By Soham Jethani and Rhea Shah

On 25 June 2026, the Capital Market Authority (CMA) adopted Resolution No. 16/Chairman of 2026, allowing eligible Central Bank licensees, excluding insurance companies, to undertake activities under the CMA’s virtual asset framework.[1] Eligible institutions may seek authorisation for services including dealing in virtual assets, custody and investment advice.[2] Resolution 16 does not itself grant a licence to provide those services; each institution must complete the applicable authorisation process.[3] The change brings established financial institutions into a framework specialist providers have helped build. It signals confidence in regulated virtual asset services and the UAE’s willingness to integrate them into its financial system.

For customers, a familiar bank app may simplify access. But it may not change which provider performs the service or bears responsibility. Banks should make that distinction clear in customer contracts and explain their role.

Part of a wider progression

This decision forms part of a wider sequence. Dubai established the Virtual Assets Regulatory Authority (VARA) in 2022.[4] The Central Bank’s Payment Token Services Regulation followed in 2024.[5] In February 2026, the Central Bank approved DDSC, a dirham-backed stablecoin, to go live.[6] Payment tokens are governed by a distinct framework. Together, these developments show the UAE building separate regulatory routes for different digital asset activities.

This approach has international relevance. The United Kingdom’s broader cryptoasset regime is expected to commence in October 2027.[7] The UAE offers a useful point of comparison: specialist providers operate under dedicated frameworks, and eligible Central Bank licensees can now seek to participate. The test will be whether this wider participation gives customers easier access while making clear which provider is responsible for each regulated activity.

Why supervision strengthens the opening

The policy direction is sound. Demand for virtual asset services exists whether traditional institutions participate or not. A supervised route can bring activity within regulators’ reach, identify accountable institutions and apply anti-money laundering and counter-terrorist financing controls. Regulation cannot remove risk, but it is a more constructive response than relying on exclusion to make demand disappear.

Central Bank approval is a further safeguard. Article 61(3) of Federal Decree-Law No. 6 of 2025 requires a licensed financial institution to obtain Central Bank approval before obtaining a licence from another regulator for activities outside those listed in Article 61(1).[8] Banking competence alone does not establish competence in virtual asset services. The Central Bank can assess institutional readiness while the CMA assesses the proposed activities. Preserving both reviews enables participation under oversight.

The legal route must be clear

The relationship between the CMA framework and VARA raises a specific question. Cabinet Decision No. 112/2022 delegates specified virtual asset licensing and supervisory powers of the erstwhile Securities and Commodities Authority (SCA) to VARA under Decision No. 111/2022, and requires coordination with the federal authority.[9] Federal Decree-Law No. 32 of 2025 makes the CMA the SCA’s legal successor and directs that references to the SCA in legislation be read as references to the CMA.[10] Those provisions support a coordinated interpretation, but do not establish that CMA permission is interchangeable with a VARA licence. The authorities should clarify how eligible licensees should approach both regimes, particularly for Dubai operations outside the DIFC.

That clarity will affect commercial structures. A customer may access a service through a bank app while a specialist provider performs custody or other functions behind it. A seamless interface does not necessarily mean a simple legal relationship. Banks and providers should identify who contracts with the customer, who performs each regulated activity and who remains responsible. In custody, the CMA framework expressly keeps the licensed provider responsible to its client when it appoints a third party.[11]

A broader market, not a smaller role for specialists

Bank participation recognises the sector specialists have built; it does not make their role obsolete. Banks bring customer relationships and institutional resources; specialists bring experience and capabilities that banks may choose to obtain through partnerships. Emirates NBD’s December 2024 investment in Zodia Custody illustrates that commercial alignment.[12] Providers should show how their licensed capabilities fit a bank’s proposed service, while banks should define the expertise and accountability they need before setting a launch plan.

This is a significant and positive regulatory step, and a reason to prepare. Approvals are not assured, and implementation will take time. Success will depend on clear regulatory routes, capable providers and services customers can use with confidence.