Quick answer
CMA, often searched under ESCA or formerly SCA, regulates the UAE mainland capital-market framework. Select the actual dealing, investment-management, custody, rating, arranging/advice, crowdfunding or virtual-asset activity. Category 5 is not a forex/CFD execution licence; dealing permissions require separate category/activity approval.
UAE / Permission architecture
Which CMA / ESCA Licence Category Do You Need?
The category is the starting point, not blanket authority to perform every financial activity. Select the actual activity and approved jobs. CMA is the current regulator; ESCA and formerly SCA are common search terms for this framework.
Category 1 — Dealing in Securities
- Trading Broker
- Trading & Clearing Broker
- Trading Broker in International Markets
- OTC derivatives / OTC commodity contracts / spot-market currencies
- Financial Products Dealer
- Typical use case
- Brokerage, dealing and execution under the selected activity
- Capital
- AED30,000,000 minimum paid-up capital in the official category table
- Key personnel
- Head / Manager of Category, Compliance, Risk; trading/operations managers and broker representatives as applicable
Category 2 — Dealing in Investment
- Investment Fund Management
- Portfolio Management
- Fund Administration
- Managing a profit-sharing investment account; restricted ownership/Sharia model
- Family Business Investment Management; eligibility restrictions apply
- Typical use case
- Investment-management or fund operations
- Capital
- Fund management/family office AED1m; portfolio management AED3m; fund administration AED1m; profit-sharing account AED35m. Activity minimums are summed where multiple activities are conducted.
- Key personnel
- Head / Manager of Category, Compliance, Risk and Investment Operations roles; exact activity table applies
Category 3 — Custody, Clearing & Registration
- Custody
- General Clearing
- Depository / registrar activities
- Covered-warrant or depository functions where approved
- Typical use case
- Safekeeping, clearing and registration functions
- Capital
- AED50,000,000 minimum paid-up capital
- Key personnel
- Head / Manager of Category, Compliance, Risk and Operations; activity jobs apply
Category 4 — Credit Rating
- Credit-rating activity
- Typical use case
- Specialist credit-rating business
- Capital
- AED5,000,000 minimum paid-up capital
- Key personnel
- Head / Manager of Category, Compliance, Credit Rating Analyst / Head of Analysis; current approval matrix applies
Category 5 — Arranging and Advice
- Financial Consulting
- Financial Adviser / Issuance Manager
- Listing Adviser
- Introducing
- Promotion
- Typical use case
- Introduction, promotion and approved advisory work
- Capital
- AED500,000 minimum paid-up capital in CMA-hosted table
- Key personnel
- Head / Manager of Category + Head of Compliance; Financial Analyst / Promotion Manager and other activity jobs as applicable
Category 6 — Crowdfunding Platform Operator
- Crowdfunding-platform operation under the applicable framework
- Typical use case
- Crowdfunding, not brokerage licensing
- Capital
- AED1,000,000 in the annex; Cabinet Resolution 36/2022 framework also applies
- Key personnel
- Category Manager, Compliance Officer, Risk Management Officer and Operations Manager
Category 7 — Virtual Asset Service Providers
- Separate 2026 General Framework, Business Regulation and Alternative Trading System modules; applicant transition status matters
- Typical use case
- Virtual-asset business; mainland / free-zone perimeter must be assessed
- Capital
- Activity-specific virtual-asset rules; current amount to verify
- Key personnel
- Virtual-asset framework-specific governance and controls
Which category is right for you?
Final classification depends on the exact business model and CMA approval. This selector is a discussion aid, not a legal or regulator determination.
