Updated 10 September 2026: the original Robius regulator map had the right instinct — “regulated” only means something when you know who regulates which legal entity for which activity. But the old five-box map was too neat for the UAE’s current financial architecture.
A single app can now sit over a licensed bank account, a separate card issuer, a payment institution and a software company. Crypto regulation also has local and federal layers. And a company being incorporated in DIFC or ADGM does not automatically mean its ordinary commercial activity is a regulated financial service.
| THE ROBIUS READ: Do not ask only “is this company regulated?” Ask four questions: what product am I using, which legal entity provides it, what regulated activity is that entity authorised to perform, and which public register proves it? CBUAE, CMA, VARA, DFSA and FSRA cover different activities and perimeters, and some products involve more than one regulated entity. A trade licence or company registration is not a financial-services licence. A foreign licence is not a UAE licence. And finding a brand name on one register does not prove every feature in the app is covered. |
The Current Map at a Glance
| What you are checking | Primary UAE register / regulator to start with | Important qualification |
|---|---|---|
| Bank, finance company, exchange house, stored-value or retail-payment provider, many lending/payment activities, insurance | CBUAE | Check the exact licence category and legal entity; one app may use a licensed partner rather than hold the licence itself. |
| Mainland capital-market firm, securities activity, investment activity under the federal capital-markets framework | CMA | Check the licensed activity, not merely that the company appears somewhere in CMA data. |
| Virtual-asset service in Dubai outside DIFC | VARA | VARA is Dubai’s VA regulator outside DIFC. Its current register also shows CMA registration numbers for licensed VASPs, so note both records where displayed. |
| Financial service conducted in or from DIFC | DFSA | DFSA regulates financial and related regulated services — not every ordinary DIFC company. |
| Financial service in ADGM | FSRA | Use the FSRA public register to verify the firm and the specific authorised activities. |
| Dubai real-estate broker / property activity | DLD / RERA tools | A real-estate licence is not a financial-services licence. |
| Ordinary UAE trade licence | Relevant economic / issuing authority and National Economic Registry | Commercial registration proves the business exists; it does not prove permission to provide regulated finance. |
CBUAE: Banking, Credit, Payments, Exchange and Insurance
The Central Bank of the UAE maintains the main register for institutions it licenses and supervises. Current CBUAE materials include banks, finance companies, exchange houses, payment-service providers and insurance entities, among other licensed categories.
Federal Decree-Law No. 6 of 2025 also lists Licensed Financial Activities including deposits, credit, funding, open finance, currency exchange, money transfer, payment services using virtual assets, stored value, retail payments, digital money, arranging/promoting/marketing licensed financial activities and insurance.
Do not translate that list into “every financial-looking app is a CBUAE institution.” The current Article 62 clarification says pure technical providers are not automatically licensed merely because they provide software or infrastructure. Identify the entity actually carrying on the regulated activity.
CMA: The Federal Capital-Markets Regulator
The Securities and Commodities Authority was replaced by the Capital Market Authority under the new 2025 capital-market laws that took effect in 2026. The CMA regulates licensed capital-market activities and issuers under the federal framework and maintains public data for licensed and registered companies.
This is where the exact activity matters. A company can appear on a CMA page for one category while not being authorised for another. CMA’s own licensed-company pages can carry warnings making that distinction explicit — for example, a Category 5 introduction/advisory permission does not automatically permit derivatives brokerage or execution.
That is why Robius no longer uses shorthand such as “CMA-regulated broker” without naming the legal entity and the actual licence activity.
VARA: Virtual Assets in Dubai Outside DIFC
VARA states that it is the sole authority regulating virtual assets across Dubai’s mainland and free zones except DIFC.
Its public register separates fully licensed VASPs from applicants holding only In-Principle Approval. VARA explicitly says an IPA holder may not start virtual-asset activities or service clients until the full VASP licence is obtained.
The 2026 register also shows a CMA Registration Number for licensed VARA firms. That is a useful reminder that UAE virtual-asset regulation can involve coordinated federal and emirate-level layers. For a Dubai customer, still start with the VARA record for the licensed Dubai activity and then note the accompanying CMA registration shown there.
