This is our published view
The bench stands behind it
For your facts, in confidence, put the question to the firm.
The bench stands behind it
The position
Since 1 January 2026 the federal capital-markets regime has rested on two instruments issued together on 1 October 2025.
Since 1 January 2026 the federal capital-markets regime has rested on two instruments issued together on 1 October 2025. Federal Decree-Law No. 32 of 2025 reconstitutes the regulator: the Capital Market Authority replaces the former Securities and Commodities Authority in all its rights, obligations and contracts as its legal successor, and the former name is replaced with “Capital Market Authority” wherever it appears in any legislation (Federal Decree-Law No. 32 of 2025, Articles 2(2) and 2(3), current as at 3 July 2026). Federal Decree-Law No. 33 of 2025 is the substantive statute, and the law that stood beneath the market since 2000, Federal Law No. 4 of 2000, is repealed in terms (Federal Decree-Law No. 32 of 2025, Article 29(1)). Both decree-laws came into force on 1 January 2026 by their own commencement clauses (FDL 32, Article 30; FDL 33, Article 85).
What the new statute does, and deliberately does not do, shapes every question asked of it. It fixes three things at the level of primary law: who is inside the perimeter, what crossing the perimeter costs, and who decides everything else. Nearly all conduct-level substance, licence conditions, offering procedures, fund rules, disclosure controls, the sanctions tariff, is delegated to regulations the Authority will issue. Until each of those issues, the resolutions made before 1 January 2026 remain in effect “to the extent that they do not conflict” with the new decree-laws (FDL 33, Article 82), and everyone subject to the law has one year from enforcement, to 1 January 2027 unless the Board extends it, to adjust their status (FDL 33, Article 83).
The practical consequence is that every rule in this regime today carries one of three statuses, and the status matters as much as the rule. A rule may sit in the decree-laws themselves, in which case it is settled primary law. It may sit in a carried-over resolution, in which case it is operative but conditional: it survives only so far as it does not conflict with the new statute, and no authority has yet published a provision-by-provision conflict map. Or it may await an Authority regulation the statute contemplates, in which case the position is open and should not be stated as settled. A firm that reads a carried-over resolution without running the conflict question is at risk of relying on a provision that Article 82 has already displaced without anyone saying so.
Two features of the perimeter belong in the short answer because they change its character. First, the perimeter is criminal: conducting any financial activity subject to the law without a licence, approval, registration or accreditation from the Authority carries imprisonment of not less than one year and a fine of AED 50,000 up to AED 250,000,000, or either, and the offence is committed “whether the result is achieved or intended to be achieved” (FDL 33, Article 71(1)). Second, the perimeter reaches outward: the law applies to any person targeting clients within the State “even if their activity is conducted outside the State or from a financial free zone” (FDL 33, Article 2(1)(d)). Read together, a firm in a financial free zone or abroad that markets regulated services to onshore clients without federal cover is inside a criminal statute, today, before any implementing regulation issues. The rest of this article works through the two instruments, the transition mechanics, the perimeter, its four boundary seams, and what is settled, open, and moving.
Federal Decree-Law No. 32 of 2025 builds the institution. The Authority is a federal public authority with legal personality and financial and administrative independence, operating under Cabinet supervision (FDL 32, Article 2(1)), with codified objectives running from the safety and efficiency of the capital market to the development of the State as a financial centre with an international reputation (Article 4). Its Board holds the rule-making power, and Article 8(15) catalogues what the Board may regulate: capital market institutions, financial activities and licensed persons, the licensing of financial-free-zone and foreign firms seeking to operate within the State outside those zones, trading platforms for specific products, investment funds and collective investment schemes, governance, guarantees and enforcement mechanics, among others (FDL 32, Articles 8(15)(a) to 8(15)(s)). The territorial limit is stated in the institution’s own charter: the Authority exercises its powers “within the state, excluding financial free zones” (Article 5(3)).
Federal Decree-Law No. 33 of 2025 is the substance: definitions and scope (Articles 1 and 2), the activity list and licence requirement (Article 3), the licensing lifecycle, client-asset protection, market infrastructure, offerings and disclosure, market conduct, funds, virtual assets, Shari’ah-compliant activity, supervision and investigation, a recovery-and-resolution regime for systemically important firms, and the enforcement ladder. Each of those blocks is examined in its own article in this series. This piece takes the two blocks everything else depends on: who is inside, and which rules answer a question asked now.
