SCA vs DFSA: Understanding the UAE's Dual Regulatory Framework

Table of Contents

• • The UAE’s Dual Regulatory Framework
• • The Securities and Commodities Authority (SCA) / CMA
• - Key Responsibilities
• - SCA Licensing Framework
• - SCA Conduct of Business Rules
• • The Dubai Financial Services Authority (DFSA)
• - DFSA’s Regulatory Approach
• - DFSA Authorised Firm Categories
• • Comparing SCA and DFSA
• • The Central Bank of the UAE (CBUAE)
• • Exam Strategy for Regulatory Questions
• - Memorization Techniques That Work
• • Staying Current with Regulatory Changes

Key Takeaways

• SCA / CMA (Mainland UAE): The Securities and Commodities Authority was formally reconstituted as the Capital Market Authority (CMA) effective January 2026. It requires the CISI UAE FRR exam for mainland licensed professionals. Read more about the CMA rebrand and what it means for candidates.
• DFSA (DIFC): An independent regulator operating under common law. Does not require the CISI UAE FRR exam.
• FSRA (ADGM): An independent regulator in Abu Dhabi operating under common law. Does not require the CISI UAE FRR exam.
• Action: Test your readiness using our Free UAE FRR Sample Paper.

The UAE’s Dual Regulatory Framework

The UAE operates a unique dual regulatory system for financial services, and understanding this framework is essential for anyone preparing for the CISI UAE Financial Rules and Regulations exam. Two primary regulators oversee the financial sector:

• Securities and Commodities Authority (SCA) — Oversees financial markets across the UAE mainland
• Dubai Financial Services Authority (DFSA) — Regulates financial activities within the DIFC

Additionally, the Central Bank of the UAE (CBUAE) oversees banking, insurance, and the monetary system. For CISI candidates, understanding how these three entities interact — and where their jurisdictions begin and end — is crucial. You can also review the latest syllabus changes and weightings to see how much of the exam focuses on each regulator.

The Securities and Commodities Authority (SCA) / CMA

The SCA is the primary regulator for securities and commodities markets across the UAE, excluding the DIFC.

Important 2026 Update: Effective January 2026, the SCA has been formally reconstituted as the Capital Market Authority (CMA). Learn about all the practical implications of the SCA-to-CMA rebrand.

Established by Federal Law No. 4 of 2000, the SCA (now CMA) mandate covers:

Key Responsibilities

• Licensing and supervision of financial markets, brokers, and intermediaries
• Regulating listed companies and ensuring corporate governance
• Protecting investors through market surveillance and enforcement
• Overseeing mutual funds and collective investment schemes
• Combating market abuse including insider dealing and market manipulation

SCA Licensing Framework

The SCA requires specific licences for different financial activities. Key categories include:

• Brokerage firms — Licensed to execute buy/sell orders on behalf of clients
• Financial advisors — Licensed to provide investment advice (see how to become a licensed financial analyst in the UAE)
• Fund managers — Licensed to manage collective investment vehicles
• Market makers — Licensed to provide liquidity in specific securities
• Custodians — Licensed to hold and safeguard client assets

For the CISI exam, you should understand the licensing requirements, capital adequacy standards, and conduct of business rules that apply to each category. Some entities may qualify for licensing exemptions under specific conditions.

SCA Conduct of Business Rules

The SCA imposes strict conduct requirements on regulated firms:

• Client classification — Firms must classify clients appropriately and provide suitable protections
• Best execution — Orders must be executed on terms most favourable to the client
• Conflict of interest management — Firms must identify, manage, and disclose conflicts
• Financial promotions — Marketing materials must be fair, clear, and not misleading
• Complaint handling — Regulated firms must maintain complaint procedures

Practical scenario: Imagine a mainland brokerage in Abu Dhabi receives an order from a retail client to purchase shares on the Abu Dhabi Securities Exchange (ADX). The firm must first verify the client’s classification (retail vs. professional), then apply best execution obligations under CMA rules — selecting the execution venue and timing that achieves the best possible outcome for that client. If the firm also holds the same stock in its proprietary book, it must disclose and manage that conflict of interest before proceeding.

The Dubai Financial Services Authority (DFSA)

The DFSA operates within the Dubai International Financial Centre (DIFC), an independently regulated financial free zone. The DIFC has its own legal system, courts, and regulatory framework, modelled on international best practices. For an in-depth look at the DFSA’s latest requirements, see our guide on the DFSA operational resilience framework.

DFSA’s Regulatory Approach

The DFSA follows a risk-based regulatory approach, meaning the intensity of regulation is proportionate to the risk posed by each firm. Key aspects include:

• Authorisation and licensing of firms operating within the DIFC
• Prudential regulation — capital requirements and financial resource management
• Conduct of business regulation — rules governing how firms interact with clients
• Market regulation — oversight of NASDAQ Dubai and the DIFC market
• Anti-Money Laundering — AML/CFT regime within the DIFC, enforced in coordination with the UAE’s national AML framework

Practical scenario: A fintech startup registers in the DIFC to offer robo-advisory services. It must apply to the DFSA for a Category 4 licence (advising on financial products). The DFSA assesses the firm’s technology infrastructure, cyber-resilience plans, and operational processes before granting authorisation. The startup reports exclusively to the DFSA — the CMA has no jurisdiction inside the DIFC gate.

