THE IMPLICATIONS OF THE UAE’S NEW SECURITIES AND INVESTMENT LAWS

An analysis of Federal Decree-Laws No. 32 and 33 of 2025 and the UAE’s broader 2025–2026 legislative reform programme

Legislative Context

The UAE’s capital markets framework has, since its inception, been built on Federal Law No. 4 of 2000, which established the Emirates Securities and Commodities Authority and provided the foundational architecture for regulating securities, commodities, and investment activities onshore. Despite a series of regulatory updates, the framework was increasingly strained by the scale, cross-border complexity, and pace of financial innovation that now characterise UAE markets. The 2025-2026 reforms address these structural limitations through a coordinated package of primary legislation that touches every significant dimension of UAE’s financial regulatory architecture. The 2025-2026 reforms have four components, each of which affect capital markets participants to varying degrees:

1. Federal Decree Laws No. 32 and 33 of 2025[1]: the centrepiece of the reforms, effective 1 January 2026, governing the new Capital Market Authority and the substantive regulation of UAE capital markets respectively.
2. Federal Decree Law No. 20 of 2025: amendments to the Commercial Companies Law (“CCL”), effective 15 October 2025, introducing multiple share classes for limited liability companies, statutory drag-along and tag-along rights, a private placement pathway for private joint stock companies (“PrJSCs“), and a corporate re-domiciliation framework.
3. Federal Decree Law No. 6 of 2025[2]: a comprehensive overhaul of the Central Bank Law, effective 16 September 2025, consolidating oversight of banking, insurance, payments, and fintech regulation under a unified supervisory framework.
4. Federal Decree Law No. 10 of 2025[3]: a replacement of the 2018 AML/CTF framework, effective December 2025, expanding the Financial Intelligence Unit’s operational powers and tightening obligations across financial institutions and virtual asset service providers.

This Article focuses primarily on the Federal Decree Law No. 32 of 2025 Regarding the Capital Market Authority (“CMA Law”) and Federal Decree Law No. 33 of 2025 Regarding the Regulation of Capital Market (“Capital Market Law”), with specific analysis of the CCL amendments where they are directly relevant to capital markets activity.

The Capital Market Authority: Institutional Reconstitution

The CMA Law reconstitutes the Securities and Commodities Authority (“SCA“) as the Capital Market Authority (“CMA“), an independent federal public authority with separate legal personality, which assumes all rights, obligations, contracts, and liabilities of the former SCA. All existing references to the “SCA” in legislation, contracts, and official documents are automatically substituted by “CMA” without further amendment.

The institutional change is substantive, not cosmetic. For the first time, the CMA’s core statutory objectives are embedded in primary law. These include: regulating, supervising, and developing the UAE’s capital markets sector in accordance with the country’s broader economic and policy objectives; protecting investors and market participants; enhancing market integrity, efficiency, and transparency; promoting fair competition; supporting sustainable economic growth; fostering innovation within a safe and well-governed environment; and positioning the UAE as an internationally competitive financial centre. Embedding these objectives in statute is legally significant, in any future challenge to CMA regulatory action, they provide a benchmark against which the reasonableness and proportionality of that action may be assessed. The CMA is also granted broader supervisory, investigatory, and enforcement powers than its predecessor, including the ability to impose a wider range of administrative sanctions and to conduct on-site inspections and information-gathering exercises with enhanced statutory backing.

The CMA Law introduces express governance and accountability requirements applicable to the CMA itself. These include requirements relating to board composition and structural matters, information safeguarding obligations applicable to board members and all CMA staff, and external auditing requirements. These provisions are designed to reinforce institutional credibility and provide a framework for oversight of the regulator as well as by it.

All entities and persons within scope of the new legislation must regularise their position within one year of 1 January 2026, i.e., by 1 January 2027, subject to extension by the CMA Board.[4] Pre-existing Cabinet decisions and SCA resolutions remain operative to the extent they do not conflict with the Decree-Laws, until replaced by new implementing resolutions. In practice, the substantive SCA rulebook carries over in the interim, and the transitional window is intended to give the CMA time to issue updated rules and regulated firms time to adapt their compliance frameworks accordingly. Firms that take a proactive approach to identifying gaps and engaging with CMA guidance during this period will be better placed than those who wait for formal requirements to crystallise.

