SCA Regulations in UAE: Penetration Testing and Risk Assessment Guide

Federal Decree-Law No. 32 of 2025 established the CMA, and Federal Decree-Law No. 33 of 2025 regulates the capital market. Both came into effect on 1 January 2026. The Capital Market Authority (CMA) became the legal successor to the Securities and Commodities Authority (SCA) under Federal Decree-Law No. 32 of 2025. 

Federal Decree-Law No. 33 of 2025 worked alongside this statute to establish the capital market regulatory perimeter. While the SCA regulations UAE previously governed securities and commodities activities, the Capital Market Authority (CMA) has now assumed the regulatory role under the new framework. Chairman’s Resolution No. (04/Chairman)/2026, which introduced cybersecurity requirements for these entities, came into effect on 28 February 2026. The resolution sets out cybersecurity and risk management requirements for licensed Virtual Asset Service Providers (VASPs) and Alternative Trading System (ATS) operators under the CMA framework.

Technical leads, security directors, and compliance teams face a direct operational challenge. Trading platforms, client portals, and cloud infrastructure depend on secure software and systems. An unpatched web vulnerability, a misconfigured cloud setting, or an unsecured API endpoint can expose client data and assets or disrupt trading operations.

Compliance under the CMA framework demands more than occasional vulnerability scans. Licensed entities must maintain a documented cybersecurity risk management framework, assess risks across their ICT assets, manage third-party security risks, and regularly test their technical controls.

This blog explains the new cybersecurity requirements under Chapter Three of the CMA Rulebook and what regulated firms need to do to assess and protect their systems.

What Are the UAE CMA Regulations? Understanding the SCA-to-CMA Transition 

The Securities and Commodities Authority (SCA) was previously the federal regulator for UAE capital markets under historical SCA UAE mandates. On 1 January 2026, Federal Decree-Law No. 32 of 2025 replaced the former SCA framework with the Capital Market Authority (CMA). The accompanying Federal Decree-Law No. 33 of 2025 introduced the new framework for regulating the capital market.

These laws gave the CMA updated supervisory powers and changed the rules governing licensed financial activities. Another important change was Chairman’s Resolution No. (04/Chairman)/2026. It introduced specific rules for virtual asset service providers and alternative trading system operators, including cybersecurity risk management requirements.

SCA vs CMA: Key Changes in the UAE Capital Market Regulatory Framework

The transition from the Securities and Commodities Authority (SCA) to the Capital Market Authority (CMA) changed the regulatory structure governing UAE capital markets. Federal Decree-Law No. 32 of 2025 established the CMA, while Federal Decree-Law No. 33 of 2025 introduced the updated capital market regulatory framework. The following table highlights the main differences between the former SCA framework and the current CMA structure.

The transition to the CMA introduced a more specific regulatory framework for cybersecurity risk management among the entities covered by the new resolution. In particular, Articles 47–53 establish requirements for cybersecurity governance, third-party risk management, ICT asset protection, risk assessment and incident reporting. These requirements make cybersecurity an important part of operational and regulatory oversight for licensed VASPs and ATS operators.

 Which Entities Must Follow the CMA Cybersecurity Requirements? 

Chairman’s Resolution No. (04/Chairman)/2026 covers licensed Virtual Asset Service Providers (VASPs) and Alternative Trading System (ATS) operators within the scope of the resolution.

The regulated activities include:

• Operating virtual asset trading platforms.
• Providing virtual asset exchange services.
• Providing virtual asset transfer services.
• Providing brokerage services for virtual asset trading.
• Providing virtual asset custody and management services.
• Operating regulated alternative trading systems

The exact requirements depend on the licensed activity and applicable regulatory provisions. Firms should verify their licensing category before applying the cybersecurity requirements to their operations.

The resolution also provides a transition period of up to one year for compliance with the Business Regulation and Alternative Trading System Modules. The General Framework requirements apply from the resolution’s effective date. Existing licensing and employee accreditation conditions continue during status regularisation.