DFSA: Financial Services in or From DIFC
The Dubai Financial Services Authority is the independent regulator of financial services conducted in or from DIFC. Its mandate includes banking and credit, investments, funds, custody, insurance, fintech, crypto and investment tokens, money services, capital markets and crowdfunding.
The old map’s cell saying “any firm inside DIFC → DFSA” was wrong. DIFC contains ordinary commercial companies too. The relevant check is whether the company is carrying on a regulated financial or related activity that requires DFSA authorisation or registration.
And even for an authorised firm, read the permission. DFSA itself warns that being regulated does not allow a firm to provide every financial service; it must hold the right permission for the activity offered.
FSRA: Financial Services in ADGM
ADGM’s Financial Services Regulatory Authority maintains its own public register for firms, individuals, funds and other approved bodies in the Abu Dhabi financial free zone.
Use that register to confirm both status and the financial services the entity may carry on. A group brand operating elsewhere in the UAE does not automatically place every related company under the same FSRA permission.
Sanadak Is a Dispute Route, Not a Sixth General Regulator
Sanadak is the UAE’s independent financial ombudsman mechanism for complaints involving CBUAE-licensed financial institutions and insurance companies. It is not the dispute body for every company holding any UAE licence.
Sanadak’s current FAQ says initial complaints are free for consumers and SMEs. An appeal carries an AED 500 fee, refundable when the appeal determination is in favour of the appellant.
So the old sentence “No UAE licence, no UAE ombudsman” was too broad. The correct question is whether the dispute falls within Sanadak’s CBUAE financial-institution or insurance remit and whether the eligibility requirements have been met.
Why One App Can Require More Than One Register Check
Modern fintech makes the old one-brand-one-licence model unreliable.
A business app can provide the software interface while a bank supplies the IBAN, a payment institution issues the card and another licensed entity processes remittances. Pemo’s current business-account structure is a good example: the app is Pemo, the bank account is provided by ruya, and the card terms name NymCard as issuer.
Regulatory due diligence therefore has to follow the product layer. The fact that one partner is licensed does not automatically confer that licence on the technology company; equally, the technology company does not need to become a bank simply to distribute a bank account supplied transparently by a licensed bank.
The Five-Minute Register Check
- 1. Name the product. Bank account, card, loan, brokerage, fund, insurance, wallet, remittance and crypto exchange are different regulated activities.
- 2. Find the legal entity. Use the contract, Key Facts Statement, account agreement or regulatory footer — not only the app-store brand.
- 3. Identify the perimeter. Mainland/federal, Dubai/VARA, DIFC or ADGM can change the regulator.
- 4. Search the official register. Confirm the entity is active and note the licence/reference number.
- 5. Read the permitted activity. A licence for advice, introduction or payments is not automatically permission for brokerage, lending, deposits or custody.
- 6. Check the dispute route. Identify the firm’s complaints process and the relevant regulator/ombudsman route before you need it.
The Bottom Line
The useful Robius rule survives the rewrite: ignore the badge and verify the legal entity.
What changed is the map. UAE financial regulation is not five simple boxes and one regulator does not “protect your money” merely because its logo appears somewhere in the corporate group. Product, entity, activity and jurisdiction have to line up.
If those four things match the official register, you know what permission you are actually relying on. If they do not, keep digging before you fund the account or sign the contract.
Sources
• CBUAE: current licensing register and Article 61 licensed-financial-activities framework — centralbank.ae
• Capital Market Authority: current licensed-company and registered-company data — uaecma.gov.ae
• VARA: current Dubai VASP public register, licence/IPA distinction and CMA registration numbers — vara.ae
• DFSA: current mandate and public register for financial services conducted in or from DIFC — dfsa.ae
• ADGM FSRA: current public register — adgm.com
• Sanadak: current complaint scope and fee FAQ — sanadak.gov.ae
Checked 10 September 2026. Regulatory perimeters and licences can change. Verify the exact current entity and authorised activity before funding or relying on a financial product. This article is general information, not legal or financial advice.
Robius.news — Dubai, UAE — 2026 | Built to be first. Built to be trusted.