The Capital Market Law: Key Substantive Reforms

An Expanded Regulatory Perimeter

Article 2 of the Capital Market Law materially expands the CMA’s jurisdictional reach. The provision expressly extends the scope of the Capital Market Law to: financial products dealt with within the UAE; financial activities practised within the UAE or by any person operating in a UAE financial free zone; licensed persons, approved persons, issuers (including foreign issuers), funds, and connected persons operating within the UAE; and any person targeting clients within the UAE, even where the activity is conducted from outside the UAE or from a financial free zone such as the DIFC or ADGM. Public sector issuances and activities within the exclusive purview of the Central Bank are expressly excluded from scope.

Under the prior framework, regulatory reach was largely tied to domestic execution and physical presence, leaving meaningful uncertainty around the treatment of cross-border activity. The new provision resolves that uncertainty by making explicit that directing financial services, offers, or marketing at UAE investors, regardless of where the firm is incorporated or where the transaction is executed, falls within the CMA’s regulatory perimeter. Firms currently relying on cross-border exemptions that were available under the old regime should not assume those exemptions automatically carry over; the CMA is yet to confirm whether or how existing exemptions will be preserved under the new framework.

Foreign financial institutions, fund managers, and investment advisers with UAE investor bases should treat this change as a prompt to review their licensing and compliance frameworks. The jurisdictional reach of the Capital Market Law is broader than the prior regime, and the position on cross-border exemptions remains to be clarified by the CMA through implementing regulations.

Statutory Prospectus Liability

Article 29 of the Capital Market Law introduces a unified statutory prospectus liability regime applicable to all issuers of securities in the UAE. Statutory liability is expressly imposed on the issuer’s board of directors, executive management, and advisers for any failure to provide required information, or for providing misleading or inaccurate information, within the prospectus, each within the scope of their respective competence. The liability standard is stringent and leaves no room for ambiguity: if the information is wrong or missing and falls within a party’s area of responsibility, that party is exposed. For intentional conduct, the Capital Market Law imposes criminal sanctions including imprisonment of not less than one year and substantial financial penalties. Prior to this reform, prospectus liability in the UAE was derived primarily from SCA regulatory rules and exchange requirements rather than primary statute. While liability existed, the legal basis was indirect and its scope was uncertain. Article 29 resolves that uncertainty entirely, placing prospectus liability on a clear and direct statutory footing for the first time.

Issuers, their boards, and their advisers should review diligence processes, verification procedures, and sign-off frameworks in light of the direct statutory exposure now imposed by Article 29. Comfort letter and verification frameworks developed under the old regime may need updating. Underwriting banks, in particular, should consider whether their existing diligence records and verification materials are sufficiently robust to support available defences

Inside Information and Delayed Disclosure

Article 33(2) of the Capital Market Law permits an issuer to delay the public disclosure of inside information where it has reasonable grounds to believe that immediate disclosure would cause serious harm to its interests or those of its shareholders. To invoke the delay, the issuer must submit a justified written request to the CMA (for unlisted securities) or to the relevant exchange, the Abu Dhabi Securities Exchange (“ADX“) or Dubai Financial Market (“DFM“), in respect of listed securities. The CMA or exchange may accept, reject, or subsequently amend or revoke the decision to delay. This is a welcome and practical provision: the ability to manage the timing of sensitive disclosures in a structured and legally compliant manner is important for issuers managing complex corporate events.

Complementing this is the substantially strengthened market abuse framework under Article 37, which codifies a more granular and behaviourally precise set of prohibited market conduct offences. These include: entering into transactions with the intent to deceive or mislead investors or the market; employing manipulative trading practices; disseminating false or misleading statements about a financial product or issuer; inciting or spreading rumours capable of affecting the price or value of securities; and exploiting inside information, with the prohibition capturing both direct and indirect dealings by persons in possession of material non-public information. The CMA is underpinned by a significantly enhanced enforcement apparatus, including robust surveillance and investigation tools, graduated administrative sanctions, and direct criminal referral powers. Administrative penalties may reach up to AED 200 million or ten times the illicit gains realised or losses avoided, whichever is higher. The CMA may also impose warnings, suspend or cancel licences, and publish imposed penalties.

