TRW & Co · Banking, Finance & Capital Markets
Securities Regulation in the UAE
Securities regulation in the UAE was rebuilt on 1 January 2026, when the Capital Market Authority replaced the SCA under two new federal decree-laws. Issuers, brokers, platforms and foreign firms targeting UAE investors face new licensing, prospectus liability and penalty rules, while the DIFC and ADGM keep their own regimes. Regularisation is due within a year.
Key pointThe 2025 decree-laws reach anyone targeting UAE clients from abroad or from a free zone, so a DIFC, ADGM or overseas firm serving onshore investors can need CMA authorisation even though its home licence is unchanged.
At a glance
CMA replaced the SCA
Federal Decree-Laws No. 32 and 33 of 2025 took effect on 1 January 2026, repealing Federal Law No. 4 of 2000 and creating the Capital Market Authority.
Sixteen regulated activities
The new law lists sixteen licensable activities, from brokerage and custody to fund management, virtual asset and crowdfunding services, and the CMA board can add more.
Penalties up to AED 250m
Administrative fines reach AED 200 million or ten times the gain; criminal fines range from AED 1 million to AED 250 million with minimum imprisonment.
One-year regularisation
Entities covered by the new law must regularise their status within one year from 1 January 2026, unless the CMA extends the deadline.
Free zones keep own rules
Activity conducted exclusively in the DIFC or ADGM stays under the DFSA or FSRA, but targeting onshore clients brings the CMA's rules into play.
Swipe or scroll →
What securities regulation in the UAE covers
Securities regulation in the UAE is the body of law that governs how shares, bonds, sukuk, units, derivatives and, increasingly, virtual assets are issued, offered, listed, traded, cleared and promoted, and who may carry on securities business for others. It protects investors through disclosure, licensing and market integrity rules, and it gives regulators the power to investigate and sanction.
The question arises for many more businesses than listed companies. A private company raising capital from a wide group of investors, a foreign issuer selling bonds to UAE banks, a broker onboarding UAE residents online, a family business planning an IPO, a fintech launching a trading app and a board deciding whether to announce a contract all face securities rules.
The landscape changed fundamentally on 1 January 2026, when new federal capital markets legislation replaced a regime that had stood since 2000. Most market participants are still working through the consequences, and the transition period closes at the start of 2027.
The legal framework after the 2026 reform
Federal Decree-Laws No. 32 and 33 of 2025
Federal Decree-Law No. 32 of 2025 reconstituted the Securities and Commodities Authority (SCA) as the Capital Market Authority (CMA), a federal authority with financial and administrative independence that reports to the Cabinet. Federal Decree-Law No. 33 of 2025 on the Regulation of the Capital Market sets the substantive rules. Both took effect on 1 January 2026 and repealed Federal Law No. 4 of 2000; the texts are available through the UAE Legislation portal.
The CMA is the SCA's legal successor, and references to the SCA in other legislation now read as references to the CMA. Earlier Cabinet decisions and SCA resolutions remain in force where they do not conflict with the new laws, until replaced. Federal Decree-Law No. 22 of 2020, which divides competencies between the regulator and the licensed markets, also remains in force.
Scope and reach
The capital markets law covers financial products and activities onshore. It also reaches anyone who targets clients in the UAE with a regulated activity from outside the country or from a financial free zone, and it covers foreign issuers, including DIFC- and ADGM-incorporated issuers, that offer or trade securities in the UAE. Activity conducted exclusively inside the DIFC or ADGM remains outside the CMA's authority.
Government-issued securities and funds are excluded unless publicly offered or listed, and activities licensed or supervised by the Central Bank of the UAE fall outside the law.