CMA / ESCA Licence Categories Compared
These seven categories belong to the UAE framework, not seven separate jurisdictions. Each category links to its detail in the UAE dossier; other jurisdiction permissions are assessed separately.
| Category / UAE dossier | Primary activity | Can deal / execute? | Can advise? | Can introduce? | Can hold client assets? | Capital | Main personnel | Typical business | Infy support |
|---|---|---|---|---|---|---|---|---|---|
| Category 1 | Dealing in Securities | Relevant approved activity only | Not inferred | Not inferred | Activity / custody conditions | AED30,000,000 minimum paid-up capital in the official category table | Head / Manager of Category, Compliance, Risk; trading/operations managers and broker representatives as applicable | Brokerage, dealing and execution under the selected activity | Classification, application, personnel coordination and scoped post-licence support |
| Category 2 | Dealing in Investment | Not a general forex brokerage licence | Selected permissions only | Not inferred | Activity-specific safeguarding | Fund management/family office AED1m; portfolio management AED3m; fund administration AED1m; profit-sharing account AED35m. Activity minimums are summed where multiple activities are conducted. | Head / Manager of Category, Compliance, Risk and Investment Operations roles; exact activity table applies | Investment-management or fund operations | Classification, application, personnel coordination and scoped post-licence support |
| Category 3 | Custody, Clearing & Registration | Not general dealing | Not inferred | Not inferred | Approved custody / activity scope | AED50,000,000 minimum paid-up capital | Head / Manager of Category, Compliance, Risk and Operations; activity jobs apply | Safekeeping, clearing and registration functions | Classification, application, personnel coordination and scoped post-licence support |
| Category 4 | Credit Rating | No trading permission from rating | Rating is not a blanket advisory licence | Not inferred | No custody permission inferred | AED5,000,000 minimum paid-up capital | Head / Manager of Category, Compliance, Credit Rating Analyst / Head of Analysis; current approval matrix applies | Specialist credit-rating business | Classification, application, personnel coordination and scoped post-licence support |
| Category 5 | Arranging and Advice | No forex / CFD execution or principal-dealing permission | Approved advisory activity only | If Introducing is approved | No custody permission inferred | AED500,000 minimum paid-up capital in CMA-hosted table | Head / Manager of Category + Head of Compliance; Financial Analyst / Promotion Manager and other activity jobs as applicable | Introduction, promotion and approved advisory work | Classification, application, personnel coordination and scoped post-licence support |
| Category 6 | Crowdfunding Platform Operator | Not a general dealing licence | Not inferred | Not general introducing | Framework-specific | AED1,000,000 in the annex; Cabinet Resolution 36/2022 framework also applies | Category Manager, Compliance Officer, Risk Management Officer and Operations Manager | Crowdfunding, not brokerage licensing | Classification, application, personnel coordination and scoped post-licence support |
| Category 7 | Virtual Asset Service Providers | Virtual-asset approval is not forex dealing | Specific scope only | Specific scope only | Specific custody approval only | Activity-specific virtual-asset rules; current amount to verify | Virtual-asset framework-specific governance and controls | Virtual-asset business; mainland / free-zone perimeter must be assessed | Classification, application, personnel coordination and scoped post-licence support |
Source: CMA Financial Activities and Jobs Approval table and current regulations. Unverified activity-specific figures and rules are withheld pending final review.
What this licence actually authorizes
- Introducing and promotion where specifically approved.
- Financial consulting/analysis and the other advisory activities listed in the category only within the firm’s activity approval.
What it does not authorize
- Not a UAE forex principal-dealing licence.
- Not authority for derivatives/spot-FX trading operations or execution of client orders in those activities.
- Not permission to manage client portfolios or imply that a foreign introduced broker is locally authorised to deal.
Who this jurisdiction suits
Suitable operating model
An introduction, promotion or advisory operation needing the specific mainland capital-market activities and approved professional roles.
Who it does not suit
A retail CFD dealing business attempting to use Category 5 as its trading authorisation; a firm assuming initial approval allows commencement.
Legal / regulatory framework
Federal Decree-Laws 32 and 33 of 2025; Financial Activities Rulebook as amended in 2026
The legal framework, current amendments, application guidance and individual conditions must be read together. A guideline is not a substitute for legislation; neither a company certificate nor software licensing establishes regulatory permission. Official source versions and unresolved verification notes are recorded below.
Former SCA / ESCA search terms, one current owner
SCA and the commonly used ESCA search term refer to the former authority. This dossier uses CMA as the current regulator and captures the older terms without creating competing commercial pages. Federal Decree-Laws 32 and 33 of 2025 entered into effect on 1 January 2026. Confirm any particular licence-transition or savings provision from the operative legislation; no universal reapplication deadline is asserted.