The enhanced penalty regime is a material change from the prior framework and substantially elevates the consequences of non-compliance. All regulated firms should review their market conduct policies and training programmes in light of the broadened offences and significantly increased sanctions.

Price Stabilisation Safe Harbour

Article 37(2) of the Capital Market Law codifies a statutory safe harbour for price stabilisation activities conducted in connection with securities offerings. The provision states that the exercise of price stabilisation controls, procedures, or mechanisms for which controls have been issued by the CMA or Capital Market Institutions shall not constitute a violation of the Capital Market Law or of the provisions of Federal Decree-Law No. 32 of 2021 on Commercial Companies that prohibit the influencing of securities prices. This resolves a longstanding and practically significant ambiguity. Under the prior framework, investment banks conducting standard IPO stabilisation programmes operated in a theoretically exposed position, with comfort derived from regulatory practice and structural workarounds, including the frequent appointment of independent third-party stabilisation managers, rather than a clear statutory exclusion. Article 37(2) eliminates that structural uncertainty and places the safe harbour on an explicit primary legislative basis.

Investment banks acting as stabilisation managers in UAE public offerings should update their stabilisation documentation, internal procedures, and disclosure materials to reflect the new statutory framework. The codification of the safe harbour may also remove the need for certain structural arrangements that were historically used to manage stabilisation risk.

Systemically Important Licensed Persons and Recovery

The Capital Market Law introduces a dedicated regulatory framework for entities designated as Systemically Important Licensed Persons. The CMA has full discretion to determine which firms fall within this category based on criteria including size and market share, complexity, interconnectedness with other market participants, and potential systemic impact. Designated firms are subject to enhanced prudential requirements, including capital, liquidity, governance, and risk management obligations, as well as recovery and resolution planning requirements. The CMA is granted a comprehensive toolkit of early-intervention and resolution powers. In resolution, it may: remove or appoint management; terminate, assign, or vary contracts; write down or convert debt; transfer assets and liabilities to third parties or bridge entities; impose temporary stays on termination rights; and conduct orderly wind-downs with a statutory hierarchy of claims. These powers may be exercised before formal insolvency proceedings are initiated, giving the CMA meaningful tools to intervene at an early stage and manage a firm’s failure in an orderly manner.

Firms of a size or complexity that could attract systemic importance designation should begin assessing their exposure now, before formal designation criteria are published. Recovery planning, governance documentation, and capital planning frameworks should all be considered as early priorities.

Investor Protection Fund and Settlement Guarantee Fund

Article 44 of the Capital Market Law requires the CMA to establish an Investor Protection Fund, an independent legal entity with separate legal personality and financial liability, the purpose of which is to protect investors’ funds against risks determined by the CMA. The CMA is responsible for issuing a decision regarding the fund’s establishment, operational mechanisms, management, membership conditions, financial resources, obligations towards investors, risks covered, eligibility periods, and dissolution mechanisms. Separately, Article 45 permits the central clearinghouse to establish a Settlement Guarantee Fund, also with independent legal personality, the purpose of which is to guarantee the settlement of transactions executed on the market, subject to CMA-approved controls. These mechanisms are a structural improvement over the prior regime, which lacked equivalent statutory investor compensation or settlement guarantee arrangements, and are designed to deepen confidence among the full range of investors engaging with UAE markets.

Whistleblower Protections

Article 60 of the Capital Market Law introduces robust whistle-blower protections. Any person may report suspected violations to the CMA, to a Capital Market Institution, to their employer, to the compliance officer of their employer, or to judicial authorities. Persons making such reports are afforded immunity from criminal, civil, and contractual liability arising from the act of reporting, as well as protection from compensation claims and adverse employment consequences. This provision is designed to encourage the reporting of misconduct from within regulated firms and is likely to increase the volume and quality of information reaching the CMA through internal channels.

Regulated firms should review their internal whistle-blower and speak-up frameworks to ensure they are consistent with Article 60 and that employees are aware of both the internal and external reporting channels available to them.

Collective Investment Schemes

Article 38 of the Capital Market Law establishes a revised framework for investment funds. Funds now enjoy independent legal personality and ring-fenced financial liability, strengthening the structural integrity of UAE-domiciled funds and the protections available to fund investors. Funds may be established in one of two forms: as an investment fund established and licensed by a CMA decision; or as a recognised form of commercial company, established in accordance with applicable UAE company laws, with prior CMA approval. This dual-track structure provides meaningful flexibility for fund sponsors in designing their fund vehicles.