Secure Your Business with a Expert-Led Security Assessment

Partner with certified security specialists to identify, prioritize, and remediate real-world risks across your systems.

Book a Security Assessment →

Key CMA Cybersecurity and Risk Management Requirements 

Chapter Three of the CMA Rulebook sets specific rules for Information and Communications Technology (ICT) security, operational continuity, and risk management.

These rules make the board and senior management responsible for cybersecurity oversight. They also require firms to include security controls in their IT operations and risk management processes under SCA regulations UAE.

Article 47: Cybersecurity Risk Management Framework

Entities covered by the CMA framework must maintain a documented cybersecurity risk management framework approved by the board. This framework should explain how the organisation identifies, evaluates and manages cybersecurity risks across its technology infrastructure and business operations.

The framework must form part of the organisation’s overall risk management approach and should be reviewed at least once a year. Its policies, systems and security controls should also be proportionate to the nature, size and complexity of the organisation’s activities. This means that a firm operating a large virtual asset trading platform may need different security measures from an organisation with a smaller and less complex technology environment.

A documented framework also helps management understand which cybersecurity risks need attention, who is responsible for managing them and whether existing security measures are adequate.

Article 48: Third-Party Cybersecurity Risk Management

Financial services organisations often depend on external vendors for cloud hosting, software development, payment processing and other technology services. These relationships can introduce security risks, particularly when third parties have access to sensitive information or critical business systems.

Article 48 requires regulated entities to assess the cybersecurity practices of third-party service providers before engaging them. They must include appropriate security requirements in service contracts, covering areas such as incident reporting, cooperation during security investigations and compliance with the organisation’s cybersecurity requirements.

Organisations must also monitor whether vendors continue to meet these security expectations throughout the business relationship. This is important because a vendor’s security practices can change over time, potentially exposing connected systems and sensitive information to new risks. Outsourcing a technology service does not remove the regulated entity’s responsibility for managing the associated cybersecurity risks.

Article 49: Board and Senior Management Responsibilities

Cybersecurity oversight is not limited to the IT or information security department. Article 49 makes the board and senior management responsible for ensuring that cybersecurity risks are properly managed across the organisation. The board must oversee the cybersecurity risk management framework, while senior management is responsible for ensuring that the required policies, processes and security controls are implemented in day-to-day operations.

Their responsibilities include defining the organisation’s cybersecurity risk appetite, establishing a suitable management structure and ensuring that employees responsible for cybersecurity have the knowledge and skills needed for their roles. Clear responsibilities help prevent cybersecurity decisions from becoming isolated within technical teams. They also ensure that security risks receive appropriate attention at the management level.

Article 50: Identification and Assessment of Cybersecurity Risks

Before an organisation can manage cybersecurity risks, it needs to understand which systems it operates, what information they handle and how their compromise could affect business activities. Article 50 requires regulated entities to maintain an up-to-date inventory of their ICT assets, including applications, servers, databases, networks and other technology resources. These assets should be classified according to the confidentiality of the information they handle and their importance to business functions.

Organisations must regularly identify potential cybersecurity threats and assess the risks they pose to these assets. This involves reviewing existing security controls to determine whether they are working as intended and identifying any weaknesses that could leave systems exposed. An important part of this process is assessing residual risk. This refers to the risk that remains after existing security controls have been considered. Organisations must understand whether this remaining risk could disrupt business operations, expose sensitive information or affect clients.

Vulnerability assessments and penetration testing can support this process by helping security teams identify technical weaknesses and understand how those weaknesses could affect the organisation.

