Why "licence transfer" is the wrong question
The DFSA licenses firms to carry on Financial Services in or from the DIFC only, under the Regulatory Law 2004 (DIFC Law No. 1 of 2004). The Licence names the Financial Services the firm may conduct and exists only as an attribute of that firm: the register entry, permissions, conditions, prudential Category and Authorised Individuals all belong to the company the DFSA approved. Nothing in the Rulebook moves a Licence between legal persons.
That is why every genuine "ready-made DFSA firm" deal is a share purchase: the company keeps its Licence, and what changes is who controls it - the event GEN 11.8 regulates. One perimeter note: a DIFC firm answers to the DFSA, not to VARA - Dubai Law No. 4 of 2022 carves the DIFC out of VARA's territory - and a DIFC Licence is not a mainland UAE licence. How the Emirates' perimeters divide is mapped in our UAE jurisdiction hub.
The 10% test: who counts as a Controller
GEN 11.8.2 defines a Controller as a person who, alone or with Associates, holds 10% or more of the shares or voting rights in the firm or in a Holding Company of it, or who can exercise significant influence over the firm. Three consequences follow.
The test aggregates: your stake and your Associates' stakes count together, so a deal spread across related parties does not stay under the line. Indirect control counts: 10% of a Holding Company anywhere up the chain makes you a Controller of the DIFC firm beneath it. And the significant-influence limb can catch arrangements below 10%. GEN 11.8.3 disregards a narrow set of holdings, such as shares held in clearing, custodial or underwriting capacities - technical exceptions, not planning tools.
Prior written approval, and the thresholds that re-trigger it
For a Domestic Firm - a firm incorporated in the DIFC, which is what most for-sale targets are - GEN 11.8.4 is blunt: a person must not become a Controller, and must not increase control through the 30% or 50% thresholds, without first obtaining the DFSA's written approval. Prior means before completion; closing first and filing later is a breach, not a missed formality.
The filing vehicle is the AFN AUT-CON form, "Applications and Notifications Concerning a Change in Control", submitted through the DFSA's ePortal service for amendments to ownership or control. A budgeting note: FER chapter 2, the fee module's authorisation chapter, lists no separate controller-application fee as of July 2026 - verify the current FER before filing rather than assuming.
GEN 11.8 change-of-control mechanics (as of July 2026)
| Event | Applies to | Obligation | Rule |
|---|---|---|---|
| Event Becoming a Controller (10% of shares or voting rights) | Applies to Domestic Firm (DIFC-incorporated) | Obligation Prior written DFSA approval before completion | Rule GEN 11.8.4 |
| Event Increasing control through 30% or 50% | Applies to Domestic Firm | Obligation Fresh prior written DFSA approval at each threshold | Rule GEN 11.8.4 |
| Event Becoming or ceasing to be a Controller, or crossing 30% or 50% up or down | Applies to Branch of a firm incorporated outside the DIFC | Obligation Notification before the acquisition or disposal (AFN form) | Rule GEN 11.8.10 |
| Event DFSA decision on an application | Applies to Any applicant | Obligation Written notice of objection or conditional approval within 90 days of the duly completed application | Rule GEN 11.8.7 |
| Event Pushing back on a proposed objection or conditions | Applies to Any applicant | Obligation 14 days for representations; adverse decisions referable to the Financial Markets Tribunal | Rule GEN 11.8.7 |
The 90-day clock, the 14-day window and the FMT
GEN 11.8.7 gives the DFSA up to 90 days from receipt of the duly completed application form to object, or to approve with conditions, by written notice. "Duly completed" is the gate: the clock starts when the DFSA holds a complete file, so an application thin on the acquirer's structure, funding or background has not started any clock at all. And "up to 90 days" is a statutory outer bound, not a promised duration in either direction: the DFSA publishes no end-to-end processing commitment for changes in control, and no adviser can guarantee approval or a date.
If the DFSA is minded to object or impose conditions, the applicant has 14 days to make representations, and an adverse decision can be referred to the Financial Markets Tribunal, the appeal body under the Regulatory Law 2004. GEN 11.8.8 closes the loop: conditions attached to an approval bind the controller, and a rejected acquirer must not proceed with the acquisition. In deal terms, DFSA approval belongs in the conditions precedent, and completion waits for the written notice.
Branches: notification, not approval
GEN 11.8.10 treats Branches differently. A Branch - the DIFC operation of a firm incorporated outside the centre - does not need prior DFSA approval for a change in control: it notifies the DFSA when a person becomes or ceases to be a Controller, or crosses 30% or 50% in either direction, as soon as possible and in any event before the acquisition or disposal, using the AFN form.