Virtual Assets

Article 39 of the Capital Market Law formally integrates virtual asset trading into the capital markets regulatory perimeter. The CMA assumes federal supervisory responsibility for virtual asset activities in the onshore UAE, and trading of any virtual asset is prohibited unless it has been approved and listed by a CMA-licensed virtual asset platform operator registered with the CMA. The existing delegation arrangement to the Dubai Virtual Asset Regulatory Authority (“VARA“) is preserved pending amendment or repeal, meaning the UAE’s multi-regulator approach to digital assets continues within a clearer federal framework. Implementing regulations are expected and will define much of the practical operation of this regime. Firms operating in the virtual asset space, whether as issuers, platform operators, or advisers, should closely monitor CMA publications as implementing regulations take shape. The licensing requirements, the interface with VARA’s existing framework, and the precise scope of the approved asset list will all be critical details that the primary law leaves to secondary legislation.

Criminal Settlement Mechanism

Article 75 of the Capital Market Law introduces a pre-prosecution criminal settlement mechanism. Prior to initiating criminal proceedings, the CMA may settle with a violator in respect of crimes under the Capital Market Law, subject to controls to be issued by Cabinet decision. If settlement is not achieved or the violator rejects its terms, the CMA is required to refer the matter to the public prosecution. The public prosecution may also settle after proceedings commence, but before final judgment is delivered. This mechanism gives the CMA a more proportionate and commercially sensitive enforcement pathway, enabling resolution of serious matters without necessarily resorting to criminal prosecution, while preserving the ability to escalate where appropriate.

Commercial Companies Law: Capital Markets Implications

The October 2025 amendments to the CCL are a distinct legislative framework, but their relevance to capital markets activity is direct. Three changes are of particular note.

Private Placements for Private Joint Stock Companies

Article 32 of the CCL, as amended, permits PrJSCs to raise capital through regulated private placements on UAE financial markets for the first time, without the need to conduct a full public offering. Prior to this reform, PrJSCs had no clear domestic pathway for accessing institutional capital short of a full listing, a structural gap that regularly drove issuers towards offshore structures or parallel vehicles. The reform closes that gap and is expected to deepen the pipeline of growth-stage companies able to access UAE capital markets and, in time, to graduate to the ADX or DFM. The practical operation of the private placement framework is contingent on implementing regulations from the CMA, which remain outstanding. The shape of those regulations, including eligibility criteria, investor categorisation, disclosure requirements, and any resale restrictions, will determine how commercially viable this new pathway proves in practice. Market participants with an interest in this area should monitor CMA publications closely.

Statutory Investor Rights and Multiple Share Classes

Article 14 of the CCL, as amended, introduces statutory recognition of drag-along and tag-along rights, which may now be embedded directly in a company’s constitutional documents rather than relying on private shareholders’ agreements with historically uncertain enforceability. Multiple share classes are also now available in limited liability companies. These changes bring UAE corporate governance tools meaningfully closer to the structures available in leading investment jurisdictions, reducing transaction friction and providing materially stronger and more reliably enforceable protections for private equity and venture capital investors in UAE-incorporated entities.

Corporate Re-domiciliation

The new Article 15 of the CCL establishes a framework for corporate re-domiciliation, permitting companies to transfer their commercial register and licensing to a different competent authority — including from foreign jurisdictions into the UAE, while preserving the same legal entity and its existing contractual relationships. There is no requirement for liquidation or reincorporation, and there is no discontinuity of legal personality. For regional groups seeking to consolidate their structures, or for foreign businesses considering establishing a UAE anchor entity, this is a new and commercially significant option that was previously unavailable.

Key Considerations for Market Participants

The transitional window runs until 1 January 2027, but a number of the changes described in this article have immediate compliance implications. The following sets out the priority considerations by market participant type.

Licensed Financial Intermediaries

• Map existing licences against the Capital Market Law’s revised activity definitions. Gaps are more easily addressed proactively than reactively, and the CMA is likely to expect regulated firms to have conducted this exercise.
• Review conduct of business policies, governance arrangements, and fitness and propriety assessments for senior staff against the elevated CMA expectations embedded in the new framework.
• Assess whether your firm could attract designation as a Systemically Important Licensed Person and, if so, begin preliminary recovery planning work ahead of any formal regulatory requirement.
• Ensure AML/CTF procedures have been updated in line with the new AML Law and associated FIU requirements. These obligations are already in force.
• Review and update internal whistle-blower and speak-up frameworks to reflect the protections and reporting channels now codified in Article 60.

