CMA Resolution 16/2026: Streamlining Virtual Asset Operations for UAE Financial Institutions

Introduction

A significant regulatory update from the UAE Capital Market Authority (CMA) now allows most financial entities licensed by the Central Bank of the UAE (CBUAE) to offer virtual asset services. This pivotal development, formalized through CMA Resolution No. 16/Chairman of 2026, creates a streamlined path for banks and other financial institutions to integrate virtual asset activities directly into their existing operations. It promises reduced complexity and potentially lower operational costs for UAE businesses navigating this rapidly evolving sector.

This article details the scope and implications of this new resolution, outlining which entities are included and excluded, the operational advantages it offers, and the critical steps businesses must take to ensure compliance. We also explore the anticipated further guidance from regulators and provide actionable recommendations for financial institutions preparing to expand their service portfolios into virtual assets.

Understanding CMA Resolution No. 16/Chairman of 2026

The UAE Capital Market Authority (CMA) recently issued Resolution No. 16/Chairman of 2026, a landmark regulation designed to integrate virtual asset services more smoothly into the nation's financial landscape. This resolution explicitly grants permission to most entities licensed by the Central Bank of the UAE (CBUAE) to engage in virtual asset activities that fall under the CMA’s regulatory purview. To proceed with these services, licensed entities must obtain the necessary specific authorizations from the CMA.

Historically, engaging in virtual asset activities within the UAE often necessitated the establishment of separate legal entities or required complex, multi-layered licensing structures. Such arrangements added significant bureaucratic hurdles, increased operational expenses, and complicated overall governance. The introduction of CMA Resolution No. 16/Chairman of 2026 marks a strategic shift, aiming to simplify this landscape by allowing existing, regulated financial institutions to use their established infrastructure for virtual asset operations.

This resolution not only reduces administrative burdens but also reinforces the UAE's commitment to becoming a leading global hub for digital finance, ensuring that virtual asset activities are conducted within a well-defined and supervised framework.

What This Means for CBUAE-Licensed Financial Institutions

For financial institutions operating in the UAE, CMA Resolution No. 16/Chairman of 2026 presents substantial operational and strategic advantages. Understanding these benefits is crucial for planning effective market entry and service expansion.

Streamlined Operations

One of the most significant benefits is the ability to operate both traditional CBUAE-regulated financial services and CMA-regulated virtual asset activities under a single legal entity. This eliminates the complexities associated with establishing, maintaining, and overseeing separate corporate structures. The consolidation simplifies:

• Corporate Governance: A unified governance framework minimizes duplication of roles and responsibilities.
• Risk Management: Integrated risk management systems can more efficiently identify, assess, and mitigate risks across all service lines.
• Reporting Requirements: Centralized reporting to both regulatory bodies (where applicable) can reduce administrative overhead.

Cost Efficiency

By consolidating operations, businesses can expect a notable reduction in various costs:

• Licensing Fees: Avoiding the need for multiple licenses for different entities.
• Administrative Overhead: Lower costs associated with separate legal, accounting, and compliance teams.
• Compliance Expenses: Streamlined compliance processes can reduce the overall resources required to meet regulatory obligations.

Expanded Service Offerings

The resolution paves the way for CBUAE-licensed entities to significantly expand their product and service portfolios. As demand for virtual asset services grows, financial institutions can now more readily offer:

• Virtual Asset Custody: Secure storage solutions for digital assets.
• Virtual Asset Exchange Services: Facilitating the buying and selling of virtual assets.
• Brokering and Advisory Services: Guiding clients through the virtual asset market.
• Tokenization Services: Converting real-world assets into digital tokens.

This expansion allows institutions to cater to a broader client base, including institutional investors and high-net-worth individuals increasingly interested in digital assets.

