SCA license categories

The Securities and Commodities Authority has evolved from a conventional markets supervisor into a layered gatekeeper for everything from digital token launches to classic brokerage houses. Understanding where your proposed activity fits inside the Authority’s framework is therefore the first strategic decision any founder makes, long before a term sheet or technology stack is finalised. This guide unpacks every license category SCA offers in plain English, explains the obligations that accompany each authorisation and highlights practical selection tips that keep time-to-market short while satisfying the regulator’s quickly maturing expectations.

Why SCA divides the market into distinct license categories

The Emirati capital markets have expanded at breakneck speed. What began as spot equities on two local exchanges now includes over-the-counter derivatives, algorithmic crypto trading desks and robo-advisory apps that re-balance thousands of retail portfolios in real time. The SCA responds to that diversity by grouping licenses into categories according to the specific risks they create for clients, counterparties and the financial system. A multi-tier framework means lighter supervision for low-impact data aggregators, intense scrutiny for market-moving dealers and a flexible middle ground for everything in between. When you apply for approval, the Securities and Commodities Authority measures your technology, governance and capital against the standards written into the relevant tier, not against an ambiguous “one size fits all” handbook.

Finding your place on the regulatory ladder

Before you dive into the granular requirements of each license category SCA offers, it helps to map your proposed business model against the Authority’s risk spectrum. Ask three questions up front: Will we ever hold client money or assets? Do we intend to trade on our own account, on behalf of customers, or simply pass information between parties? And does our technology introduce systemic risk if it fails? Answering these honestly lets founders pinpoint the most relevant license category, budget for the correct capital threshold and assemble the policies the SCA will expect to see at interview. By aligning internal ambitions with the regulator’s risk-based lens from day one, applicants avoid costly redesigns later in the approval cycle.

The SCA divides businesses into license categories based on their risk profile, with capital, governance, and compliance obligations increasing in line with systemic impact.

The traditional license categories offered by SCA: Explained

First-category license: Dealing in securities as principal

Firms in the first tier are the market’s price setters. They buy or sell shares, Sukuk and structured notes on their own balance sheet, quote firm two-way prices to clients and, in many cases, take positions that absorb liquidity shocks. Because a badly run dealer could destabilise the market, the SCA demands a minimum paid-up capital of AED 30 million, daily capital-adequacy reporting, a real-time market-risk engine and separation of front-office, risk and back-office reporting lines. Senior managers must possess at least five years of continuous dealing experience, verified by regulator-issued competence certificates.

Operational obligations in practice

Submit electronic trade files within ten minutes of execution so the SCA can monitor abnormal price moves.
Maintain an automated kill switch that freezes trading when net positions breach pre-set risk limits.
Keep client complaint logs for five years and publish quarterly best-execution statistics.

Second-category license: Investment dealing without market making

Second-category firms execute client orders on an agency basis or match buyers and sellers inside their own dark pool but do not warehouse inventory or quote continuous prices. Capital requirements drop to AED 10 million, yet the compliance load remains significant: best-execution policies must evidence venue selection logic, and order-handling systems require time-sequenced audit trails accurate to one-second granularity. The SCA regularly reviews a random sample of trades to ensure commission structures are not discriminatory.

Phone number

Prefer messaging? Contact us through messengers or simply give us a call:

Third-category license: Arranging and advisory roles

Corporate finance boutiques, crowdfunding platforms and digital advisers fall under the third tier. Their job is to structure transactions or provide investment recommendations without ever holding client money or executing orders. As information intermediaries they still influence investment decisions, so the Authority insists on robust suitability procedures, advertising controls and conflicts-of-interest registers. Minimum capital sits at AED 500,000, but the SCA often asks to see a professional indemnity policy that covers at least AED 1 million per claim for negligent advice or prospectus misstatements.

Key advertising rule: every marketing post on social media must carry a disclaimer that the content is for informational purposes unless the message is issued by a fully authorised and disclosed advisory entity.