DFSA Authorised Firm Categories

Understanding these categories is important for the exam:

Category	Activity	Description
Category 1	Dealing in investments as principal	Trading with the firm’s own capital
Category 2	Dealing as agent	Executing trades on behalf of clients
Category 3A	Managing assets	Discretionary portfolio management
Category 3C	Managing collective investments	Fund management
Category 4	Advising on financial products	Investment advice
Category 5	Operating an exchange	Running a financial exchange

Each category has different capital requirements, governance standards, and conduct obligations.

Comparing SCA and DFSA

While both regulators aim to maintain market integrity and protect investors, there are important differences:

Aspect	CMA (formerly SCA)	DFSA
Jurisdiction	UAE mainland	DIFC only
Legal framework	UAE civil law	English common law (DIFC)
Primary legislation	Federal laws and decisions	DIFC laws and DFSA rulebooks
Governing language	Arabic (official)	English
Appeal mechanism	UAE courts	DIFC courts
International alignment	IOSCO principles	UK FCA-inspired framework
CISI UAE FRR required?	Yes, for licensed roles	No

The Central Bank of the UAE (CBUAE)

While the CMA and DFSA focus on securities and investment, the CBUAE provides critical oversight of broader financial infrastructure:

• Banking sector — licensing, supervision, and prudential regulation of all banks operating in the UAE, including setting capital adequacy ratios and liquidity requirements
• Insurance sector — the Insurance Authority (IA), now integrated under the CBUAE, regulates insurance companies, brokers, and actuaries. Firms must meet solvency requirements and maintain adequate reserves for policyholder protection
• Monetary policy — managing the UAE dirham, which is pegged to the US dollar, and maintaining monetary stability across the economy
• Payment systems — oversight of payment infrastructure including the UAE Funds Transfer System (UAEFTS) for high-value transfers, the Wages Protection System (WPS), and Stored Value Facilities (prepaid cards and digital wallets)
• AML/CFT — national-level coordination of anti-money laundering efforts through the National Anti-Money Laundering and Counter Terrorism Financing Committee (NAMLCFTC)

For CISI exam purposes, understanding how the CBUAE interacts with the CMA and DFSA in areas like AML compliance is important. The CBUAE sets the national AML standards, while the CMA and DFSA enforce them within their respective jurisdictions. For a structured study approach to this topic, consider our 7-day UAE FRR revision plan.

Exam Strategy for Regulatory Questions

Regulatory questions in the CISI exam often test your ability to:

• Identify which regulator has jurisdiction in a given scenario — this is the single most tested skill in the regulatory section
• Apply the correct rules — CMA and DFSA rules differ in areas such as client classification thresholds and capital requirements
• Understand licensing requirements — which activities require which type of licence, and how licensing exemptions apply
• Recognise compliance obligations — conduct of business, reporting, and recordkeeping rules

Memorization Techniques That Work

To retain the complex regulatory distinctions, try these proven approaches:

1. Three-column comparison table: Create a table with CMA, DFSA, and FSRA as column headers. For each regulatory topic (licensing, client classification, AML reporting, capital requirements), fill in the differences side by side.
2. Jurisdiction flowchart: Draw a decision tree: “Where is the firm physically located?” → Mainland = CMA; DIFC = DFSA; ADGM = FSRA. This simple visual eliminates most scenario-based confusion.
3. Mnemonic device: Use “CDF” — CMA for the Country (mainland), DFSA for Dubai’s DIFC, FSRA for Abu Dhabi’s Free zone.
4. Flashcard drills: Use digital flashcards to memorise the key regulatory bodies, their jurisdictions, and their primary responsibilities. Create comparison cards that highlight the differences between CMA and DFSA approaches to the same topic.
5. Timed scenario practice: Give yourself 90 seconds per regulatory scenario question in practice mode. This builds the quick-identification skill the exam demands. For more exam-specific guidance, review the UAE FRR exam fees and booking process.

Staying Current with Regulatory Changes

Both the CMA and DFSA regularly update their regulatory frameworks. Before your exam, check these specific resources:

• CISI website — Always verify you are studying the latest syllabus version. The CISI publishes syllabus update notices at least 3 months before changes take effect. Check our syllabus changes and weightings guide for a detailed breakdown.
• CMA portal — The CMA publishes regulatory circulars, board decisions, and updated licensing requirements. Key recent changes include the January 2026 rebrand and updated minimum capital requirements.
• DFSA rulebook — The DFSA maintains a consolidated rulebook online, with tracked changes for recent amendments. Pay particular attention to the General Module (GEN), Conduct of Business (COB), and Anti-Money Laundering (AML) modules.
• CBUAE circulars — The Central Bank regularly issues circulars on AML/CFT compliance, payment system updates, and insurance regulation changes.

Significant regulatory changes are typically incorporated into the CISI exam within 6–12 months of implementation. Understanding these key UAE regulators is fundamental to both exam success and professional competence. The knowledge you gain preparing for this section will serve you throughout your finance career in the UAE.