The financial free zones
In the DIFC, the Markets Law (DIFC Law No. 1 of 2012) and the DFSA Markets Rules in the DFSA Rulebook govern offers of securities, the DFSA's Official List and market disclosure, with Nasdaq Dubai as the main exchange. In ADGM, the Financial Services and Markets Regulations 2015 and the FSRA Market Rules in the ADGM rulebook perform the same role, with the FSRA acting as listing authority.
| Area | Onshore | DIFC | ADGM |
|---|---|---|---|
| Regulator | Capital Market Authority (CMA) | DFSA | FSRA |
| Core legislation | Federal Decree-Laws No. 32 and 33 of 2025 | Markets Law 2012; Markets Rules | FSMR 2015; Market Rules |
| Exchanges | Abu Dhabi Securities Exchange (ADX); Dubai Financial Market (DFM) | Nasdaq Dubai | FSRA-recognised investment exchanges |
| Listing authority | CMA with the relevant market | DFSA (Official List) | FSRA (Official List) |
| Courts | Onshore federal and emirate courts | DIFC Courts | ADGM Courts |
Licensing securities business
The new law lists sixteen regulated activities, including operating exchanges and trading platforms, clearing, central depository services, brokerage, fund establishment and management, portfolio management, underwriting, financial advisory, custody, and virtual asset and crowdfunding activities. The CMA board can add activities by resolution. No one may carry on a regulated activity without the required licence or approval.
Licensees face tighter governance supervision. Appointments to the board and executive management need prior CMA approval, close links must be notified, and the CMA may require changes to links that impede supervision. A licensee may ask to suspend its licence temporarily for up to twelve months, extendable, but failure to resume can lead to revocation. The CMA's powers survive for three years after a licence ends for conduct discovered in that period.
For the free-zone equivalents, see DIFC financial regulation and ADGM financial regulation. Our article on securities licensing after the capital markets reform goes deeper on the onshore application.
Every entity covered by the new federal law must regularise its status within one year of 1 January 2026, a deadline the CMA may extend. Brokers, advisers, promoters and foreign firms serving onshore clients should map their current permissions to the new list of regulated activities now, rather than in December.
Public offers, prospectuses and listings
Onshore IPOs usually involve converting a company into a public joint stock company under Federal Decree-Law No. 32 of 2021 on Commercial Companies, obtaining CMA approval of the prospectus and listing on ADX or DFM. Our guide to the IPO process in the UAE sets out the stages. Free-zone issuers list on Nasdaq Dubai or apply to the FSRA's Official List under their own rules, and some issuers pursue dual listings.
Prospectus liability under Article 29
The new law imposes statutory prospectus liability on the issuer's board, executive management and advisers, each within their area of competence, for omitting required information or for misleading or inaccurate information. Knowingly including incorrect data, or signing or distributing a prospectus known to be incorrect, carries a minimum one-year prison term and fines. The same standard applies to onshore and free-zone issuers offering securities onshore, and the CMA may suspend an issuance that would breach the law.
The CMA's fee resolution, effective 31 August 2026, sets an AED 75,000 fee for approving a prospectus for public joint stock company shares and introduces separate fees for foreign and free-zone issuers, including registration of capital increase shares for listing.
Price stabilisation
Article 37(2) creates a safe harbour for price stabilisation carried out under the controls of the CMA or the relevant market. This removes an uncertainty that previously made bookrunners cautious about over-allotment and stabilisation trades in UAE IPOs.
Disclosure, market abuse and enforcement
Securities regulation in the UAE now draws a sharper line between disclosure duties and market abuse. Under Article 33(2), an issuer may delay disclosing inside information where immediate disclosure would seriously harm its interests or its shareholders' interests, but only on written request: to the CMA for unlisted securities and to ADX or DFM for listed securities. The regulator or market may accept with conditions, refuse and require disclosure, or later amend its decision.
Article 37 prohibits manipulative trading, false or misleading information, insider dealing and exploiting knowledge of investors' orders. Foreign issuers dealing in their securities in the UAE fall within market oversight and must provide documents and reports to the CMA even if unlisted. Our market conduct practice covers trading surveillance, insider lists and dealing codes, and our corporate governance team advises listed boards on disclosure committees.
Delaying disclosure is now a regulated decision, not a board's private judgement: if you need time, ask the CMA or the market in writing before the information leaks.
