Which Regulator Applies to Your UAE Business?
Before you can work out who you need to hire, you need to know which regulator licenses your business. The UAE has several financial regulators, and each one sets its own expectations for the people who run a licensed firm.
| Regulator | Where it applies | Typical licensed firms |
|---|---|---|
| Securities and Commodities Authority (SCA), now operating as the Capital Market Authority (CMA) | Onshore UAE (federal) | Brokers, dealers, advisers, arrangers, asset and fund managers |
| Dubai Financial Services Authority (DFSA) | Dubai International Financial Centre (DIFC) | Financial services firms licensed in the DIFC |
| Financial Services Regulatory Authority (FSRA) | Abu Dhabi Global Market (ADGM) | Financial services firms licensed in ADGM |
| Virtual Assets Regulatory Authority (VARA) | Dubai, outside the DIFC | Virtual asset service providers (VASPs) |
| Central Bank of the UAE (CBUAE) | Onshore UAE | Banks, payment and stored value businesses |
This guide focuses on the two regimes we are asked about most often: SCA/CMA for onshore securities and investment firms, and VARA for virtual asset businesses in Dubai. For DFSA and FSRA, see our key individual requirements guide for the UAE.
SCA / CMA: Approved Individuals in Control Functions
A firm licensed by the SCA (now operating as the CMA) must put named, approved individuals into its key control functions. Those most commonly required are:
- General Manager or chief executive, responsible for running the licensed business
- Compliance Officer, responsible for regulatory compliance and the compliance monitoring programme
- Money Laundering Reporting Officer (MLRO), responsible for anti-money laundering controls and suspicious transaction reporting
- Risk Officer, responsible for the risk management framework
- Finance Officer, responsible for financial reporting and capital adequacy
Depending on the licence category and the size of the firm, some of these functions may be combined, and some structures also require an internal audit function. Your licensing adviser will confirm the exact list for your category.
What the SCA Looks For
The regulator assesses each proposed individual before the licence is granted or the appointment is approved. In practice, it looks at:
- Relevant experience in regulated financial services, ideally in the same type of activity the firm will carry out
- Qualifications appropriate to the function
- Regulatory examinations, which many approved functions must pass, depending on the licence category and the role
- Integrity and reputation, including regulatory history, references and background checks
Candidates who already hold, or have previously held, an approved function in the UAE are usually the easiest to get approved. They understand what the regulator asks for, and their history can be verified.
VARA: Responsible Individuals for Virtual Asset Service Providers
VARA was established under Dubai Law No. 4 of 2022 to regulate virtual assets in Dubai, excluding the DIFC. Its requirements are set out in a series of rulebooks, including the Company Rulebook, the Compliance and Risk Management Rulebook, the Technology and Information Rulebook and the Market Conduct Rulebook, alongside activity-specific rulebooks.
A VASP licensed by VARA needs a governance structure with clearly accountable individuals. The roles we are most often asked to fill for VARA applicants are:
- Senior management, including the chief executive or general manager
- Compliance Officer
- Money Laundering Reporting Officer (MLRO)
- Risk and technology leads, including information security, given the weight VARA gives to technology and custody risk
- Board members and directors, who are also subject to fit and proper review
VARA reviews the firm and its proposed key people during a staged licensing process before an operating licence is granted. Expect the regulator to look closely at relevant virtual asset experience, AML/CFT knowledge and the individual's real involvement in the business. Confirm residency and dual-role expectations with your licensing adviser at the outset, because they affect who you can hire.
The AML Baseline That Applies to Everyone
Whichever regulator licenses the firm, UAE financial businesses are subject to federal anti-money laundering law, principally Federal Decree-Law No. 20 of 2018 on anti-money laundering and countering the financing of terrorism, and its implementing regulations. In practice, this means:
- Appointing a compliance officer or MLRO with responsibility for AML/CFT
- Reporting suspicious transactions to the UAE Financial Intelligence Unit through the goAML system
- Maintaining customer due diligence, sanctions screening and record-keeping controls
A candidate for an MLRO role should be able to explain how they have run these controls in practice, not only describe the law.
How to Hire Approved Individuals in the UAE
The pool of people with UAE approval history is limited, and the strongest candidates are usually already in senior roles. A few practical points make the difference:
- Start the search before you file. The regulator assesses your proposed people as part of the application, so they need to be identified early.
- Screen for approvability, not just experience. Check examinations, regulatory history and references before a candidate reaches the regulator.
- Plan for visas and onboarding. Employers sponsor residence visas and arrange health insurance, so candidates already resident in the UAE can usually start sooner.
- Be clear about the scope of the role. Combined Compliance Officer and MLRO roles are common, but the candidate needs to be credible in both.
For a breakdown of costs, see what it costs to hire a compliance officer in Cyprus or the UAE. For timelines, see how long it takes to hire an MLRO for a CySEC or CMA licence.
Browse UAE and Compliance Vacancies
Work With HRFinEase
Looking for your next approved role in the UAE? Submit your CV and we will contact you when a matching search opens.
Need an approved individual for an SCA/CMA or VARA licence? Hire talent through HRFinEase. We pre-screen candidates for regulatory approvability before you meet them.
Key Individual Guides for Other Jurisdictions
- Key Individual requirements for FSCA licensed firms in South Africa
- Key Person requirements for CySEC regulated firms in Cyprus
- SCA license employees and UAE finance recruitment
Frequently Asked Questions
Is the SCA the same as the Capital Market Authority? The UAE's federal securities regulator, the Securities and Commodities Authority, now operates as the Capital Market Authority (CMA). Many firms and candidates still use both names, so you will see "SCA" and "CMA" used for the same regulator.
Does VARA regulate virtual assets across the whole UAE? No. VARA regulates virtual asset activity in Dubai, excluding the DIFC. Virtual asset firms in the DIFC fall under the DFSA, firms in ADGM fall under the FSRA, and other onshore activity may fall under federal regulators.
Can one person be both Compliance Officer and MLRO? Combined roles are common in smaller firms, but whether they are acceptable depends on the regulator, the licence and the size of the business. Confirm with your licensing adviser before you hire.
Do approved individuals need to pass examinations in the UAE? For many SCA/CMA approved functions, yes. The examinations required depend on the licence category and the function. Candidates who have already passed them are generally faster to approve.
Can HRFinEase help find approved individuals for a UAE licence? Yes. We recruit general managers, compliance officers, MLROs, risk officers and finance officers for SCA/CMA, DFSA and VARA regulated firms. Brief us on your role or register your CV.
Summary of published rules and practitioner experience as of November 2026. Requirements change, so confirm with the relevant regulator and your licensing adviser before filing.