What the CMA Now Bans

Most of the conversation around the UAE's new federal crypto framework focuses on how to get licensed - the activities, the capital, the senior roles. But Decision No. 4/R.M/2026 also draws a set of hard lines that no licence can cross. Some business models are now simply off the table, and the prohibitions apply across the whole country rather than a single emirate.

For anyone scoping a product, this is the part to read first. A licensing application built around a prohibited asset is not a slow application - it is a rejected one. Worse, supporting a banned token after licensing can trigger enforcement that puts the entire business at risk. In our experience advising firms on activity classification, the cost of checking your asset list at the design stage is trivial; the cost of discovering the problem later rarely is.

Here are the three categories the CMA bans outright - with no exceptions.

1. Privacy Tokens and Anonymity Tools

Assets engineered to conceal who is transacting, with whom, and for how much are prohibited. That captures the well-known privacy coins - Monero (XMR), Zcash (ZEC), and Dash - as well as any wallet, protocol, or technique designed to obscure transaction trails. The ban also extends to mixing and tumbling services such as Tornado Cash.

The logic is regulatory rather than ideological. Tokens that break the link between an asset and a verified identity make it nearly impossible to meet the Financial Action Task Force (FATF) standards that underpin the UAE's AML regime. Notably, this is not a CMA outlier: VARA has prohibited anonymity-enhanced cryptocurrencies since 2023, and the DFSA reinforced the same ban across the DIFC in January 2026. The federal framework simply unifies the position nationwide.

2. Algorithmic Tokens

Assets that attempt to stabilise their price - or manage another asset's supply and demand - through code rather than real reserves are banned across the board. This is a direct response to the collapse of TerraUSD, which wiped out billions and demonstrated how quickly an algorithmic peg can unravel. Under the new framework, a token presented as a stablecoin must be genuinely backed: the UAE recognises only fiat-backed tokens supported by high-quality, liquid reserves, subject to ongoing verification.

For issuers, the practical message is that 'stable' must now mean reserved, audited, and demonstrable - not merely engineered.

3. Discretionary (Organised) Trading Facilities

All crypto trading must take place on non-discretionary, rules-based platforms. Organised trading facilities that match orders at the operator's discretion are expressly prohibited for virtual assets. The aim is to remove opacity and conflict of interest from the point of execution, ensuring trades are matched by transparent rules rather than judgement calls.

The Grey Zone: Utility Tokens and NFTs

Not everything outside the three bans is automatically permitted. Utility tokens and NFTs sit in a restricted middle ground: licensed firms generally cannot offer services around them, with narrow exceptions - typically custody and trading-platform operation - and only with the CMA's prior approval. If your model relies on these assets, treat their status as a question to resolve early, not an assumption to build on.

Why These Bans Should Shape Your Strategy

The prohibitions are more than a compliance checklist; they signal the kind of market the UAE intends to be. By closing the door on anonymity, algorithmic pegs, and discretionary matching, the regulator is positioning the UAE as institutional-grade financial infrastructure rather than a permissive frontier. That is a feature, not a bug - it is precisely what gives banks, custodians, and institutional capital the confidence to participate.

For founders, the implication is strategic. Building toward transparency, real reserves, and rules-based execution is no longer just good practice - it is the price of entry. The firms that internalise this early tend to move through licensing faster and face fewer surprises in supervision.