The Robius Regulator Map: Who Actually Protects Your Money in the UAE, by What You Are Using

UAE financial regulator by product

The Robius Regulator Map: Who Actually Protects Your Money in the UAE, by What You Are Using

The UAE has at least five financial regulators. The one that protects you depends entirely on what you are using.

That single fact is behind almost every money scam and every nasty surprise we cover. People check whether a company is “regulated,” see a badge, and stop. They never ask the only question that matters. Regulated by whom, for what, and where can I confirm it.

So we built the map. Bookmark it. The next time an app, a broker, or a salesperson says the word “regulated,” you will know exactly which register to open, and what it means if the name is not there.

The Map, in One Table

Start here. Find what you are using in the left column, and you have your regulator and your register. The sections below explain each one.

The Change Everyone Missed: SCA Is Now the CMA

This is the update most articles online still have wrong, so read it carefully.

On 1 January 2026, the Securities and Commodities Authority, the SCA, was replaced by the Capital Market Authority, the CMA. The change came through Federal Decree-Law No. 32 of 2025 and Federal Decree-Law No. 33 of 2025. The new regulator has broader powers, a codified licensing regime, and an expanded scope that now includes virtual assets outside the free zones.

If a broker’s website, or a review, still says “SCA-regulated,” that is not automatically a red flag, since the transition is recent. But the live register to check is now the CMA’s, at uaecma.gov.ae. And the penalties are not trivial. Operating a financial activity in the UAE without a CMA license can carry fines up to AED 250 million.

CMA: Forex, Stocks, and Funds on the Mainland

The CMA is the federal securities regulator. It covers the mainland UAE, meaning everywhere outside the two financial free zones. Forex and CFD brokers, stockbrokers, investment managers, fund distributors, and custody providers all sit here.

This is the register where most “is my broker legit” questions are actually answered, and where most offshore brokers quietly are not listed. We walked through exactly that gap in our Exness review, where even the broker’s own page muddled which regulator it named, and in our Olymp Trade piece, where a broker can be legal to use in the UAE while holding no UAE license at all. Legal to use is not the same as locally regulated. The register tells you which one you have.

VARA: Crypto in Dubai

VARA is the Virtual Assets Regulatory Authority. It regulates crypto exchanges, brokers, and custody providers operating in Dubai, outside the DIFC.

Its public register does something most do not. It separates firms holding a full license from those holding only an In-Principle Approval. An In-Principle Approval is a conditional step, and by VARA’s own rules, those holders cannot yet serve clients. So on VARA’s register, do not just check that a name appears. Check that it holds a full license, for the specific activity you need.

DFSA and FSRA: The Two Free Zones With Their Own Rules

The DIFC and the ADGM are financial free zones. They are inside the UAE geographically, but they run their own financial law and their own regulators. This is where a lot of confusion lives.

The DFSA, the Dubai Financial Services Authority, regulates every financial firm inside the DIFC. The FSRA, the Financial Services Regulatory Authority, does the same inside the ADGM in Abu Dhabi. Both keep public registers. So a firm can be “UAE regulated” by the DFSA or the FSRA and still be nothing to do with the CMA or the Central Bank. The label is only meaningful once you know which of these bodies issued it.

CBUAE: The Big One for Everyday Money

The Central Bank of the UAE covers the widest slice of daily life. Banks. Payment apps and wallets. Exchange houses. Finance and lending companies. Stored value facilities. And, since the Insurance Authority merged into it in 2021, insurers and insurance brokers too.

So the app you use to send money, the card in your wallet, the policy on your car, and the loan on your books all trace back to one regulator. That breadth is why so many impersonation scams pretend to be “the Central Bank” or “your bank.” The name carries weight.

It is also why the structure of a fintech deal matters. When a payment platform offers you an account, the license and the protection sit with the regulated bank behind it, not the app, which is the whole point we unpacked in the Wio and Geidea partnership. Ask which CBUAE-licensed entity actually holds your money.

The Regulator That Is Not Yours

Here is the trap the whole map is built to defeat. Many platforms are regulated by someone. Just not by anyone who can help you.

Watch for three moves. First, a foreign license presented as if it were local. A broker regulated only in an offshore jurisdiction is not UAE-regulated, and your recourse runs through that foreign body, wherever it is. Second, a look-alike regulator name. Kenya and Saudi Arabia both have a “Capital Market Authority,” so a “CMA license” on a page is not automatically the UAE’s CMA. Read which country it names. Third, a scheme registration dressed up as regulation. Being a registered payment facilitator with Visa or Mastercard is a commercial arrangement, not a financial license.

In every case the fix is identical. Ignore the badge. Take the exact legal entity name, open the correct UAE register from the table above, and confirm it yourself.

If It Goes Wrong Anyway

Regulation is the front door. The back door matters too, and most residents do not know it exists.

If a dispute with a bank, an insurer, or a finance company stalls, you are not stuck with the company’s own complaints desk. Sanadak, the UAE’s independent financial ombudsman, resolves those disputes for free. It only works for firms that are actually regulated here, which is one more reason the register check comes first. No UAE license, no UAE ombudsman.

The Five-Minute Habit

You do not need to memorize any of this. You need one routine, run before you ever fund an account or sign a contract.

• Find the exact legal entity name, not the brand or the app name.
• Use the table above to pick the right regulator for what you are using.
• Open that regulator’s official register and search the entity.
• Confirm the license is active, and that it covers the specific activity you need.
• If the name is not there, treat the platform as unregulated in the UAE, whatever its website says.

The Bottom Line

“Regulated” is a word, not a guarantee. In the UAE it points to five different bodies, and only the right one, holding a current licence for the right activity, actually stands behind your money.

Keep this map close. The badge on the website is decoration. The name on the register is the truth.

Sources

• Capital Market Authority (official): UAE federal securities regulator, formerly the SCA, and its licensed-firms register — https://www.uaecma.gov.ae/en/home.aspx
• Dechert LLP: How Federal Decree-Laws 32 and 33 of 2025 replaced the SCA with the CMA on 1 January 2026 — https://www.dechert.com/knowledge/onpoint/2026/2/from-sca-to-cma—more-than-just-a-rebrand.html
• Central Bank of the UAE (official): Regulator for banks, payments, wallets, exchange houses, lenders, and insurers — https://www.centralbank.ae/en/
• VARA (official): Dubai virtual assets regulator, public register, and the full-license versus In-Principle Approval distinction — https://www.vara.ae/en/licenses-and-register/public-register/
• DFSA (official): Regulator for firms inside the DIFC, with public register — https://www.dfsa.ae/public-register
• FSRA / ADGM (official): Regulator for firms inside the ADGM in Abu Dhabi — https://www.adgm.com/

This is not financial advice.

Robius.news — Dubai, UAE — 2026 | Built to be first. Built to be trusted.