Article 51: Protection of ICT Assets and Resilience Testing Requirements

Article 51 focuses on protecting the organisation’s ICT infrastructure through appropriate technical and operational security controls. These controls should address risks across networks, applications, devices, user accounts and supporting infrastructure. Regulated entities must implement suitable safeguards, including:

• Access control: Apply least-privilege access so employees and users only have permissions required for their responsibilities. Access rights should be reviewed periodically, and unnecessary permissions should be revoked.
• Authentication security: Use strong authentication mechanisms and multi-factor authentication (MFA), particularly for internet-accessible systems and privileged accounts.
• Encryption: Protect sensitive information through encryption measures that help maintain data confidentiality and integrity.
• Network security: Use appropriate network protection and monitoring controls to identify suspicious activity and prevent unauthorised access.
• Software and patch management: Keep operating systems, applications and infrastructure updated. Critical security updates should receive appropriate priority to reduce exposure to known vulnerabilities.
• Change management: Ensure changes to systems and infrastructure are reviewed, tested and approved before implementation to avoid introducing new security weaknesses.
• Physical security: Restrict unauthorised access to data centres, server rooms and other facilities that support critical IT infrastructure.
• Employee awareness: Provide relevant employees with cybersecurity training at least once a year so they understand common threats and their responsibilities.

Article 51(16): Comprehensive Resilience Testing Programme

An important part of Article 51 is the requirement to maintain a comprehensive resilience testing programme covering the organisation’s IT systems, networks, processes and security controls. The programme must be tested regularly, with testing conducted at least once a year for internet-connected systems. Organisations should also have procedures to review test results, prioritise identified weaknesses and ensure that necessary corrective actions are taken.

Penetration testing can contribute to this programme by examining whether security weaknesses in applications, APIs, networks and infrastructure can be exploited. It helps organisations understand the potential impact of vulnerabilities rather than relying only on automated security scans. However, the regulation requires regular testing of the comprehensive resilience programme. It does not explicitly prescribe an annual penetration test as a separate standalone obligation.

Article 52: Cybersecurity Incident Detection, Response and Recovery

Preventing every cybersecurity incident is not always possible. Organisations must also be prepared to detect suspicious activity, respond to security incidents and restore affected systems without unnecessary disruption.

Article 52 requires regulated entities to continuously monitor their IT systems and networks to identify potential cybersecurity incidents. They should have clear escalation procedures so that actual or suspected incidents reach the appropriate teams without delay.

Organisations must also maintain an incident response plan and review it regularly to ensure it remains relevant to their technology environment and operational risks. When an incident occurs, the response process should cover several activities:

1. Incident investigation: Identify what happened, which systems were affected and the possible impact on business operations or client information.
2. Threat containment: Take appropriate action to limit the spread of the incident and prevent further unauthorised access.
3. System recovery: Restore affected systems and recover corrupted or lost data using appropriate recovery procedures.
4. Vulnerability remediation: Identify and fix the security weaknesses that were exploited during the incident to reduce the likelihood of similar attacks.
5. Stakeholder communication: Make sure that relevant internal teams and external stakeholders are informed when required.

Having a documented response process helps organisations manage incidents in a structured way and reduce the impact on critical services.

Article 53: Cybersecurity Incident Reporting Within 72 Hours

Article 53 establishes the reporting requirement for material cybersecurity incidents. Regulated entities must inform the CMA as soon as practically possible and no later than 72 hours after becoming aware of a material cybersecurity incident.

Not every security alert or minor incident automatically meets this reporting threshold. Organisations must consider the nature and potential impact of the incident when determining its materiality.

The assessment should consider whether the incident:

• Affects client information or assets: For example, unauthorised access to customer accounts or exposure of information related to client holdings.
• Exposes sensitive or confidential information: Such as the disclosure, alteration or loss of protected business or customer data.
• Disrupts critical operations: Including interruptions to trading platforms, virtual asset services or other essential information systems.
• Causes significant financial or external impact: Such as substantial financial losses or consequences for clients and other external stakeholders.

Organisations should establish an internal incident escalation process to identify potentially material incidents, assess their impact and ensure that reporting decisions are made without unnecessary delays. Keeping accurate incident records also helps organisations document what happened, how they responded and what corrective actions were taken.