Enhanced Market Position and Innovation

By embracing virtual assets within a regulated framework, UAE financial institutions can enhance their competitive edge both regionally and globally. This forward-thinking regulatory approach:

• Fosters Innovation: Encourages the development of new financial products and services using blockchain technology.
• Attracts Talent and Investment: Positions the UAE as an attractive destination for fintech companies and virtual asset specialists.
• Strengthens Client Relationships: Allows existing clients to access a wider range of services from a trusted provider.

Scope and Eligibility: Who Can Offer Virtual Asset Services?

CMA Resolution No. 16/Chairman of 2026 defines a broad scope of eligibility, yet also specifies important exclusions. Understanding these parameters is critical for any financial institution considering entry into the virtual asset market.

Included Entities

The resolution broadly applies to most entities licensed by the CBUAE. This encompasses a wide spectrum of financial institutions central to the UAE's economy:

• Banks: Commercial banks, Islamic banks, and investment banks operating within the UAE.
• Finance Companies: Institutions providing various forms of financing and credit.
• Payment Service Providers: Companies facilitating electronic payments and money transfers.
• Money Exchange Houses: Businesses involved in currency exchange.
• Other Financial Institutions: Any other entity whose primary licensing and oversight reside with the CBUAE.

These institutions can now apply for the necessary authorizations from the CMA to offer virtual asset services. This means that an existing CBUAE license serves as a foundational credential, enabling a more direct pathway to CMA authorization for virtual asset activities.

Excluded Entities

It is crucial to note a specific and significant exclusion from the resolution: insurance companies are not included. Therefore, entities primarily licensed as insurance providers cannot use this new pathway to engage in virtual asset activities under the CMA's regulatory framework. This distinction underscores the differing risk profiles and regulatory considerations associated with insurance versus other financial services.

Conditions for Participation

For included CBUAE-licensed entities, the ability to offer virtual asset services is not automatic. It is contingent upon obtaining specific authorizations from the CMA. This typically involves:

• Application Submission: Submitting a detailed application to the CMA, outlining the scope of proposed virtual asset activities.
• Compliance with CMA Regulations: Demonstrating adherence to all relevant CMA rules, including those pertaining to licensing, conduct of business, capital adequacy, technology and cybersecurity, and consumer protection.
• Internal Readiness: Proving robust internal controls, risk management frameworks (especially for anti-money laundering and combating the financing of terrorism, AML/CFT), and adequate technological infrastructure capable of handling virtual asset operations securely. Further guidance on AML/CFT compliance can be found in our insight: UAE Businesses: FATF Plenary to Sharpen Focus on Virtual Asset AML/CFT Compliance.

This structured approach ensures that only well-prepared and compliant institutions enter the virtual asset market, maintaining market integrity and investor protection.

Key Regulatory and Operational Considerations

While CMA Resolution No. 16/Chairman of 2026 streamlines the path for CBUAE-licensed institutions into virtual assets, success hinges on meticulous preparation and adherence to a complex regulatory landscape. Several critical factors must be addressed.

Regulatory Alignment and Compliance

Institutions will need to navigate regulatory requirements from both the CBUAE and the CMA. This involves:

• Harmonizing Frameworks: Integrating CBUAE's existing prudential and conduct-of-business regulations with CMA's specialized virtual asset rules. This requires a comprehensive understanding of overlapping and distinct requirements.
• Licensing and Permissions: Beyond the general permission, securing specific CMA authorizations for each virtual asset activity contemplated (e.g., custody, exchange, advisory).
• Reporting Obligations: Establishing robust systems for reporting to both regulators as per their respective mandates, ensuring consistency and accuracy.

Robust Risk Management Frameworks

The nature of virtual assets introduces unique risks that traditional financial institutions must mitigate effectively:

• AML/CFT Compliance: Implementing enhanced due diligence, transaction monitoring, and suspicious activity reporting tailored to virtual assets. This is a critical area of focus for UAE regulators. Refer to: Navigating Heightened AML/CFT Scrutiny: What UAE Fintech and Digital Asset Businesses Need to Know.
• Cybersecurity Risks: Protecting virtual asset holdings and client data from hacks, exploits, and cyber threats through advanced security protocols.
• Market Volatility Risk: Managing exposure to the inherent price volatility of virtual assets and communicating these risks transparently to clients.
• Technological Risk: Addressing potential vulnerabilities in smart contracts, blockchain protocols, and integration with legacy systems.
• Custody Risk: Ensuring secure segregation of client assets, robust key management, and contingency planning for asset recovery.