What Category 5 actually permits
The current official register warns that Category 5 does not confer brokerage permission in financial derivatives, unregulated commodity contracts or spot FX, or the relevant trading, portfolio-management and client-order execution activities. Introduction/promotion is not the introduced firm’s dealing licence. The activity matrix must connect the actual proposed service, approved person and client documentation to each approval sought.
Application stages and current rulebook
The published framework distinguishes initial approval from licensing. Prepare category/activity requests, ownership and management suitability, business plan, projected revenue/expenses and adequate resources. Licensing then requires evidence that category and activity conditions are satisfied; CMA may seek clarification or further documents. Examinations and approved-person eligibility need activity-specific verification. Statutory process periods are not advertised here as guaranteed end-to-end launch times.
Before You Apply
| Prerequisite | Classification | Application evidence |
|---|---|---|
| Company / UBO | Activity dependent | Legal form, controller disclosures, beneficial ownership and source of funds must match the actual application. |
| Regulatory capital | Activity dependent | Category/activity-specific; verified Category 5 table: AED500,000 paid-up capital. |
| Office / local substance | Activity dependent; verify applicable rule | Prepare premises, organisation, systems, controls, banking and appropriate resources for the approved activity set. Confirm office and staffing evidence against current CMA requirements rather than repeating historical SCA requirements. This mainland framework is not the DIFC DFSA or ADGM FSRA framework. |
| Directors / approved persons | Activity dependent | The category table lists Head or Manager of Category and Head of Compliance. Activity-specific approved jobs include Financial Analyst for financial consulting and Promotion Manager for promotion; other advisory activities have their own jobs. These are positions, not a universal headcount. Verify examinations, qualifications, role combination and any outsourcing approval before appointment. |
| Compliance / risk / MLRO | Activity dependent | Confirm mandatory appointments, eligibility, residence, independence and permitted outsourcing. Software does not replace accountable governance. |
| Auditor / company secretary | Activity dependent | Identify audit and corporate-secretarial obligations under the chosen company and regulatory structure; do not treat every role as universally mandatory. |
| Professional indemnity | Activity dependent | Confirm any insurance obligation, coverage and eligibility under current rules; no universal amount is inferred. |
| Business plan / forecasts | Activity dependent | Reconcile the programme of operations, financial projections, capital, staffing costs and downside assumptions with approved permissions. |
| Technology / client-money architecture | Activity dependent | Map platforms, liquidity counterparties, customer contracts, settlement, safeguarding, records and access controls to the actual permission. |
| Managed support / staffing sourcing | InfyTradeTech add-on support | Coordination, suitable personnel sourcing, management consulting and scoped technology/compliance operations, subject to legal eligibility and approvals. |
Corporate structure
Confirm the legal form, ownership chain, funding, group contracts and appropriate local professional support. Keep incorporation and regulatory authorisation as separate workstreams, and explain which entity contracts with customers and counterparties.
Regulatory capital
Category/activity-specific; verified Category 5 table: AED500,000 paid-up capital.
Client-money arrangements
No dealing / client-order execution permission under Category 5. Record banking, safeguarding, reconciliation and withdrawal-authority controls against the actual permissions before accepting funds.
Regulatory Operating Model
Required roles, activity-dependent responsibilities and InfyTradeTech add-on support are different things. This structure identifies operating responsibilities without calling every role a universal legal requirement.
Capital Market Authority (CMA), formerly SCA
Authorised entity / approved scope
Governance and legal responsibility remain with the entity.
Head / Manager of Category
Regulator required for Category 5
Governance and activity accountability
Head of Compliance
Regulator required for Category 5
Compliance function and controls
Activity roles
Activity dependent
Promotion Manager / Financial Analyst, according to approved activity
Illustrative operating structure, not a regulator-endorsed chart. Infy support is not a substitute for approved persons.
Directors / key personnel
The category table lists Head or Manager of Category and Head of Compliance. Activity-specific approved jobs include Financial Analyst for financial consulting and Promotion Manager for promotion; other advisory activities have their own jobs. These are positions, not a universal headcount. Verify examinations, qualifications, role combination and any outsourcing approval before appointment.
