Understanding UAE Change of Control Rules for Financial Businesses

The UAE’s financial regulatory landscape is divided between the federal onshore regime and the country’s financial free zones. Businesses operating onshore may fall under the supervision of the Federal Capital Market Authority (CMA), while entities established in the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) are subject to their respective regulatory frameworks.

For investors and businesses pursuing acquisitions in the UAE financial sector, that distinction can directly affect how a transaction is structured and when it can close.

The DIFC and ADGM have long maintained change of control requirements for regulated financial businesses. In 2026, the UAE introduced a comparable framework for CMA-regulated onshore entities, expanding the regulatory approvals that may need to be considered when ownership of a financial services business changes.

The rules are significant not only for financial institutions themselves, but also for private equity firms, strategic investors, holding companies and international businesses considering investments in regulated UAE businesses.

Why Change of Control Rules Matter in UAE Transactions

Financial regulators generally want visibility into who ultimately owns or controls businesses carrying out regulated financial activities. A transaction that gives an investor a significant ownership position may therefore require more than the ordinary corporate approvals associated with an acquisition.

Depending on the entity involved and the size of the interest being acquired, regulatory approval may need to be obtained before the transaction is completed.

This can affect several elements of a deal. Regulatory approvals may need to be built into conditions precedent. Long-stop dates may have to account for the applicable review period. Investors may also need to provide information regarding ownership structures, financial resources, management and suitability before a regulator will approve the proposed change.

These considerations become particularly important in competitive sale processes or multi-jurisdictional transactions where regulatory approvals in several countries are running simultaneously.

For investors, identifying a UAE change of control requirement early can help avoid a situation in which the commercial terms of a transaction have been agreed but closing is delayed because a regulatory approval process was not incorporated into the deal timetable.

Which Businesses Fall Under the CMA Regime?

For purposes of the onshore framework, licensed persons broadly include persons licensed, or approved by or registered with the CMA to conduct financial activities within its jurisdiction. These activities may include:

• Brokerage
• Portfolio management
• Dealing in financial products
• Underwriting
• Financial advisory services
• Custody services

Businesses regulated by the UAE Central Bank generally fall outside this framework. The rules applicable within the DIFC and ADGM are also separate from the CMA regime.

As a result, determining the relevant regulator is an important first step when assessing a transaction involving a UAE financial services business.

When CMA Approval Is Required for Local Entities

For a locally established CMA-licensed business, regulatory approval may be required before an investor acquires or increases a significant ownership interest.

Prior CMA approval is required where a person proposes to become a Controller by acquiring an interest of at least 10% in the licensed person.

Approval is also required where an existing Controller proposes to increase its ownership beyond either the 30% or 50% thresholds.

The thresholds are therefore relevant not only when an investor first acquires a substantial interest, but also in later investments. An existing shareholder making a follow-on investment may trigger another regulatory process when crossing one of these ownership levels.

An applicant seeking approval must submit the prescribed information to the CMA. The authority may approve the change, approve it subject to conditions or reject the application.

The CMA is generally required to assess a complete and accurate application within 90 days, although that review period may be extended where the authority considers additional time necessary.

Reductions in Ownership Can Also Trigger Obligations

Change of control regulation does not apply only when shares are being acquired.

An existing Controller of a CMA-licensed entity may also have a notification obligation when reducing or disposing of its interest.

Notification is generally required where the Controller intends to cease being a Controller entirely or reduce its ownership:

• From more than 50% to 50% or below; or
• From more than 30% to 30% or below.

This means regulatory analysis may be relevant on both sides of an ownership change. A buyer may need approval for increasing its position while an existing shareholder may have a separate notification obligation arising from the reduction of its stake.

That becomes particularly relevant in transactions involving consortium investors, partial exits, reorganizations or staged acquisitions.

Different Rules Apply to Foreign Company Branches

The framework is somewhat different where the CMA-licensed business operates as a branch of a foreign company.

Changes in control of the foreign parent generally do not require prior CMA approval. Instead, the relevant changes must be notified to the authority.

The applicable ownership thresholds broadly correspond to those used for locally incorporated entities. Notification may therefore arise when a person becomes a Controller, moves through specified ownership thresholds, reduces its interest below them or ceases to be a Controller.

For international financial groups, this distinction can be important when assessing the UAE consequences of a transaction occurring at parent-company level outside the UAE.

An acquisition involving a global financial institution may therefore create a UAE regulatory notification even where the UAE branch itself is not directly being sold.

Regulated Businesses Have Their Own Monitoring Duties

The investor is not the only party with regulatory responsibilities.

A CMA-licensed entity must maintain appropriate systems for identifying changes involving its Controllers and monitoring significant developments affecting existing Controllers.

The licensed business generally must notify the CMA when it becomes aware of a relevant event, unless it reasonably understands that the Controller has already obtained the necessary approval or submitted the required notification.

For regulated firms, this makes shareholder monitoring part of ongoing regulatory compliance rather than a concern arising only during major M&A transactions.

Corporate reorganizations, transfers between related entities and changes higher in an ownership chain may all need to be reviewed to determine whether they affect the regulated entity.

Non-Compliance Can Affect Both the Investor and the Business

Proceeding with a change of control without satisfying the applicable requirements can create consequences beyond a procedural delay.

The CMA has authority to take action where an investor acquires or increases control without obtaining required approval, fails to make a required notification involving a foreign branch or is otherwise considered unsuitable to act as a Controller.

In certain circumstances, the authority may ultimately require the relevant interest to be disposed of.

The regulated entity may also face consequences. Breaches of conditions or procedures imposed in connection with control may result in restrictions or conditions being placed on the business and may, in serious cases, affect its license.

For transaction parties, this makes change of control analysis part of regulatory risk allocation rather than simply a post-signing filing exercise.

Comparing the CMA, DIFC and ADGM Frameworks

The new CMA framework brings the onshore regime closer to the change of control systems already established in the DIFC and ADGM.

For locally established entities, both the CMA and the Dubai Financial Services Authority generally require prior approval when a person first becomes a Controller and when an existing Controller crosses the 30% or 50% thresholds.

The ADGM framework goes further by also requiring approval when a Controller moves beyond the 20% level.

For branches of foreign companies, the three regimes are more closely aligned. Relevant changes in ownership are generally handled through prior notification rather than prior approval.

Review periods can also differ. The CMA generally has up to 90 days to assess a complete application and may extend that period. The ADGM regime similarly contemplates a review period of up to three months. DIFC rules do not prescribe an equivalent fixed timetable.

Those differences should be considered when establishing expected signing-to-closing periods.

Planning for Regulatory M&A in the UAE

The introduction of the CMA change of control framework reflects the continuing development of transaction-related regulation in the UAE.

For investors, this means an acquisition involving a financial business may need to be assessed against several regulatory layers before a deal timetable is finalized. The identity of the regulator, the structure of the licensed business, the percentage being acquired and the investor’s existing ownership position can each affect the required process.

In cross-border transactions, these requirements may also sit alongside merger control, foreign investment, sector-specific and financial regulatory approvals elsewhere in the region.

Early regulatory analysis can help parties identify these processes before they become closing obstacles and structure transaction documents around realistic approval periods.

BREMER advises PE firms, international corporates and financial institutions on regulatory M&A matters across the UAE and the wider Middle East and Africa region, including financial regulatory approvals, merger control and related transaction requirements.