Enforcement, penalties and investor protection
The penalties are among the most significant features of the reform. Administrative sanctions under Article 65 include warnings, fines of up to AED 200 million or ten times the profit made or loss avoided, trading suspensions of up to three years, suspension of directors or staff for up to a year, and licence revocation. Markets may fine their participants up to AED 1 million per violation.
Criminal offences under Article 71 carry at least one year's imprisonment and fines from AED 1 million to AED 250 million, and courts may disqualify directors for up to five years and confiscate funds. Article 75 allows the CMA to settle offences before proceedings start, under Cabinet controls; unsettled matters go to the Public Prosecution.
The law also provides an Investor Protection Fund (Article 44), a Settlement Guarantee Fund that the central clearing house may establish (Article 45) and protection for whistle-blowers (Article 60), including immunity from liability and from retaliation at work. The CMA may designate systemically important licensees, require recovery plans and use early intervention and resolution powers. If you receive a CMA request, see our regulatory investigations page.
- Triage the request. Identify the legal basis, the deadline, the entities and individuals named, and whether the matter is supervisory, investigative or potentially criminal.
- Preserve and collect. Issue a document hold covering emails, chat and trading records, and secure order data before routine deletion cycles run.
- Establish the facts. Run a privileged internal review where appropriate, interview key staff and reconstruct trading or disclosure timelines.
- Engage with the regulator. Respond accurately and on time, agree the scope of production and correct any misunderstanding early.
- Assess settlement. Consider whether a settlement under Article 75 is available and in the company's interest before referral to prosecution.
- Remediate. Fix control failures, update insider lists and dealing codes, and document the changes for the regulator and the board.
Virtual assets inside the securities perimeter
The new law treats virtual assets as financial products. Under Article 39, trading any virtual asset in the UAE is prohibited unless it is on the list of a CMA-licensed platform operator that is registered with the CMA. The CMA has since issued a dedicated 2026 virtual assets framework with a transition period for existing licensees. Dubai's VARA regime and the DIFC and ADGM token rules continue alongside it; our virtual assets page maps the perimeters.
Documents and evidence to assemble
Most problems under securities regulation in the UAE are won or lost on paper. Regulators ask for records quickly, and the documents a business holds on the day a request arrives decide how credibly it can respond. Build the file before it is needed.
- Licence map: every regulated activity the group performs, the licensing entity and regulator, and the client jurisdictions served.
- Governance approvals: CMA, DFSA or FSRA approvals for directors, executives and control functions, and notifications of close links.
- Offering records: offering documents, offeree lists, investor classification evidence and the exemption relied on for each private placement.
- Prospectus verification: verification notes, due diligence reports, board minutes approving the prospectus and advisers' sign-offs.
- Disclosure records: disclosure policy, insider lists, written requests to delay disclosure and the regulator's or market's response.
- Dealing controls: personal account dealing codes, closed-period notices, trade surveillance alerts and how each was resolved.
- Marketing approvals: sign-off records for promotions, social media content and any paid promoters or finfluencers.
For listed issuers, the board should also hold an annual compliance report to the audit committee that tests these records against the new law. That report becomes powerful evidence of good faith if a regulator later questions a disclosure or trading decision.
Key decisions under securities regulation in the UAE
Three decisions shape most mandates. The first is where to raise capital: onshore listing on ADX or DFM gives access to a deep domestic retail and institutional base, while Nasdaq Dubai or ADGM offers a common-law framework and English-language rulebooks that some international investors prefer. Dual listing can capture both but doubles the disclosure workload.
The second is how to reach UAE investors: through an onshore licensed entity, through a licensed intermediary, or only by genuine reverse enquiry. Under securities regulation in the UAE after 2026, the third option is narrower than many firms assume, because targeting is assessed from the firm's conduct rather than its intentions.
The third is how to manage information. Boards that adopt a written disclosure policy, keep insider lists current and decide early whether to request a delay rarely face market abuse questions. Boards that improvise under deal pressure frequently do.
