Overview of UAE Financial Regulations 2026: CMA, DFSA, & CBUAE

Table of Contents

• • The Monumental 2026 Regulatory Shifts
• • The Three-Pillar Regulatory Structure
• • CMA: Mainland Securities & Market Conduct
• - Licensing and Fit & Proper Status
• - Corporate Governance
• - Conduct of Business (COB) Standards
• • Anti-Money Laundering (AML/CFT/CPF) Standards
• • Market Conduct & Abuse Prevention
• • Exam Preparation Strategy

The United Arab Emirates has rapidly established itself as a global financial powerhouse, attracting financial institutions and investment professionals from across the globe. However, its regulatory landscape is uniquely dynamic and complex—featuring multiple jurisdictions, independent free zones, and frequent updates that reflect international standards.

Whether you are seeking to understand the local market structure or executing compliance operations, this complete guide provides a structured breakdown of the monumental 2026 regulatory framework.

---

[!IMPORTANT] Preparing for the UAE FRR exam? Try 15 free Investment Funds questions with answer explanations. This is a single-topic preview, not a full mock exam or readiness assessment.

The Monumental 2026 Regulatory Shifts

Two major legislative decrees have completely transformed the financial regulatory environment in the UAE:

1. Reconstitution of UAE CMA (formerly SCA) to the Capital Market Authority (CMA): Effective January 1, 2026, the UAE Capital Market Authority (formerly the Securities and Commodities Authority) (UAE CMA (formerly SCA)) was formally reconstituted as the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025. This establishes a modern, highly focused regulator for securities, derivatives, and corporate capital markets.
2. CBUAE Consolidation (Decree-Law No. 6 of 2025): This landmark law consolidated banking, insurance, and fintech regulation under the Central Bank of the UAE (CBUAE). The official one-year transition window for regulated firms to adapt and comply with these consolidated regulations expires on September 16, 2026.

---

The Three-Pillar Regulatory Structure

The UAE operates a multi-jurisdictional financial regulatory architecture:

• The CMA (Capital Market Authority): Formerly the UAE CMA (formerly SCA), the CMA regulates the mainland securities exchanges—Dubai Financial Market (DFM) and Abu Dhabi Securities Exchange (ADX)—as well as mainland brokerage (including the minimum capital requirements for UAE CMA (formerly SCA)/CMA licensing), fund promotions, and public joint stock companies.
• The DFSA (Dubai Financial Services Authority): Independent regulator for the Dubai International Financial Centre (DIFC) free zone, operating on a common law framework.
• The FSRA (Financial Services Regulatory Authority): Independent regulator for the Abu Dhabi Global Market (ADGM) free zone, operating on a common law framework.

Each authority has its own licensing requirements, rulebooks and enforcement mechanisms. Do not assign a regulator from a group’s office address alone: identify the employing legal entity, the regulated activity, where the service is booked or marketed and any cross-border permission before deciding whether CMA, DFSA, FSRA or CBUAE rules govern the scenario.

---

CMA: Mainland Securities & Market Conduct

The CMA rules form the absolute core of the CISI UAE licensing exam. Key areas of study include:

Licensing and Fit & Proper Status

Under CMA rules, individuals performing “Controlled Functions” (such as Compliance Officers, MLROs, Advisors, and Brokers) must hold active licenses and meet ongoing “Fit and Proper” standards covering technical competence, honesty, and financial stability.

Corporate Governance

Public Joint Stock Companies (PJSCs) listed on the DFM or ADX must comply with the CMA’s Corporate Governance Code. This includes related-party transaction rules, where any transaction exceeding a 5% threshold requires board and shareholder approval, and companies must maintain strict “Insider Lists” with a 15-day blackout period before financial results.

Conduct of Business (COB) Standards

Licensed firms must adhere to strict business conduct rules:

• Client Categorization: Distinguishing between Retail Clients and Professional Clients (who must meet a net worth threshold of AED 3.67 million / USD 1 million or be a regulated institution).
• Suitability & Appropriateness: Ensuring financial recommendations align perfectly with a client’s objectives and risk appetite.
• Best Execution: Taking all reasonable steps to obtain the best possible price and execution terms for client trades.

---

Anti-Money Laundering (AML/CFT/CPF) Standards

AML compliance is a matter of critical priority in the UAE, governed by Federal Decree-Law No. 20 of 2018 and augmented by CBUAE’s updated transaction monitoring rules in April 2026:

• Customer Due Diligence (CDD): Mandatory at onboarding and periodically reviewed. Firms must identify the Ultimate Beneficial Owner (UBO) at a 25% ownership threshold or higher.
• Enhanced Due Diligence (EDD): Required for Politically Exposed Persons (PEPs), high-risk jurisdictions, and complex or unusually large transactions.
• goAML Reporting: Staff indicators should follow the firm’s internal escalation process; once the reporting entity has grounds for suspicion, its authorised compliance function files through the FIU’s goAML portal at the earliest. An STR is used where the suspicious transaction and relevant account information are available, while an SAR can cover suspicious activity or an attempted transaction without that transaction information.
• 5-Year Record Keeping: All KYC, transaction, and compliance records must be preserved for a minimum of 5 years following the transaction date or termination of the business relationship.

---

Market Conduct & Abuse Prevention

CMA actively monitors and prosecutes market abuse:

• Insider Trading: Trading on, or tipping others about, non-public material information is a criminal offense carrying hefty fines and imprisonment.
• Market Manipulation: Practices like wash trading (creating artificial volume), spoofing (submitting orders with intent to cancel), and layering are strictly prohibited.
• Disclosure Timelines: Material developments must be disclosed to the public and the exchange immediately, ensuring fair access to market-moving information.

---

Exam Preparation Strategy

Staying completely abreast of these regulatory shifts is essential for career advancement and operational compliance in the UAE. To ensure you are fully prepared for the CISI UAE FRR exam:

1. Master the Multi-Jurisdictional Model: For each scenario, label the legal entity, activity, client, product and booking location before choosing CMA, CBUAE, DFSA or FSRA. A Dubai address alone does not establish DFSA jurisdiction.
2. Internalize AML/CFT Thresholds: Ensure you know the 25% UBO threshold, the 5-year record-keeping requirement, and the goAML reporting process.
3. Review Corporate Governance Rules: Focus on the 5% related-party transaction threshold and the 15-day insider trading blackout period for PJSCs.
4. Take Scenario-Based Mock Exams: Practice applying the Conduct of Business (COB) rules to realistic client scenarios to test your understanding of Suitability and Best Execution.