UAE · DIFC / DFSA route

DFSA Licence in the DIFC: What It Actually Takes

The DFSA licenses Financial Services conducted in or from the Dubai International Financial Centre - and nowhere else in the UAE. Behind the licence sit prudential Categories 1 to 5, base capital under PIB, a fee stack under FER plus DIFC centre fees, three UAE-resident roles and a five-stage process with no published durations. SKY7 runs both routes: a fresh DFSA authorisation, or buy-side representation when you acquire a firm that already holds one.

Book a consultation See how a SKY7 mandate runs

1,050+: DFSA-regulated firms in the DIFC at the end of 2025, with 182 licensed or registered that year - DFSA Annual Report 2025.
US$200,000: Current base capital for a Category 3A firm under PIB Rule 3.6.2. Many consultancy pages still quote the outdated US$500,000.
90 days: The DFSA's statutory window to decide a change-of-control application once it is complete - GEN 11.8.7. Buying a licensed firm is a supervised process.
TBC: Every stage duration published on the DFSA's own authorisation page as of July 2026. No committed end-to-end timeline exists.

The route in short

A DFSA Licence authorises named Financial Services carried on in or from the DIFC, Dubai's financial free zone, under the Regulatory Law 2004 - the cornerstone of the DFSA's powers. The activity list lives in GEN Rule 2.2.2 of the DFSA Rulebook; prudential treatment follows in Categories 1 to 5, each with its own base capital, fees and conduct overlay. This is the UAE's institutional perimeter: a common-law framework, independent DIFC Courts and what the DIFC's 2025 results call the region's largest regulated financial services ecosystem. Where it sits against the UAE's other routes is mapped in the UAE jurisdiction overview.

Read this first

A DIFC licence is not a UAE-mainland licence

Start with the boundary most pages skip. Federal Law No. 8 of 2004, the statute behind the UAE's Financial Free Zones, exempts the DIFC from federal civil and commercial financial regulation (federal criminal and AML law still apply) - and draws hard lines in return: DIFC authorised firms may not take deposits from the UAE market, may not deal in the UAE Dirham, and may write insurance into the UAE market only as reinsurance. The DFSA's remit is financial services in or from the DIFC, full stop.

The rest of the map: virtual assets everywhere else in Dubai answer to VARA - Law No. 4 of 2022 expressly excludes the DIFC - a regime covered in the Dubai VARA licence guide; Abu Dhabi's financial free zone runs its own regulator, the FSRA; mainland banking and payments sit with the Central Bank and securities with the SCA at federal level. No perimeter passports into another. A DIFC platform is a gateway to institutional and cross-border business run from Dubai - not a licence for the UAE high street.

The architecture

One licence, prudential Categories 1 to 5

The licence names what you may do; the Categories price what you must hold. PIB Rules 1.3.1 to 1.3.7 sort Authorised Firms by their highest-reach activity: deposit-takers in Category 1, lenders and principal dealers in Category 2, agency brokers and trading venues in 3A, custodians and fund trustees in 3B, asset and fund managers in 3C, payments firms in 3D, arrangers and advisers in Category 4, and Islamic financial institutions managing unrestricted PSIAs in Category 5.

Base capital comes from PIB Rule 3.6.2 and is a floor, not the requirement - risk-based and expenditure-based components can set the actual Capital Requirement higher. One correction worth money: a striking number of consultancy pages still quote US$500,000 base capital for Category 3A; the current rule says US$200,000. Read the rulebook, not the brochures.

Categories and capital

DFSA prudential categories with PIB 3.6.2 base capital

Category	Trigger activities (abridged)	Base capital, PIB 3.6.2
Category Category 1	Trigger activities (abridged) Accepting Deposits; Managing a PSIAu	Base capital, PIB 3.6.2 US$10 million
Category Category 2	Trigger activities (abridged) Providing Credit; Dealing in Investments as Principal	Base capital, PIB 3.6.2 US$2 million; US$500,000 as Matched Principal only
Category Category 3A	Trigger activities (abridged) Dealing in Investments as Agent; Operating an Alternative Trading System	Base capital, PIB 3.6.2 US$200,000
Category Category 3B	Trigger activities (abridged) Providing Custody for a fund or of Crypto Assets; acting as fund trustee; employee money purchase schemes	Base capital, PIB 3.6.2 US$500,000 to US$2 million by activity; Crypto Asset custody US$1 million
Category Category 3C	Trigger activities (abridged) Managing Assets; Managing a Collective Investment Fund; other custody; Issuing Stored Value	Base capital, PIB 3.6.2 US$500,000 default; US$140,000 for Managing Assets and public or credit fund managers; US$40,000 other fund managers
Category Category 3D	Trigger activities (abridged) Providing Money Services with payment accounts, payment transactions or payment instruments	Base capital, PIB 3.6.2 US$200,000
Category Category 4	Trigger activities (abridged) Arranging Deals in Investments; Advising on Financial Products; Arranging Custody; fund administration; crowdfunding platforms	Base capital, PIB 3.6.2 US$140,000 for crowdfunding and money transmission; US$30,000 otherwise
Category Category 5	Trigger activities (abridged) Islamic Financial Institution managing a PSIAu	Base capital, PIB 3.6.2 US$10 million

