UAE Capital Market Authority Framework Brings Investment Advisors Under Expanded Federal Perimeter

{getToc} $title={Table of Contents}

UAE's new CMA framework brings cross-border investment advisors under federal regulation. Who is in scope and what must change before January 2027.

Federal Decree-Law No. 33 of 2025 explicitly applies to any person targeting UAE clients, even when operating from outside the country or from a financial free zone such as the DIFC or ADGM.
The Capital Market Authority replaces the Securities and Commodities Authority with substantially broader supervisory, enforcement, and early-intervention powers.
Criminal penalties for unlicensed financial activity now include mandatory imprisonment and fines up to AED 250 million, while administrative fines reach AED 200 million.
Virtual assets regulation is integrated into the capital markets perimeter under a new activity-based licensing model with higher capital requirements.
Affected entities must regularise their status by 1 January 2027, subject to discretionary extension by the CMA Board of Directors.
Investment advisors operating cross-border or from free zones must conduct immediate gap analyses and initiate CMA licensing applications before the transition period expires.

A New Federal Perimeter for UAE Capital Markets Regulation

On 1 January 2026, Federal Decree-Law No. 33 of 2025 and its companion Federal Decree-Law No. 32 of 2025 came into force, reconstituting the Securities and Commodities Authority (SCA) as the Capital Market Authority (CMA) and fundamentally expanding the federal regulatory perimeter for investment advisory services in the UAE. The legislation represents the most significant overhaul of UAE securities regulation since the original framework was established in 2000.

For investment advisors operating from the DIFC, ADGM, or jurisdictions outside the UAE, the implications are immediate and consequential. The Capital Market Law codifies an expansive jurisdictional reach that captures cross-border advisory activities directed at onshore UAE clients, regardless of where the advisor is physically located or incorporated. With a hard compliance deadline of January 2027, affected firms face an urgent imperative to assess their licensing position and regularise their status under the new regime.

What the Capital Markets Law Changes for Cross-Border Advisory

The most consequential innovation in the Capital Market Law is its explicit codification of the "directed at" principle. Article 2(1)(d) provides that the law applies to any person targeting clients within the UAE, even if their activity is conducted outside the UAE or from a financial free zone. This resolves a longstanding ambiguity under the previous SCA regime, where regulatory reach was largely tied to domestic execution and physical presence.

In practice, this means an independent financial advisor regulated in London, Singapore, or the Cayman Islands who provides investment advice to UAE-based clients is now presumptively subject to CMA regulation. Marketing materials accessible to UAE residents, promotional emails sent to UAE recipients, and digital platforms permitting access from UAE internet addresses all trigger the jurisdictional threshold.

Crucially, the principle extends to entities established in the DIFC under the Dubai Financial Services Authority (DFSA) or in ADGM under the Financial Services Regulatory Authority (FSRA). Free-zone firms that target onshore UAE clients with regulated activities now fall within the CMA's enforcement perimeter, creating dual compliance obligations. Activities conducted exclusively within a free zone remain subject only to the relevant free-zone regulator, but any outward-facing advisory or marketing directed at the onshore market activates federal requirements.

Key Provisions Reshaping the Regulatory Landscape

Prospectus Liability and Price Stabilisation

The Capital Market Law introduces a unified statutory prospectus liability framework. Article 29 imposes explicit liability on board directors, executive management, and advisers for any failure to provide required information or for including misleading disclosures in offering documents. This applies to both onshore UAE issuers and foreign issuers offering securities into onshore UAE.

Alongside this, a statutory safe harbour for price stabilisation activities resolves a previous ambiguity where standard stabilisation practices could theoretically be prosecuted as market manipulation. Article 37(2) now provides that CMA-approved stabilisation mechanisms do not constitute violations of the Capital Market Law, aligning UAE practice with established international norms for securities distribution.

Enhanced Penalties and Criminal Sanctions

The enforcement escalation is substantial. Administrative fines under Article 65 now reach up to AED 200 million or ten times the profit achieved through a violation, whichever is greater. Criminal sanctions under Article 71 carry mandatory imprisonment of not less than one year and fines from AED 1 million to AED 250 million for offences including practising financial activities without a licence.

By comparison, disclosure-related fines under the previous regime were capped at approximately AED 1 million. The new penalties bring the UAE enforcement framework materially closer to those of major international regulators such as the FCA and ESMA.

Virtual Assets and Recovery Powers

Article 39 integrates virtual asset regulation into the capital markets perimeter. Trading of virtual assets for investment purposes is now prohibited unless the asset is approved and registered with the CMA. Following enactment, CMA Decision No. 4/R.M/2026 introduced a modular licensing framework covering eight distinct virtual asset activities, with materially higher capital and governance thresholds than the previous SCA regime.

