CMA (formerly SCA): the UAE's Onshore Financial Regulator

What is the CMA (Capital Market Authority)?

The CMA is the UAE's onshore federal regulator for securities and commodities markets. It supervises the Dubai Financial Market (DFM) and the Abu Dhabi Securities Exchange (ADX), and it licenses and oversees brokers, investment firms and other financial businesses operating in mainland (“onshore”) UAE. It does not regulate the financial free zones, which have their own regulators.

For a trader, the CMA is the authority that stands behind an onshore-licensed broker: it sets conduct standards, licenses the activity, and maintains the licensed-companies register you can check a firm against.

CMA licensed-companies register

Is the SCA now the CMA?

Yes. On 1 January 2026, Federal Decree-Law No. 32 of 2025 and Federal Decree-Law No. 33 of 2025 came into force, replacing the Securities and Commodities Authority (SCA) with the Capital Market Authority (CMA). The CMA is the SCA's legal successor: it assumes all of the SCA's rights, obligations and contracts, and references to “SCA” in existing licences and rules now read as the CMA. So a broker that held an SCA licence holds a CMA licence now, without doing anything, and its authorisation carries over unchanged.

One nuance worth stating plainly, because most pages get it wrong in one direction or the other: this was more than a rename. The two decree-laws repealed the old founding law (Federal Law No. 4 of 2000) and replaced it with a broader, modernised framework that, among other things, expands regulated financial products to include virtual assets. There is a one-year transition period for the new capital-markets law, and implementing regulations are still being issued.

For you as a retail trader the practical takeaway is simple: your broker's licence is intact under the new name, but the wider rulebook is genuinely new, so treat any older “SCA” guidance as dated and check current detail against the CMA. If you see a broker or a comparison site still saying only “SCA regulated”, that is not a red flag in itself: it just means the page predates, or has not caught up with, the 2026 change.

What does the CMA regulate, and what does it not?

The CMA regulates onshore (mainland) UAE only. Its remit is securities, commodities and the financial activities around them across the UAE mainland, including the DFM and ADX. What it does not cover:

• The DIFC, which is regulated by the DFSA.
• The ADGM, which is regulated by the FSRA.
• Virtual assets in Dubai, which are licensed by VARA specifically.

This is the single most useful thing to understand about UAE regulation: “UAE-regulated” is not one thing. A broker can be perfectly legitimately regulated by the CMA, the DFSA or the FSRA, and those are different regulators with different registers.

CMA vs DFSA vs FSRA vs VARA

Read this as a map, not a ranking. A free-zone licence (DFSA or FSRA) is not weaker than an onshore CMA one; they are parallel, legitimate regimes. What matters is that the firm holds a real licence with the regulator it claims, for the service it offers you, and that you can find it on that regulator's register.

How do I check if a broker is CMA-regulated?

Verify the firm yourself on the CMA's public register, not on the broker's own website.

• Go directly to the CMA's official site and type the address yourself rather than following a link from the broker, because clone firms copy real licence numbers onto lookalike domains.
• Find the licensed-firms or public-register section and search the broker's exact registered legal entity name, not just its brand.
• Confirm the entity is listed, active, and licensed for the service you want: dealing, arranging, and so on.
• If the broker serves you from a free zone or offshore instead, check the matching register from the table above, and be wary of any firm that presents an offshore or promotion-only permission as if it were full onshore CMA regulation.

Two traps are specific to the UAE. A promotion licence is not a dealing licence: some firms hold only a permission to market locally while the account sits with an offshore entity, which changes who holds your money. And “regulated in the UAE” on a landing page means nothing until you have matched the exact entity to a live register entry.

CMA licensed-companies registerBroker warning list →How we verify a broker's regulation →

Is “CMA regulated” the same as Kenya's CMA?

No, and this is a real source of confusion. Kenya's regulator is also called the Capital Markets Authority (CMA), and some brokers hold a Kenyan CMA licence that has nothing to do with the UAE. A “CMA regulated” claim only means UAE oversight if the entity is licensed by the UAE Capital Market Authority and appears on its register. When in doubt, check which country's CMA is named, and confirm it on the UAE register directly.

What CMA regulation protects you from

Onshore CMA regulation means the firm must meet conduct and licensing standards, and it gives you a regulator to complain to and a register to verify against. Those are real protections.

But note the limit, and it is the same one that applies across UAE regulation: as at this review there is no statutory investor-compensation scheme that pays out UAE retail clients if a firm fails, the way the UK's FSCS or Cyprus's ICF do for those jurisdictions. Client-money segregation is the standard safeguard and is worth confirming, but segregation is not the same as compensation. The 2026 framework is new and its implementing regulations are still emerging, so treat this as the current position and verify against the CMA rather than assume it is fixed forever.

Which UAE brokers are CMA-regulated?

Among the brokers we review, the onshore CMA-licensed names are Capital.com and Pepperstone, and the two licences are not the same thing, which is the point of reading permissions rather than regulator names.

Capital.com onboards UAE residents to Capital Com MENA Securities Trading L.L.C., shown as Active on the CMA's licensed-companies register under company code CP-0000937 when we read it on 18 September 2026. The register lists four activities: introduction, financial products dealer, trading broker in the international markets, and trading broker of OTC derivatives and currencies in the spot market. Custody and asset management are not among them. Clause 1.1 of its MENA terms names two licences, First Category (Dealing in Securities) under 20200000176 and Fifth Category (Arrangement and Advice) under 20200000471, though those numbers are Capital.com's own figures and the register publishes none. On client money, be precise about what segregation buys you here: funds are held apart from Capital.com's own money, but clause 10.7 of the same terms allows them to sit in pooled accounts at third-party institutions, “kept with money belonging to other clients”. Separate from the firm's money, then, rather than separate from other clients'.

Pepperstone holds two UAE licences, and both are limited in scope. Pepperstone Financial Services L.L.C is the onshore company, on the same CMA register under company code CP-0001424, status Active, holding a Category 5 licence for financial consultations and introduction; the number Pepperstone quotes in its own client documents, 20200000358, is not what the register publishes against the entry. Its other UAE licence is DFSA reference F004356 in the DIFC, recorded for arranging deals in investments, in futures and crypto tokens. Check which companies your own client agreement names.

Others serving the UAE are regulated in a free zone (eToro through the FSRA in ADGM, and Interactive Brokers through the DFSA in the DIFC), which are legitimate, not lesser.

Which regulator sits behind each broker, and the caveats, are set out in the individual reviews.

Best forex brokers in the UAE →