Costs

The fee stack: DFSA fees plus DIFC fees, every year

Two schedules govern, and both are named here so you can check them. On the regulator's side, the Fees Module (FER) of the DFSA Rulebook - current version VER35 - sets application fees in FER 2.1.1: US$70,000 for Accepting Deposits or Providing Credit, US$40,000 for dealing as principal, US$25,000 for agency dealing, asset management or custody, US$15,000 for arranging and advising, with a 100 per cent uplift for complex structures. The DFSA's own fees page summarises the band for most firms as US$15,000 to US$70,000.

The point competitors rarely state: for most categories the annual fee equals or exceeds the application fee. FER 3.2.1 sets US$25,000 a year for an agency broker, asset manager or custodian (US$35,000 where Crypto Tokens are involved), plus an expenditure-based component - US$1,000 on the first US$1 million of annual expenditure, then US$1 per additional US$1,000 - plus US$4,000 a year for each additional Financial Service. A Retail Client endorsement costs US$20,000 to apply for and US$4,000 a year to keep. On the centre side, the DIFC Registrar of Companies charges per its Company Services Table of Fees (Rev. 16, 31 December 2025); note that the fintech concession normalises to the standard US$12,000 licence fee from year eight, or as soon as headcount passes ten. SKY7 fees are quoted on request, after scoping.

Budget honestly

What the DFSA and the DIFC actually charge

Item	Amount	Named schedule
Item DFSA application - agency dealing, asset management or custody	Amount US$25,000	Named schedule FER 2.1.1
Item DFSA application - Accepting Deposits or Providing Credit	Amount US$70,000	Named schedule FER 2.1.1
Item DFSA application - arranging or advising (Category 4)	Amount US$15,000	Named schedule FER 2.1.1
Item DFSA annual fee - agent, asset manager or custodian	Amount US$25,000, or US$35,000 with Crypto Tokens, plus the expenditure-based component	Named schedule FER 3.2.1
Item Each additional Financial Service	Amount US$4,000 per year	Named schedule FER 3.2.1
Item Retail Client endorsement	Amount US$20,000 application, then US$4,000 per year	Named schedule FER 2.2.5 and FER 3.2.1
Item DIFC incorporation - private or public company	Amount US$8,000	Named schedule ROC Company Services Table of Fees
Item DIFC commercial licence - at incorporation and each renewal	Amount US$12,000 per year	Named schedule ROC Company Services Table of Fees
Item Fintech or Innovation Firm concession	Amount US$100 incorporation; US$1,500 annual licence in the early years, normalising from year eight	Named schedule ROC Company Services Table of Fees
Item Data protection registration - financial entity	Amount US$1,250	Named schedule ROC Company Services Table of Fees

People and substance

Four mandatory officers - three of them UAE-resident

GEN Rule 7.5.1 requires every Authorised Firm to maintain four Authorised Individuals at all times: a Senior Executive Officer, a Finance Officer, a Compliance Officer and a Money Laundering Reporting Officer (narrow exceptions exist for credit rating agencies and VC-fund-only managers). GEN 7.5.2 adds the residency rule: the SEO, the Compliance Officer and the MLRO must be resident in the UAE - only the Finance Officer may sit elsewhere. Combinations are policed too: CO and MLRO may be combined where each role can be performed effectively, but the SEO cannot combine with the Finance Officer or the Compliance Officer - GEN 7.5.1A.

The application file is personal as much as corporate: board CVs, UBO passports, the group structure and the UBOs' source of wealth and funds all go in; low-risk business models may self-certify the regulatory business plan and the policy suite, per the DFSA's own service portal. The practical meaning is a real resident team on payroll before revenue - price that in from day one.

The process

Five stages to a DFSA authorisation

Enquire
An authorisation enquiry through DFSA Connect and a meeting with the DFSA come first; ePortal credentials are issued only once the DFSA confirms eligibility.
Apply
The application forms are filed on the DFSA ePortal and the invoiced fees are paid per the FER schedule.
Evaluate
The DFSA reviews the file and comes back with further information requests - completeness and the model's complexity drive the pace.
Fulfil
The conditions in the DFSA's in-principle letter are met. Market practice commonly includes incorporation with the DIFC Registrar of Companies, capital, premises and resident appointments, but the actual letter controls and must be checked case by case. It is a conditional gate, not permission to trade.
Approve
The DFSA makes its final assessment and grants the authorisation once every condition is satisfied. Only then may the firm carry on Financial Services in or from the DIFC.

