Banking Regulations in DIFC: Complete Guide
Doing something outside the licence conditions is an offence here, not a paperwork problem.
Written for firms weighing or already holding a DIFC licence. It sets out what counts as a financial service needing DFSA authorisation, how the DIFC Authority's role differs from the DFSA's, and the ongoing duties firms most often breach: client money segregation, approved persons, prior approval for change of control, prudential returns and conduct records made at the time. It also covers the federal laws that still apply, including corporate tax, VAT and anti-money laundering, and why DIFC data protection is a separate regime from the federal one.
The DIFC is a different proposition from the UAE's other free zones. It is a financial free zone with its own civil and commercial laws, its own regulator in the Dubai Financial Services Authority, its own common-law courts, and its own data protection regime. A company that sets up there is not simply renting a Dubai address with better banking access; it is entering a regulatory system where the licence defines what the business may do, and doing anything outside it is an offence rather than a paperwork problem.
This guide sets out how the pieces fit: what needs DFSA authorisation, what the regulator expects on an ongoing basis, which federal laws still reach into the DIFC, and where disputes end up.
Two regulators, and the line between them
The DIFC Authority runs the zone itself — company registration under DIFC companies law rather than the federal Commercial Companies Law (Federal Decree-Law No. 32 of 2021), leases, and the commercial licence. The DFSA is the financial services regulator. It authorises firms, approves the individuals who hold senior functions, sets prudential and conduct rules, supervises, and enforces.
Federal law has not been displaced. Criminal law, the anti-money laundering and counter-terrorist financing regime, immigration, corporate tax and VAT all apply to DIFC entities. What the DIFC replaces is the civil and commercial framework: contract, companies, insolvency, employment, security interests and data protection are governed by DIFC legislation and interpreted by the DIFC Courts.
What requires DFSA authorisation
Financial services carried on in or from the DIFC require authorisation. That covers accepting deposits, providing credit, dealing in and arranging investments, managing assets and collective investment funds, advising on financial products, providing custody and trust services, operating payment and money services, insurance and insurance intermediation, and virtual asset activity brought within the regime. The scope is drawn by activity, not by job title, so a group treasury company, a family office or a technology business that touches client money should test its model against the list before it applies for a licence.
Authorisation is not a form-filling exercise. The DFSA will examine the regulatory business plan, the financial projections, the ownership and group structure, the source of capital, systems and controls, outsourcing arrangements, and the individuals proposed for controlled functions. Each licence category carries its own capital requirement and its own conditions, and the conditions imposed on the licence, not the category label, determine what the firm may actually do.
Living with the licence
Ongoing obligations are where most firms come unstuck.
- Client money and client assets. Where a firm holds or controls client money, it must keep it segregated, reconcile it, and be able to demonstrate whose money is whose at any moment. Breaches here are treated seriously because they turn a solvency problem into a customer loss.
- Senior individuals. Controlled functions must be held by approved persons, and departures, replacements and changes to responsibilities must be notified.
- Change of control. Acquisitions of, or increases in, control over an authorised firm require prior approval. Signing a share purchase agreement without conditioning completion on that approval is a recurring error in DIFC transactions.
- Reporting and returns. Prudential returns, audited financial statements and notifications of material events are due within the periods the rules specify, and late filing is itself a breach.
- Conduct. Client classification, suitability, disclosure, conflicts of interest and complaints handling are all rule-based, and the file has to show the process was followed at the time rather than reconstructed afterwards.
Anti-money laundering
DIFC firms are supervised by the DFSA for anti-money laundering purposes, but the underlying duties come from the federal regime and apply across the UAE. A firm needs a business risk assessment, customer due diligence calibrated to risk, identification of beneficial owners, sanctions screening, enhanced measures for high-risk relationships and politically exposed persons, an appointed money laundering reporting officer, training, and record retention for the period the law prescribes. Suspicion is reported to the UAE Financial Intelligence Unit through the goAML platform. Designated non-financial businesses and professions in the DIFC, including corporate service providers and auditors, carry their own version of the same duties.
Tax and data
Corporate tax under Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023, at 0% on taxable income up to AED 375,000 and 9% above. DIFC entities are within that law and must register and file. Whether free zone relief applies to a given firm turns on rules that have to be tested against its actual income streams; it is not a consequence of being in the DIFC. VAT applies at 5% under Federal Decree-Law No. 8 of 2017 as amended by Federal Decree-Law No. 18 of 2022, with financial services treatment depending on how each fee or margin is charged rather than on the firm's licence.
Data protection in the DIFC is governed by DIFC law, not the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) that applies elsewhere in the UAE. Firms need a lawful basis for processing, a record of processing activities, controls on transfers out of the DIFC, written terms with processors, and a breach response process. Groups that assume one federal policy covers every UAE entity usually find that neither the DIFC nor the mainland requirements are properly met.
Economic substance filings are frequently still in internal calendars without cause. The Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 by Cabinet Decision No. 98 of 2024; obligations remain only for the financial years FY2019 to FY2022.
Disputes and enforcement
The DIFC Courts hear civil and commercial claims connected with the DIFC, apply common law, and work in English. Parties elsewhere in the UAE can also opt in by written agreement, which is why DIFC jurisdiction clauses appear in contracts with no other DIFC connection. Arbitration seated in the DIFC remains available under Federal Law No. 6 of 2018 as amended in 2023. Contracts still naming the DIFC-LCIA need revisiting, because it was abolished by Dubai Decree No. 34 of 2021 and its caseload moved to DIAC.
Regulatory action is a separate track. DFSA enforcement can lead to fines, restrictions on the licence, prohibitions on individuals and public censure, and firms are expected to cooperate and to self-report. Early advice on how a matter is handled with the regulator affects the outcome as much as the underlying facts, and it sits alongside any financial dispute resolution running in parallel with clients or counterparties.
Conclusion
The DIFC rewards firms that treat the rulebook as an operating manual rather than a licensing hurdle. Most enforcement in this jurisdiction concerns process: money that was not properly segregated, an approval that was not obtained, a return that went in late, a file that could not show why a product was recommended. Those are all avoidable with systems that are built before the licence is granted and maintained afterwards.
For advice on DFSA authorisation, an ongoing compliance question or a change of control in the DIFC, speak to the Nour Attorneys team.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
Explore more of our insights on related topics:
- Banking Regulations Compliance in the UAE
- Fintech Legal Frameworks for Dubai Businesses
- Anti-Money Laundering Compliance for UAE Investors
- Investment Advisory Strategies for Multinational Entities