Technological Infrastructure and Integration

The successful integration of virtual asset services demands significant technological investment and careful planning:

• Platform Selection: Choosing or developing secure, scalable, and compliant virtual asset platforms.
• System Integration: Smoothly integrating new virtual asset systems with existing core banking platforms, customer relationship management (CRM) systems, and compliance tools.
• Data Management: Implementing systems for secure storage, processing, and analysis of virtual asset transaction data, ensuring data integrity and privacy.
• Interoperability: Ensuring compatibility with various blockchain networks and virtual asset protocols.

Talent and Expertise Development

Operating in the virtual asset space requires specialized knowledge and skills:

• Recruitment: Hiring professionals with expertise in blockchain technology, virtual asset trading, smart contract auditing, and digital forensics.
• Training: Upskilling existing staff on virtual asset fundamentals, regulatory compliance, risk management, and customer service for digital assets.
• Legal and Compliance Specialists: Engaging legal and compliance teams well-versed in the evolving virtual asset regulatory landscape.

Navigating the Authorization Process with the CMA

For CBUAE-licensed entities, securing authorization from the CMA to engage in virtual asset activities is a multi-stage process that requires meticulous preparation and engagement.

1. Pre-Application Assessment and Consultation

Before formally applying, prospective institutions should conduct a thorough internal assessment of their readiness, including:

• Business Plan Development: Clearly defining the scope of virtual asset services, target markets, operational model, and revenue projections.
• Gap Analysis: Identifying discrepancies between current capabilities and anticipated CMA requirements across all operational, technological, and compliance functions.
• Initial Consultation: Engaging with the CMA (and potentially the CBUAE) to discuss the proposed activities, clarify regulatory expectations, and understand any specific guidance applicable to their business model.

2. Application Submission

The formal application to the CMA will typically require extensive documentation, including:

• Corporate Information: Detailed legal structure, ownership, and governance arrangements.
• Financials: Capital adequacy projections, financial statements, and business forecasts demonstrating sustainability and capacity.
• Operational Framework: Comprehensive descriptions of internal controls, processes for customer onboarding (KYC/AML), transaction processing, custody arrangements, and IT security frameworks.
• Risk Management Strategy: A detailed plan outlining how virtual asset specific risks (cybersecurity, market, liquidity, operational, legal, and reputational risks) will be identified, assessed, monitored, and mitigated.
• Key Personnel Information: Profiles of individuals responsible for virtual asset operations, demonstrating their relevant expertise and fitness.

3. Due Diligence and Review by the CMA

Upon submission, the CMA will undertake a rigorous review of the application package. This phase typically involves:

• Information Requests: The CMA may request additional information, clarifications, or amendments to the submitted documents.
• Meetings and Interviews: Engagements with the applicant's senior management and key personnel responsible for virtual asset activities.
• On-site Assessments: Depending on the complexity and novelty of the proposed activities, the CMA may conduct on-site visits to review operational readiness, IT infrastructure, and compliance systems. The assessment focuses on ensuring the institution possesses the necessary financial, technical, and human resources, alongside robust governance and risk controls, to conduct virtual asset activities safely and compliantly.

4. Authorization and Ongoing Compliance

If the application is successful, the CMA will issue the relevant authorization. However, this is not the end of the regulatory journey:

• Conditions of Authorization: The CMA may impose specific conditions or restrictions on the authorization, which must be strictly adhered to.
• Continuous Compliance: Authorized entities must maintain continuous compliance with CMA regulations, including regular reporting, periodic audits, and prompt notification of any significant changes to their operations or risk profile.
• Regulatory Updates: Staying abreast of evolving virtual asset regulations and guidance from both the CMA and CBUAE is paramount.

