For three years, Dubai’s Virtual Assets Regulatory Authority was the most visible crypto regulator in the region, arguably the most internationally recognised. When founders talked about getting licensed in the UAE, they usually meant VARA. That mental model is now out of date, and most operators have not fully registered why.
On 1 January 2026, the UAE’s federal securities regulator, the Securities and Commodities Authority, was reconstituted as the Capital Market Authority. In February it issued a comprehensive new federal framework for virtual assets. Together, these moves quietly repositioned VARA as a local licensing authority operating within, and ultimately beneath, a federal rulebook. The jurisdictional choice a crypto founder makes in the second half of 2026 looks materially different from the one that made sense even twelve months ago.
What actually changed
Two federal decree-laws, No. 32 and No. 33 of 2025, came into force on 1 January 2026. The first reconstituted the SCA as the Capital Market Authority, an independent federal body inheriting all of the SCA’s rights and obligations as its legal successor. The second brought virtual assets explicitly inside the federal capital markets perimeter for the first time, defining them as a Financial Product and giving the CMA authority over virtual asset trading, related services and licensed platforms. This was not a rebrand. It was a formal elevation of federal authority over crypto.
The detail arrived on 13 February 2026, when the CMA issued Decision No. 4/R.M/2026, a standalone rulebook that replaced the old 2023 federal framework in full. It is built on three modules, a General Framework, a Business Regulation module, and an Alternative Trading System module. It establishes eight distinct licensed activity categories, expanded from three under the previous regime, sets minimum capital requirements ranging from AED 500,000 to AED 4 million, prohibits privacy and algorithmic tokens outright, and asserts extraterritorial reach over anyone targeting UAE clients, including from outside the country or from a financial free zone.
Why this is structural, not procedural
Until this shift, the regulatory map was relatively simple to hold in your head. Dubai-based crypto businesses sat under VARA. DIFC and ADGM firms sat under the DFSA and FSRA respectively. The federal SCA operated at a higher level but was less present in day-to-day licensing.
The CMA’s expanded mandate changes that balance. It now sets a federal baseline for onshore virtual asset activity, operating alongside the emirate-level regimes while expressly excluding the DIFC and ADGM financial free zones. The practical consequence is the part founders keep missing: a Dubai-based exchange that serves clients across the wider UAE, not only within Dubai, can now sit under both VARA and CMA jurisdiction at once. Compliance with one regulator’s framework does not substitute for compliance with the other. Depending on its activities, structure and client geography, a single business can face concurrent obligations to VARA, the CMA and the Central Bank of the UAE.
Is VARA being dissolved?
This is the question every operator asks, and the answer, for now, is no. VARA continues to issue substantive guidance. Its updated Exchange Services Rulebook, effective 31 March 2026, introduced a formal regime for exchange-traded virtual asset derivatives including futures, options and perpetuals, one of the most commercially significant openings in the market. More than twenty entities hold VARA licences, and Dubai has invested heavy political and commercial capital in VARA’s international standing.
But the underlying legal architecture has always pointed one way. Cabinet Decisions 111 and 112 of 2022, which remain in force, designate the federal authority as the ultimate regulator and enable it to delegate licensing to local bodies like VARA. The direction of travel under the 2026 framework is toward the federal rulebook becoming the primary standard over time, with VARA’s role shifting gradually from independent regulator toward local implementation arm. A mutual recognition framework between the CMA and VARA has been formalised and is being implemented, which should reduce duplication as it matures, though full cross-recognition with the free zones has not yet been delivered. Until it is, the transitional period imposes cumulative obligations rather than a single clean licence.
The decision framework for the second half of 2026
The upshot is that jurisdiction choice can no longer be made on reputation alone. Onshore UAE under the CMA, Dubai under VARA, DIFC under the DFSA and ADGM under the FSRA now each carry different levels of federal exposure. The right route depends on the specific mix of a firm’s products, client base, ownership structure and capital position, not simply on which jurisdiction has historically been branded the most crypto-friendly.
Three operational actions follow directly. First, conduct a gap analysis against the two decree-laws and CMA Decision 4/R.M/2026, regardless of whether the business currently holds a VARA, DFSA, FSRA or mainland licence. Second, review every token the business lists or offers, since trading a virtual asset onshore is prohibited unless it has been accepted onto the official list maintained by a CMA-licensed platform and registered with the CMA, meaning some tokens may become untradeable once the transitional period ends. Third, reassess overall licensing strategy, because the expanded eight-category framework may require additional approvals for firms previously licensed under the narrower structure.
The tokenisation complication
The real-world asset tokenisation boom adds another layer. The Dubai Land Department moved its tokenised property title initiative from pilot into a regulated secondary market, with resale trading of roughly 7.8 million property tokens beginning on 20 February 2026 through the VARA-licensed platforms Prypco Mint and Ctrl Alt. Sitting across this are two clarifications that matter: the federal regulator has indicated that real-world asset tokens are not treated as securities unless the underlying asset is itself a security, while VARA has separately created a regulated category for asset-referenced virtual assets. A founder building in this specific space therefore faces an even more layered set of jurisdictional questions than a standard exchange or custody business, and should treat legal structuring as a first-order design decision rather than an afterthought.
What to do now
The temptation is to wait. The transitional window looks generous on paper, with existing operators given until 1 January 2027 to regularise their status and the Business Regulation and ATS modules carrying a compliance window running to 13 February 2027. That comfort is deceptive. Pre-approval and licensing processes in the UAE’s virtual asset space routinely take twelve to eighteen months. A firm that begins its gap analysis now is positioned to meet the deadline comfortably. A firm that waits until late 2026 is positioned to discover the deadline has arrived before its application has cleared.
The deeper shift is one of posture. The era in which a founder could pick a UAE jurisdiction by asking which regulator was the friendliest is closing. A federal floor is being laid beneath all of them, and regulatory literacy has become an operating discipline rather than a one-time hurdle. The founders who map the perimeter now, and design their structure around where the framework is heading rather than where it has been, will move faster as the regime matures. Those who treat the UAE as a quick licensing stop will find the ground has shifted beneath them.
Sources: Cleary Gottlieb, UAE Capital Markets Overhaul 2026, January 2026; Chambers and Partners, Blockchain & Crypto-Assets 2026, UAE, 2026; Clyde & Co, The UAE Capital Markets Authority Replaces the Federal VASP Framework, April 2026; Pnyxhill, UAE Crypto Licensing 2026: From SCA to CMA, April 2026; Horizons & Co, New UAE Virtual Asset Rules: CMA Decision 4, April 2026; Legal500, The Implications of the UAE’s New Securities and Investment Laws, April 2026; Forbes, UAE Crypto Regulations 2025 Recap, Irina Heaver, December 2025; Dubai Land Department and UAE Advisor Guide, Real Estate Tokenisation Phase II, February 2026.
