Starting an SCA-Regulated Business in Dubai: The 2026 Licensing Guide

The Securities and Commodities Authority (SCA) was established under UAE Federal Law No. 4 of 2000 and is the UAE's federal-level regulator for the securities and commodities sector in the UAE mainland. Unlike the DFSA, which operates within DIFC as a financial free zone, and the FSRA, which operates within ADGM, the SCA regulates all securities and investment activities conducted in or from the UAE mainland — covering the full spectrum of regulated financial activities from investment advisory to exchange-based brokerage, fund management, commodity derivatives, and custody.

The SCA licence is the appropriate regulatory pathway for financial services businesses whose primary market is UAE mainland-based retail investors, professional investors, or institutional clients. It provides direct access to the UAE's domestic capital markets — the Abu Dhabi Securities Exchange (ADX) and the Dubai Financial Market (DFM) — and to the UAE's significant population of high-net-worth and mass-affluent investors who represent some of the region's most important investable wealth.

This guide is a practical operator's reference for the SCA licensing process in 2026, covering the full range of regulated activities, capital requirements, fit and proper standards, AML/CFT obligations, step-by-step application guidance, and ongoing compliance requirements. It is written for founders, senior executives, and compliance officers planning to establish or already operating a UAE financial services business.

What Activities Require an SCA Licence?

The SCA regulates a defined list of financial activities under UAE Federal Law No. 4 of 2000 and its subsequent amendments. Operating any of these activities in the UAE mainland without an SCA licence is a criminal offence under UAE Federal Law, carrying substantial financial penalties and potential imprisonment for responsible individuals. The criminal nature of unlicensed activity — not just a civil regulatory matter — underscores the importance of confirming whether your business activities fall within the SCA's regulated scope before beginning operations.

Note that the SCA also regulates activities beyond this core list, including public offerings of securities, mergers and acquisitions advisory involving listed companies, and commodity derivatives. If your proposed activities include any of these areas, consult with SCA or a licensed SCA advisory firm before proceeding.

The SCA Fit and Proper Assessment in Detail

The fit and proper assessment is the most substantive and least predictable part of the SCA licensing process. Unlike capital requirements and documentation checklists — which are clear and objectively assessable — the fit and proper assessment involves qualitative judgements about the character, competence, and suitability of the individuals involved. Understanding how the SCA applies this assessment helps applicants prepare effectively.

The SCA conducts fit and proper assessments on all proposed shareholders (corporate and individual), all proposed directors, all members of the Board, and all key persons in the regulated activities. "Key persons" are individuals who will carry out, supervise, or manage the regulated activities — including the CEO, Chief Investment Officer, Chief Compliance Officer, and any licensed registered persons who deal directly with clients. The SCA may also assess any individual who, in the SCA's view, exerts significant influence over the management of the regulated entity even if not formally appointed to one of these roles.

Criminal Background

The SCA checks for any criminal conviction in any jurisdiction for offences involving financial crime, fraud, dishonesty, breach of trust, or any closely related offence. Notably, the SCA applies this assessment independently of the home country's statute of limitations or "spent" conviction rules. A conviction that is legally considered spent in the individual's home country under that country's law is not necessarily treated as spent by the SCA. If in doubt, disclose and explain — undisclosed convictions discovered by the SCA independently are treated far more seriously than disclosed convictions with a credible explanation.

Regulatory History

The SCA requests a regulatory history declaration covering all financial regulatory interactions globally — not just UAE regulators. This includes any disqualification, suspension, restriction, public censure, or adverse finding by any financial services regulator, exchange, or professional body. Market participants who have had any regulatory interaction — even one that was resolved in their favour — are advised to take professional advice on how to present that history to the SCA before submitting the application.

Financial Probity

The SCA assesses whether key persons have demonstrated financial responsibility in their personal affairs. Personal bankruptcy or insolvency in any jurisdiction, unpaid court judgements, undisclosed significant personal debt, or a history of defaulting on financial obligations all raise fit and proper concerns. The SCA expects individuals in positions of financial responsibility to demonstrate that they manage their own financial affairs responsibly.

Qualifications and Experience

The SCA expects that key persons have qualifications and experience that are genuinely relevant to the specific roles they will perform. For a proposed CEO of a fund management company, the SCA expects documented fund management experience at a senior level — not just general financial services experience. Common qualifying qualifications include CFA charterholder status, CFA Institute certificates in investment management, CISI qualifications (Chartered Institute for Securities and Investment), and ACCA for accounting-focused roles. Academic qualifications alone, without practical experience in the specific activity, are insufficient.

