Since 1 January 2026 the Capital Market Authority has replaced the Securities and Commodities Authority. The new perimeter does not stop at the free zone boundary: it reaches financial activity carried out from the Dubai International Financial Centre and the Abu Dhabi Global Market towards clients resident elsewhere in the UAE. The test is no longer where the company sits, but where the client sits.
What happened
Two federal decree-laws came into force on 1 January 2026. Decree-Law No. 32 of 2025 turned the Securities and Commodities Authority (SCA) into the Capital Market Authority (CMA), which succeeds it in all legal relationships and holds wider investigative and sanctioning powers. Decree-Law No. 33 of 2025 rewrote the licensing rules for financial activities. Together they repealed Federal Law No. 4 of 2000 in its entirety, the statute that had governed the field since 2000.
What changes in practice
Decree-Law No. 33 of 2025 states expressly that it applies to issuers incorporated in the financial free zones — the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC) — when they offer or trade securities in the UAE. It also covers financial activities carried out from a free zone, or from abroad, when they are directed at onshore clients, meaning persons resident in federal territory outside the free zones. The connecting factor is no longer the place of incorporation: it is the residence of the client the activity is aimed at.
Who it applies to
Financial advisory firms, fund managers, promoters of investment products and capital-raising vehicles licensed in DIFC or ADGM that have, even in part, clients resident in the UAE outside those two free zones. A firm with exclusively foreign clients, or clients inside its own free zone, stays outside the federal perimeter. The check must be run against the client base as it stands today, not against the assumptions the structure was set up on.
The exposure
The common mistake is to reason by geography: a DIFC licence, supervision by the Dubai Financial Services Authority, end of story. Under Decree-Law No. 33 of 2025 that reasoning no longer holds. Carrying out a regulated activity towards onshore clients without the federal licence is unlicensed activity, and the consequences go beyond an administrative fine: they reach the standing of the authorisation the whole structure rests on.
What to do now
Three concrete checks. Extract the client list of the DIFC or ADGM entity and classify it by residence, separating UAE onshore residents from everyone else. Compare the activities actually carried out against the list of regulated financial activities in Decree-Law No. 33 of 2025, bearing in mind that promotion and placement alone fall within it. If onshore clients appear, ask your legal counsel for a written position on whether the federal licence is required, before the next commercial campaign starts.
Sources
- https://www.uaecma.gov.ae/en/new-cma-law
- https://uaelegislation.gov.ae/en/legislations/4001/download
- https://uaelegislation.gov.ae/en/legislations/4002/download
- https://www.clearygottlieb.com/news-and-insights/publication-listing/uae-capital-markets-overhaul-2026-new-regulatory-framework-for-the-capital-market-authority
Published 20 August 2026 on the basis of public sources and official United Arab Emirates instruments. This is not legal or tax advice. Verify your position with a qualified professional before acting.