Who is in scope
Brokers, fund and asset managers, advisers and other CMA-licensed capital-markets firms onshore.
CMA
Capital Market Authority
Regulates onshore capital markets: brokers, fund and asset managers, advisers, listed companies, onshore virtual-asset providers, and robo-advisers, whose rules mandate independent IT audits.
Last verified: September 2026Official site
Notification window
Incident reporting to the Authority as its regulations prescribe.
Current instrument
CMA regulations for licensed entities: client-asset safeguarding, system resilience, outsourcing and vendor risk, data protection and continuity, with independent IT audits mandated for certain activities such as robo-advisory.
The duties, in plain language
- Resilient trading and portfolio systems with tested continuity.
- Vendor and outsourcing risk governed and evidenced.
- Independent IT audit where the activity requires it.
Frameworks that satisfy it
Questions we get
We are CMA-licensed and considering a DIFC entity. What changes?
You add the DFSA GEN 5.5 program and the DIFC data protection registration. On one mapped control set that is a delta, not a second compliance department.
Summary for orientation, with attribution to the regulator, last checked September 2026. The regulator's own publications govern; consult them and your advisers for decisions. Where this page and the instrument differ, follow the instrument and tell us, so we can fix it.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. Much regulator language is still being clarified, and we say so rather than guess. We help interpret the requirements, scope what applies to you, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify; where a regulator has its own process, that process governs.
Book a demo
See your obligations as one program.
Tell us your sector and we will show you which UAE regulations apply to you, where the gaps are, and how one control set covers them all.