The UAE virtual asset framework that governed onshore crypto firms since 2023 has been replaced outright. In its place sits Decision No. 4/R.M/2026, issued by the newly constituted Capital Markets Authority (CMA) under Federal Law No. 33 of 2025 — a rulebook that does not amend the old Securities and Commodities Authority regime so much as retire it and start again. Eight discrete licensed activities replace the previous broad categories, capital floors rise across most of them, and licensed firms must now hold liquid resources covering at least six months of operating expenses.
Key takeaways: the federal VASP regime is fully replaced, not amended; eight standalone activity licences now apply; capital and liquidity thresholds rise materially; senior compliance roles must sit onshore; and VARA, DIFC and ADGM regimes are untouched.
What the new UAE virtual asset framework licenses
Decision 4/R.M/2026 breaks the old perimeter into eight separately licensed activities. Firms must hold authorisation for each activity they carry out — a bundled licence no longer covers adjacent business lines. The activities include dealing in virtual assets as principal, dealing as agent, custody, operating multilateral trading facilities, portfolio management, investment advice and arranging investment transactions.
The practical effect is that a firm running an order book, holding client assets and advising on allocations is now looking at three authorisations rather than one. Law firm Clyde & Co, which published one of the earliest detailed reads of the decision, described the shift as a move away from market-access-led regulation towards a model built around institutional resilience and supervisory discipline.
Secondary summaries from UAE counsel also report that the decision draws hard lines around certain asset types — a prohibition on privacy tokens whose obfuscation features sit awkwardly with federal AML standards, and the exclusion of algorithmic stablecoins from the recognised virtual asset list. Those specifics have not been independently confirmed against the published text here, so treat them as reported rather than settled.
Capital and liquidity: the quiet barrier to entry
The capital architecture is where the new UAE virtual asset framework bites hardest. Minimum capital requirements have risen across most activities, with the steepest floors attached to firms that take balance sheet or trading risk — dealing as principal now carries one of the highest thresholds under the regime. Platform operators face graduated requirements depending on whether they run a standalone venue or a combined offering.
Layered on top is a liquidity test with no equivalent in the previous framework: firms must maintain liquid financial resources sufficient to cover at least six months of operating expenses. That is a deliberate recalibration rather than a technicality. It filters for businesses that can survive a quiet quarter, and it prices out the thinly capitalised intermediaries that clustered around the earlier regime. Law-firm summaries have cited minimum capital bands running from roughly AED 500,000 to AED 4 million depending on activity; firms should verify the applicable figure against the decision itself rather than press coverage.
Governance has to live onshore now
Under the UAE virtual asset framework, licensed firms must appoint defined senior roles spanning executive management, compliance, AML/CFT oversight, finance and internal audit. Critically, certain key positions must be held by UAE-resident individuals. For operators that ran lean local entities with decision-making and compliance functions parked offshore, this is the provision that forces restructuring rather than paperwork.
AML and CFT compliance is positioned as a foundational licensing condition rather than an add-on obligation. Firms are expected to evidence client due diligence, transaction monitoring and risk management arrangements proportionate to each licensed activity — an approach that rhymes with the direction VARA has taken in Dubai, where supervisors have pushed licensees towards continuous, data-driven risk assessment.
How it sits alongside VARA, DIFC and ADGM
The federal UAE virtual asset framework does not displace the emirate-level regimes. VARA remains the competent authority for virtual asset businesses established in Dubai outside the DIFC, and the DIFC and ADGM continue to operate under their own rulebooks — both financial free zones are expressly excluded from the CMA decision. What 4/R.M/2026 establishes is a federal baseline for onshore activity that runs alongside those regimes.
For firms operating across more than one UAE jurisdiction, that makes regulatory mapping a live exercise rather than a filing formality. Overlapping licensing, capital and governance requirements now need to be reconciled deliberately. Our guide to which UAE regulator actually covers you and the running VARA-licensed VASP tracker are useful starting points for that mapping.
What it means
The UAE spent four years competing for crypto businesses on speed and accessibility, and the rebuilt UAE virtual asset framework closes that chapter. Decision 4/R.M/2026 marks the point where the federal layer stops optimising for onboarding and starts optimising for durability. That is a normal maturation curve — the same one the EU walked under MiCA and Hong Kong walked under its VASP regime — but it lands with unusual force here because it replaces rather than revises.
The winners are well-capitalised institutional operators and incumbents already carrying real compliance infrastructure. The losers are the long tail of lightly staffed intermediaries that treated a federal licence as a marketing asset. Transitional arrangements apply, but the gap analysis across capital, governance and compliance is not a weekend exercise: capital restructuring and senior hiring both run on timelines measured in quarters. Firms still waiting to see how supervisors interpret the decision are, in effect, spending their transition period.
The open question is enforcement posture. A framework this demanding is only as real as the CMA’s willingness to police it, and early supervisory guidance will tell the market far more than the text does.
FAQ
Does the new UAE virtual asset framework apply to firms licensed by VARA, DIFC or ADGM?
No. Decision 4/R.M/2026 sets a federal baseline for onshore virtual asset activity. VARA remains the competent authority for Dubai businesses outside the DIFC, and the DIFC and ADGM are expressly excluded and continue under their own rulebooks.
What happens to firms already licensed under the old SCA regime?
Transitional arrangements apply, but the previous framework has been replaced in full rather than amended. Existing licensees will need a gap analysis across capital, governance and compliance and must migrate to the new activity-based licences; the scale of the changes means capital restructuring and senior appointments should be started early.
Sources: Capital Markets Authority Decision No. 4/R.M/2026 as analysed by Clyde & Co and CMS. Further reading: our UAE regulator guide and VARA VASP tracker, linked above. This article is news and analysis, not legal, tax or investment advice; verify the decision text and take professional advice before acting.
