UAE CMA (formerly SCA) vs DFSA: Understanding the UAE's Dual Regulatory Framework

Table of Contents

• • The UAE’s Dual Regulatory Framework
• • The UAE Capital Market Authority (formerly the Securities and Commodities Authority) (UAE CMA (formerly SCA)) / CMA
• - Key Responsibilities
• - UAE CMA (formerly SCA) Licensing Framework
• - UAE CMA (formerly SCA) Conduct of Business Rules
• • The Dubai Financial Services Authority (DFSA)
• - DFSA’s Regulatory Approach
• - DFSA Authorised Firm Categories
• • Comparing UAE CMA (formerly SCA) and DFSA
• • The Central Bank of the UAE (CBUAE)
• • Exam Strategy for Regulatory Questions
• - Memorization Techniques That Work
• • Staying Current with Regulatory Changes

Key Takeaways

• UAE CMA (formerly SCA) / CMA (Mainland UAE): The Securities and Commodities Authority (SCA) was succeeded by the Capital Market Authority (CMA) effective January 2026. UAE FRR is used in specified approved-job pathways; the employer must confirm the exact examination combination. Read more about the CMA rebrand and what it means for candidates.
• DFSA (DIFC): An independent regulator operating under common law. Do not infer an exam requirement from the office location; confirm the role-specific competence and authorisation requirements.
• FSRA (ADGM): An independent regulator in Abu Dhabi operating under common law. Do not infer an exam requirement from the office location; confirm the role-specific competence and authorisation requirements.
• Action: Preview one UAE FRR syllabus topic using our Free UAE FRR Topic Questions, then use full mock exams for broader practice.

The UAE’s Dual Regulatory Framework

The UAE operates a unique dual regulatory system for financial services, and understanding this framework is essential for anyone preparing for the CISI UAE Financial Rules and Regulations exam. This comparison focuses on two capital-market frameworks, rather than every UAE financial supervisor:

• UAE Capital Market Authority (formerly the Securities and Commodities Authority) (UAE CMA (formerly SCA)) — Oversees financial markets across the UAE mainland
• Dubai Financial Services Authority (DFSA) — Regulates financial activities within the DIFC

Additionally, the Central Bank of the UAE (CBUAE) supervises institutions and activities within its banking, insurance and monetary/payment perimeter, and the FSRA supervises financial services in ADGM. These jurisdictional distinctions are useful professional context, but the current UAE FRR syllabus does not allocate separate DFSA or FSRA elements. Review the latest syllabus changes and weightings against the eight published exam elements.

The UAE Capital Market Authority (formerly the Securities and Commodities Authority) (UAE CMA (formerly SCA)) / CMA

The CMA is the federal capital-markets regulator. The capital-market law distinguishes financial free zones from its onshore perimeter, while provisions concerning dealings within the State can involve foreign or financial-free-zone issuers. Do not infer an exemption from all federal obligations simply from a DIFC or ADGM address.

Important 2026 Update: Effective January 2026, the Securities and Commodities Authority (SCA) was succeeded by the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025. Learn about all the practical implications of the UAE CMA (formerly SCA)-to-CMA rebrand.

The former SCA was established under Federal Law No. 4 of 2000. CMA is its legal successor under the current law; its mandate includes:

Key Responsibilities

• Licensing and supervision of financial markets, brokers, and intermediaries
• Regulating listed companies and ensuring corporate governance
• Protecting investors through market surveillance and enforcement
• Overseeing mutual funds and collective investment schemes
• Combating market abuse including insider dealing and market manipulation

UAE CMA (formerly SCA) Licensing Framework

The UAE CMA (formerly SCA) requires specific licences for different financial activities. Key categories include:

• Brokerage firms — Licensed to execute buy/sell orders on behalf of clients
• Financial advisors — Licensed to provide investment advice (see how to become a licensed financial analyst in the UAE)
• Fund managers — Licensed to manage collective investment vehicles
• Market makers — Licensed to provide liquidity in specific securities
• Custodians — Licensed to hold and safeguard client assets

For the CISI exam, you should understand the licensing requirements, capital adequacy standards, and conduct of business rules that apply to each category. For individual competency routes, technical-exam equivalency may be considered under specific conditions; this is not a firm-licence exemption.