One drafting detail in the institutional law repays structural reading, because it governs the transition. Article 27 of FDL 32 continues three sets of prior instruments in three different ways. Federal Decree-Law No. 22 of 2020, on the distribution of competencies between the former authority and the licensed markets, “shall remain in effect,” with no conflict qualifier attached (Article 27(2)). Cabinet Resolution No. 111 of 2022 concerning the regulation of virtual assets and their service providers, and Cabinet Resolution No. 112 of 2022 delegating certain virtual-asset powers, remain in effect to the extent they do not conflict, “until they are repealed, amended, or replaced” (Article 27(3)). And all other Cabinet and Authority decisions remain in effect to the extent they do not conflict, until implementing decisions issue (Article 27(4), mirrored by FDL 33, Article 82). The three formulas are the statute’s own, and the differences read as deliberate: the competencies law is preserved outright, the virtual-asset resolutions are preserved but marked for replacement, and the general stock of resolutions is preserved only as scaffolding. That reading of the drafters’ design is an inference from the structure of the article rather than a stated rule, and it is marked as one; but the operative texts themselves are exactly as quoted.
The transition mechanic deserves to be stated as the regime’s own design rather than as commentary, because the statute drafted it in two sentences. Resolutions issued by the Cabinet and the Authority before 1 January 2026 “shall remain in effect to the extent that they do not conflict with the provisions of this Decree-Law and the relevant legislation, until the necessary resolutions for implementing the provisions of this Decree-Law and the relevant legislation are issued” (FDL 33, Article 82). And all entities and persons subject to the law must adjust their status “within one year from the date of enforcement,” a period the Board may extend (Article 83).
So the operative law today is a hybrid. The decree-laws supply the perimeter, the powers and the penalties. The detail beneath them, what a brokerage licence requires, how an offering is documented, what a fund manager must hold, currently lives in the resolutions of the predecessor authority, each alive only through the Article 82 filter. Three consequences follow, and each is a discipline rather than a formality.
First, every specific rule should be cited with its derivation: decree-law, carried-over resolution, or awaited regulation. A threshold quoted from a 2023 resolution is a different kind of authority from a threshold in Article 65, because the former holds only if it survives a conflict test that has not been authoritatively run.
Second, the conflict test is live and unmapped. Article 82 does not list which provisions of which resolutions conflict; it states the principle and leaves the application open. Where a carried-over provision sits comfortably beneath the new statute, it continues. Where it contradicts the statute, it fell away on 1 January 2026 whether or not anyone has said so. Identifying which is which, resolution by resolution, is analysis the regime requires of its participants and has not done for them.
Third, the carried-over layer is already being replaced, piece by piece. Practitioner reporting through the second quarter of 2026 records a new Authority decision on virtual-asset activities and service providers, replacing the 2023 platform-operator decision of the predecessor authority; that report is stated here on secondary sources, the decision itself has not been read for this article, and its provisions are examined in the virtual-assets article of this series once loaded from the register. The direction it marks is the point for present purposes: each new Authority regulation converts a block of the carried-over layer from “operative, conditionally” to “replaced,” and a compliance build anchored to the old instrument names will go stale exactly the way the companion article on the VARA framework’s federal layer found AML builds going stale. The refresh discipline is the same: the register, at the point of reliance, every time.
The perimeter is drawn by the definitions of Article 1, the scope clauses of Article 2, and the activity list of Article 3, and the three operate as a cascade.
The product layer is wide by definition. “Financial Product” means securities, foreign securities, “virtual assets for investment purposes,” and any other financial product falling within the Authority’s jurisdiction (FDL 33, Article 1). “Securities” runs from shares and preemptive rights through bonds, sukuk, structured products, certificates, warrants, licensed fund units, securitised instruments and related derivatives, and closes with a deeming power: any instrument the Board decides to treat as a security for the purposes of the law (Article 1, Securities, items 1 to 11). A virtual asset is defined as a digital representation of value that can be traded or transferred digitally and may be used for investment purposes, excluding digital representations of fiat currencies, securities or other funds, and without prejudice to the Central Bank’s jurisdiction over monetary and payment instruments (Article 1). One point of the definitions requires a caution this article states openly: the two official English translations of the law differ on the tail of the Article 3 activity list and on whether item 1 of the Securities definition reads “joint stock companies” or “public joint-stock companies,” and the official portal’s own terms provide that the Arabic text prevails. Where an analysis turns on either point, the Arabic must be read; this article’s conclusions below are drawn so that they hold on both English texts.
