Financial promotion rules in the UAE: CBUAE, CMA, DFSA, FSRA (ADGM) and VARA

Which regulator applies

The UAE splits financial regulation between federal regulators onshore, two financial free zones with their own rulebooks and VARA, Dubai's virtual asset regulator.

Onshore, federal

• CBUAECentral Bank of the UAEBanks, finance companies and other licensed financial institutionsConsumer Protection Regulation and Standards, 2.3
• CBUAECentral Bank of the UAE, insuranceInsurers and insurance-related professionsIA Board Resolution No. 3 of 2010, art. 11; No. 18 of 2020, art. 14
• CMACapital Market Authority, formerly the SCASecurities and funds, and the virtual asset firms it licensesCMA Rulebook, art. 6; VASP Business Regulation Module, arts. 14 and 103

Financial free zones

• DFSADubai Financial Services AuthorityPromotions in or from the Dubai International Financial CentreGEN 3.4 to 3.6; COB 3.2
• FSRAFinancial Services Regulatory AuthorityPromotions in Abu Dhabi Global MarketFSMR section 18; COBS 3.2

Virtual assets

• VARAVirtual Assets Regulatory Authority, DubaiVirtual asset marketing in or targeting the UAEMarketing Regulations 2024

A DIFC firm advertising to onshore retail customers, for example, should check both the DFSA's rules and the onshore regime for the product.

Onshore banking, finance and insurance: the CBUAE

The CBUAE's Consumer Protection Regulation sets the standard for licensed financial institutions:

Advertising issued by Licensed Financial Institutions must not be deceptive, misleading, fraudulent or unfair and must be easily understandable by a Consumer. All text and numbers must be clearly visible and understandable.

The Regulation adds that promotional material must be “clearly identified as a financial promotion” (2.3.2.1), and must not “exaggerate the advantages of a product and/or service”, including through “general impressions conveyed through words, pictures, digital images, audio and/or video, and the use of disclaimers not clearly and prominently disclosed and displayed” (2.3.2.3). It covers “all channels”, including websites, mobile apps and social media (2.3.2.5).

The Consumer Protection Standards are more specific: “All advertisements must be available in both Arabic and English”, though an advert targeted to one linguistic market can be tailored to it, and text and numbers must be “of a sufficient font size, minimum 10” (2.3.1.3 to 2.3.1.4).

Insurers follow separate rules. The Consumer Protection Regulation applies to financial institutions licensed under the banking law, which does not cover insurers (article 1, definitions). Under the former Insurance Authority's code of conduct, now in the CBUAE Rulebook, “Prior to publishing an advertisement in the media or through direct communication with the Clients with respect to a certain insurance policy or scheme, the Company shall forward such Policy or scheme to the IA” (Board Resolution No. 3 of 2010, article 11). Advertising electronic insurance operations needs “the prior written approval of the Insurance Authority” (now the CBUAE) (Board Resolution No. 18 of 2020, article 14).

Onshore securities, funds and virtual assets: the Capital Market Authority

The Securities and Commodities Authority became the Capital Market Authority on 1 January 2026, under the Capital Market Authority Law, Federal Decree-Law No. 32 of 2025. Its rules on promoting financial products are in article 6 of its Rulebook.

Promotion is a licensed activity. Article 6 lists the cases exempt from needing a licence to promote, including “Financial products listed on the market”, “Financial products promoted to the professional investor and the counterparty, excluding foreign funds units” and “Reverse promotion, at the initiative of an investor inside the state”.

A promoter must use promotional means that are “easy, clear, honest, correct, not misleading … and in a language that the investor understands”. It must tell clients that past performance “is not necessarily an indication or evidence on the future performance”, and must withdraw material “immediately upon awareness of violation by its issuer” (article 6, Second, clauses 5, 9 and 10).

Banks, and branches of foreign banks licensed in the UAE, are excluded from those three clauses if they keep a register of the data of each promoted product and everything related to its promotion, and provide it to the CMA on request (clause 18). Units of unlisted local or foreign funds have their own application process (clause 19), and foreign fund units are restricted to private offering to professional investors and counterparties (article 6, Fourth). The CMA's rulebook text has been amended over time, so check the current article on its website before relying on it.

Virtual asset firms licensed by the CMA. The CMA's current rules for virtual asset service providers, Resolution No. (04/Chairman) of 2026, took effect on 28 February 2026. Their marketing material must contain the firm's name and its regulatory status, and material aimed only at professional investors or counterparties must say so, with a statement “that no person other than those identified should act on it” (Business Regulation Module, article 14). Marketing, educational and other materials about a virtual asset must also show six prescribed risk warnings prominently at or near the top of every page, fixed at the top of the screen on a website or app (article 103):

a. Virtual assets are highly volatile and may rapidly lose value. b. Investors may lose all or part of their investment. c. Virtual assets may not always be liquid or transferable. d. Virtual asset investments are complex and risky to understand, buy, sell, or lend. e. Virtual assets are susceptible to theft from cyberattacks. f. Virtual asset investments differ significantly from traditional investments like securities.