Risks and common mistakes
Assuming a private raise is outside securities regulation
Offers to a wide audience of individuals, or offers made through online platforms, can amount to a public offer even when the issuer calls them private. The new law also reaches certain private placements. Before circulating an information memorandum, confirm the exemption you rely on, cap and record the offerees, check their classification, and avoid general advertising. A misjudged private placement can trigger prospectus requirements, unlicensed activity findings and rescission claims from investors.
Serving onshore clients from a free zone or overseas
Many DIFC and ADGM firms and overseas brokers have historically assumed that clients who approach them are fair game. The new law expressly covers persons targeting UAE clients from outside the UAE or from a free zone. Marketing, onboarding flows, local events and social media campaigns aimed at UAE residents may all count as targeting. Review distribution models and, where needed, obtain onshore licensing or work through a licensed intermediary.
Leaks before an announcement
Rumours about a transaction, a large contract or a profit warning often reach the market before the issuer is ready. If the issuer has not obtained approval to delay disclosure, a leak can leave it in breach and expose insiders to dealing allegations. Keep insider lists current, restrict information on a need-to-know basis, prepare a holding announcement in advance and agree in writing with the CMA or the market before relying on a delay.
Treating finfluencer and social media promotion as marketing only
Paid promotion of securities or financial products through social media can be a regulated activity, and the onshore regulator has brought finfluencers within a licensing framework. A listed company or broker that pays an influencer to discuss its products may share responsibility for the content. Approve scripts, check the promoter's status and keep records. See our guide to financial promotions and finfluencers.
Underestimating personal exposure
Directors, executives and advisers carry individual liability for prospectus statements within their competence, and courts can disqualify directors for up to five years. Board minutes that show directors questioned verification work, received due diligence reports and challenged forecasts are the best protection. Directors' and officers' insurance should be checked against the new penalty levels.
Cross-border securities regulation in the UAE
Cross-border securities regulation in the UAE matters because UAE issuers raise capital internationally and foreign issuers target UAE investors. A Saudi or Indian company considering a dual listing on ADX or DFM must satisfy home and UAE rules together, and GCC cross-listings increasingly feature in regional capital markets planning.
UK and EU investors in a UAE offering bring their own prospectus exemptions and financial promotion rules; US investors usually require Rule 144A or Regulation S structuring. Singapore-based investors and managers face MAS offer rules. For Bangladeshi issuers and investors, Bangladesh Securities and Exchange Commission requirements and Bangladesh Bank foreign exchange rules govern participation, and TRW & Co's Dhaka team coordinates that side. Chinese investors may rely on outbound investment schemes with quota and approval conditions.
How TRW & Co helps
We advise issuers, boards, brokers, platforms and investors on securities regulation in the UAE across onshore, DIFC and ADGM regimes, linking closely with our M&A and directors duties practices.
Reform readiness
We map existing SCA-era licences and approvals to the CMA's list of regulated activities and plan regularisation before the transition deadline.
Capital raising
We advise on IPOs, private placements, bonds and sukuk, prospectus content and verification, and dual listing across ADX, DFM, Nasdaq Dubai and ADGM.
Disclosure and market abuse
We build disclosure policies, insider lists and dealing codes, and advise boards in real time on whether and how to request a disclosure delay.
Cross-border distribution
We review how foreign and free-zone firms reach UAE clients and redesign distribution to stay within the CMA's perimeter.
Investigations and enforcement
We manage CMA, DFSA and FSRA inquiries, internal reviews and settlement strategy. Where court representation is required, we work alongside locally licensed advocates and registered practitioners.
Governance for listed companies
We support boards and committees on governance codes, related party transactions and shareholder engagement.
To discuss a transaction or a regulatory issue, contact TRW & Co or browse our practices.
Checklist for boards and decision-makers
- Confirm whether your business carries on any of the sixteen regulated activities and whether each is licensed by the CMA, DFSA or FSRA.
- Plan regularisation under the new federal law before the transition period ends, allowing for CMA queries.
- Review any marketing that targets UAE residents from a free zone or abroad.
- Check private placement exemptions before circulating offering documents.