Local substance / office
Prepare premises, organisation, systems, controls, banking and appropriate resources for the approved activity set. Confirm office and staffing evidence against current CMA requirements rather than repeating historical SCA requirements. This mainland framework is not the DIFC DFSA or ADGM FSRA framework.
Need Qualified Regulatory Personnel?
We can assist with sourcing and structuring required personnel through our professional network, subject to qualification, fit-and-proper and regulator approval requirements.
Compliance, technology & operating evidence
Compliance / AML
Build the AML/CFT framework around the customers, instruments, payment methods and countries the firm will actually serve. The onboarding policy needs customer identification, beneficial-owner identification, purpose of the relationship, source-of-funds assessment, sanctions and PEP screening, escalation and ongoing monitoring. A downloaded manual is not evidence that these controls operate. Allocate accountable people, document exception handling and retain an auditable decision trail. Suspicious-activity reporting, record retention and training must be aligned with the applicable local rules; do not substitute a vendor screening result for the firm’s own risk assessment.
Technology & operating model
The regulatory dossier and the trading configuration should describe the same business. Record which legal entity contracts with the customer, which entity is the counterparty, where an order is executed and who holds the money. Describe account groups, instrument availability, markups, margin settings, order handling, access rights and change controls. An agency label is not enough if the client agreement or platform makes the applicant the contractual principal. Likewise, hedging every trade does not necessarily change the legal identity of the counterparty. Confirm the permission analysis before configuring production accounts.
Trading platform / liquidity
Prepare a platform architecture showing client terminal → trading server → execution interface → authorised counterparty. For an intermediary, demonstrate the actual external execution relationship rather than a simulated A-book diagram. For a principal model, document exposure measurement, hedging authority and limits. Identify the platform vendor, hosting location, bridge provider, LP agreements, order-reject handling, price-feed ownership and disaster-recovery arrangements. Vendor agreements must match the applying entity. Software licensing, an LP account and regulator authorisation are separate approvals; none proves the other.
Documents required
Ownership & corporate evidence
Constitutional documents, ownership chart to natural-person beneficial owners, shareholder and controller records, source-of-funds/source-of-wealth evidence and any required certified identity records. Disclose changes and linked entities consistently across forms, bank submissions and the business plan.
Business plan & financial projections
A permission-led business plan: target clients and countries, products, execution model, commercial assumptions, staffing and outsourcing. Prepare three-year projections as an application working file, identifying capital, operating expenses, revenue assumptions and downside scenarios; use the regulator’s actual prescribed horizon where different. Do not present a forecast as an achieved result.
Operations & Compliance Manual
Organisational responsibilities, account opening, approvals, complaints, recordkeeping, outsourcing oversight, incident management and regulatory reporting. Each policy needs an owner and practical evidence of implementation; avoid mutually inconsistent definitions across manuals.
AML/CFT systems and procedures
KYC/CDD and enhanced-due-diligence procedures, customer risk assessment, beneficial ownership, screening, transaction monitoring, reporting, training and review. Map the client cabinet and payment workflow to these decisions and preserve evidence of exceptions.
Client agreements & material contracts
Customer terms, risk disclosures, conflicts policy, execution disclosures and client-money arrangements where relevant. Provide platform, hosting, bridge, liquidity, outsourcing and key service-provider contracts aligned with the legal entity and proposed permissions.
Risk, business continuity & disaster recovery
Exposure and liquidity controls, dealing authority, escalation, continuity ownership, system backups, restoration tests and communications. Distinguish RiskMan’s automated software controls from the decisions taken by a human dealing desk. Document the limitations of each.
Personnel evidence
Personnel CVs, qualifications, experience certificates and background disclosures. Police/criminal-record certificates and regulatory exams apply where the current regime requires them. Confirm certification, translations, expiry and regulator eligibility before filing.
Application process
Perimeter
Map products, contractual principal, customers and target markets to required permissions. Record host-country marketing restrictions before selecting an entity.
Structure
Establish ownership, local professional support, key persons and the substance plan. Confirm funding and the capital basis rather than converting an historic minimum into a launch budget.