Complete SCA Application Documentation

A complete SCA application package is essential for a smooth process. SCA application review time is heavily influenced by the completeness and quality of the initial submission. Applications submitted with missing documentation or vague business plans consistently require multiple information request rounds, each adding 2–4 weeks to the overall timeline. Applications submitted with complete, well-organised, clearly presented documentation move through the review queue significantly faster.

• Completed SCA application form: submitted through the SCA electronic portal. The SCA has a structured application form that requires specific information about the proposed regulated activities, legal structure, ownership, and key persons. Read and complete every section — do not leave fields blank with the intention of providing information later.
• Business plan — 3-year financial projections and market analysis: the business plan must be credible, specific, and grounded in realistic market analysis. The SCA does not approve business plans that describe an unrealistically large target market or revenue projections with no clear basis. Include: detailed description of target client segments, how clients will be sourced, the competitive landscape, fee structures, and financial projections showing when and how the business reaches breakeven.
• AML/CFT manual — comprehensive policies and procedures: the AML/CFT manual is a critical document that will be scrutinised by the SCA compliance examination team as well as by external auditors once the firm is licensed. It must include: a business risk assessment (what ML/TF risks the specific business faces given its activities, clients, and geographies), customer due diligence policies, enhanced due diligence procedures, transaction monitoring policies, suspicious activity reporting procedures and responsibility matrix, record retention policies, and staff training programme.
• Compliance manual: internal compliance policies and procedures covering regulatory compliance obligations specific to the SCA licence category, including conduct of business standards, conflict of interest management, complaint handling procedures, insider trading prevention, market manipulation prevention, and whistleblowing procedures.
• Organisational chart and governance structure: showing all proposed roles, reporting lines, responsibilities, and the division of functions between the regulated activities and support functions. The SCA expects clear governance with no conflicts of interest between client-facing roles and compliance functions.
• Key person documentation: for each proposed director, board member, and key person: full CV (education, employment history with dates and employer details, specific roles and responsibilities), copies of all professional qualifications and certificates, fit and proper declaration, criminal record check, regulatory history declaration, and two professional reference letters.
• Shareholder and capital structure documentation: for individual shareholders: passport, address proof, source of funds declaration with evidence. For corporate shareholders: full corporate documentation including incorporation certificate, MOA, register of directors and shareholders, and ultimate beneficial owner declaration to natural person level.
• Capital adequacy evidence: a letter from a UAE bank confirming that the required minimum capital is available in a UAE bank account in the name of the proposed regulated entity, unencumbered and available for injection into the entity. The capital must be demonstrably available at the time of application, not promised or contingent.
• Technology and systems description: a description of the technology infrastructure that will support the proposed regulated activities, proportionate to the complexity of the business. For an advisory firm, this might be a CRM and portfolio analysis platform. For a brokerage, this includes trading systems, order management, client reporting, and compliance surveillance.
• Professional indemnity insurance confirmation: for most SCA licence categories, evidence that professional indemnity insurance has been placed or is committedly placeable, in a coverage amount appropriate for the proposed client base and activity volume.

Step-by-Step SCA Licensing Process

Step 1 — Activity confirmation: confirm the specific SCA licence category for your intended activities. If your activities span multiple categories, determine whether they can be covered under a single application or require separate licences. Consult with SCA or a licensed SCA advisory firm if there is any ambiguity.

Step 2 — Entity incorporation: incorporate a UAE mainland LLC with DED (Dubai Department of Economy and Tourism) or with the relevant emirate's DED equivalent. The SCA licence is issued to the LLC; free zone entities cannot hold SCA licences for mainland-regulated activities.

Step 3 — Management appointment: appoint and formally engage the qualified management team: CEO, CCO/MLRO, and proposed licensed persons. Begin gathering their fit and proper documentation immediately — personal documentation assembly often takes 4–6 weeks if the individuals are international.

Step 4 — Documentation preparation: prepare the full regulatory application package. This is typically the most time-consuming stage. A complete package for a standard advisory application typically takes 4–6 weeks to prepare properly. Fund management or brokerage applications take 8–12 weeks given the additional complexity.

Step 5 — SCA portal submission: create an account on the SCA electronic portal and complete the structured application form. Attach all supporting documentation. Pay the applicable application fee. The SCA typically acknowledges receipt within 5 working days.

Step 6 — Completeness review: the SCA conducts an initial completeness check, typically within 2–4 weeks. If the application is materially incomplete, the SCA will return it for resubmission. A returned application resets the clock — another reason to ensure completeness before submission.

Step 7 — Information request (IR): the SCA typically issues one or more information requests during the substantive review, asking for clarifications, additional documentation, or amendments to the business plan or compliance documents. Respond within the SCA's stated deadline (typically 30 working days for each IR).

