The UAE operates a layered regulatory landscape: federal laws applied nationwide, emirate-specific authorities, and standalone regulators inside the country's two English common-law financial centres — DIFC and ADGM. The federal layer is anchored by the Central Bank of the UAE (CBUAE), the Securities and Commodities Authority (SCA), and the Federal Tax Authority (FTA). Inside DIFC, the Dubai Financial Services Authority (DFSA) regulates financial activity; inside ADGM, the Financial Services Regulatory Authority (FSRA) plays the equivalent role. Dubai also runs the world's first standalone crypto regulator, the Virtual Asset Regulatory Authority (VARA), established in 2022. This guide maps the regulators, the 2021 mainland ownership reform, sandboxes, and how to choose the right authority for your activity.
At a Glance
| Regulator | Free zone / Federal | Activity scope | Founded | Key responsibility |
|---|---|---|---|---|
| CBUAE | Federal | Banking, insurance, exchange houses, payments | 1980 (current form); absorbed Insurance Authority 2020 | Monetary policy, prudential supervision, AML |
| SCA | Federal | Mainland securities, funds, listed issuers | 2000 | Mainland capital-markets regulation |
| FTA | Federal | VAT, corporate tax, excise tax | 2017 | Tax registration, returns, audit |
| DFSA | DIFC (free zone) | Banks, asset managers, insurers, fintech in DIFC | 2004 | Independent financial regulation in DIFC |
| FSRA | ADGM (free zone) | Banks, fund managers, virtual assets, fintech in ADGM | 2015 | Independent financial regulation in ADGM |
| VARA | Dubai (cross-zone) | Virtual assets in Dubai (excluding DIFC) | 2022 | Crypto exchange, custody, broker licensing |
| DED (per emirate) | Emirate | Mainland commercial, professional, industrial licences | Various | Mainland trade licensing |
UAE Federal Regulators
The Central Bank of the UAE (CBUAE) supervises the country's banking system, finance companies, exchange houses, payment service providers, and — since absorbing the former Insurance Authority in 2020 — the entire UAE insurance sector. CBUAE issues the federal banking licence, sets capital and liquidity rules, and runs federal AML supervision. Its Innovation Hub has been live since 2019.
The Securities and Commodities Authority (SCA) is the federal capital-markets regulator. It oversees the mainland securities exchanges (DFM in Dubai, ADX in Abu Dhabi), licenses brokers and fund managers outside the financial free zones, and approves prospectuses for mainland-listed issuers. SCA does not regulate firms inside DIFC or ADGM — those fall to DFSA and FSRA respectively.
The Federal Tax Authority (FTA) was established in 2017 to administer VAT (live since 1 January 2018 at 5%). Since 1 June 2023 the FTA has also administered the federal corporate tax, applied at 9% above AED 375,000 of taxable income, with a 0% rate for Qualifying Free Zone Persons on qualifying income. The FTA also runs excise tax and economic-substance filings. See /business-guide/corporate-tax for the full breakdown.
DFSA (Dubai Financial Services Authority)
The DFSA has been DIFC's independent financial regulator since the centre opened in 2004. DIFC has a federal-law carve-out giving the DFSA exclusive jurisdiction over financial services within the centre. Supervised activities include banking, asset management, fund administration, insurance and reinsurance, securities dealing, custody, audit, and an expanding fintech and tokenised-securities perimeter.
The DFSA applies a principles-based framework drawn from international standards (Basel, IOSCO) and its own DIFC rulebook, with appeals handled through the independent DIFC Courts. It is a recognised regulator under the IOSCO MMoU. For regulated financial activity anchored in central Dubai, DFSA-in-DIFC is one of two UAE routes alongside FSRA-in-ADGM. See /uae/difc for the centre profile.
FSRA (Financial Services Regulatory Authority)
The FSRA has regulated financial services inside the Abu Dhabi Global Market (ADGM) since the centre's launch on Al Maryah Island in 2015. Like the DFSA, it is independent of the federal regulators and applies an English common-law framework with its own rulebook and the independent ADGM Courts.
The FSRA was one of the first major regulators globally to publish a full virtual-asset framework, with crypto-asset guidance issued in 2018 — well ahead of most peers. It licenses exchanges, custodians, brokers, tokenised-fund managers, and stablecoin issuers, and has become a preferred home for institutional crypto firms in the region. The FSRA also operates the RegLab sandbox (below). See /uae/adgm for the centre profile.
VARA (Virtual Asset Regulatory Authority)
The Virtual Asset Regulatory Authority (VARA) was established in March 2022 by Dubai decree and is the world's first dedicated, standalone regulator for virtual assets. VARA's jurisdiction covers all of Dubai except DIFC, which remains under DFSA. A crypto firm anywhere else in Dubai — including the DMCC Crypto Centre, mainland Dubai, and most other Dubai free zones — is licensed by VARA.
VARA issues tiered licences covering exchange services, broker-dealer services, custody, lending and borrowing, advisory, and management and investment services. It runs a phased process — provisional and minimum-viable-product permissions progress to full operational licences as compliance and substance build. In Abu Dhabi, the equivalent route is the FSRA virtual-asset framework.
