Virtual Asset Service Providers and ATS Regulation

Issues the regulation of virtual asset service providers and alternative trading system operators: licensing categories and in-principle approval, systems, controls and cybersecurity, business conduct (client agreements, suitability, conflicts, records), market conduct and penalties. It repealed Decision No. 26/Chairman of 2023.

Summary

Decision No. 4/Chairman of 2026 issues the Capital Market Authority's (CMA) regulation of virtual asset service providers (VASPs) and alternative trading system operators, in three modules: a General Framework Module, a Business Regulation Module and an Alternative Trading System Module (Article 1). It was issued on 13 February 2026 under Federal Decree-Laws No. 32 and 33 of 2025 and Cabinet Resolution No. 111 of 2022, published on 27 February and in force from 28 February 2026 (Article 7). It repealed Decision No. 26/Chairman of 2023 on virtual asset platform operators and the VASP provisions of the Regulations Manual, keeping only their licensing and accreditation conditions until regularisation ends (Article 6). Existing licensees have one year from 28 February 2026 to meet the business and ATS modules (Article 3); pending applications without in-principle approval lapsed and must be refiled without a new fee (Article 5).

The General Framework Module applies to anyone conducting VASP activities in or from the State for virtual assets used for investment purposes (Article 2). Article 4 prohibits, without a CMA licence, operating virtual asset platforms, exchange between virtual assets, transfers, brokerage, custody, and services linked to offering or selling virtual assets. Privacy tokens, privacy devices and algorithmic tokens are banned outright (Articles 5 and 6), and licensees may not deal in utility tokens or NFTs except custody or trading facilities with prior approval (Article 7). A trading facility must register each virtual asset with the CMA before listing it, and the CMA may publish a Green List of recognised assets (Articles 8 and 9).

Article 12 maps the activities to eight regulated financial activities, and Article 21 sets six licensing categories with minimum capital: AED 4 million for dealing as principal, AED 3 million for custody, AED 1 million for agency dealing, advice, arranging and portfolio management, and AED 500,000 for operating a multilateral trading facility, or a percentage of annual expenses (25% or 35%) if higher. Applicants first seek in-principle approval, decided within 45 working days, then have six months, extendable once, to meet licensing requirements (Articles 23 to 26). The module adds governance, compliance, cybersecurity and personnel rules, a physical head office in the State (Article 65), "Licensed by the Capital Market Authority" disclosure on business documents (Article 64), annual licences ending each calendar year (Article 88) and prior approval for controllers. The Business Regulation Module covers client classification, client agreements, suitability, conflicts and records.

Who it applies to

Any person carrying on, or seeking to carry on, virtual asset service activities in or from the UAE outside the financial free zones, including CMA-licensed VASPs and virtual asset trading platforms, their controllers, board members and accredited employees, and applicants for in-principle approval.

Contents

English official text in 94 articles. Open the full text or jump to a provision:

1. Article 1
2. Article 2
3. Article 3
4. Article 4
5. Article 5
6. Article 6
7. Article 7
8. Article 8 — Submission of Notice for Virtual Asset Registration
9. Article 9 — Recognition of Virtual Assets
10. Article 10 — Publication
11. Article 12 — Financial Activities
12. Article 14 — Dealing in Virtual Assets as An agent
13. Article 15 — Providing Custody
14. Article 16 — Arranging Custody
15. Article 17 — Operating a Multilateral Trading Facility
16. Article 18 — Providing Investment Advice
17. Article 19 — Portfolio Management
18. Article 20 — Arranging Investment Deals
19. Article 21 — Licensing Categories and Capital
20. Article 23 — Conditions for Obtaining In principle Approval
21. Article 24 — Submission of In principle Approval Request
22. Article 25 — Evaluation of In principle Approval Request
23. Article 26 — Approval or Rejection
24. Article 28 — Allocation of Significant Responsibilities
25. Article 30 — Organization
26. Article 31 — Risk Management
27. Article 32 — Compliance
28. Article 33 — Internal Audit
29. Article 34 — Business Plan and Strategy
30. Article 35 — Management Information
31. Article 36 — Employees and Agents
32. Article 37 — Continuing Professional Development (CPD)
33. Article 38 — Conduct
34. Article 39 — Outsourcing
35. Article 40 — Business Continuity and Disaster Recovery
36. Article 41 — Records
37. Article 42 — Fraud
38. Article 43 — Corporate Governance
39. Article 44 — Remuneration Structure and Strategies
40. Article 45 — Reporting of Violations
41. Article 46 — Complaints and Their Handling
42. Article 47 — Cybersecurity Risk Management Framework
43. Article 48 — Third-Party Cybersecurity Risk Management
44. Article 49 — Responsibilities of the Board of Directors and Senior Management in Cybersecurity Risk Management
45. Article 50 — Identification and Assessment of Cybersecurity Risks
46. Article 51 — Protection of ICT Assets from Cybersecurity Incidents
47. Article 52 — Detection, Response, and Recovery
48. Article 53 — Reporting Cybersecurity Incidents
49. Article 54 — Positions Required at the Licensed Entity
50. Article 55 — Persons Occupying Positions Subject to Approval
51. Article 56 — Technical Positions Required at the Licensed Entity
52. Article 57 — Persons Occupying Technical Positions Subject to Approval
53. Article 59 — Principles Applicable to the Licensed Entity
54. Article 60 — Principles Applicable to Persons
55. Article 62 — Interpretation
56. Article 63 — Emergencies
57. Article 64 — Disclosure of Regulatory Status
58. Article 65 — Head Office
59. Article 66 — Close Links
60. Article 67 — Supervision and Investigation
61. Article 68 — Communication with the Authority
62. Article 69 — Public Register
63. Article 71 — Submission of License Application
64. Article 72 — Submission of Approval Application
65. Article 73 — Application Evaluation
66. Article 74 — Approval or Rejection Decision
67. Article 75 — Fees
68. Article 77 — Application for Accredited Person Status
69. Article 78 — Evaluation of the Application for Accredited Person Status
70. Article 79 — Approval or Rejection Decision
71. Article 80 — Fees
72. Article 81 — Temporary Coverage, Termination of Service, or Resignation of an Accredited Persons
73. Article 82 — Memorandum of Association and Ownership
74. Article 83 — Financial Reporting
75. Article 84 — Accounting Records
76. Article 85 — External Audit
77. Article 86 — Notifications
78. Article 87 — Appointment of an Independent Expert
79. Article 88 — License Duration and Renewal
80. Article 89 — License or Financial Activity Cancellation
81. Article 90 — Voluntary Liquidation
82. Article 91 — Protective Composition (Arrangement) Against Bankruptcy
83. Article 92 — Bankruptcy Procedures
84. Article 93 — Excluded Holdings
85. Article 94 — Prior Approval for Control Purposes
86. Article 95 — Requirements for Prior Approval
87. Article 96 — Approval or Rejection
88. Article 97 — Notification of Decrease in Control Level in the Licensed Entity
89. Article 98 — Notification Requirements Regarding Control Changes in Branches
90. Article 99 — Obligations of the Licensed Entity Regarding the Controller
91. Article 100 — Powers of the Authority
92. Article 101 — Key Characteristics Document
93. Article 102 — White Paper Publication
94. Article 103 — Risk Warnings

Key provisions

Obligations and deadlines

• Obtain a CMA licence before carrying on any virtual asset activity in or from the State (General Framework Module, Article 4).
• Existing licensees must comply with the Business Regulation and ATS Modules by 28 February 2027 (Article 3).
• Register each virtual asset with the CMA before listing it on a trading facility (General Framework Module, Article 8).
• Meet licensing requirements within six months of in-principle approval, extendable once (General Framework Module, Article 26).
• Maintain a physical head office in the State and disclose CMA licensing on business documents (General Framework Module, Articles 64–65).

Penalties

Article 4 of the decision applies the penalties in Cabinet Resolution No. 99 of 2024 on virtual asset violations where a licensed entity or its employees lose or breach licensing or accreditation conditions during regularisation, or miss the regularisation deadline. Acts based only on in-principle approval are void (General Framework Module, Article 26). Unlicensed virtual asset activity is also a criminal offence under Article 71 of Federal Decree-Law No. 33 of 2025.

History and citations

“Cites” and “Cited by” are built automatically from references in the full texts held in this library; they cover only instruments in the library.

Related instruments

Related Polaris services

• Free Zone Company Formation UAE
• Mainland Company Formation UAE
• Corporate Structuring & Group Design
• AML Compliance UAE — goAML, KYC