Step 8 — Key person interviews: the SCA conducts interviews with proposed key persons — typically the CEO, CCO, and any proposed licensed registered persons — as part of the fit and proper assessment. Interviews may be in person or by video call.

Step 9 — In-principle approval conditions: the SCA issues an in-principle approval subject to conditions. Common conditions include: capital injection evidence (bank letter confirming capital is in the UAE account), systems demonstrations, finalised employment contracts for key persons, and formal commitment letters on compliance matters.

Step 10 — Final authorisation: once all in-principle conditions are met, the SCA issues the Regulated Activity Certificate. The entity may begin operations under the scope of the certificate from the date of issue.

Step 11 — Post-licence setup: register the entity with the UAE FTA for Corporate Tax, establish the ongoing compliance infrastructure (quarterly capital reporting, annual audit engagement, goAML registration), and begin operations in strict accordance with the regulatory conditions.

AML/CFT Obligations for SCA-Licensed Entities

SCA-licensed entities are regulated financial institutions (not merely designated non-financial businesses) under UAE AML/CFT Law. This means the highest standard of AML/CFT obligation applies — equivalent to the obligations placed on UAE banks and other licensed financial institutions. The practical implications are significant:

• Full Customer Due Diligence (CDD) before onboarding: no client relationship may be established before CDD is complete. CDD for individuals includes identity verification (passport and official ID), address verification, source of funds assessment, and purpose of investment relationship. CDD for corporate clients includes entity verification, beneficial ownership to natural person level (25%+ threshold), source of corporate funds, and purpose of relationship.
• Enhanced Due Diligence (EDD) for elevated-risk relationships: Politically Exposed Persons (PEPs), their immediate family members, and known close associates require EDD before onboarding and ongoing enhanced monitoring thereafter. EDD is also required for clients from FATF high-risk or monitored jurisdictions, clients with complex multi-jurisdictional ownership structures, and clients in sectors with elevated inherent AML risk.
• Ongoing transaction monitoring: a documented system for monitoring client transactions and investment activity against declared profiles, flagging transactions that are inconsistent in size, type, frequency, or counterparty. For larger financial services firms, this typically requires automated transaction monitoring software. For smaller advisory firms, a documented manual review process may suffice, provided it is genuinely operational.
• Suspicious Activity Reports (SARs) via goAML: mandatory registration on the UAE Financial Intelligence Unit's goAML platform is required before commencing operations. SARs must be filed when the compliance function identifies reasonable grounds to suspect that a transaction, attempted transaction, or inquiry relates to money laundering or terrorism financing. SARs are filed without "tipping off" the client — confidentiality of the SAR is mandatory.
• 5-year record retention: all CDD documentation, transaction records, compliance decisions, and SAR decisions (including cases where a SAR was considered but not filed and the reasons why not) must be retained for minimum 5 years from the date of the transaction or end of the client relationship.
• Annual AML/CFT risk assessment: a documented, updated assessment of the business's exposure to ML/TF risks must be maintained and refreshed at least annually. The risk assessment should consider: client risk (PEPs, jurisdictions, sectors), transaction risk (instruments, channels, volumes), and operational risk (delivery channels, new products).

Ongoing Compliance Obligations Post-Authorisation

Real-World Case Studies

Case Study 1: Boutique Investment Advisory Firm

A financial professional with 18 years of investment banking and wealth management experience across several regional banks decides to establish an independent investment advisory firm targeting UAE-based high-net-worth families. He chooses the SCA advisory licence (AED 300,000 capital) for direct UAE client access. Key steps: incorporation of a UAE mainland LLC with DED in 10 days; appointment of a part-time qualified CCO on a consultancy basis; preparation of business plan, AML/CFT manual, and compliance framework over 8 weeks; SCA portal submission. The SCA issued one IR at week 6 requesting clarification on the firm's target client identification and onboarding process. IR responded to in 5 days. Key person interview conducted by video call at week 10. In-principle approval at week 14. Final authorisation at week 18 (4.5 months). Year 1 compliance costs: approximately AED 230,000 (regulatory fees, audit, CCO retainer, professional indemnity, goAML setup).

Case Study 2: UAE Equity Fund Manager

A regional asset management company with offices in Bahrain and Kuwait establishes a UAE subsidiary to manage a dedicated UAE equity fund targeting institutional investors across the GCC. The SCA fund management licence (AED 10 million capital) requires the most extensive application process of any SCA category. Key challenges: identifying and engaging a UAE-based qualified fund manager with verifiable UAE equity market experience; engaging a UAE-licensed fund administrator; obtaining SCA approval for the fund prospectus in parallel with the licence application. Total application-to-authorisation timeline: 8 months. The fund launched with 3 founding institutional investors and AED 75 million in initial AUM.

