Written for firms weighing or already holding a DIFC licence. It sets out what counts as a financial service needing DFSA authorisation, how the DIFC Authority's role differs from the DFSA's, and the ongoing duties firms most often breach: client money segregation, prudential returns and conduct records made at the time. It also covers the federal laws that still apply, including corporate tax, VAT and anti-money laundering.
Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant
The DIFC is a different proposition from the UAE's other free zones. It is a financial free zone with its own civil and commercial laws, its own regulator in the Dubai Financial Services Authority, its own courts, and its own data protection regime. A company that sets up there is not simply renting a Dubai address with better banking access; it is entering a regulatory system where the licence defines what the business may do.
This guide sets out how the pieces fit: what needs DFSA authorisation, what the regulator expects on an ongoing basis, which federal laws still reach into the DIFC, and where disputes end up.
Two regulators, and the line between them
The DIFC Authority runs the zone itself. The DFSA is the financial services regulator.
Federal law has not been displaced. The anti-money laundering and counter-terrorist financing regime, corporate tax and VAT all apply to DIFC entities.
What requires DFSA authorisation
Financial services carried on in or from the DIFC require authorisation. That covers operating payment and money services, insurance and insurance intermediation. The scope is drawn by activity, not by job title.
Authorisation is not a form-filling exercise. The DFSA will examine the regulatory business plan, the financial projections, the ownership and group structure, the source of capital, systems and controls, outsourcing arrangements, and the individuals proposed for controlled functions. Each licence category carries its own capital requirement and its own conditions, and the conditions imposed on the licence, not the category label, determine what the firm may actually do.
Living with the licence
Ongoing obligations are where most firms come unstuck.
- Client money and client assets. Where a firm holds or controls client money, it must keep it segregated, reconcile it, and be able to demonstrate whose money is whose at any moment. Breaches here are treated seriously because they turn a solvency problem into a customer loss.
- Reporting and returns. Prudential returns, audited financial statements and notifications of material events are due within the periods the rules specify, and late filing is itself a breach.
- Conduct. Client classification, suitability, disclosure, conflicts of interest and complaints handling are all rule-based, and the file has to show the process was followed at the time rather than reconstructed afterwards.
Anti-money laundering
A firm needs a business risk assessment, customer due diligence calibrated to risk, identification of beneficial owners, sanctions screening, enhanced measures for high-risk relationships and politically exposed persons, an appointed money laundering reporting officer, training, and record retention for the period the law prescribes. Suspicion is reported to the UAE Financial Intelligence Unit through the goAML platform.
Tax and data
Corporate tax under Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023, at 0% on taxable income up to the amount specified in a Cabinet decision and 9% above. DIFC entities are within that law and must register and file. Whether free zone relief applies to a given firm turns on rules that have to be tested against its actual income streams; it is not a consequence of being in the DIFC. VAT applies at 5% under Federal Decree-Law No. 8 of 2017 as amended by Federal Decree-Law No. 18 of 2022.
Firms need a lawful basis for processing, a record of processing activities, controls on transfers out of the DIFC, written terms with processors, and a breach response process.
Disputes and enforcement
The DIFC Courts hear civil and commercial claims connected with the DIFC and work in English. Arbitration seated in the DIFC remains available. Contracts still naming the DIFC-LCIA need revisiting.
Regulatory action is a separate track. Firms are expected to cooperate and to self-report. Early advice on how a matter is handled with the regulator affects the outcome as much as the underlying facts, and it sits alongside any financial dispute resolution running in parallel with clients or counterparties.
Conclusion
The DIFC rewards firms that treat the rulebook as an operating manual rather than a licensing hurdle. Most enforcement in this jurisdiction concerns process: money that was not properly segregated, an approval that was not obtained, a return that went in late, a file that could not show why a product was recommended. Those are all avoidable with systems that are built before the licence is granted and maintained afterwards.
For advice on DFSA authorisation, an ongoing compliance question or a change of control in the DIFC, speak to the Nour Attorneys team.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
Explore more of our insights on related topics:
- Banking Regulations Compliance in the UAE
- Fintech Legal Frameworks for Dubai Businesses
- Anti-Money Laundering Compliance for UAE Investors
- Investment Advisory Strategies for Multinational Entities