Additionally, the law establishes a recovery and resolution regime granting the CMA early-intervention powers over systemically important licensed persons. Under Articles 54 and 55, the CMA may require implementation of recovery measures, mandate structural changes, remove management, or conduct orderly wind-downs. These powers activate where a designated entity breaches or is likely to breach capital or liquidity requirements.

Who Falls Within Scope and the January 2027 Deadline

The definition of regulated financial activities is intentionally comprehensive. It encompasses financial advisory, portfolio management, fund management, promotion, brokerage, custody, underwriting, securitisation, and virtual asset services. Investment advisors providing personalised recommendations regarding the acquisition, disposal, or holding of financial products to UAE-based clients fall squarely within scope.

Certain exclusions apply, including government-issued securities and activities supervised by the UAE Central Bank. However, these carveouts do not substantively reduce coverage for cross-border advisory firms. Importantly, home-country regulatory authorisation - whether from the FCA, MAS, or any other jurisdiction - does not create an exemption from CMA requirements if the advisor engages in regulated activities targeting UAE clients.

All entities subject to the Decree-Laws must regularise their status within one year from entry into force - by 1 January 2027. The CMA Board may grant extensions, but these are discretionary, require formal application, and should not be relied upon as a planning assumption. For firms lacking pre-existing SCA licences, regularisation means initiating and completing the CMA licensing process within this window.

Immediate Compliance Priorities for Affected Firms

The first step is a comprehensive gap analysis examining existing licensing arrangements against the new CMA framework. This should address whether current authorisations cover all activities being conducted, whether the territorial reach of existing licences encompasses cross-border clients, and whether governance and capital infrastructure meets CMA expectations.

For firms operating from the DIFC or ADGM and serving onshore clients, the analysis must determine which specific activities constitute "directed at" conduct. Coordination between CMA requirements and existing DFSA or FSRA obligations will be necessary, as the regulators have not yet articulated detailed mutual recognition arrangements. Dual compliance may require material additional investment.

Following the gap analysis, affected firms should initiate CMA licensing applications immediately. International regulatory experience suggests that foreign adviser licensing processes typically require four to eight months, and CMA processing timelines remain uncertain given the volume of applications expected during the transition period. Waiting until late 2026 creates unacceptable risk of missing the deadline.

What This Means for Independent Financial Advisors and Wealth Managers

For IFAs and wealth managers serving UAE expat communities or high-net-worth individuals, the regulatory shift demands urgent action. Advisors who have historically operated on a cross-border basis must now assess whether their activities fall within the CMA's expanded perimeter. Those providing advice from jurisdictions such as the UK, Hong Kong, or the Channel Islands to clients resident in the UAE are most directly affected. In most cases involving active marketing or ongoing advisory relationships with UAE-based clients, the answer will be yes.

The consequences of inaction are severe. Criminal penalties for unlicensed activity, administrative fines that could reach hundreds of millions of dirhams, and reputational damage from enforcement action all dwarf the cost of proactive compliance. Advisors should view CMA licensing not merely as a defensive measure but as a competitive credential in a rapidly professionalising market where regulatory status increasingly influences client trust and institutional relationships.

What Clients are Asking their Advisors

Does a DIFC or ADGM licence exempt my firm from UAE CMA requirements?

No. If your firm targets onshore UAE clients with regulated financial activities, the Capital Market Law applies regardless of free-zone licensing. Activities conducted exclusively within the DIFC or ADGM remain under their respective regulators, but any marketing, solicitation, or advisory services directed at onshore UAE clients trigger CMA requirements in addition to your free-zone obligations.

What happens if my advisory firm misses the January 2027 regularisation deadline?

Firms that fail to regularise their status face potential criminal penalties including imprisonment of not less than one year and fines up to AED 250 million for conducting unlicensed financial activities. The CMA Board may grant extensions in specific circumstances, but these require formal application and are not automatic. Firms should initiate licensing applications immediately rather than relying on extensions.

How does the CMA define activities 'directed at' UAE clients?

The Capital Market Law captures any person targeting clients within the UAE through regulated financial activities, even when conducted from outside the country or from a financial free zone. This includes marketing materials accessible to UAE residents, solicitation via email or social media, and platform access permitted from UAE internet addresses. The precise boundaries remain subject to CMA guidance as the regime matures.

Are virtual asset advisory services now regulated by the CMA?

Yes. The Capital Market Law integrates virtual assets into the capital markets perimeter. Advisors providing recommendations regarding cryptocurrency or tokenised securities to UAE clients require CMA licensing. CMA Decision No. 4/R.M/2026 introduced a modular framework covering eight virtual asset activities including investment advice and portfolio management, with higher capital and governance thresholds than the previous regime.