UAE CMA (formerly SCA) Conduct of Business Rules

The UAE CMA (formerly SCA) imposes strict conduct requirements on regulated firms:

• Client classification — Firms must classify clients appropriately and provide suitable protections
• Best execution — Orders must be executed on terms most favourable to the client
• Conflict of interest management — Firms must identify, manage, and disclose conflicts
• Financial promotions — Marketing materials must be fair, clear, and not misleading
• Complaint handling — Regulated firms must maintain complaint procedures

Practical scenario: Imagine a mainland brokerage in Abu Dhabi receives an order from a retail client to purchase shares on the Abu Dhabi Securities Exchange (ADX). The firm must first verify the client’s classification (retail vs. professional), then apply best execution obligations under CMA rules — selecting the execution venue and timing that achieves the best possible outcome for that client. If the firm also holds the same stock in its proprietary book, it must disclose and manage that conflict of interest before proceeding.

The Dubai Financial Services Authority (DFSA)

The DFSA operates within the Dubai International Financial Centre (DIFC), an independently regulated financial free zone. The DIFC has its own legal system, courts, and regulatory framework, modelled on international best practices. For an in-depth look at the DFSA’s latest requirements, see our guide on the DFSA operational resilience framework.

DFSA’s Regulatory Approach

The DFSA follows a risk-based regulatory approach, meaning the intensity of regulation is proportionate to the risk posed by each firm. Key aspects include:

• Authorisation and licensing of firms operating within the DIFC
• Prudential regulation — capital requirements and financial resource management
• Conduct of business regulation — rules governing how firms interact with clients
• Market regulation — oversight of NASDAQ Dubai and the DIFC market
• Anti-Money Laundering — AML/CFT regime within the DIFC, enforced in coordination with the UAE’s national AML framework

Practical scenario: A fintech startup proposes robo-advice from the DIFC. It must identify its actual services and seek the necessary DFSA permissions; commercial registration alone is insufficient. Advice-only activity may fall in Category 4, but managing portfolios or adding other services can change the prudential category. National AML obligations and any business carried on outside the DIFC require their own assessment; there is no general “DIFC gate” exemption from every other obligation.

DFSA Authorised Firm Categories

The current PIB 1.3 rules provide this professional comparison; they are not a separate element of the published UAE FRR syllabus:

Category	Activity	Description
Category 1	Accepting deposits or managing an unrestricted PSIA	Banking and unrestricted profit-sharing investment accounts
Category 2	Providing credit or dealing as principal	Lending or trading with the firm’s own capital
Category 3A	Dealing as agent or operating an alternative trading system	Agency execution and alternative trading systems
Category 3B	Specified custody, fund trustee or employee money-purchase scheme services	Custody for funds or crypto assets and specified trustee or scheme functions
Category 3C	Managing assets or funds and other specified services	Portfolio or fund management, specified custody, trust or stored-value services
Category 3D	Specified payment services	Payment accounts, payment transactions or payment instruments
Category 4	Advising, arranging and other listed services	Advice, arranging, administration and other lower-risk services listed in PIB 1.3.6
Category 5	Islamic financial institution managing an unrestricted PSIA	Sharia-compliant business with unrestricted profit-sharing investment accounts

Apply the full determining-activity rules and category exclusions. A category number is not permission for every activity. An authorised exchange is an Authorised Market Institution, not simply a Category 5 firm.

Comparing UAE CMA (formerly SCA) and DFSA

While both regulators aim to maintain market integrity and protect investors, there are important differences:

Aspect	CMA (formerly SCA)	DFSA
Jurisdiction	UAE mainland	DIFC only
Legal framework	Applicable UAE federal legislation	DIFC laws and DFSA rules within its common-law-based framework
Primary legislation	Federal laws and decisions	DIFC laws and DFSA rulebooks
Governing language	Arabic (official)	English
Appeal mechanism	Applicable administrative and UAE court procedures	FMT review and, with permission, DIFC Court appeal on a point of law
International alignment	International standards within the UAE federal framework	International standards within the DIFC framework
CISI UAE FRR required?	Confirm the approved job and examination combination	Confirm role-specific competence; do not assume the mainland route applies

The Central Bank of the UAE (CBUAE)