For a buyer, classification is the first diligence question: it decides whether you face an approval or a notification regime. Most targets marketed as DIFC companies are DIFC-incorporated Domestic Firms - the approval regime, in full.
Why "turnkey in 4-6 weeks" collides with the regime
As of July 2026, listings ranking for ready-made DIFC searches advertise turnkey DFSA-licensed brokerages with trading promised in 4-6 weeks via "licence transfer". We name no names; the pattern is what matters, and it collides with the Rulebook in three places. There is no licence transfer. A buyer at 10% or more needs prior written approval, so completion cannot lawfully precede it. And the statutory window alone can run to 90 days from a duly completed application, with the completeness work sitting in front of that clock. A seller controls none of this, and nobody can promise what the DFSA will decide.
Our own position, stated plainly: SKY7 holds no DIFC inventory as of July 2026. Our live UAE inventory sits in ADGM - a Category 3A entity under the FSRA, a different regulator in a different centre with its own prior-approval regime. Where speed is the real constraint, that route is often the honest answer; how the FSRA approves a new owner is covered in our ADGM change-in-control guide.
A realistic buyer sequence
-
Read the register before the teaser
Pull the target's entry on the DFSA public register: status, permitted Financial Services, prudential Category, endorsements, conditions. The register, not the seller's deck, defines what you are buying.
-
Classify the target
DIFC-incorporated means prior approval under GEN 11.8.4; a Branch means notification under GEN 11.8.10. The obligation - and your timetable - follows the classification.
-
Map the controller chain
Work out who becomes a Controller at completion: everyone crossing 10%, 30% or 50%, counting Associates and every Holding Company up the chain. Each needs the right filing.
-
Prepare the AFN AUT-CON to completeness
The 90-day clock runs from a duly completed application. Assemble what the DFSA needs to assess the acquirer and answer the form fully the first time.
-
Sequence the SPA around approval
Make DFSA approval a condition precedent, price the statutory window into the long-stop date, and decide in advance how conditions attached to an approval would be handled. They bind.
-
Plan the people alongside the shares
The firm must keep Authorised Individuals in place at all times - SEO, Finance Officer, Compliance Officer and MLRO (GEN 7.5.1) - with the SEO, CO and MLRO UAE-resident (GEN 7.5.2); the SEO cannot combine with FO or CO (GEN 7.5.1A). Replacement officers are DFSA-assessed in their own right, so line them up early.
-
Do not stop at completion
GEN 11.8 also carries firm-side obligations and notifications for decreases in control. Diarise them: the regime follows the shareholding for as long as you hold it.
- 10%
- shareholding or voting power that makes a buyer a Controller (GEN 11.8.2)
- 30% / 50%
- thresholds that re-trigger prior approval for Domestic Firms (GEN 11.8.4)
- 90 days
- statutory window to object or approve with conditions (GEN 11.8.7)
- 14 days
- to make representations against a proposed objection or conditions
FAQ
Frequently asked questions
01 Can a DFSA licence be transferred to my own company?
No. A DFSA Licence exists only as an attribute of the authorised firm that holds it. Buying the business means buying shares in that firm and obtaining prior DFSA approval as its new Controller under GEN 11.8. Moving the activity into your own entity is a fresh authorisation, not a transfer.
02 When exactly is prior DFSA approval required?
For a DIFC-incorporated Domestic Firm: before a person becomes a Controller at 10% - directly, with Associates or through a Holding Company - and again before crossing 30% or 50% (GEN 11.8.4). For a Branch, the duty is notification before the acquisition or disposal (GEN 11.8.10).
03 How long does DFSA change-of-control approval take?
The DFSA publishes no end-to-end figure. The statutory frame in GEN 11.8.7: objection or conditional approval must issue within 90 days of a duly completed application. Elapsed time is driven by file completeness and what the review surfaces. Treat any fixed promise with suspicion, and verify the current rule before setting a long-stop date.
04 What happens if the DFSA objects or attaches conditions?
You have 14 days to make representations, and an adverse decision can be referred to the Financial Markets Tribunal. Conditions bind, and a rejected acquirer must not proceed with the acquisition (GEN 11.8.8) - which is why completion always sits behind the written approval.
Keep reading
Related reading
DIFC / DFSA licence: the full route
Categories, base capital, the FER and DIFC fee stack, and the five-stage authorisation process for the DIFC perimeter.
Buying an FSRA-licensed company in ADGM
The Abu Dhabi counterpart: FSMR section 105 approval and GEN 8.8 thresholds when acquiring an FSRA-licensed firm.
United Arab Emirates: jurisdiction overview
VARA, ADGM and DIFC on one honest map - which regulator owns which perimeter.