Evidence
Build and reconcile the application dossier, projections, client terms and operational controls. Test that the platform configuration matches the legal model.
Submission
Submit through the applicable official channel using the current forms and appropriate local representation. Maintain a versioned response register for further information requests.
Conditions
Resolve regulator queries and any pre-commencement conditions. Verify the authorisation, approved activities and register entry before enabling the corresponding business.
Operate
Maintain reporting, audit, financial-resource monitoring, complaints and AML controls. Assess changes to ownership, personnel, vendors, products and client countries before implementation.
Timeline
Plan by dependencies rather than a promised approval date: ownership and funding evidence → personnel/premises readiness → reconciled application → regulator queries → conditions → commencement. There is no guaranteed regulator timetable. Any indicative preparation schedule must be agreed for the actual scope and is not a commitment by the regulator.
What InfyTradeTech Handles
Application architecture
Translate the actual business model into a permission matrix, corporate structure and controlled application evidence register. Coordinate local professional input; the regulator retains the authorisation decision.
Corporate setup coordination
Coordinate incorporation, ownership documentation and the appropriate local management/company-secretarial workstream. Registered-office services alone are not represented as regulatory substance.
KYC / CDD file preparation
Organise shareholder, UBO and key-person evidence with source-of-funds and source-of-wealth support. The client remains responsible for complete and truthful disclosures.
Policies, projections & agreements
Coordinate client agreements, Operations & Compliance Manual, AML/CFT procedures, risk and conflicts policies, financial projections and material contracts against the agreed operating model.
Business continuity / disaster recovery
Connect the policy architecture to hosting, backups, permissions, restoration procedures and the people responsible for incident decisions.
Application pack & regulator queries
Coordinate the application forms and supporting pack, reconcile responses and track follow-up. Filing and representation arrangements depend on local eligibility rules and the agreed engagement.
Operational readiness
Connect licensing work to banking/PSP support, trading platform, Forex CRM, bridge/gateway, liquidity integration, RiskMan software and separately scoped 24/7 human operations. These services are not implied to be mandatory regulatory vendors.
What the client provides
Ownership, identity and funding
Provide accurate legal ownership, beneficial owners, certified personal records where needed, background disclosures and evidence explaining the origin and availability of capital.
Commercial decisions
Confirm products, agency/principal model, customer countries, distribution channels, client-money handling and launch priorities. The application cannot resolve conflicting instructions about who will be the counterparty.
People and premises
Nominate suitably qualified key persons, agree local substance arrangements and provide office/service contracts. Attendance, experience and accountability cannot be replaced by a name on a form.
Approvals and evidence
Review and approve the business plan, projections, policies and agreements; disclose changes promptly and provide vendor contracts and practical control-test evidence. Do not begin regulated activity before the required permissions and conditions are met.
From Application to Operating Company
We do not disappear once the licence is issued. Application coordination, suitable personnel and scoped ongoing management support should connect to the way the business actually operates.
Licensing
Regulatory strategy & application
Category selection, corporate structure, feasibility study, business plan, forecasts, forms and authority submission coordination; queries are tracked through a controlled evidence register.
Control architecture
AML/CFT, compliance, risk, internal controls, internal-audit planning, conflicts, code of conduct, BCP/DR, complaints, whistleblowing and sanctions/terrorist-financing screening aligned with the real operating model.
Banking & technology readiness
Banking assistance, client documentation, platform/CRM architecture, liquidity relationships and operational evidence. No bank acceptance or authorisation is guaranteed.
Staff & substance
Need the required team? We can help.
Assist with sourcing / arranging suitably qualified personnel subject to regulatory approval: Head of Category, compliance officer, MLRO/DMLRO, risk officer, financial analyst, promotion manager, dealer representatives, resident directors, company secretary and operations/administration staff, where legally permitted.
Qualifications & approvals
Build role-specific CV, qualifications, experience and background evidence, including exams where applicable. Verify fit-and-proper, residence, independence and role-combination requirements rather than promising guaranteed approved staff.
Physical operating presence
Coordinate premises, local professional support, systems and responsible personnel. A nameplate or registered-office contract is not proof that every local-substance requirement is met.