The DFSA regulates a range of financial services in or from the DIFC, including banking and insurance. CBUAE separately supervises the institutions and activities within its statutory perimeter:

• Banking sector — licensing, supervision and prudential requirements for banks within its perimeter; identify financial-free-zone and cross-border activity separately
• Insurance sector — CBUAE regulates insurance business within its perimeter under the consolidated law; it is not a separate continuing Insurance Authority. Firms must meet solvency requirements and maintain adequate reserves for policyholder protection
• Monetary policy — managing the UAE dirham, which is pegged to the US dollar, and maintaining monetary stability across the economy
• Payment systems — oversight of payment infrastructure including the UAE Funds Transfer System (UAEFTS) for high-value transfers, the Wages Protection System (WPS), and Stored Value Facilities (prepaid cards and digital wallets)
• AML/CFT — supervision of its regulated institutions under the current federal framework, alongside FIU reporting and national coordination arrangements

The CBUAE, CMA and financial-free-zone regulators all operate within the national AML framework, which is useful context for AML compliance. For UAE FRR preparation, however, follow the AML learning objectives named in the current CISI syllabus rather than studying the DFSA rulebook as an additional exam module. The 7-day UAE FRR revision plan can then be mapped to those published objectives.

Exam Strategy for Regulatory Questions

Questions in the current UAE FRR syllabus test your ability to:

• Identify the relevant mainland authority or market body in scenarios drawn from the published learning objectives
• Apply the cited mainland rules on licensing, funds, markets, AML, client protection and trading; DFSA rules are comparison context, not a separate current syllabus element
• Understand licensing requirements — which activities require which type of licence, and how technical-exam equivalency differs from firm authorisation
• Recognise compliance obligations — conduct of business, reporting, and recordkeeping rules

Memorization Techniques That Work

To retain the complex regulatory distinctions, try these proven approaches:

1. Three-column comparison table: Create a table with CMA, DFSA, and FSRA as column headers. For each regulatory topic (licensing, client classification, AML reporting, capital requirements), fill in the differences side by side.
2. Jurisdiction flowchart: Start with the legal entity, then identify the regulated activity, where it is conducted or marketed, and the actual permissions. Distinguish mainland capital markets (CMA), CBUAE-licensed activities, DIFC (DFSA) and ADGM (FSRA); an office address alone is insufficient.
3. Mnemonic device: Use “CDF” only to recall CMA, DFSA and FSRA names. It is not a licensing decision rule: include CBUAE and check the actual legal scope.
4. Flashcard drills: Use digital flashcards to memorise the key regulatory bodies, their jurisdictions, and their primary responsibilities. Create comparison cards that highlight the differences between CMA and DFSA approaches to the same topic.
5. Timed scenario practice: Give yourself 90 seconds per regulatory scenario question in practice mode. This builds the quick-identification skill the exam demands. For more exam-specific guidance, review the UAE FRR exam fees and booking process.

Staying Current with Regulatory Changes

Both the CMA and DFSA regularly update their regulatory frameworks. Before your exam, check these specific resources:

• CISI website — Always verify you are studying the latest syllabus version. Check the official syllabus and Candidate Update for the sitting; do not assume a universal three-month notice or fixed incorporation delay. Check our syllabus changes and weightings guide for a detailed breakdown.
• CMA portal — The CMA publishes regulatory circulars, board decisions, and updated licensing requirements. Key recent changes include the January 2026 rebrand and updated minimum capital requirements.
• DFSA rulebook — The DFSA maintains a consolidated rulebook online, with tracked changes for recent amendments. Pay particular attention to the General Module (GEN), Conduct of Business (COB), and Anti-Money Laundering (AML) modules.
• CBUAE circulars — The Central Bank regularly issues circulars on AML/CFT compliance, payment system updates, and insurance regulation changes.

CISI tells candidates to check its Candidate Update and the version date of the syllabus for examinable changes; it does not state a fixed incorporation delay. Understanding the wider regulators remains useful professional context, while exam preparation should stay tied to the current learning objectives.

The DFSA Financial Markets Tribunal guide explains the review/appeal distinction in the table. For virtual assets, VARA’s guidance identifies its Dubai perimeter outside DIFC; asset type and activity still matter.