CMA Resilience Testing Requirements: Where Penetration Testing Fits 

Article 51(16) requires licensed entities to establish a comprehensive resilience testing programme covering their IT systems, networks, processes and security controls. The programme must be tested regularly, with testing conducted at least annually for internet-connected systems. 

Penetration testing can support this requirement by identifying exploitable vulnerabilities and evaluating the effectiveness of technical security controls. However, the regulation does not explicitly mandate an annual penetration test as a standalone requirement. 

How Security Testing Works

Step 1. Vulnerability Assessment – Security teams use automated tools and manual checks to find known software vulnerabilities, weak configurations, and missing security patches.

Step 2. Penetration Testing – Security engineers test applications, APIs, networks, and infrastructure to find security weaknesses. They also attempt to exploit these weaknesses to understand what an attacker could access or control.

Step 3. Fixes and Retesting – Development teams fix the reported vulnerabilities. Security engineers then test the affected systems again to confirm that the fixes work and have not created new security issues.

Suppose a VASP launches a new API endpoint that allows clients to view their virtual asset holdings and initiate transactions. Before release, the security team should evaluate how the endpoint handles authentication and authorization.

A Broken Object Level Authorization (BOLA) flaw could allow one client to access another client’s portfolio simply by changing the account ID in an API request. The security team should record the issue, assess its severity and business impact, and ask developers to fix it. The affected API should then be tested again before release.

Vulnerability Remediation and Retesting

Finding a vulnerability is only the first step. Firms must also make sure that reported issues are fixed and tested again. 

1. Prioritization – Rank vulnerabilities by technical severity, system exposure, and business risk.
2. Fix Assignment – Assign security findings to software developers with clear deadlines for fixing the code.
3. Retesting – Run follow-up security checks to confirm that code updates resolved the issues without breaking other security controls.
4. Documentation – Keep detailed testing reports and remediation logs as recommended technical evidence to present to auditors during reviews.

What Should a CMA Cybersecurity Assessment Cover? 

A thorough security assessment for a regulated firm must cover every digital entry point that stores, processes, or routes investor data or money transactions as mandated by SCA regulations UAE.

Key Infrastructure Scope

• Web Applications and Client Portals – Test login security, session handling, password resets, and input validation to find flaws such as Cross-Site Scripting (XSS) and SQL Injection.
• APIs and Financial Integrations – Test REST and GraphQL endpoints that connect applications with payment providers and market data feeds. Check for BOLA and unauthorized access to client information.
• Mobile Trading Applications – Check for exposed API keys, weak local data protection, unencrypted network connections, and risks from reverse engineering.
• Cloud Infrastructure and Networks – Check for publicly accessible storage, excessive user permissions, and unpatched servers.
• Identity and Access Management – Review MFA settings, role-based access rules, and administrator permissions across business systems.
• Transaction Systems and Financial Engines – Test payment and trading workflows for flaws that could allow unauthorized balance changes, order tampering, or trade manipulation.
• Third-Party Technology – Review external software, vendor modules, and data connections to find security weaknesses in third-party systems.
• Virtual Asset Platforms and Digital Wallets – Check key management, wallet API connections, and trade execution systems used by licensed virtual asset entities.

CMA Cybersecurity Risk Assessment Checklist for Regulated Entities 

The following checklist translates the cybersecurity risk identification and assessment requirements under Article 50 into practical activities. It also includes additional security checks that can help firms manage their technical risks.

How to Prepare for a CMA Cybersecurity Assessment

Preparing for a CMA cybersecurity assessment starts with understanding which requirements apply to the organisation and whether its existing security controls address the risks identified under the CMA framework.

