Regulatory Gate

Middle East / Jurisdiction

United Arab Emirates

Fintech, crypto, securities & gaming

All jurisdictions

At a glance

Choose the route your business actually needs.

Dubai, ADGM, DIFC and federal regimes have different perimeters. GCGRA commercial-gaming permissions depend on the specific activity and approval process.

CMAVARAFSRADFSACBUAEGCGRA
  • Federal, Dubai, ADGM or DIFC? The place of establishment and the regulated activity determine the route; a free-zone trade licence is not a financial-services permission.
  • Separate securities, virtual-asset services and payment-token activities. A token's name does not determine its legal classification.
  • Define custody, client-money flows, retail versus professional clients and cross-border marketing before selecting permissions.
  • Gaming and prediction markets need a separate product assessment. Financial-services authorisation does not permit commercial gaming.

Permissions & perimeter

Distinct activities. Distinct requirements.

01 / CMA

Federal capital markets & relevant virtual-asset activities

Assess brokerage, dealing, investment management, advice, funds and other capital-market permissions within the federal perimeter. The 2026 virtual-asset framework distinguishes dealing as principal or agent, providing or arranging custody, operating a multilateral trading facility, investment advice, portfolio management and arranging investment deals. Outside financial free zones, establish whether the federal regime or a competent local authority applies; do not assume a CMA permission substitutes for VARA, FSRA or DFSA approval.

Application focus

Map requested activities and client types; prepare capital and financial resources, controllers' evidence, qualified management, compliance arrangements and the application documents for the relevant category.

After authorisation

Activity-specific reporting, capital adequacy, client-asset controls, conduct, AML/CFT and approval or notification of material business changes.

Regulatory source ↗

02 / VARA

Virtual-asset services in Dubai, excluding DIFC

Assess exchange, broker-dealer, custody, lending and borrowing, management and investment, transfer and settlement, and other relevant virtual-asset activity permissions. Approval to Incorporate (ATI) is an initial setup stage, not permission to operate. A full VASP licence and operational readiness are separate. Multiple activities may need multiple permissions and additional separation of functions.

Application focus

Activity-specific business plan, ownership evidence, key personnel, AML and Travel Rule controls, custody and wallet architecture, technology security and outsourcing documentation.

After authorisation

Company, compliance, technology and market-conduct rulebooks plus the applicable activity rulebooks; client protection, regulatory reporting and licence-condition monitoring.

Regulatory source ↗

03 / FSRA

ADGM financial services & virtual assets

Financial Services Permission for the particular activities conducted in ADGM. An exchange, custodian, broker or asset manager must map its model to the relevant permissions and virtual-asset framework; the commercial entity registration is separate. Fiat-Referenced Tokens have distinct rules and should not simply be treated as ordinary virtual assets.

Application focus

Regulatory business plan, approved-person applications, capital, compliance and AML arrangements, technology and operational controls, and relevant asset-eligibility assessment.

After authorisation

Prudential and conduct requirements, financial reporting, client protection, AML/CFT, systems controls and permission-specific obligations.

Regulatory source ↗

04 / DFSA

DIFC investment, financial & crypto-token activities

DFSA authorisation applies to financial services in or from DIFC. Establish the financial-service permissions and applicable crypto-token rules; The updated Crypto Token rules effective in January 2026 require firm-led token suitability assessment and ongoing monitoring; token treatment and customer eligibility require separate analysis.

Application focus

Financial-service activity map, regulatory business plan, authorised individuals, resources, compliance systems and product-specific controls.

After authorisation

DFSA conduct, prudential and AML rules, applicable token requirements, client-money or custody controls and regulatory notifications.

Regulatory source ↗

05 / CBUAE

Payments, stored value & payment tokens

Assess retail payment services, stored-value facilities and payment-token services under the relevant Central Bank framework. A virtual-asset exchange licence alone does not authorise payment-token issuance or regulated payment services.

Application focus

Payment flows, safeguarding arrangements, settlement and reconciliation, capital, cybersecurity, outsourcing and relevant issuer reserve or redemption arrangements.

After authorisation

Safeguarding, operational resilience, transaction monitoring, reporting and the product-specific customer-protection requirements.

Regulatory source ↗

06 / GCGRA

Commercial gaming

Assess the proposed operator, supplier or other commercial-gaming category and whether an application route is available. No blanket permission should be inferred for online gaming, event contracts or prediction markets.

Application focus

Ownership and suitability evidence, product and market scope, responsible gaming, player protection, AML, payments and technical systems appropriate to the category.

After authorisation

Licence conditions, player-market controls, responsible gaming, AML, technical compliance and supervisory requirements.

Regulatory source ↗

Application evidence

Prepare a coherent submission—not just forms.

The exact checklist depends on the authority, permission and applicant. These workstreams establish a practical preparation baseline; authority-specific forms and evidence take precedence.

  1. 01Business plan and activity map: products, customer types, revenue, execution flow and target countries.
  2. 02Ownership and control chart, source of funds, beneficial-owner evidence and fit-and-proper files for management.
  3. 03Financial projections, capital and liquidity plan, staffing, local presence and outsourcing arrangements.
  4. 04AML/CFT risk assessment, customer due diligence, sanctions screening, monitoring and reporting procedures.
  5. 05Governance, compliance monitoring, complaints, cybersecurity, business continuity and incident-response policies.

Assessment to launch

A structured path through the application.

  1. 01Classify products and map each regulated activity to the competent authority.
  2. 02Compare establishment, capital, staffing, ownership and operational requirements for viable routes.
  3. 03Prepare the application, supporting policies and governance evidence; address regulator questions.
  4. 04Complete any approval conditions, operational readiness and required testing before launch.
  5. 05Maintain reporting, compliance monitoring and change-control processes after authorisation.

Capital, fees and timing vary by permission and applicant. Incorporation, initial approval or a pending application does not by itself permit regulated operations. Approval remains the regulator's decision.

Beyond the licence

Compliance and risk must work in practice.

Build a permissions register, regulatory calendar and control-testing programme. Assign owners for financial-crime controls, client assets, outsourcing, cyber incidents, complaints and board reporting. Reassess permissions before adding products, jurisdictions or distribution channels.

Compliance frameworks ↗Risk management & resilience ↗

General advisory guidance, not a legal opinion or a guarantee of eligibility. Confirm current rules and local legal requirements for the proposed business before taking action.

Your next chapter starts here.

Let's discuss your business, your markets and the path ahead.

Book a call