Fourth-category license: Credit-rating agencies

Credit-rating agencies evaluate issuers’ default probability and thus mould investor perception across the entire yield curve. To restrain potential conflicts, the SCA applies governance rules closely modelled on IOSCO’s global code. Analysts must rotate off an issuer after three years, the surveillance function must be fire-walled from commercial teams, and the agency publishes an annual transparency report audited by an external compliance reviewer. Although ratings are an opinion, the Authority can sanction an agency that repeatedly issues assessments unsupported by public methodology or material data.

Fifth-category license: Data-aggregation, account-information and payment-initiation services

Originally designed for securities account reporting, the fifth tier now also houses open-banking specialists that fall under Strong Customer Authentication rules. These entities access or initiate payments from customer accounts but never touch the funds themselves. Capital is a modest AED 200,000, yet cyber-resilience requirements are strict.

"Multi-factor authentication, end-to-end encryption and real-time anomaly detection must be built into the architecture from day one."

The virtual-asset landscape

Why virtual-asset permissions sit on top of, not outside, traditional tiers

The Authority treats crypto businesses in the UAE as an evolution of capital markets rather than a separate universe. If you operate a Bitcoin order book you are, in essence, running a securities exchange with additional technology risks. Therefore the SCA super-imposes virtual asset endorsements onto the core tier that best mirrors your activity. A custody provider needs a fifth-category base license plus a digital-asset-custody endorsement, whereas a crypto derivatives desk needs a first-category trading license with a derivative-token add-on.

Virtual-asset exchange endorsement

An exchange matches orders, maintains a public order book and publishes last-trade data. The SCA demands:

Multilateral trading facility engine hosted in a Tier III data centre within the UAE.
Cold-storage solution that isolates at least 80 percent of client tokens from the internet.
Proof-of-reserves attestation signed by a Big Four or DFSA-recognised audit firm every quarter.
User-verification tiers linked to withdrawal limits, aligned with FATF travel-rule thresholds.

Virtual-wallet service endorsement

Wallet providers who store private keys on behalf of customers must implement hardware-security-module (HSM) technology, geo-fenced access controls and daily reconciliation between on-chain balances and internal ledgers. The SCA reviews incident-response playbooks and penetration-test summaries prior to license issuance and again at annual renewal.

Custody providers for institutional investors

Institutional custodians go further than wallet providers by offering settlement finality, asset-servicing and insurance coverage. The Authority expects segregated omnibus accounts, dual-control key signing and an insurance policy that covers hacking losses, insider theft and operational errors up to the total value of assets under custody.

Investment-management and advisory services for digital assets

Portfolio managers who allocate client capital into tokens or DeFi pools must meet the same fiduciary duties that apply to conventional assets: daily value-at-risk monitoring, counterparty credit limits and independent valuation where reliable market prices are unavailable. Marketing materials must disclose smart-contract risks and consensus vulnerabilities in plain language.

Initial coin offering and token-sale approvals

Issuers must submit a white paper equivalent to a prospectus: tokenomics, rights attached, lock-up periods, use of proceeds and a technical audit of the smart contract. The SCA requires escrow of at least 20 percent of proceeds until project milestones are verified by an independent assessor.

Selecting the correct license for your business model

Map activities before you complete a form

Too many founders begin the application based on a headline they have read rather than on a granular activity map. List every action your platform will perform: matching, custody, borrowing, staking, advice, and data. Then cross-reference each action against the Authority’s activity schedule to identify the highest-risk activity, This dictates the base tier.

Factor capital, governance and audit into your budget early

Capital locks cannot be paid from seed investors’ convertible notes: the SCA demands fully paid equity or irrevocable cash contribution. In parallel, allocate at least AED 150,000 annually for external audit, cybersecurity testing and compliance consultancy. Under-budgeting is the most common reason applications stall.

Prepare technology documentation in human language

Regulators are technical, not tech-native. Provide network diagrams, data-flow charts and a plain English description of each API’s purpose. The clearer your narrative, the fewer supplementary questions, and the faster your approval arrives.

Post-approval life cycle: reporting, renewal and change management

Ongoing reporting cadence

Monthly: client-asset reconciliation and suspicious-transaction reports.
Quarterly: financial statements, capital-adequacy certificate, virtual-asset proof-of-reserves.
Annually: external audit, cyber-penetration test, board effectiveness review, business-continuity drill results.

