Do not describe your company as licensed by the UAE's Capital Markets Authority until a license has actually been issued, and do not treat an application as equivalent to approval in a press release. That distinction matters more than usual right now because the UAE just stood up an entirely new federal licensing regime for virtual asset businesses, with a compliance deadline a little over a year away. The Securities and Commodities Authority was renamed the Capital Markets Authority (CMA) on January 1, 2026, and the CMA has since issued implementing rules that put eight specific virtual asset activities under a licensing requirement for the first time at the federal level. Here is what actually changed and what it means for how you talk about it.
What changed, and when?
Two things happened roughly in sequence. First, a federal law restructured the regulator: the SCA became the CMA on January 1, 2026. Separately, Federal Decree-Law No. 33 of 2025, which also took effect that same day, created the legal basis for the new virtual asset regime, including its transition timeline and penalties. Then, in April 2026, the CMA issued its implementing rules, Board of Directors Resolution No. 4/R.M of 2026, setting out the eight activities that now require a CMA license and the conditions attached to each.
Which eight activities now need a CMA license?
Two independent legal analyses of the Resolution agree on the same list: dealing in virtual assets as principal, dealing as agent (including as matched principal), providing custody of virtual assets, arranging custody without providing it directly, operating a multilateral trading facility, providing investment advice on virtual assets, portfolio management of virtual assets, and arranging investment transactions in virtual assets. If your business does any of these for UAE-based clients and is not already licensed by a recognized regulator, this framework now applies to you by activity, not by how your company happens to describe itself.
In plain terms, an exchange buying and selling tokens against its own balance sheet is dealing as principal. A platform that matches buyers and sellers without taking the other side of the trade is operating a multilateral trading facility. A firm holding client tokens in its own wallets is providing custody, while a firm that merely connects a client to a separate custodian is arranging custody rather than providing it. The activity-based structure means two companies that both call themselves "a crypto exchange" in their own marketing can land in different licensing categories, or in more than one at once, depending on what their platform actually does mechanically.
What should a crypto business actually do between now and the deadline?
Confirm which of the eight activities, if any, your business actually performs, and do that before drafting anything for public consumption. A company already licensed by VARA, the DFSA or the FSRA should confirm in writing that its existing license covers its UAE-wide activity, rather than assuming it does. A company with no existing license that falls under one of the eight categories should start the application process well before the January 2027 deadline, since a license issued at the last minute leaves no room for a delay on the regulator's side. Neither of those steps is a PR decision, but both determine what a PR team can honestly say afterward, so loop communications in once the legal and compliance work is underway, not after a release has already gone out describing a status the company does not yet have.
Does this apply if your company is set up in DIFC or ADGM?
No. Both legal analyses are explicit that the framework does not extend to the UAE's financial free zones, named as the Dubai International Financial Centre and Abu Dhabi Global Market. Those zones keep their own regulators, the DFSA in DIFC and the FSRA in ADGM. And if your virtual asset business operates in Dubai outside those free zones, the Virtual Assets Regulatory Authority remains the governing regulator there, not the CMA. The CMA's framework is built to sit alongside VARA, the DFSA and the FSRA, filling the federal gap for activity that falls outside all three, mainly virtual asset business based in the other emirates. If you are already licensed by one of those three regulators, nothing here changes your status, and you should not imply otherwise.
What is the actual deadline, and what happens if you miss it?
Under Article 83 of Federal Decree-Law No. 33 of 2025, entities already conducting an in-scope activity when the law took effect have one year from that date, so until January 1, 2027, to bring their status into line. A legal analysis by Icon Partners notes the law allows the CMA to extend that window, but no extension had been issued as of the analysis. The same analysis points to Article 71 of the same law for what happens after that: operating a regulated virtual asset activity without a license carries a minimum of one year in prison and a fine ranging from AED 50,000 to AED 250 million. That is a wide range, and the analysis notes the law provides no general safe harbor for activity that continues unlicensed past the deadline, so a company genuinely unsure of its own transitional status should confirm it with counsel or the CMA directly rather than guess.
What can you actually say about this in a press release right now?
Say exactly where you are in the process, and nothing further. "Licensed by the CMA" means a license has been issued, full stop. "Has applied to the CMA for a virtual asset license" or "is in the process of CMA licensing" are accurate if that is genuinely where things stand, and a reporter or a regulator reading either phrase cannot mistake it for the first one. This is the same discipline VARA's own marketing rules require in Dubai, and it is the same instinct behind why the SEC's crypto asset taxonomy matters for what a project can claim in the US: regulators read PR language as a factual claim, not marketing color, and an overstated one invites exactly the scrutiny a young crypto business can least afford.
Is a licensing application newsworthy enough to announce at all?
Usually not on its own, and announcing one prematurely can work against you. A reporter covering crypto regulation in the Gulf has seen enough companies announce an "application" that never converts into a license to treat the announcement itself skeptically. The more durable story, the kind that holds up in the kind of ongoing coverage a token launch needs, is the license itself once issued, paired with specifics: which of the eight activities it covers, what it lets the business do that it could not do before, and what compliance commitments came with it. If you are weighing whether to distribute that announcement through a paid newswire or through direct pitching, the distribution choice matters as much as the timing does.
The direct answer, for anyone who read this far
The UAE now licenses eight virtual asset activities federally through the CMA, the deadline to regularize an existing business is January 1, 2027, DIFC and ADGM entities are exempt, and Dubai activity outside those free zones stays with VARA. Say precisely where your company stands in that process, licensed, applied, or neither, and resist the pull to round an application up to a license in your own materials. If you want help turning an actual CMA license, once issued, into coverage that a Gulf business reporter will run, talk to us.
