.svg)
.png)
If you already hold a UAE virtual asset licence, the new federal framework comes with a date you cannot ignore: 13 February 2027. That is the end of the one-year transitional period the CMA granted when Decision No. 4/R.M/2026 took effect, and it is the deadline by which existing licensees must align with - and obtain approval under - the new regime's Business Regulation and ATS Modules.
A year sounds generous. It rarely is. The framework did not refine the old rules; it replaced them, raising the bar on capital, governance, and compliance all at once. Closing that distance means a structured gap analysis across your entire operation - and capital restructuring, senior appointments, and compliance uplift are not exercises you complete in a fortnight.
Having supported firms through precisely this kind of regulatory migration, we have seen a consistent pattern: those who start their gap analysis early move through the transition calmly, while those who wait find themselves competing for advisers, regulator attention, and senior hires at the worst possible moment. Here is a practical checklist to get ahead of it.
1. Map Your Activities to the New Categories
The framework licenses eight standalone activities, and the old broader permissions do not map across cleanly. Begin by matching what you actually do today against each new category - dealing as principal, dealing as agent, custody, operating a multilateral trading facility, portfolio management, advice, and arranging. Any activity you conduct needs its own authorisation. Gaps identified here drive every other workstream, so this is the right place to start.
2. Stress-Test Your Capital
Capital requirements have increased across most activities, particularly where you take balance-sheet or trading risk. Confirm you meet the fixed minimum for each activity, then run the binding calculation: your requirement is the highest of the fixed floor, a risk-based figure, and an expense-based test (broadly 25–35% of annual operating expenses). On top of that, you must hold liquid resources covering at least six months of operating costs. For many firms, the effective number sits well above the headline floor.
3. Review Your Senior Team and Substance
The CMA expects accountability to sit in the UAE. You need six designated senior roles - CEO, Senior Executive Officer, Compliance Officer, MLRO, Finance Director, and Internal Auditor - with the CEO, Compliance Officer, and MLRO resident in the country. Firms that have relied on offshore management or heavily outsourced compliance will need material restructuring, and senior hires take time to source, vet, and onboard. This is often the longest-lead workstream of all.
4. Uplift Your Compliance and AML Framework
AML/CFT is now positioned as a foundational licensing requirement, not a supplementary one. Refresh your customer due diligence, transaction monitoring, and risk management so they are proportionate to your licensed activities. Build in the new operational duties too: six-year record retention, client classification reviews, annual technology audits, cybersecurity testing, and 72-hour incident reporting.
5. Screen Your Assets Against the Prohibitions
Check your supported tokens against the federal bans on privacy tokens, algorithmic tokens, and discretionary trading venues. If any prohibited asset sits in your product, the time to plan a wind-down or pivot is now - not during a regulator review.
6. Build a Backwards Timeline to Submission
Finally, work your plan backwards from 13 February 2027, not forwards from today. Allow time for capital injection, recruitment, documentation, and the CMA's own processing window. A realistic timeline treats the deadline as the finish line for approval, not the date you begin the conversation.
Why Early Movers Win
The transitional runway is real, but the regulator's direction is unmistakable: post-transition, supervisory engagement will be more deliberate and routine. Firms that invest in governance and substance early will be best placed as the regime matures - and will avoid the bottleneck of a market-wide scramble in the closing months of 2026. Treating the deadline as a project to be managed, rather than a problem to be deferred, is the single biggest predictor of a smooth migration.
Key Takeaways
- 13 February 2027 is the hard date: existing licensees must be compliant and re-approved under the new modules by then.
- Activity mapping comes first: the old permissions don't translate directly to the eight new categories.
- Capital is the higher of three tests: plus a six-month liquidity buffer - budget beyond the floor.
- Substance takes the longest: six senior roles, three UAE-resident, are often the critical-path item.
- Plan backwards: build your timeline from the deadline, allowing for the CMA's processing window.
A gap analysis is only daunting until it is mapped. CFC MENA runs exactly this exercise for firms migrating to the new framework - across activities, capital, governance, and AML - turning a compliance deadline into a clear, sequenced plan. If you hold a UAE licence, speak to our team to start your gap analysis well before February 2027.
.png)
Jun 2, 2026
What the CMA Now BansPrivacy tokens, algorithmic tokens and discretionary venues are now banned across the UAE. Here are the CMA's new red lines - and what they mean for your business.
%201.svg){kind=small}