Timing honesty

Durations are officially TBC

The DFSA's own service page lists the duration of every stage as "TBC" - there is no committed processing timeline, and the regulator reported a 25 per cent rise in authorisation applications in 2025. Consultancy sites advertise end-to-end estimates, often in a four-to-nine-month band; treat those as market colour, not commitments - the DFSA has published none, and no adviser can guarantee a date.

The stage that trips announcements is the fourth: an in-principle letter reads like a win and is only a list of conditions. Nothing may be carried on until the DFSA grants the authorisation itself at stage five. Plan capital, premises and hires against that grant, not against the letter.

Crypto in the DIFC

Crypto Tokens after 12 January 2026

The DFSA regulates Crypto Tokens as Financial Instruments - like Securities or Derivatives - under GEN Rule 3A, not as a standalone licence type: using a token is not itself a Financial Service, and the licensed activity still comes from GEN 2.2.2. On 12 January 2026 the regime changed materially. The DFSA no longer maintains a prescribed list of Recognised Crypto Tokens; a firm may engage only with tokens it has itself assessed as suitable under GEN Rule 3A.2.1 - characteristics and governance, regulatory status in other jurisdictions, market size, liquidity and trading history, the technology, and the legal and compliance impact - with the assessment documented and kept current. Fiat Crypto Tokens remain assessed by the DFSA, and the old restrictions on funds investing in Crypto Tokens have been removed, subject to suitability. Any page still describing Recognised Crypto Token applications describes a superseded mechanism; the working detail is in the DFSA Crypto Token rules after January 2026.

The prudential and fee hooks are concrete: custody of Crypto Assets is a Category 3B activity with US$1 million base capital; Crypto Token services require a Body Corporate under GEN 7.2.2; an Alternative Trading System dealing in Security or Crypto Tokens pays a US$150,000 application fee against US$65,000 standard; and adding Crypto Token permissions to an existing licence costs US$5,000 to US$40,000 by activity under FER 2.2.6. The perimeter stays territorial: this regime governs the DIFC only - a retail token exchange for the wider Dubai market belongs with VARA. How custody obligations compare across the three perimeters is in UAE crypto custody across DIFC, ADGM and VARA.

Buying instead of building

Change of control under GEN 11.8

There is no licence transfer in the DIFC. A DFSA Licence attaches to the Authorised Firm; what a buyer acquires is the firm itself, and the regulator approves the buyer. Anyone who alone or with associates would hold 10 per cent or more of the shares or voting rights of the firm or its holding company - or could exercise significant influence over it - is a Controller under GEN 11.8.2. For DIFC-incorporated Domestic Firms, becoming a Controller, or crossing 30 per cent or 50 per cent, requires the DFSA's prior written approval under GEN 11.8.4, applied for on the AFN AUT-CON form. The rulebook then runs a real clock: the DFSA must approve, object or impose conditions by written notice within 90 days of a duly completed application; the applicant has 14 days to make representations; adverse decisions can be referred to the Financial Markets Tribunal. Conditions bind, and a rejected acquirer must not proceed - GEN 11.8.8. Branches notify instead of applying.

Read against that regime, "turnkey DFSA broker, trading in weeks" seller claims answer themselves. The realistic sequencing, the disclosure file and where deals actually stall are in buying a DFSA-licensed firm in the DIFC. Approval is a genuine assessment of the new owner - no adviser can guarantee it, including us.

Scale and fit

Who the DIFC fits - and what SKY7 actually offers here

Scale first, from official releases: the DIFC closed 2025 with 8,844 active companies and more than 1,050 DFSA-regulated firms, among them 290+ banks and capital-markets institutions, 70 brokerages and 500+ wealth and asset management firms; the DFSA licensed or registered 182 firms in 2025, its third consecutive year of double-digit growth. The centre fits institutional and professional-client models: agency brokerage and trading venues in 3A, asset and fund management in 3C, custody in 3B, payments in 3D, advisory and arranging boutiques in Category 4. Retail reach is a priced endorsement, not a default - and retail-facing crypto for the wider Dubai market belongs with VARA. Which perimeter fits which business model is worked through in VARA, ADGM or DIFC: which UAE licence fits.

Inventory honesty, because this market is short of it: SKY7 holds no DIFC-licensed company for sale as of July 2026. In this perimeter we sell two things - fresh-authorisation advisory, and buy-side representation through GEN 11.8 change of control. Where the model is brokerage and speed decides, the live alternative is our ready-made ADGM Category 3A entity - a different perimeter under its own regulator, mapped in the ADGM FSRA licence guide, not a substitute for DIFC authorisation. We will say plainly which of the three routes your model needs.