The activity layer, Article 3(1), catalogues the financial activities subject to the Authority’s regulation, licensing, supervision and oversight, expressly including when practised under Islamic Shari’ah principles: operating markets, trading platforms, clearing houses and central depositories; brokerage and general clearing; establishing and managing investment funds; portfolio management; promotion; introducing; financial product trading; securitisation services; underwriting; financial advisory; custody; issuance management; credit rating; trust services; depository-bank functions; listing advisory; warrant issuance; financial evaluation of supervised entities; and managing profit-sharing investment accounts outside the banking sector (FDL 33, Articles 3(1)(a) to 3(1)(w) on the text loaded for this article, with the longer tail of the portal translation noted above). No person may engage in any listed activity within the State without a licence or approval from the Authority (Article 3(2)), and no legal entity may even be registered by the licensing authorities for such an activity without the Authority’s prior approval (Article 6(1)).
On virtual assets specifically, the perimeter conclusion does not depend on the disputed tail of the list. Dealing in virtual assets for investment purposes is dealing in a Financial Product by definition, and financial product trading is an Article 3(1) activity on both English texts; the definitions carry what the list may or may not repeat. That is a conclusion reached by substituting the defined terms rather than a provision stated in one sentence of the law, and it is marked as such; Article 39 then confirms it operationally, prohibiting the trading of a virtual asset within the State unless the asset is on the official list, the platform is licensed and approved, and the asset is registered with the Authority (Article 39(2)).
The person-and-territory layer, Article 2(1), applies the law along five limbs: financial products dealt with within the State; financial activities practised within the State or by any person in a free zone, whether conducted inside or outside that zone; licensed persons, accredited persons, issuers, foreign issuers operating within the State, investment funds, and connected persons; any person targeting clients within the State even from outside it or from a financial free zone; and any person engaging in activities, investing or transacting subject to the law (Articles 2(1)(a) to 2(1)(e)). The fourth limb is the one that changes practice. A financial-free-zone firm whose activity never leaves its zone is outside the law; the same firm marketing to onshore clients is inside it, and inside Article 71 with it. What “targeting” means at the margin, a website, a roadshow, a reverse solicitation, is not defined in the decree-law and awaits the Authority’s regulations or practice; that question is open, and this article does not resolve it.
The perimeter’s edges are drawn by four exclusions, and in each case the operative content sits in the exception to the exclusion.
The Central Bank seam. The law does not apply to financial activities licensed by the Central Bank, to the Central Bank’s own deposit, clearing and settlement systems, or to persons licensed by the Central Bank, “except within the scope of securities issuance or financial activities specified in Article (3)” (FDL 33, Articles 2(4)(a) to 2(4)(c)). The carve-back in clause (c) is the working rule: a bank is outside this law for its banking, and inside it the moment it issues securities or conducts an Article 3 activity. The virtual-asset definition preserves the same boundary on the product side, leaving monetary and payment instruments to the Central Bank’s jurisdiction (Article 1).
The financial free zone seam. The law does not apply to financial free zones (Article 2(4)(d)), and the Authority’s charter repeats the exclusion (FDL 32, Article 5(3)). The exclusion is then pierced from two directions: the targeting limb of Article 2(1)(d) reaches any person marketing into the State from a financial free zone, and foreign issuers, defined to include entities established in financial free zones, are inside the law when they issue or list securities within the State (FDL 33, Article 1, Foreign Issuer; Article 28(2)). The DIFC or ADGM firm’s question is therefore never “is my zone exempt,” which it is, but “does my activity cross the line,” which is a facts question about clients and offerings, not about incorporation.
The commercial free zone seam. Free zones other than the financial free zones receive no exclusion at all: activities practised by any person in such a zone are inside the law whether conducted within or outside the zone (Article 2(1)(b)), and the Authority’s virtual-asset oversight extends in terms to activities, transactions and trading “within the State and in the free zone,” the defined term excluding financial free zones (Article 39(3), read with the Article 1 definition of Zone). In Dubai, this is the seam with the emirate-level virtual-asset regime this series has examined, since both layers now claim the same ground outside the DIFC. The federal statute’s own accommodation is the continuation clause: the 2022 Cabinet Resolutions on virtual assets and their delegation remain in effect to the extent they do not conflict, until repealed, amended or replaced (FDL 32, Article 27(3)). The content of those resolutions, and of the Authority’s 2026 virtual-asset decision reported to have issued, is not read in this article; how the federal and emirate layers divide the field in practice is a genuinely open question on the texts loaded here, and it is treated in full, against the loaded instruments, in the virtual-assets article of this series.
