What the CMA Law Changes Mean for Regulatory Inquiries

The UAE’s New Capital Markets Framework: How Regulatory Inquiries Are Likely to Evolve

The UAE has entered a new phase in the supervision of its capital markets — one that is less about rewriting rules and more about how those rules are applied, tested and, where necessary, examined.

Two new federal decree laws—Federal Decree Law No. 32 of 2025, establishing the Capital Market Authority (the CMA), and Federal Decree Law No. 33 of 2025, regulating the capital market (together, the CMA Laws)—came into force on 1 January 2026. Together, they replace the framework that governed onshore capital markets for more than two decades and introduce a clearer, more consolidated foundation for market oversight.

For companies, the key point from a regulatory inquiries perspective is not that day‑to‑day obligations have suddenly changed, but that regulatory inquiries and investigations are likely to become more structured, more consistent and more predictable over time.

A clearer framework—not a new rulebook overnight

The CMA Laws reconstitute the former Securities and Commodities Authority as the CMA, with a clearer mandate and a unified framework for supervising capital markets activity. While this does not amount to a single, comprehensive “rulebook” of the kind seen in some other jurisdictions, it does give the CMA a more coherent reference point when engaging with market participants.

From an investigations perspective, this matters. A consolidated framework gives the CMA clearer lines of sight when asking questions about governance, disclosure, market conduct and internal controls—and gives market participants greater certainty about the basis on which those questions are asked. Over time, this typically leads to earlier and more routine supervisory engagement, rather than reactive inquiries triggered only by market events.

Who may be in scope?

The CMA Laws are relevant to a broad range of participants, including listed companies, businesses considering IPOs, financial institutions, asset managers and funds, as well as companies involved in capital‑raising or investment activity connected to UAE markets or UAE investors. Virtual assets are now explicitly within the CMA's regulatory perimeter, with the previous 2023 framework superseded by a comprehensive federal-level framework established through the new CMA Laws and its implementing regulations (Virtual Asset Regulation, Decision No. 4/R.M/2026). 

Another important development is the CMA’s articulated territorial reach. Under the new framework, rather than being limited to onshore markets, the CMA may look at onshore financial activities, certain activities in UAE free-zones (excluding the financial free-zones), and cross‑border activities with a sufficient UAE nexus—for example, where activity is directed at UAE markets or investors. This approach is consistent with modern capital markets regulation. For investigations, it means the CMA may focus more on substance and market impact, rather than formal structuring, when assessing whether transactions fall within scope.

Regulatory inquiries in context

While the CMA Laws are now in force, their early application coincides with a period of regional political disruption. In practical terms, this may mean that some supervisory engagement take longer to progress as the CMA manages competing priorities and operational constraints. That said, the direction of travel is clear. Alongside the compliance transition runway through to 1 January 2027, this creates a period in which market participants can prepare in a measured way for more structured and routine regulatory engagement as the new framework beds in.

Experience across the region suggests that while timing may be affected, regulatory intent is not. Post the transition period, inquiries are more likely to be deliberate and sequenced than sudden or confrontational.

What this means for investigations risk

From an investigations standpoint, the CMA Laws lay the groundwork for a more consistent engagement model. Market participants may begin to see more information requests aimed at understanding market activity and controls, greater focus on how decisions are documented and overseen, and closer scrutiny of consistency between disclosures, internal records and external communications.

As in other jurisdictions following major regulatory change, early engagement typically focuses on supervision and alignment rather than penalties.

A constructive window to prepare

The current environment gives market participants a valuable opportunity to focus on team‑level readiness, not just policies. As regulatory engagement becomes more routine, the way organisations respond in real time—how issues are escalated, how information is assembled, and who leads the interaction—will increasingly matter. Many market participants are therefore using this period to refresh training for senior and market‑facing teams, clarify internal roles, and stress‑test their response plans. For most organisations, this is about alignment rather than overhaul.

Looking ahead

The CMA Laws mark an important step in the continued maturation of the UAE’s capital markets. From an investigations perspective, they point toward a regulatory environment that is becoming more structured, more transparent and more predictable.

The message for companies is not one of alarm, but of readiness.