- Update disclosure policies to reflect the written request process for delaying inside information.
- Refresh insider lists, dealing codes and price stabilisation arrangements for any planned offering.
- Brief directors on personal prospectus liability and the new penalty ceilings, and review D&O cover.
- Prepare an investigation response protocol, including document preservation and whistle-blower handling.
Frequently asked questions
01Is the SCA still the securities regulator in the UAE?
No. From 1 January 2026, Federal Decree-Law No. 32 of 2025 reconstituted the Securities and Commodities Authority as the Capital Market Authority. The CMA is the SCA's legal successor, so existing licences, contracts and obligations carry over, and references to the SCA in other laws now refer to the CMA. Earlier SCA resolutions continue to apply where they do not conflict with the new decree-laws, until the CMA replaces them. Entities covered must regularise their status within one year.
02Does the CMA regulate firms in the DIFC and ADGM?
Not for activity carried on exclusively inside those financial free zones, which remain under the DFSA and the FSRA. However, the capital markets law covers anyone who targets clients in the UAE with a regulated activity from a free zone or from abroad, and it applies to DIFC- and ADGM-incorporated issuers that offer or trade securities in the UAE. A free-zone firm with onshore clients should analyse whether it needs CMA licensing or should use a licensed onshore intermediary.
03What are the penalties for insider dealing or market manipulation?
Administrative sanctions include fines of up to AED 200 million or ten times the profit made or loss avoided, trading suspensions of up to three years and licence revocation. Criminal penalties carry at least one year's imprisonment and fines between AED 1 million and AED 250 million, and courts can disqualify directors for up to five years and confiscate funds. The CMA may settle an offence before proceedings begin, under Cabinet controls; otherwise the matter is referred to the Public Prosecution.
04Can a listed company delay announcing inside information?
Yes, but only with permission. Under Article 33(2) of the new capital markets law, an issuer may delay disclosure where immediate disclosure would seriously harm its interests or those of its shareholders. It must submit a written request, to ADX or DFM for listed securities or to the CMA for unlisted securities. The regulator or market may accept with conditions, refuse and require disclosure, or later amend or revoke its decision. Confidentiality must be maintained throughout.
05Who is liable for errors in a prospectus?
Article 29 imposes statutory liability on the issuer's board members, executive management and advisers, each within their area of competence, for omitting required information or providing misleading or inaccurate information. Knowingly including incorrect data, or signing or distributing a prospectus known to be incorrect, can lead to imprisonment of at least one year and fines. The rule applies equally to onshore issuers and to free-zone issuers offering onshore, so directors should insist on a documented verification process.
06When must existing firms comply with the new securities law?
The decree-laws took effect on 1 January 2026, and entities to which they apply must regularise their status within one year, so by 1 January 2027 unless the CMA board extends the period. Firms should map existing permissions to the sixteen regulated activities, check governance approvals for directors and executives, review cross-border distribution, and update disclosure and market abuse procedures. Starting early leaves room for CMA queries and any new applications.
07Are virtual assets regulated as securities in the UAE?
The new law treats virtual assets as financial products within the CMA's remit. Article 39 prohibits trading a virtual asset in the UAE unless it is listed by a CMA-licensed platform operator registered with the CMA, and the CMA issued a dedicated virtual assets framework in 2026. Dubai's VARA continues to license virtual asset service providers in Dubai, and the DIFC and ADGM run their own token regimes, so the right regulator depends on location and activity.
Sources and official materials
- Capital Market Authority (UAE) — Federal securities regulator, successor to the SCA from 1 January 2026
- UAE Legislation portal — Official texts of federal decree-laws including the 2025 capital markets laws
- Dubai Financial Market — Onshore exchange listing and disclosure
- Nasdaq Dubai — DIFC exchange regulated by the DFSA
- DFSA Rulebook — DIFC Markets Law and Markets Rules
- ADGM FSRA Rulebook — FSMR 2015 and FSRA Market Rules
- ADGM Financial Services Regulatory Authority — ADGM regulator and listing authority
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
