Virtual Asset Compliance Audit for CMA (formerly SCA) Licensing

The UAE Capital Market Authority, formerly the Securities and Commodities Authority, requires virtual asset service providers to be reviewed by a qualified independent external auditor.

We carry out that review of your technology, custody and security controls and issue a report you submit with your licence application or renewal.

The CMA has already granted virtual asset licences on the strength of our reports.

request a quote

When is a CMA compliance audit required?

Before applying for a CMA virtual asset licence
As part of the evidence package submitted with the application.
Before 1 January 2027
Decision No. 4/R.M/2026 replaced the previous SCA regime in full, and existing licensees have to bring their operations in line with the new framework by this date.
At renewal
A CMA licence is granted for one year and is renewed annually.
After major change
Changes to custody, wallet infrastructure, the trading engine or key third-party providers.

What we assess

Our methodology covers 19 control blocks drawn from the CMA virtual assets framework. The audit ends with three independent certification letters, confirming:

  • Compliance with internationally recognised best practices and standards
  • Robustness of your internal and external testing framework
  • Compliance with the requirements of Annex 7

1. Custody and key management

Hot and cold wallet separation, key generation and storage, signing and approval flows, segregation of client assets, recovery procedures, third-party custodians.

2. Platform and application security

Web, mobile and API security of the client-facing platform; authentication, authorisation and session management; business logic of deposits, withdrawals and trades.

3. Infrastructure and cloud

Network segmentation, cloud configuration, hardening, privileged access, secrets management, backup and disaster recovery.

4. Monitoring and incident response

Logging coverage, alerting, detection of suspicious activity, incident response and escalation, notification of the regulator.

5. Governance and technology risk

Information security policies, access management, change management, outsourcing and third-party risk, business continuity, internal controls over technology.

Our approach: from scoping to a licence-ready report

1. Scoping

We confirm which licensed activities, entities and systems are in scope.

2. Evidence review

We review policies, architecture documents and configuration evidence against each control block.

3. Interviews and technical validation

We verify how controls work in practice, with your engineering and compliance teams.

4. Gap analysis

Each gap is ranked by its weight for the regulator and its risk to client assets.

5. Reporting

You receive the audit report and the three certification letters in the format the regulator accepts, plus a debrief before the final version is issued.

A typical engagement is around 100–150 hours over 4–6 weeks.

FAQ

Is the CMA the same as the SCA?

Yes. The Securities and Commodities Authority was reconstituted as the Capital Market Authority under the 2025 federal decree-laws. The regulator's website is still sca.ae, and many documents use both names.

Does this cover VARA, ADGM or DIFC?

No. The CMA framework covers onshore UAE outside Dubai's VARA regime and the DIFC and ADGM free zones. If you are licensed in one of those, tell us and we will confirm whether we can help.

Do you help fix what you find?

You get a prioritised list of gaps with a recommended approach to each. We don't implement fixes ourselves, so that our report stays independent.

Can you work with a company that hasn't applied yet?

Yes. A readiness review before the application shows what to close first and saves a round of questions from the regulator.

Prepare your virtual asset business for CMA approval

Tell us which activities you hold or plan to apply for. We will come back with a scope and a fixed quote.