere assess changes of control.
3. Dormant licences have a clock
The temporary suspension option is useful for firms pausing activity. Restructuring, waiting on a partner bank or rethinking the business are all legitimate reasons. But the possibility of revocation if activity doesn’t resume means a dormant licence can’t be parked forever.
How the free zones compare
The CMA reforms apply to the federal mainland. DIFC and ADGM have their own regulators, rulebooks and courts, built on common-law models familiar to international firms. Each zone can suit a different strategy. Firms serving institutional and international clients often favour the free zones, while those focused on UAE retail clients and local distribution often need the mainland.
The CMA’s tighter governance rules narrow some of the practical differences between the regimes. For groups that operate in more than one zone, aligning governance standards across all their UAE entities, rather than running each to its own minimum, is becoming the sensible default.
What hasn’t changed
The basic architecture remains. Mainland firms still need the right licence category for what they do, adequate capital, fit and proper management, a compliance function and AML controls that meet UAE federal requirements. Firms still need to choose carefully between the mainland, DIFC and ADGM based on who their clients are and what they plan to offer.
And as everywhere, banks will ask about your regulator, your compliance team and your controls before they open accounts.
A practical checklist for 2026
For firms already licensed on the mainland:
- Map every role that now needs prior CMA approval and build a succession plan for each.
- Review shareholder and group structures in light of the transfer and change of control rules.
- Check that compliance manuals, AML policies and governance documents reflect the new laws, not the old SCA framework.
- Brief the board on the new conduct expectations and how the firm will evidence compliance.
For firms planning to enter the UAE:
- Decide early between the mainland, DIFC and ADGM. Each has a different regulator, client base and cost profile.
- Budget time for approval of key people, not just the licence itself.
- Line up compliance and MLRO candidates who already understand UAE requirements.
Common mistakes to avoid
The most common mistake is treating the reform as a rebrand and changing only the regulator’s name in policy documents. The second is assuming that a senior hire can start while approval is pending. The third is buying or restructuring a licensed business without checking how the new transfer and approval rules apply. Each is easy to avoid with early planning, and expensive to fix later.
The bigger picture
The move from SCA to CMA is part of a broader trend: fast-growing financial centres tightening governance to match their ambitions. For serious firms, that’s good news. A regulator that scrutinises who runs licensed businesses makes the whole market more credible to banks, investors and international partners.
The firms that adapt early, building succession plans, updating documentation and treating approvals as part of the business plan, will find the new regime easier to work with than the old one.