Organisations can prepare by following these steps:

1. Confirm regulatory applicability: Check whether the organisation’s CMA licence and regulated activities fall within the scope of the cybersecurity requirements.
2. Create an ICT asset inventory: List the applications, APIs, servers, networks, cloud environments and third-party systems used in business operations. Identify which systems handle sensitive information or support critical services.
3. Review existing security controls: Compare current cybersecurity policies, risk assessments, access controls, vendor management practices and incident response procedures with the relevant CMA requirements under Articles 47–53.
4. Assess technical security: Conduct appropriate vulnerability assessments and penetration tests to identify weaknesses in applications, APIs, networks and infrastructure. Record the findings, their potential business impact and the corrective actions required.
5. Maintain assessment records: Keep relevant documentation, including risk assessments, vendor due diligence records, security testing reports, remediation updates, governance reviews and resilience testing results.

These activities help organisations identify gaps and demonstrate how they manage cybersecurity risks. Penetration testing is one part of the assessment process; it does not, by itself, establish compliance with the CMA framework. 

Prepare for Your Next Cybersecurity Audit with Qualysec

Choose a partner that helps you identify and fix real security risks before attackers do. We are here to help.

Talk to an Expert→

How Qualysec Supports CMA-Regulated Entities

Organisations covered by the CMA cybersecurity framework need to understand whether their applications, APIs, networks and infrastructure have weaknesses that could affect their operations or expose sensitive information. While the SCA regulations UAE previously governed securities and commodities activities, organisations now need to consider the updated CMA regulatory framework. Technical security testing can help identify these weaknesses and provide a basis for remediation.

Qualysec provides vulnerability assessment and penetration testing services for applications and IT infrastructure. Its testing can help organisations assess the security of systems relevant to their business operations.

• Security Risk and Gap Assessment: Review relevant technical security controls and identify weaknesses that may increase the organisation’s exposure to cyber risks.
• Penetration Testing: Assess web applications, mobile applications, APIs, cloud environments and networks using a combination of automated tools and manual testing techniques.
• Technical Findings and Remediation Guidance: Provide reports detailing identified vulnerabilities, their severity, potential impact, supporting evidence and recommended corrective actions.
• Retesting After Remediation: Test reported vulnerabilities again after fixes have been implemented to verify whether the identified issues have been resolved.

These services can support the technical security assessment and resilience testing activities discussed under Article 51(16) of the CMA framework. However, penetration testing is only one part of cybersecurity risk management. Organisations remain responsible for meeting their applicable regulatory obligations, including governance, third-party risk management, incident response and other requirements under the framework.

Frequently Asked Questions

1. Is resilience testing mandatory for CMA-regulated entities in the UAE?

Yes. Article 51, clause 16 requires licensed VASPs and ATS operators covered by the resolution to maintain a comprehensive resilience testing program for their IT systems, networks, processes, and controls. The program must be tested regularly, at least annually for internet-connected systems.

2. How often should CMA-regulated entities conduct technical security testing?

Article 51 requires regular testing of the comprehensive resilience program, with testing at least once a year for internet-connected systems. The regulation does not separately prescribe an annual penetration test. However, firms should also consider additional vulnerability assessments and penetration tests following major application changes, infrastructure upgrades, or cloud migrations.

3. What is the difference between a cybersecurity risk assessment and penetration testing?

A cybersecurity risk assessment evaluates an organization’s overall exposure to security threats. It considers ICT assets, potential threats, existing controls, and the remaining risks to business operations.Penetration testing is a technical security assessment in which security engineers simulate attacks to find and exploit vulnerabilities in applications, APIs, networks, and infrastructure. It helps organizations understand whether identified weaknesses could be used to compromise their systems.

4. What is the CMA’s 72-hour cybersecurity incident reporting requirement?

Under Article 53, licensed entities must notify the CMA as soon as practically possible and within 72 hours of becoming aware of a material cybersecurity incident. Materiality depends on factors such as risks to client assets, exposure of confidential information, disruption to critical operations, and significant financial losses or impacts on external stakeholders.