FAQ

DIFC / DFSA licensing FAQ

01 Can a DIFC-licensed firm serve the UAE mainland market?

Not as a right. Federal Law No. 8 of 2004 keeps hard carve-outs: no deposit-taking from the UAE market, no dealing in the UAE Dirham, and insurance into the UAE market only as reinsurance. The DFSA authorises business in or from the DIFC; a DIFC licence does not passport into the mainland - mainland banking and payments sit with the Central Bank, and securities with the SCA.

02 How long does DFSA authorisation take?

The DFSA publishes no committed durations - its own service page lists every stage as TBC. Consultancy ranges circulate, but they are market estimates, not commitments; file completeness, the model's complexity and the resident hires usually decide the pace. No adviser can guarantee a date, including us.

03 Is the DFSA in-principle letter a licence?

No. It is a conditional gate at stage four of five, and its actual conditions control. Market-practice conditions often address incorporation, capital, premises and resident appointments, but they must be verified in the specific letter. Until the final grant, the firm may not carry on Financial Services in or from the DIFC.

04 How much capital does a DFSA Category 3A brokerage need?

Base capital is US$200,000 under PIB Rule 3.6.2 as of July 2026 - many pages still quote a stale US$500,000. The base is a floor: risk-based and expenditure-based components can set the actual Capital Requirement higher, and the DFSA and DIFC fee stack sits on top of it.

05 Can I buy a DFSA-licensed company and start trading in weeks?

Treat that promise as a red flag. Crossing 10 per cent of a DIFC-incorporated Authorised Firm makes you a Controller, and controllers of Domestic Firms need the DFSA's prior written approval - with a 90-day statutory decision window from a complete application, 14 days for representations and appeal to the Financial Markets Tribunal. Conditions bind and a rejected acquirer must not proceed. The deal can absolutely work; it works on the regulator's clock.

06 Who regulates crypto in Dubai - the DFSA or VARA?

Both, split by territory. Inside the DIFC, the DFSA regulates Crypto Tokens as Financial Instruments under GEN 3A - since 12 January 2026 with firm-led suitability assessments instead of a Recognised list. Everywhere else in Dubai, virtual assets answer to VARA under Law No. 4 of 2022, which expressly excludes the DIFC. A retail token exchange belongs with VARA; institutional crypto custody or tokenised securities can sit with the DFSA.

07 What does a DFSA licence cost through SKY7?

SKY7 fees are quoted on request, after scoping - mandates differ too much for a rate card. The official side is checkable in the schedules named on this page: application and annual fees in the DFSA's FER module (current version VER35), centre fees in the DIFC ROC Company Services Table of Fees. Budget the annual run-rate, not just the entry ticket - for most categories the yearly fees exceed the application fee.

Go deeper

Guides for this route

Buying a DFSA-licensed firm in the DIFC

GEN 11.8 change of control end to end - the 10 per cent trigger, the AFN AUT-CON file, the 90-day window and realistic deal sequencing.

DFSA Crypto Token rules after January 2026

The Recognised list is gone - what the firm-led suitability duty under GEN 3A.2.1 now demands of every licensed firm.

VARA, ADGM or DIFC: which UAE licence

The corridor-accurate three-regulator map - who licenses what in the UAE, and which perimeter fits which business model.

UAE crypto custody: DIFC, ADGM and VARA

How custody obligations, capital and client-asset rules compare across the UAE's three regulatory perimeters.

UAE routes overview

Every UAE route in one place - VARA, ADGM and DIFC, what each regulator covers and how the perimeters connect.

Reviewed by the SKY7 advisory team. Last reviewed: 11 July 2026. This page is general information only, not legal, regulatory, tax, investment or financial advice. Figures cited here come from the DFSA Rulebook (PIB 3.6.2, GEN 7.5, GEN 11.8 and the FER module, version VER35/04-26) and the DIFC ROC Company Services Table of Fees (Rev. 16, 31 December 2025); the Crypto Token framework changed on 12 January 2026, and DFSA consultation papers open as of July 2026 - including CP 173 on the collective investment fund framework and CP 174 - may amend the rules cited. These are moving targets: statements on this page are made as of July 2026 and must be verified against the primary sources - dfsa.ae, the DFSA Rulebook and difc.com - before you rely on them.

Tell us what you need

Get a straight answer on the DIFC route

Tell us your model, your clients and your ownership chain. We will tell you which Category fits, what the DFSA and DIFC stack really costs to run, whether to authorise fresh or buy through change of control - and whether ADGM or VARA fits your model better - before you spend anything.