What the Decree-Law does
Federal Decree-Law No. 33 of 2025 does three structurally important things at the federal layer of the UAE virtual asset perimeter.
1. It replaces the SCA with the Capital Market Authority (CMA)
The Securities and Commodities Authority is being succeeded by the Capital Market Authority — a federal authority with consolidated and broadened statutory powers across the UAE capital markets. The transition is progressive: implementing regulations are being issued through 2026, and existing SCA registrations and approvals are being read across to the CMA under transitional provisions. The architectural relationship between the federal CMA and the financial free-zone regulators (DFSA, FSRA) and the dedicated virtual asset regulator (VARA) is preserved, with the federal layer remaining the apex.
2. It brings virtual assets explicitly within the federal perimeter
Where the prior federal architecture treated virtual assets through Cabinet Decisions and delegations, Federal Decree-Law No. 33 of 2025 places virtual assets used for investment purposes within the CMA's primary statutory remit. This is a status change: the federal authority's interest in virtual assets is no longer derivative; it is direct.
3. It asserts extraterritorial reach
The Decree-Law asserts CMA authority over activities that target UAE clients from outside the UAE or from a financial free zone, where the activity sits within the federal perimeter. This is the most commercially material provision for international firms that have, until now, served UAE clients on a cross-border basis without a UAE foothold. The expectation is that such firms will require either UAE authorisation or a documented basis for cross-border activity that can be defended under the new federal regime.
The federal–free-zone architecture, after the Decree-Law
The post-Decree-Law architecture preserves the relationships familiar from the pre-Decree-Law regime, but tightens them. A simplified map is below:
| Layer | Authority | Scope |
|---|---|---|
| Federal apex | CMA (successor to SCA) | UAE-wide capital markets perimeter, including virtual assets used for investment purposes; extraterritorial reach over activities targeting UAE clients. |
| Dubai (ex-DIFC) | VARA, with federal back-stop | Primary VASP licensing in Dubai; VARA licensees auto-registered with the federal authority under the existing Cabinet delegation; UAE-wide reach (excluding DIFC). |
| DIFC | DFSA | Crypto Token regime within the DIFC perimeter, as amended 12 January 2026. |
| ADGM | FSRA (regulated) + RA (commercial) | FSRA-regulated virtual asset activities within ADGM; common-law framework. |
| Free zones (non-financial) | DMCC, DWTC and others | Commercial licensing of unregulated activities; regulated VA activity requires federal-tier or VARA licensing. |
| Mainland | Department of Economy & Tourism (DET) | Mainland commercial licensing; regulated VA activity requires federal-tier or VARA licensing. |
What this means for licensing strategy in 2026
1. The "no UAE entity, just serve UAE clients" model is closing
International firms that have served UAE clients without a UAE entity should expect to make a decision in 2026: either obtain a UAE authorisation appropriate to their activity, or document a defensible cross-border basis and live with the supervisory exposure. The extraterritorial-reach provision is the operative pressure point. Firms should not wait for an enforcement action to test their position.
2. VARA + DMCC remains a strong primary architecture
For firms that will hold a regulated virtual asset advisory licence in Dubai (excluding DIFC), the VARA primary entity coupled with a DMCC sister entity for unregulated services remains a strong primary architecture. The Cabinet Resolution No. 112 of 2022 delegation is preserved under the new federal regime: VARA licensees are auto-registered with the federal authority and may operate UAE-wide (excluding DIFC).
3. ADGM FSRA Cat 4 + ADGM RA holds as a credible alternative
For firms that place high weight on the common-law jurisdiction and on cross-border (Saudi, GCC, broader MENA, Europe) workflows, the ADGM FSRA Category 4 + RA architecture remains a credible alternative. The federal layer's interaction with the financial free zones is unchanged in structure; it is the cross-border serving-UAE-clients-from-outside model that is most affected.
4. DIFC firms should re-test their perimeter alongside the January 2026 amendments
The DFSA's January 2026 Crypto Token amendments and Federal Decree-Law No. 33 of 2025 are independent but related shifts. DIFC firms should re-test their token perimeter against both: the DFSA suitability standard (firm-as-gatekeeper, post-12-January) and the federal perimeter (does any activity fall outside DIFC's regulated remit and into the federal capital markets perimeter?).
5. Non-financial free zones remain valid for unregulated services
DMCC, DWTC and equivalent non-financial free zones remain valid homes for unregulated professional-services activity — compliance advisory, training, BPO, internal audit. The boundary between unregulated services and regulated activity is, however, increasingly tested. Firms should periodically review their service catalogue against the federal perimeter, particularly where the activity touches advice, arrangement, dealing or management.
The Decree-Law does not unsettle the architecture. It tightens the seams between the layers, and pulls international firms that previously served UAE clients on a cross-border basis into the perimeter.
Implementation through 2026 — what to monitor
The Decree-Law is being progressively implemented through 2026 via implementing regulations, transitional provisions and the formal stand-up of the CMA's operating architecture. CASA's regulatory monitoring stack is tracking the following items in particular:
- Implementing regulations defining the precise scope of CMA primary authority over virtual assets used for investment purposes.
- Transitional provisions for existing SCA registrations and approvals — including auto-registration of VARA licensees under the new regime.
- The CMA's operationalisation of its supervisory model, including its relationship with the financial free-zone regulators.
- Implementing regulations or guidance addressing the extraterritorial-reach provision and the documentation expected of firms relying on a cross-border basis to serve UAE clients.
- Any additional Cabinet Resolutions that reset or supplement the existing delegations to VARA, the financial free-zone regulators or other federal authorities.
Practical adjustments most boards should sequence in 2026
- A federal-perimeter test on the firm's current and planned activity catalogue, identifying any activity that may now sit within the CMA's primary perimeter.
- A cross-border serving-UAE-clients position paper for international firms without a UAE entity, with a defensible basis or a documented decision to obtain UAE authorisation.
- A UAE licensing pathway review, re-running the VARA, ADGM FSRA, DFSA and DMCC/DWTC pathways against current commercial and supervisory considerations under the new federal regime.
- A regulatory monitoring cadence that captures CMA implementing regulations as they are issued through 2026, with a defined escalation path to the board where any adjustment to the firm's licensing or operating posture is implicated.
How CASA helps
- Federal Perimeter Diagnostic — a fixed-fee assessment of the firm's activity catalogue against the post-Decree-Law federal perimeter, with a board-ready position paper and a sequenced remediation plan.
- Licensing pathway re-evaluation — a structured comparison of the VARA, ADGM, DFSA and unregulated-free-zone pathways against the firm's commercial profile.
- Regulatory monitoring stack — quarterly briefings and ad-hoc alerts as CMA implementing regulations are issued through 2026.
Want a 30-minute call on how the Decree-Law affects your licensing posture?
Brief our teamReferences: Federal Decree-Law No. 33 of 2025; Cabinet Decision No. 111 of 2022; Cabinet Resolution No. 112 of 2022; VARA Compliance and Risk Management Rulebook; DFSA Crypto Token Rules (as amended 12 January 2026); ADGM FSRA Conduct of Business Rulebook; ADGM FSRA Guidance on the Regulation of Virtual Asset Activities.
This briefing is general commentary by CASA and does not constitute regulated legal, financial or investment advice. Firms should confirm specific positions with retained counsel and the relevant supervisory authority.