Post-licence management
Regulatory compliance
Scoped support for AML/CFT monitoring, KYC/CDD oversight, screening, risk assessments, reporting, compliance calendar, policies, inspection preparation and compliance-file maintenance. Renewal support applies only where the regime requires renewal.
Management consulting
Board/management support, operational governance, vendor management, brokerage workflows, technology governance, risk framework, internal controls, business continuity and management reporting.
Operations & technology
Platform administration, CRM/account operations, payment workflows, liquidity coordination and risk monitoring. RiskMan software and human-managed dealing operations remain separately scoped. The licensed entity retains legal responsibility.
After the licence — ongoing obligations
Maintain approved-person and activity compliance, capital/resources, conduct, client documentation and applicable reporting. Current 2026 rulebook amendments must be checked for scope; no generic capital-buffer percentage is asserted for every Category 5 activity. Initial approval is not permission to commence the regulated activity.
Managed Regulatory Operations
For firms that do not want to assemble every operational and compliance function independently, InfyTradeTech can coordinate an ongoing managed-support model covering regulatory administration, compliance workflows, approved-person support, technology operations and management consulting.
Add-on support, subject to legal eligibility, regulator approval where required and agreed scope. The licensed entity retains responsibility.
Discuss Managed Regulatory OperationsBanking / PSP considerations
Banking / PSP considerations
Banks and payment providers conduct their own underwriting. Prepare the ownership chain, source-of-wealth evidence, expected customer geography, transaction flow, refund process and reconciliation model. Separate operating funds from customer funds where required and explain settlement accounts and payment-provider balances. Establish who can approve withdrawals, how duplicate callbacks are handled and how discrepancies are investigated. A licence does not guarantee bank acceptance, card acquiring or uninterrupted payment processing. Do not commence client-money handling merely because an account has been opened; check the permissions and operational controls first.
Common reasons applications fail
Material inconsistencies are more serious than cosmetic omissions. Typical readiness problems include an unexplained ownership chain, unsupported source of funds, a business plan inconsistent with proposed permissions, unrealistic revenue assumptions, unsuitable key persons, an office that does not demonstrate operational substance and contracts signed by the wrong entity. Generic compliance policies often fail to explain who investigates an alert or approves a withdrawal. A principal-dealing contract presented as agency execution creates a permission problem. Keep an evidence register, resolve contradictory versions and respond to regulator questions with reconciled documents rather than isolated edits.
Alternative jurisdictions
Frequently asked questions
What does this route actually authorise?
The UAE regulator is the Capital Market Authority following the reform effective 1 January 2026. Category 5 covers arranging/advice activities according to the approved activity set. It does not authorise derivatives brokerage, spot-FX trading, portfolio management or executing client trading orders in those activities.
Does it permit operating worldwide?
No blanket global permission is asserted. Local authorisation or incorporation does not remove the need to assess solicitation and service provision in each target market.
How much capital should the business plan include?
AED500,000 minimum paid-up capital in CMA-hosted Category 5 table; risk/resource requirements assessed separately. Separate this requirement from operating expenses, bank underwriting and any ongoing financial-resource calculation.
Can the launch date be guaranteed?
No. Application readiness, queries, personnel approvals, banking and regulator decisions affect the sequence. Preparation milestones can be planned; regulator timing and approval cannot be guaranteed.
Can an existing company be acquired instead?
An acquisition route requires genuine availability, legal and financial due diligence, and any applicable regulatory notifications/approvals or fit-and-proper assessment. Changes to ownership or key persons may affect the permission. Availability is confirmed privately, not assumed.
Official sources
Reviewed against official regulator sources for drafting. Source review does not constitute completed regulatory sign-off; incomplete checks are identified explicitly.
CMA reform announcementEffective 1 January 2026Federal Decree-Law 32 of 2025Legal reform; succession/savings full text review pendingFinancial activities and jobs approvalCMA-hosted Category 5 capital/staffing tableCMA licensed companiesCurrent Category 5 trading-permission warningCMA current regulationsIncludes 2026 rulebook amendmentsRegulatory requirements are subject to amendment and should be confirmed against the regulator’s current rules before an application is submitted.