Material-change approvals

Launching a new derivative product, onboarding high-leverage professional clients or integrating layer-two blockchain scaling solutions all count as material changes. Submit a variation-of-permission pack at least 60 days before the planned go-live.

Renewal checkpoints

Ninety days before license anniversary you will receive a renewal reminder. Provide updated risk-control self-assessment, evidence that internal policies match the latest regulatory circulars and proof that senior-management training hours meet the minimum threshold.

"Post-approval obligations include monthly and quarterly reporting, license renewals, and advance approval for material changes like launching new products."

Common pitfalls and how to avoid them

Incomplete AML framework

Template policies downloaded from the internet rarely satisfy SCA examiners. Tailor transaction-monitoring rules to your exact products.

Board composition gaps

At least one independent non-executive director with capital markets or cybersecurity expertise is mandatory for virtual-asset exchanges.

Marketing ahead of approval

Publishing token pre-sale adverts before your prospectus is signed can lead to a six-month cooling-off period and reputational damage.

Emerging compliance trends and technology focal points

While the core license architecture outlined above remains the backbone of the regulatory landscape, the Securities and Commodities Authority continues to release thematic guidance that reshapes day-to-day operational expectations. Three recent trends deserve special attention because they influence how first-time applicants design their technology stack and internal control environment.

Open-banking interface expectations

The Authority now encourages licensed payment initiation and account information providers to integrate with the UAE’s fast-evolving open-finance framework. From the first quarter of 2025, new AISPs must demonstrate that their application programming interfaces rely on industry-standard ISO 20022 message schemas and support customer-controlled permission dashboards where data-sharing rights can be revoked in real-time. Existing license holders have a twelve-month transition window. The practical takeaway is clear: build modular, standards-compliant APIs from day one, rather than custom endpoints that will require expensive rewrites when the final rulebook lands.

Enhanced due diligence for high-risk token listings

Virtual-asset exchanges have always needed listing committees, but the SCA’s latest circular adds two quantitative triggers that move a token from the normal to the enhanced-review track: an anonymous founder group or a token distribution in which insiders control more than 25 percent of total supply after the public round. Exchanges must commission an external blockchain analytics firm to produce a concentration and transaction-flow report, file it with the Authority and disclose a summary to traders. Planning to list early-stage tokens? Budget at least AED 50,000 for these reports and build a checklist that captures founder-wallet transparency at the initial onboarding stage.

Real-time transaction-monitoring benchmarks

The Authority’s new consultation proposes that all VASPs calibrate their anti-money-laundering systems to flag transfers that score above the 97th percentile of jurisdiction-specific risk signals, not the traditional 90th. That subtle change increases alert volumes by roughly 30 percent, according to pilot data shared with the SCA. Start-ups must therefore balance detection sensitivity with analyst staffing levels. A sensible approach is to embed machine-learning tools that auto-resolve low-risk alerts.

Escalate only those transactions exhibiting multiple red flags, a design that keeps compliance headcount manageable during rapid growth phases.

SCA approval requires human-readable tech documentation, capital sourced from equity (not convertible notes), and upfront budgeting for audits and cyber controls.
New compliance trends emphasize open-banking API standards, enhanced scrutiny for token listings with anonymous founders, and real-time AML benchmarks based on local risk scoring.
Common missteps include generic AML templates, missing board expertise, and marketing before approval—all of which delay or block licensing.

Aston VIP: Converting compliance into competitive edge

Our advisory practice was built inside the nation’s regulatory sandbox, so we understand the nuance behind every Article and Guidance Note. Aston VIP helps founders translate dense rulebooks into launch-ready architectures: we blueprint control systems that satisfy the SCA yet remain light enough for a start-up budget, craft technology narratives that accelerate approval timelines, and install post-license monitoring that scales seamlessly from ten to ten thousand clients.

Whether you need a first-category dealing permit, a VASP endorsement or a hybrid structure that spans multiple tiers, our specialists shoulder the application burden, interface with the regulator and deliver a turnkey compliance framework that frees you to focus on product-market fit. Contact us to learn how Aston VIP can help you choose and secure the right SCA license category for your company in the UAE.