Issuers and Prospective Issuers

• Revisit prospectus diligence frameworks, verification procedures, and board sign-off processes in light of the direct statutory liability imposed by Article 29. Boards should be satisfied that their internal disclosure controls are robust and that each party signing off on a prospectus is comfortable with the statutory exposure attaching to their respective area of responsibility.
• PrJSCs with capital raising plans should engage advisers to monitor and assess the private placement framework as CMA implementing regulations are published, and to evaluate whether the domestic route under Article 32 offers advantages over offshore alternatives.
• Companies considering conversion from LLC to PrJSC, or a cross-authority re-domiciliation under Article 15, should evaluate whether these pathways now offer a commercially attractive route to restructuring.

Investment Banks and Financial Advisors

• Update IPO stabilisation documentation, internal procedures, and disclosure materials to take full advantage of the statutory safe harbour now codified in Article 37(2). Consider whether structural arrangements previously used to manage stabilisation risk remain necessary under the new framework.
• Reassess compliance frameworks for cross-border offerings directed at UAE investors. Article 2’s expanded jurisdictional perimeter means UAE compliance obligations may extend further than your existing framework assumes, and the CMA’s position on cross-border exemptions is yet to be confirmed.
• Advise clients with virtual asset ambitions on the new CMA licensing requirements and the continued VARA delegation arrangement, and monitor CMA publications for the implementing regulations that will define the operational framework.

Foreign Entities and Investors

• Assess whether cross-border activities directed at UAE clients — including fund marketing, investment advisory services, and solicitation of investments — fall within the CMA’s expanded jurisdictional perimeter under Article 2, and take licensing or exemption advice accordingly.
• Consider the re-domiciliation framework as a potential tool for consolidating regional group structures into the UAE without the cost and disruption of liquidation and reincorporation.
• Establish a structured process to monitor CMA Board resolutions and implementing regulations. The primary legislative framework is in place, but much of the practical operation of the new regime, including key licensing requirements, exemptions, and the virtual asset framework, will be shaped by secondary legislation that is still to come.

Conclusion

The enactment of the CMA Law and the Capital Market Law, taken together with the concurrent reforms to the Commercial Companies Law, the Central Bank Law, and the AML/CTF framework, represents the most comprehensive overhaul of the UAE’s financial regulatory architecture since the establishment of the SCA in 2000. The reforms mark a structural shift from a rulebook-driven and interpretive regime to one that is statutory, consolidated, and enforcement-oriented: statutory prospectus liability, a codified market abuse framework, enhanced penalty powers, and new recovery and resolution tools all point in the same direction.

For market participants, the reforms bring both opportunities and obligations. The areas of new legal certainty reduce transaction risk and create a more predictable operating environment. At the same time, the expanded regulatory perimeter, the significantly increased penalty regime, and the new obligations applicable to systemically important firms materially raise the compliance bar.

The central challenge of the period ahead will be navigating the transition thoughtfully. The primary legislative framework is in place and clear in its direction. However, a significant body of implementing regulation remains to be issued, and the practical shape of several key provisions, including the virtual asset framework, private placement rules, cross-border exemptions, and systemic importance criteria, will only become clear as that secondary legislation emerges. Firms that engage early, monitor CMA guidance closely, and take a proactive approach to remediation will be better positioned than those who wait.

We will continue to monitor developments as implementing regulations are issued and will publish further analysis as the framework develops. We welcome the opportunity to discuss the implications of these reforms for your specific circumstances.

Author/s

Evgeny Yafasov

Partner – HAS Law Firm

Chirag Chhabra

Associate – HAS Law Firm

[1] Federal Decree Law No. 32 of 2025 Regarding the Capital Market Authority and Federal Decree Law No. 33 of 2025 Regarding the Regulation of Capital Market.

[2] Federal Decree Law No. 6 of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business.

[3] Federal Decree Law No. 10 of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing.

[4] Article 83 of the CMA Law.