Financial regulator
The DFSA grants licences for named Financial Services conducted in or from the DIFC and supervises the resulting business.
UAE · Dubai International Financial Centre
DIFC financial permissions and DFSA regulator map
The DIFC combines a common-law commercial centre with a dedicated financial regulator. The Dubai Financial Services Authority licenses Financial Services conducted in or from the centre, while the DIFC Registrar handles the entity and commercial-registration layer. This dossier maps the complete permission perimeter so a bank, investment firm, fund, insurer, payments business, Crypto Token platform or fiduciary team can identify the right route before building the application.
Route facts
DIFC regulator map
Centre administration
The DIFC Registrar establishes and maintains the legal entity and its commercial registration alongside the DFSA workstream.
Territorial reach
The DIFC permission covers business in or from the centre; access to mainland UAE and other markets follows the corresponding local perimeter.
Permission architecture
GEN 2.2.2 names the Financial Services, while PIB, PIN, COB, CIR, AMI and specialist modules set the applicable operating framework.
Capital basis
The activity selects a prudential category or specialist solvency method, and the higher risk- or expenditure-based requirement can apply.
Review date
Last reviewed against the current DFSA Rulebook and official DIFC sources on 18 July 2026.
The perimeter in short
Start with the regulated activity, then the entity
The Regulatory Law 2004 gives the DFSA its financial-services mandate, and GEN Rule 2.2.2 provides the working activity list. A business first maps what it will do - take deposits, provide credit or money services, deal, advise, manage, hold client assets, operate a fund or market, write insurance, run a crowdfunding platform, provide trust services or administer an employee money purchase scheme. The resulting DFSA licence records the exact Financial Services, endorsements, client scope, products and conditions.
The DIFC Registrar then supplies the corporate and commercial layer. Federal Law No. 8 of 2004 preserves the centre's civil and commercial framework while federal criminal and AML legislation continues to apply. It also shapes the market boundary: DIFC authorised firms operate in or from the centre, with UAE-market deposit taking, UAE Dirham dealing and direct insurance into the UAE subject to the federal limits. Cross-border activity is planned against the law of each destination market.
Permission matrix
DIFC financial permission families
| Permission family | DFSA instrument and activities | Business scope | Entry and capital basis |
|---|---|---|---|
| Permission family Banking and deposit taking | DFSA instrument and activities Licence for Accepting Deposits, Providing Credit and, where relevant, Managing a Profit Sharing Investment Account | Business scope Banking, lending and Islamic deposit-style business within the activities, client types and territorial scope recorded on the licence | Entry and capital basis Eligible DIFC entity or approved branch, controllers and resident functions; Category 1 carries US$10 million base capital, while Category 2 ordinarily carries US$2 million, with the full PIB calculation applying |
| Permission family Payments, stored value and money services | DFSA instrument and activities Licence for Providing Money Services and, where relevant, Arranging or Advising on Money Services | Business scope Currency exchange, money transmission, stored value, payment accounts, payment transactions and payment instruments according to the permission held | Entry and capital basis Activity-specific Category 3C, 3D or 4 treatment, safeguarding and operational-risk controls; the relevant PIB base, expenditure calculation and FER fees follow the exact service mix |
| Permission family Investment dealing, advice and portfolio management | DFSA instrument and activities Licence for principal, matched-principal or agency dealing, arranging, Advising on Financial Products and Managing Assets | Business scope Brokerage, principal trading, advisory and discretionary management for the products and client categories stated on the licence | Entry and capital basis Category 2, 3A, 3C or 4 according to the highest-impact activity, with base capital from US$30,000 to US$2 million before any higher risk or expenditure requirement |
| Permission family Custody and client assets | DFSA instrument and activities Licence for Providing Custody or Arranging Custody, with separate trustee and fund roles where applicable | Business scope Safekeeping, administration, reconciliation and sub-custody within the recorded investment, fund or Crypto Asset perimeter | Entry and capital basis Category 3B or 3C treatment, segregation, client-asset controls and outsourcing oversight; Crypto Asset custody has a US$1 million base under PIB 3.6.2 |
| Permission family Collective investment funds and fund services | DFSA instrument and activities Fund registration or notification plus licences for Managing a Collective Investment Fund, fund administration, custody and Acting as the Trustee of a Fund | Business scope Public Funds, Exempt Funds, Qualified Investor Funds and specialist structures, with each manager and service provider holding the status assigned to its role | Entry and capital basis Fund and investor type determine the filing route; manager capital, independent oversight, valuation, custody and disclosure follow CIR and PIB, with the relevant FER fees |
| Permission family Insurance, reinsurance and intermediation | DFSA instrument and activities Licence for Effecting or Carrying Out Contracts of Insurance, Insurance Intermediation or Insurance Management | Business scope Life and non-life insurance, reinsurance, captives, takaful, broking, managing general agency and insurance-management models within the approved classes | Entry and capital basis Eligible insurer or branch, key functions, actuarial capability and class-specific PIN solvency; intermediaries use the applicable PIB and professional-indemnity framework |
| Permission family Credit, arranging and crowdfunding | DFSA instrument and activities Licence for Providing Credit, Arranging Credit and Advising on Credit, or Operating a Crowdfunding Platform | Business scope Balance-sheet lending, commercial or specialist credit, credit intermediation and the approved loan- or investment-crowdfunding model | Entry and capital basis Providing Credit is ordinarily Category 2; arranging and advising sit in Category 4, with US$140,000 base capital for crowdfunding and US$30,000 for other Category 4 models before the full PIB calculation |
| Permission family Markets, clearing and ratings | DFSA instrument and activities Authorised Market Institution status or a licence for an Alternative Trading System or Credit Rating Agency | Business scope Exchanges, clearing houses, alternative venues and credit-rating activity within the relevant AMI, GEN and market-rule framework | Entry and capital basis Market infrastructure requires systems, surveillance, settlement, default and recovery resources; an ATS falls within Category 3A, while each model follows its specialist fees and conditions |