Mainland Commercial Companies Law (CCL) 2021
The biggest UAE business-law change of the past decade was the 2021 reform to the Commercial Companies Law (CCL). Federal Decree-Law No. 26 of 2020 amended the previous CCL of 2015 and came into force in June 2021, removing the historic requirement that a UAE national hold at least 51% of a mainland LLC. Foreign investors can now hold 100% ownership of mainland companies in the vast majority of commercial and industrial sectors.
The reform did not abolish national-ownership requirements entirely. A list of strategic-impact sectors — defence and military, certain telecoms activities, security and surveillance, hajj-and-umrah services, and a few others — still requires UAE-national involvement. Each emirate's Department of Economic Development (DED) publishes the list of activities open to 100% foreign ownership.
The practical consequence: free zones lost their single biggest historical advantage. In 2026, mainland vs free zone is no longer an ownership question — it is a tax, regulatory, customer-base, and prestige question. See /business-guide for the full setup framework.
Foreign Direct Investment Law
The UAE's Foreign Direct Investment framework sits at federal level and was liberalised alongside the CCL reform. The 2021 changes were the headline event: combined with the new CCL and the long-term residency visas (Golden Visa, Green Visa), the FDI regime now positions the UAE as one of the most foreign-investor-friendly jurisdictions in the region. The federal government publishes a Positive List of activities open to foreign investment with no national-ownership requirement, and a shorter Negative List of strategic sectors that remain restricted.
Regulatory Sandboxes and Innovation Frameworks
The UAE runs four major regulatory sandboxes, each operated by a different regulator. Sandboxes let firms test products under relaxed or restricted licences before applying for full authorisation.
The ADGM RegLab, run by the FSRA since 2016, is the longest-running fintech sandbox in the region. Cohorts have covered payments, robo-advice, equity crowdfunding, Islamic fintech, and virtual-asset infrastructure. Firms operate under a tailored Financial Services Permission, then progress to full FSRA authorisation if successful.
The CBUAE Sandbox, building on the Innovation Hub launched in 2019, lets banks and licensed financial institutions test products that sit close to their regulated activities. It is narrower than ADGM RegLab — focused on bank-adjacent products rather than greenfield startups — but is the only direct route to test inside a CBUAE-licensed perimeter.
The DFSA Innovation Testing Licence (ITL) is DIFC's equivalent: a restricted financial-services licence allowing fintech pilots under reduced regulatory burden, typically for up to 12 months, before transitioning to a standard DFSA licence.
VARA limited licences apply the same phased model in the virtual-asset space — provisional and operational stages with progressive expansion of permitted activity as compliance, capital, and substance build.
Sector-Specific Regulators
Real estate. In Dubai, the Real Estate Regulatory Agency (RERA) sits under the Dubai Land Department (DLD), covering broker licensing, escrow rules for off-plan sales, service-charge oversight, and rental disputes. In Abu Dhabi, real-estate transactions are processed through the TAMM government services platform.
Healthcare. The Department of Health Abu Dhabi (DOH) regulates healthcare in Abu Dhabi, the Dubai Health Authority (DHA) in Dubai, and the federal Ministry of Health and Prevention (MOHAP) covers the northern emirates and national policy. See /business-guide/government-subsidies for healthcare-related public funding.
Education. The Knowledge and Human Development Authority (KHDA) regulates private schools and training in Dubai; the Department of Education and Knowledge (ADEK) is its Abu Dhabi counterpart; the federal Ministry of Education and Higher Education and Research Council (MOEHRC) sets national policy and accredits universities.
Telecoms and media. The federal Telecommunications and Digital Government Regulatory Authority (TDRA) licenses telecoms and digital-services activity nationwide and runs the ICT Fund, which co-finances UAE digital-infrastructure projects. Media regulation is currently being consolidated under federal media authority structures.
How to Choose Your Regulator
Map the activity to the regulator before picking the licence vehicle.
- Banking and insurance. A federal banking or insurance licence sits with the CBUAE. If the activity is anchored in DIFC, the regulator is the DFSA; if in ADGM, the FSRA. There is no separate emirate-level banking regulator.
- Securities, funds, asset management. Onshore mainland regulator is the SCA. Inside DIFC, the DFSA. Inside ADGM, the FSRA. Choice is driven by where capital and clients sit.
- Crypto and virtual assets. In Dubai outside DIFC, VARA. In DIFC, the DFSA (limited tokenised-securities perimeter). In Abu Dhabi, the FSRA under its virtual-asset framework. There is no federal-level crypto licence — pick the emirate and zone.
- General trading, retail, and consulting. Each emirate's DED issues mainland commercial, professional, and industrial licences. Free-zone authorities issue equivalent licences for activity inside their zone.
- Healthcare. DOH for Abu Dhabi, DHA for Dubai, MOHAP for the northern emirates. Federal facilities and federal-level standards sit with MOHAP.
- Education. KHDA in Dubai, ADEK in Abu Dhabi, MOEHRC for federal university recognition.