DIFC: the DFSA

A Person shall not, subject to (2) and (3), make a Financial Promotion in or from the DIFC unless that Person is an Authorised Person.

The exceptions include promotions approved by an authorised firm (other than a representative office) and promotions directed exclusively at people who appear on reasonable grounds to be professional clients (GEN 3.4.1(2) and (3)). The DFSA's guidance says the prohibition “applies irrespective of where the communicator of the Financial Promotion is located” (GEN 3.4.2, guidance).

An authorised firm's own communications fall under the DFSA's Conduct of Business module, which requires it to “take reasonable steps to ensure that the communication is clear, fair and not misleading” (COB 3.2.1), and its marketing material must carry its name and regulatory status (COB 3.2.4).

A person that is not an authorised person but may promote under GEN 3.4.1(3) must take reasonable care that its promotion (GEN 3.5.1):

• is “clear, fair and not misleading”;
• includes the person's “name, address and regulatory status”;
• if meant only for professional clients, is not sent to anyone else;
• where it shows past performance to retail clients, carries “a prominent warning that past performance is not necessarily a reliable indicator of future performance”.

An approving firm must make sure the promotion states clearly and prominently that it has been “approved by” that firm (GEN 3.6.1), and needs a retail endorsement to approve retail promotions (GEN 3.6.2).

ADGM: the FSRA

ADGM's restriction follows the UK model:

A person (“A”) must not, in the course of business, communicate an invitation or inducement to Engage in Investment Activity (the “Financial Promotion Restriction”).

It does not apply where the communicator is an authorised or exempt person or is licensed and supervised by a financial services regulator in the UAE, or where the content is approved by an authorised or exempt person, among other exceptions (section 18(2)).

Under the FSRA's Conduct of Business Rulebook, an authorised person “must take reasonable steps to ensure that the communication is clear, fair and not misleading” (COBS 3.2.1). Marketing material must contain the authorised person's name and regulatory status and, if it is meant only for professional clients, say so. Retail material must be identified as marketing material and as not being investment advice (COBS 3.2.4). Past performance shown to retail clients needs “at least 5 years' data where available” and “a prominent warning that past performance is not necessarily a reliable indicator of future results” (COBS 3.2.6).

Virtual assets: VARA

VARA's Marketing Regulations took effect on 1 October 2024. “All Marketing of or relating to any Virtual Asset or VA Activity in or targeting the UAE must comply with these Marketing Regulations” (I.B.1). The test is where the marketing is aimed, not where the marketer sits: the exemption in I.B.5 applies only to a firm that is not in Dubai, does no virtual asset activity there and does not market in or target the UAE. A virtual asset firm licensed by the CMA follows the CMA's rules above; because VARA's rules apply by their own terms to marketing that targets the UAE, a firm marketing across the UAE should check both.

Who may market. Marketing of or relating to any VA activity in or targeting the UAE must be carried out by a VASP licensed by VARA for that activity, or on behalf of and approved by one (I.B.3). Marketing of anonymity-enhanced cryptocurrencies is “strictly prohibited” (I.B.4).

General requirements (I.C.2). Marketing must be “fair, clear and not misleading in both substance and presentation”, must “not state or imply that investments are safe, low risk or that returns are guaranteed” and must “not state or imply any urgency, or create a fear of missing out”. Paid third-party content needs “a clear and prominent notification”, and incentives need a compliance confirmation from VARA.

The risk disclaimer (I.C.3). Marketing of a virtual asset must:

a. not include a call to buy … b. include a prominent disclaimer that Virtual Assets may lose their value in full or in part, and are subject to extreme volatility; c. state clearly that the owner and/or investor in the Virtual Asset can lose all the money or other value they invest, and does not benefit from any form of financial protection

Records (I.C.4). Records of all marketing must be kept “for a minimum of eight (8) years from the date on which such Marketing is last conducted”.

A checklist for UAE promotions

Connor checks promotions for the UAE onshore, DIFC and ADGM as separate markets, alongside the UK, EU, Cyprus, Ireland, the US and Australia. Onshore it applies the CMA's rules, the CBUAE's advertising standards for the institutions it licenses and VARA's marketing rules; in DIFC the DFSA's, and in ADGM the FSRA's. Each promotion is checked only against the rules that apply to its markets and products.