CMA Federal VASP Framework

On 13 February 2026, the Capital Markets Authority issued Decision No. 4/R.M/2026 - replacing the UAE's federal VASP framework in its entirety.
This isn't an amendment. It's a ground-up rewrite under the CMA's new mandate (Federal Decree-Law No. 32 of 2025), structured across three modules with eight licensed activity categories, tiered capital floors, hard federal-level prohibitions, and defined processing timelines for the first time.

We've summarised the key practitioner implications below, covering the capital architecture, what's banned outright, the six mandated senior roles and UAE residency requirements, and the compliance deadlines now in effect.

What this means for market participants:

The UAE’s federal regulatory environment for digital assets is now the most structured in the region. The compliance window for existing licensees runs until 13 February 2027; preliminary approval holders have six months.

Compliance with one UAE framework does not substitute for compliance with another. Firms operating across CMA, VARA, ADGM, or CBUAE jurisdictions must satisfy each independently.

CFC MENA is supporting businesses navigating activity mapping, capital modelling, gap analysis, and regulatory submissions under the new framework.