The question is not is it regulated — it is regulated by whom
Every broker that markets to Gulf residents calls itself regulated. That word is doing almost no work on its own — a broker can hold a genuine license from a small offshore regulator and technically call itself regulated, which is true and not especially useful to you. The question that actually protects your money is narrower: regulated by whom, and does that specific regulator's authority extend to you as a resident of the UAE, Saudi Arabia, Kuwait, Qatar, Bahrain or Oman?
This matters because regulatory coverage is not global by default. A broker's UK FCA license protects clients under FCA rules; it does not automatically extend the same protections to an account opened from Riyadh or Dubai unless the specific legal entity you are contracting with is the one the FCA actually licenses. Multi-entity brokers route different countries to different legal entities, and each entity carries its own license, its own compensation scheme, and its own rules for what happens if the broker fails. This guide walks through what that means for the three brokers we track and shows you exactly how to check it yourself, on us as well as on anyone else.
None of this is unique to trading. It is the same reason a UAE resident buying insurance checks whether the policy is issued locally or from an offshore underwriter, and it deserves the same five minutes of attention before you fund a trading account with money that is meant to grow, not disappear into a dispute you have no formal route to resolve. The rest of this guide gives you that five minutes back in a usable form: the actual entities, the actual registers, and the actual differences between what a UAE-based DFSA license covers and what a purely offshore one does not.
The UAE's regulator was renamed CMA in 2026 — and one broker we track holds its licence
In January 2026 the UAE's Securities and Commodities Authority was renamed the CMA — the same initials Saudi Arabia already uses for its own Capital Market Authority. They are two separate national regulators in two separate countries that now happen to share an acronym, and it is worth being precise about which CMA a broker means when it uses the term in its marketing. Saudi Arabia's CMA licenses none of the three brokers we review here — XS, Pepperstone or Capital.com. The UAE's CMA is different: Capital.com holds a Category One dealing licence from it (No. 20200000176) through Capital Com MENA Securities Trading LLC, which gives it an onshore UAE dealing entity. XS also lists a UAE CMA licence (No. 20200000339) through XSTrade Financial Consultation L.L.C (a financial-consultation company, not a retail trading licence) — check the CMA register for exactly what that licence covers and whether it applies to the entity that would open your account. Pepperstone holds no UAE CMA dealing licence.
One of the three — Pepperstone — does hold a license from the DFSA, the Dubai Financial Services Authority. The DFSA is a genuine, UAE-based financial regulator, and it is a real layer of protection worth knowing about. But it only covers business conducted through the Dubai International Financial Centre, a defined free zone, and the specific DFSA-licensed entity is not necessarily the one that opens your account if you register from outside the DIFC. Check which legal entity your account actually sits under before assuming DFSA oversight applies to you — the how to verify a broker's license guide shows exactly how to do that in about five minutes.
Saudi Arabia: the same offshore reality, with fewer regional options
For Saudi residents the picture is more offshore, not less. None of the three brokers we track holds a Saudi CMA license, and Saudi Arabia's own Capital Market Authority does not license retail CFD or forex trading the way the FCA or ASIC do. Most Saudi-resident traders who use one of these three brokers are, in practice, opening an account with an entity licensed somewhere else entirely — most often Mauritius, Cyprus, Australia, the UK or The Bahamas.
That is not automatically a problem. A genuine offshore license — the FSC in Mauritius, for example — is a real license with real obligations around fund segregation and know-your-customer checks. But it carries less supervisory weight and a thinner compensation scheme than a tier-one regulator, and it is worth knowing that going in rather than assuming Saudi or GCC-specific coverage that is not actually there. Swap-free (Islamic) account terms also vary by which entity you register under, so confirm both at the same time — the Islamic trading accounts guide walks through what to check.
Our three brokers' licensing entities, compared
Here is exactly who licenses each broker we review, side by side. None carries Saudi CMA coverage; Capital.com and XS each list a UAE CMA licence, and Pepperstone carries a Dubai-based DFSA licence. For a full comparison by country, with swap-free terms, deposits, platforms and fees, see the best CFD brokers in UAE and the best CFD brokers in Saudi Arabia.
Licensing entities of the 3 brokers we review — none is Saudi CMA-licensed
| Broker | Regulators | UAE-based entity? | Headquarters |
|---|---|---|---|
| XS | ASIC, CySEC, FSCA, Seychelles FSA, Labuan FSA, Mauritius FSC, UAE CMA (the entity depends on your country) | UAE CMA licence listed (XSTrade Financial Consultation L.L.C — a financial-consultation company, not a retail trading licence) | Group established in Australia |
| Pepperstone | ASIC, FCA, CySEC, DFSA, BaFin, SCB, CMA (Kenya) | Yes — DFSA, DIFC only | Melbourne, Australia |
| Capital.com | FCA, CySEC, ASIC, CMA (UAE), SCB | Yes — UAE CMA (onshore) | Limassol, Cyprus |