Case Study 3: Online Brokerage Platform

A fintech company building a UAE retail equity investment platform applies for an SCA brokerage licence. The technology certification requirement — a specific SCA review of the trading platform and client-facing technology — adds 2 months to the standard timeline beyond the documentation review. The firm engages a UAE cybersecurity firm to conduct a penetration test of the platform before SCA technology review. Total timeline: 9 months. The platform opens with ADX and DFM connectivity, serving UAE retail investors with fractional share trading.

Common Mistakes That Lead to SCA Application Rejection or Delay

• Treating the AML/CFT manual as a template exercise. SCA compliance examiners have reviewed hundreds of AML/CFT manuals and immediately recognise those that are generic templates versus those that have been genuinely tailored to the specific business. Key differentiators: the risk assessment section must reflect the actual client mix and geographies of the specific business; CDD procedures must address the actual onboarding process; escalation procedures must show real management decision points. Generic manuals from online templates consistently draw requests for significant revision.
• Appointing unqualified or unavailable key persons. The SCA takes key person qualifications and genuine UAE presence seriously. Proposals to appoint qualified individuals who will "advise from abroad" or who "plan to relocate" after licence approval are unlikely to succeed. Key persons, particularly the CEO and licensed registered persons, must be genuinely available and actively managing the regulated activities from the UAE.
• Submitting with insufficient capital evidence. Capital must be demonstrably available and unencumbered at the time of application. A commitment letter from an investor, or capital that is "being raised," is not equivalent to available capital. Banks must confirm in writing that the specific amount of the required capital is held in a UAE account in the entity's name, free from any pledge or encumbrance.
• Not addressing the exchange membership requirement for brokerage applicants. Companies applying for a securities brokerage licence must also apply for membership of ADX and DFM (if they intend to execute orders on those exchanges). Exchange membership applications are separate from the SCA licence and run in parallel — starting the exchange membership process after the SCA licence is approved adds 2–3 months to the time before the brokerage can begin operations.
• Not engaging a compliance officer before submission. The SCA expects the compliance officer/MLRO to be engaged and available from the point of application, not as a future hire. The SCA may request to interview the compliance officer during the fit and proper process. Having no compliance officer at the time of submission raises a fundamental operational concern about how compliance will be managed.

SCA Regulatory Framework for CFDs and Derivatives

Contracts for Difference (CFDs) on UAE-listed securities and commodities are regulated activities under the SCA. Companies wishing to offer CFD products to UAE clients require an SCA brokerage licence with specific conditions relating to:

• Leverage limits specified by the SCA for retail clients (typically lower than institutional limits).
• Client risk warning obligations — mandatory, specific, and documented disclosure of the risks of leveraged products before onboarding.
• Negative balance protection for retail clients.
• Technology requirements for real-time margin monitoring and automatic position close-out.
• Segregation of client funds used as CFD margin from firm assets.

Expert Insights from MSZ Consultancy

SCA licensing is one of the more substantive UAE regulatory processes, but it is well-defined and consistently applied when the applicant understands what the SCA is assessing. In our experience guiding financial services clients through the SCA process, the applications that succeed most efficiently share three characteristics: complete documentation submitted at first application (no missing pieces, no vague sections); genuinely qualified and committed UAE-based management; and a genuinely operational AML/CFT framework that has been designed for the specific business, not lifted from a template.

The most time-efficient approach to SCA licensing is to spend 6–8 weeks on thorough preparation before submitting anything. Write the business plan as if presenting to a serious institutional investor. Build the AML/CFT manual as if you were going to rely on it operationally from day one — because you will be. Engage your compliance officer before submission, not as a theoretical future hire. Following this approach, many of our clients achieve SCA authorisation within 4 months of submission. Those who rush the preparation phase consistently spend more total time in the process due to information request delays.

Conclusion

The SCA licence is the gateway to the UAE domestic financial market — one of the world's most capital-rich retail and institutional investor bases, with rapidly growing interest in professional investment management services from an expanding UAE HNW and mass-affluent population. The licensing process is demanding but transparent: capital requirements are clear, fit and proper standards are well-established, and AML/CFT obligations follow internationally recognised standards. For financial services businesses that prepare thoroughly, the SCA authorisation timeline of 3–6 months is achievable and provides access to a market of genuine scale and quality.

Applying for an SCA licence in Dubai? Contact MSZ Consultancy for a free regulatory pathway assessment, entity structure review, and end-to-end SCA application support.