UAE Change of Control Rules for Regulated Financial Businesses

In the UAE regulation of financial markets is fragmented. Companies active onshore are regulated by the Federal Capital Market Authority (CMA). In the financial free zone: the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) the freezone specific regulations apply oversight is exercised by the freezone specific regulators. 

These authorities maintain strict rules on changes of ownership and control of regulated financial services firms. The rules are designed to ensure that anyone buying a major stake in a regulated firm meets the relevant requirements, including suitability standards. Any proposed acquisition, increase or reduction in a controlling interest may require early contact with the relevant regulator. Depending on the regime and the status of the regulated entity, this means obtaining prior regulatory approval or notification. 

The DIFC and ADGM regimes traditionally required notification or prior approval for change of control events in financially regulated entities (for a discussion of the DIFC and ADGM regime see our client brief on the two ). In 2026 the onshore legislator followed to establish a similar regime requiring notification or clearance for change of control in onshore licensed persons.

Licensed persons are broadly defined as persons licensed or approved by the CMA, or registered with it, to carry out financial activities within its regulatory competence. Relevant financial activities include, brokerage, portfolio management, dealing in financial products, underwriting, financial advisory and custody services. Financial activities licensed by the Central Bank and financial free zones, including the DIFC and ADGM, are generally outside this regime.

The overarching change of control framework requires CMA approval before certain actions are taken. This includes acquiring or gaining control of a licensed person. The CMA may grant approval, impose conditions or refuse approval and may take regulatory action where the applicable conditions or procedures are breached.

The detailed CMA Controller  rules set out the approval and notification requirements for particular changes of control. Similar to the DIFC and ADGM regimes, the process depends on whether the CMA-licensed entity is a local entity or a branch of a foreign company.

Change of control in local entities

Where the target is a local CMA-licensed entity, prior approval from the CMA is required where a person proposes to:

1. become a Controller; thus acquiring 10% or more in a licensed person; or
2. if the person is already a Controller, increase its stake in the licensed person beyond 30% or 50%.

Where an existing Controller of a licensed person proposes to reduce or give up its control, notification to the CMA is required where the controller:

1. intends to cease being a Controller entirely; or
2. intends to reduce its stake from more than 50% to 50% or less or from more than 30% to 30% or less.

A person required to obtain prior approval must submit the prescribed application to the CMA. The CMA may approve the proposed acquisition or increase in control, approve it subject to conditions, or reject the application. The CMA must assess a complete and accurate application within 90 days. It may extend this period where it considers an extension necessary and notifies the applicant accordingly.

Change of control in branches of foreign companies

Where the licensed person is a branch of a foreign company no approval is required. Still, the CMA must be notified if a person seeks to become a Controller, increases their stake above certain thresholds, reduces their stake below those thresholds, or ceases to be a controller. The thresholds are the same as those that apply to the clearance requirement for change of control in local entities.

Ongoing obligations

The licensed person itself must maintain adequate systems and controls to monitor changes relating to its Controllers and significant changes in the behavior or circumstances of existing Controllers. It must generally notify the CMA as soon as possible after becoming aware of a relevant event. This is a separate monitoring and reporting obligation on the licensed entity. It does not apply where the entity reasonably believes that the proposed or existing Controller has already obtained the required CMA approval or made the applicable notification.

The CMA also has powers to act against a person that acquires or increases control without obtaining the required prior approval, fails to comply with the branch notification requirements, or is otherwise considered unacceptable as a Controller. This may ultimately result in the person being required to dispose of the relevant holding. Separately, a breach of the conditions or procedures imposed by the CMA in relation to control may result in the CMA revoking the licensed person’s license or imposing conditions or restrictions on it. 

Key takeaways

The CMA change of control regime is broadly aligned with that of the DIFC. For locally established entities, both the CMA and DFSA require prior approval where a person becomes a Controller or where an existing Controller increases its level of control across the 30% or 

50% thresholds. The ADGM regime is more restrictive in this respect. It also requires approval where a Controller expands its stake beyond 20%. For branches of foreign companies, the three regimes are broadly aligned. Specified changes in control are generally subject to prior notification rather than prior approval. This includes becoming or ceasing to be a Controller and increases through the 30% and 50% thresholds, as well as a reduction from more than 50% to 50% or less.

The relevant review periods may also matter when planning a transaction. Under the CMA regime, the CMA must assess a complete and accurate application within 90 days. It may extend this period where necessary. The ADGM regime similarly provides for a review period of up to three months for a complete change of control application. The DIFC rules on the other hand do not prescribe a fixed review period. The resulting ambiguity should be factored into the deal timetable under each regime.