The government seam. Securities issued by the federal government, local governments, or entities wholly owned by them are exempt, “unless offered to the public or listed in the market or trading platforms,” and the same rule applies to their investment funds (Articles 2(2) and 2(3)). The proviso governs most live cases: a government-owned issuer’s private paper is outside the law; the moment it lists or goes to the public, the exemption ends. The mandatory-listing rule for public joint-stock companies is expressly made subject to this exception (Article 30(1)).
The enforcement architecture runs in tiers, and its first fact is that the licensing perimeter itself is a criminal provision. Article 71 imposes imprisonment of not less than one year and a fine between AED 50,000 and AED 250,000,000, or either, on anyone who practises a financial activity without the Authority’s licence, approval, registration or accreditation; who intentionally includes false or misleading information in offering documents or alters them after submission; who spreads false information or rumours affecting market integrity; who manipulates trading or prices; who deals on inside information or discloses it; who withholds material disclosure; who misleads the Authority; or who obstructs its investigations, in each case “whether the result is achieved or intended to be achieved” (FDL 33, Articles 71(1) to 71(9)). Holding oneself out as licensed without being so, and false reporting to the Authority, carry up to one year and a fine of AED 50,000 to AED 50,000,000 (Article 72). Courts may add prohibitions from the activity or profession for up to five years, permanent revocation, and confiscation, and must do so on recidivism (Article 73), and the penalties extend to anyone who conspires, incites, causes or participates (Article 74).
Beneath the criminal tier sits the administrative one. The Board is to issue a regulation of violations and penalties, within which the Authority may warn, reprimand, fine up to AED 200,000,000 or up to ten times the profit gained or loss avoided, impose late-payment fines up to AED 5,000,000, suspend dealing for up to three years, suspend or dismiss directors and managers, revoke licences, and close unlicensed premises (Article 65(1)). Two valves complete the ladder. The Authority may exempt a violator from administrative measures who self-discloses before the Authority or the courts become aware and stands ready to rectify (Article 70). And crimes under the law may be settled: before criminal proceedings, by the Authority under Cabinet-issued controls, and after proceedings begin but before final judgment, by the Public Prosecution, with settlement extinguishing the prosecution but never reaching confiscation (Article 75). One dependency in this architecture should be read precisely: the administrative tariff itself is one of the regulations the statute contemplates rather than contains, so until the violations regulation issues, the AED 200,000,000 ceiling is settled law while the schedule beneath it is not.
Settled, on the face of the decree-laws: the succession and the substitution of the regulator’s name across all legislation; the repeal of the 2000 law; the five-limb scope including the extraterritorial targeting limb; the activity list and the licence requirement with its criminal backstop; the four seams and their carve-backs; the penalty ceilings; the transition design itself, carried-over resolutions surviving through a no-conflict filter, with a one-year adjustment period running to 1 January 2027 unless extended.
Open, and named as open rather than resolved: the provision-by-provision conflict map that Article 82 requires but does not supply; the meaning of “targeting” at the margin of Article 2(1)(d); the content of nearly every implementing regulation the statute contemplates, from licence conditions to the violations tariff to the systemic-importance criteria; the mechanics of the federal and emirate virtual-asset overlap in Dubai; and, at the level of the text itself, the two points on which the official English translations diverge, where the Arabic governs and must be read before reliance.
Moving: the implementing layer has begun to issue, with a 2026 Authority decision on virtual assets reported and awaiting a provision-level read, and each new regulation will convert part of the carried-over layer from conditionally operative to replaced. The refresh triggers for this article are therefore specific: the issuance of each Authority regulation under the Article 8(15) catalogue; any Board decision extending the Article 83 period as 1 January 2027 approaches; and any amendment to either decree-law. The register, not any summary of it, marks each of those events.
The answer to the question in the title has the same shape as this regime’s own drafting. Who is inside is fixed by the decree-laws and is settled now, criminally enforced and wider than the State’s borders. Which rules apply today is a three-part answer by design: the decree-laws themselves; the pre-2026 resolutions, each standing only where it does not conflict; and, progressively, the Authority’s own regulations as they issue, each of which retires a piece of the old layer on the day it lands. This analysis rests on Federal Decree-Law No. 32 of 2025 and Federal Decree-Law No. 33 of 2025, each loaded in full from the official sources and each in force since 1 January 2026.
For your facts, in confidence, put the question to the firm.
The bench stands behind it