Anticipated Further Guidance and Future Outlook

While CMA Resolution No. 16/Chairman of 2026 establishes the foundational framework for CBUAE-licensed entities to engage in virtual asset activities, the regulatory landscape for such a dynamic sector is continuously evolving. Further, more granular guidance is widely anticipated, offering crucial clarity on practical implementation aspects.

Supervisory Responsibility

A key area where additional clarity is expected concerns the division and coordination of supervisory responsibilities between the CBUAE and the CMA. For entities engaging in both traditional financial services (regulated by CBUAE) and virtual asset services (regulated by CMA), specific guidance will likely detail:

• Jurisdictional Boundaries: Clear delineation of which regulator oversees what aspects of an entity's operations.
• Information Sharing Protocols: How the CBUAE and CMA will coordinate, share information, and collaborate on supervision, enforcement, and market intelligence.
• Joint Inspections: The possibility and procedures for joint regulatory inspections or audits of dual-licensed entities.

Understanding these protocols is essential for institutions to streamline their internal reporting and compliance functions effectively.

Capital Requirements

Specific details on the capital adequacy standards that CBUAE-licensed entities must meet when undertaking virtual asset activities under CMA regulation are also keenly awaited. This guidance will likely cover:

• Risk Weightings: How virtual asset exposures will be risk-weighted for capital calculation purposes.
• Minimum Capital Thresholds: Any additional capital buffers or specific minimum capital requirements unique to virtual asset operations, reflecting the inherent risks of these assets.
• Liquidity Management: Guidelines on managing liquidity specifically for virtual asset holdings and related liabilities.

These specifics will directly influence the financial capacity required for institutions to enter and sustain virtual asset operations.

Operational Standards and Customer Protection

Further operational guidelines are expected to reinforce robust practices and ensure strong customer protection:

• Technology and Cybersecurity Standards: Detailed requirements for IT infrastructure, data security, encryption, and cyber resilience specific to virtual asset platforms and custody solutions.
• Customer Disclosure and Suitability: Enhanced rules on transparency, risk disclosures to clients, and suitability assessments for virtual asset products, particularly concerning retail investors.
• Complaint Resolution Mechanisms: Clear procedures for handling customer complaints related to virtual asset services.
• Market Integrity Rules: Measures to prevent market manipulation, insider trading, and other illicit activities within virtual asset markets.

The UAE's Position as a Virtual Asset Hub

This resolution, alongside other progressive regulations (such as those from ADGM and VARA), underscores the UAE's strategic ambition to be a global leader in the virtual asset space. By providing a clear and regulated pathway for established financial institutions, the UAE enhances its appeal as a jurisdiction for digital innovation. This move is expected to:

• Attract Investment: Draw further foreign direct investment into the country's fintech and digital asset sectors.
• Foster Talent: Create demand for specialized skills and expertise, positioning the UAE as a hub for virtual asset professionals.
• Promote Innovation: Encourage the development and adoption of cutting-edge blockchain technologies and digital financial services.
• Strengthen Regulatory Certainty: Provide confidence to businesses and investors looking for robust, yet adaptable, regulatory environments. The broader regulatory efforts are also seen in initiatives like the ADGM's framework, detailed in: ADGM Strengthens Digital Asset Landscape: Key Takeaways for UAE Businesses.

Remaining proactive and informed will be key for any CBUAE-licensed entity looking to expand into virtual asset services. This resolution marks a significant step towards a more integrated, efficient, and forward-looking financial ecosystem in the UAE.

Practical Steps for UAE Financial Institutions

To effectively use CMA Resolution No. 16/Chairman of 2026 and navigate the evolving virtual asset landscape, UAE financial institutions should adopt a structured and proactive approach.