- Real estate. RERA / DLD in Dubai, TAMM plus the relevant municipal authority in Abu Dhabi, equivalent emirate-level departments elsewhere.
- Telecoms, digital, broadcasting infrastructure. TDRA at federal level.
- Tax registration and compliance. FTA for VAT, corporate tax, and excise — federal, no emirate-level alternative.
Frequently Asked Questions
Who regulates UAE banks?
The Central Bank of the UAE (CBUAE) is the federal banking regulator. Every UAE-licensed bank, finance company, exchange house, and payment service provider operating onshore is supervised by the CBUAE. Banks that want to operate inside DIFC are regulated by the DFSA; banks inside ADGM are regulated by the FSRA. The CBUAE also regulates the entire UAE insurance sector since absorbing the former Insurance Authority in 2020.
Is crypto legal in the UAE?
Yes, with licensing. Virtual-asset activity is legal across the UAE provided the firm holds the relevant authorisation. In Dubai outside DIFC, that authorisation comes from VARA, established in 2022. In DIFC, limited tokenised-securities activity is regulated by the DFSA. In Abu Dhabi, the FSRA has run a comprehensive virtual-asset framework since 2018. Operating without a licence in any of these perimeters is not permitted.
What's the difference between DFSA and FSRA?
Both are independent financial regulators inside English common-law free zones — the DFSA for DIFC in Dubai, the FSRA for ADGM in Abu Dhabi — and both regulate banks, asset managers, insurers, and fintech. Practical differences: ADGM's FSRA pioneered the UAE virtual-asset framework in 2018 and is generally seen as more forward on crypto and tokenisation; DIFC's DFSA has the longer track record (since 2004) and supervises the densest cluster of global banks in the region. Choice usually comes down to which centre the firm wants to anchor in.
What is VARA?
The Virtual Asset Regulatory Authority (VARA) is Dubai's standalone crypto regulator, established in March 2022 by Dubai decree. It is the world's first dedicated regulator solely for virtual assets, with jurisdiction across all of Dubai except DIFC. VARA issues licences for exchanges, broker-dealers, custodians, lending and borrowing, advisory, and management services, using a phased model that moves firms from provisional through to full operational licences.
Can foreigners own 100% of a UAE mainland company?
Yes, in most sectors. The 2021 amendments to the federal Commercial Companies Law (Federal Decree-Law No. 26 of 2020, effective June 2021) removed the historic requirement that a UAE national hold at least 51% of a mainland LLC. Foreign investors can now hold full 100% ownership of mainland companies across the majority of commercial, industrial, and professional activities. Strategic sectors are the exception (see next question).
What sectors still require UAE-national ownership?
A short list of strategic-impact sectors continues to require UAE-national involvement on the mainland — typically including defence and military activities, parts of telecommunications, security and surveillance services, hajj-and-umrah services, and a small number of other categories. The exact list is published and periodically updated by the Cabinet, with each emirate's Department of Economic Development publishing the activity-by-activity application. Free zones operate outside this list and have always permitted 100% foreign ownership inside the zone.
What is a regulatory sandbox?
A regulatory sandbox is a controlled framework that lets firms test innovative financial products under reduced or modified regulatory requirements, with the intention of progressing to a full licence if the test is successful. The UAE runs four major sandboxes: ADGM RegLab (FSRA), the CBUAE Sandbox, the DFSA Innovation Testing Licence (ITL) in DIFC, and the VARA limited-licence model for virtual-asset firms. Each is operated by the regulator that would issue the eventual full licence.
What documents do I need to register with the UAE Federal Tax Authority?
For VAT or corporate-tax registration with the FTA, expect to provide the trade licence, a copy of the Memorandum of Association or equivalent constitutional document, the passport and Emirates ID of authorised signatories and shareholders, the proof of authorised signatory (board resolution or power of attorney), bank account details, contact details, and turnover or expected-turnover figures. Registration is online via the EmaraTax portal. Specific document requirements vary by entity type (mainland LLC, free zone, branch of foreign company), and exact licence and registration fees are not standard across emirates — confirm current figures with the FTA portal or a licensed tax agent.
Who regulates UAE healthcare?
Three regulators, split by emirate. The Department of Health Abu Dhabi (DOH) regulates the healthcare sector in Abu Dhabi, including facility licensing, professional licensing, and the mandatory health-insurance framework. The Dubai Health Authority (DHA) plays the equivalent role in Dubai. The federal Ministry of Health and Prevention (MOHAP) regulates the northern emirates and sets national-level health policy and standards. Pharmaceutical product registration is federal under MOHAP, while distribution is licensed at emirate level.
What is RERA?
The Real Estate Regulatory Agency (RERA) is the regulator inside the Dubai Land Department (DLD) for the Dubai real-estate market. RERA licenses brokers, developers, and management companies, enforces escrow rules for off-plan sales, oversees service-charge regulation in jointly-owned buildings, and operates rental-dispute settlement. Equivalent functions in Abu Dhabi are handled via TAMM; the northern emirates each have their own land departments.