1. Internal Capability Assessment

Begin with a comprehensive evaluation of existing resources and infrastructure:

• Technology Audit: Assess current IT systems' capacity to integrate virtual asset platforms securely and scalably. Identify gaps in cybersecurity, data storage, and transaction processing.
• Personnel Expertise Review: Evaluate the current team's knowledge of blockchain technology, virtual assets, and related regulatory compliance. Identify needs for training, upskilling, or new hires.
• Risk Framework Analysis: Review existing risk management frameworks to ensure they adequately address virtual asset-specific risks, including market volatility, technological vulnerabilities, and AML/CFT complexities.

2. Regulatory Gap Analysis and Policy Development

Compare current policies and procedures against anticipated CMA and CBUAE requirements for virtual assets:

• Policy Review: Identify areas where existing compliance manuals, operational policies, and internal controls need modification to align with virtual asset regulations.
• New Policy Implementation: Develop specific policies for virtual asset custody, trading, client onboarding (KYC for virtual assets), transaction monitoring, and incident response.
• Legal Review: Engage legal counsel to interpret the resolution and subsequent guidance, ensuring all contractual agreements and client disclosures meet regulatory standards.

3. Strategic Integration Planning

Develop a clear strategy for incorporating virtual asset activities into the broader business model:

• Product Offering Definition: Determine the specific virtual asset services to be offered (e.g., custody, exchange, advisory), starting with a phased approach if necessary.
• Market Entry Strategy: Identify target client segments, market positioning, and competitive advantages.
• Financial Modeling: Project potential revenues, operational costs, capital requirements, and profitability for virtual asset ventures.
• Rollout Timeline: Establish a realistic timeline for technology implementation, regulatory authorization, pilot programs, and full service launch.

4. Stakeholder Engagement

Ensure all relevant internal and external stakeholders are aligned and prepared:

• Internal Buy-in: Secure support from senior management, board members, and department heads, emphasizing the strategic importance and potential risks.
• Vendor Selection: Identify and vet third-party technology providers, custody solutions, and cybersecurity firms that specialize in virtual assets.
• Regulatory Dialogue: Maintain an open channel of communication with both the CBUAE and CMA for clarifications and updates.

5. Proactive Monitoring of Regulatory Updates

The virtual asset regulatory landscape is dynamic; continuous monitoring is essential:

• Dedicated Monitoring: Assign responsibility for tracking new regulations, circulars, and guidance from the CBUAE, CMA, and international bodies like FATF.
• Industry Participation: Engage with industry associations, forums, and working groups to stay informed about best practices and emerging regulatory trends.
• Agile Adaptation: Build an agile framework that allows for rapid adaptation of internal policies and procedures in response to new regulatory mandates.

Conclusion

CMA Resolution No. 16/Chairman of 2026 represents a significant and progressive step in the UAE's journey to solidify its position as a global leader in digital finance. By enabling most CBUAE-licensed financial institutions to integrate virtual asset activities directly into their existing operations, the resolution effectively reduces the complexity and cost traditionally associated with entering this nascent but rapidly expanding market. This strategic move fosters innovation, expands service offerings, and enhances the competitive standing of UAE's financial sector.

The implications extend beyond operational efficiencies; they signify a maturing regulatory environment that encourages growth while maintaining strict oversight. Financial institutions that proactively assess their capabilities, refine their compliance frameworks, and strategically plan their virtual asset integration will be best positioned to capitalize on this new directive. Success will hinge on a comprehensive understanding of dual regulatory requirements from both the CBUAE and CMA, coupled with robust risk management and technological readiness.

Navigating this evolving regulatory landscape and strategically integrating virtual asset services requires specialized expertise. AURNE is well-equipped to guide your business through these complexities, ensuring full compliance and optimized operational efficiency. We invite you to contact us for comprehensive advice on UAE regulatory compliance and strategic planning for virtual asset integration. Our team is ready to support your business in embracing the opportunities presented by this new regulatory chapter.

---

This article is for general information only and does not constitute professional, legal, tax, or financial advice. Speak to AURNE for guidance specific to your situation.