| Permission family Crypto Tokens and tokenised finance | DFSA instrument and activities The relevant DFSA Financial Services licence with the Crypto Token framework applied to the activities performed | Business scope Dealing, arranging, advice, management, custody and trading-venue activity involving suitable Crypto Tokens; Fiat Crypto Tokens follow the DFSA's dedicated assessment policy | Entry and capital basis A body corporate with the underlying activity permission, documented GEN 3A.2.1 token suitability, technology and custody controls, plus the corresponding PIB capital and FER fee additions |
| Permission family Trust, fiduciary and company services | DFSA instrument and activities Licence for Providing Trust Services, or DFSA DNFBP registration for a company service provider carrying on the defined non-financial activities | Business scope Express-trust and fiduciary work follows the Financial Service; formation, registered-office, nominee and related company services follow the DNFBP and DIFC commercial layers | Entry and capital basis The legal status depends on the service: Authorised Firm requirements for trust activity, or AML-focused DFSA registration and the relevant DIFC Registrar permission for company services |
| Permission family Employee money purchase and retirement schemes | DFSA instrument and activities Licence for Operating or Acting as the Administrator of an Employee Money Purchase Scheme, with trust, management and custody permissions mapped separately | Business scope Workplace money-purchase arrangements and their administration within the scheme and service-provider roles approved by the DFSA | Entry and capital basis Category 3B base capital is US$500,000 for an operator or US$1 million for an administrator where it is the only Category 3B service, plus governance, scheme-asset and oversight controls |
| Permission family Representative offices, auditors and DNFBPs | DFSA instrument and activities Licence for Operating a Representative Office, Registered Auditor status, or DFSA registration for a qualifying DNFBP | Business scope Limited group representation, regulated audit work, or AML-supervised legal, accounting, real-estate, high-value-goods, company-service and single-family-office activity | Entry and capital basis Each route has its own eligibility, people, scope and annual obligations; the commercial permission and any separate Financial Service are mapped alongside it |
| Permission family Gambling | DFSA instrument and activities No gambling permission appears in the DFSA Financial Services list in GEN 2.2.2 | Business scope Gambling activity sits outside the DIFC financial-services permission map | Entry and capital basis A proposed gambling model requires a separate UAE perimeter analysis before any entity or licensing decision |
Eligibility and governance
Build the licence around the operating model and accountable people
The applicant structure follows GEN and the chosen activity. A DIFC body corporate or an eligible branch is typical, while Crypto Token services require a body corporate and market institutions, funds, insurers and specialist vehicles use their dedicated forms. The DFSA assesses controllers, beneficial owners, source of wealth and funds, directors, senior management, the business plan, forecasts and the complete booking, funds-flow, custody and outsourcing design.
An Authorised Firm ordinarily maintains a Senior Executive Officer, Finance Officer, Compliance Officer and Money Laundering Reporting Officer as Authorised Individuals. The Senior Executive Officer, Compliance Officer and MLRO are UAE-resident, subject to the rulebook's activity-specific exceptions. Governance depth then scales with the business: banks add prudential and liquidity functions, insurers add actuarial capability, funds add oversight and valuation, and payments or Crypto Token firms add safeguarding, operational, technology and custody ownership.
Capital, fees and client assets
Category is the starting point, not the final financial requirement
PIB places most Authorised Firms in Categories 1 to 5 according to their highest-impact Financial Service. The category supplies a base capital requirement, but credit, market, operational, expenditure and concentration calculations can produce a higher result. Insurers use PIN solvency, and market infrastructure follows its specialist financial-resource framework. Client-money safeguarding, custody segregation, professional indemnity, liquid resources or reserve arrangements can apply alongside capital.
The DFSA application and annual charges come from the FER module, while incorporation, commercial registration, premises, data protection and other centre costs sit with DIFC. The detailed current category, capital and fee tables remain on the dedicated DFSA route guide; the dossier's role is to identify which table and rulebook apply to the business.
Application path
A DFSA authorisation in regulator order
-
Define the perimeter
Map every Financial Service, product, client class, booking location, funds flow, custody role and target market before selecting a category or entity form.
-
Complete the authorisation enquiry
Present the model through DFSA Connect and confirm the relevant forms, legal structure, regulatory business plan, capital method and specialist supplements.
-
Submit one coherent application
File controller and management evidence, forecasts, governance, AML/CFT, conduct, safeguarding, custody, technology, outsourcing, resilience and wind-down materials with the prescribed fee.
-
Work through evaluation
Answer information requests and support interviews with proposed Authorised Individuals. The DFSA tests the file against the operating model and applicable rulebook modules.
-
Fulfil the in-principle conditions
Complete incorporation, premises, capitalisation, banking, appointments, systems and any model-specific condition stated in the in-principle letter.
-
Begin inside the final grant
Start Financial Services after the DFSA issues the licence and every operating condition is effective, then keep products, clients and systems within the recorded scope.
Ongoing supervision and transactions
The permission stays aligned with the live business
Ongoing supervision follows the actual activity set. Firms maintain prudential or solvency resources, regulatory returns, audited accounts, AML/CFT and sanctions controls, client classification, conduct and complaints processes, safeguarding or custody records, outsourcing oversight, technology resilience and material-event reporting. A new Financial Service, product perimeter, client class or material operating-model change is mapped to the relevant variation, endorsement or notification before launch.
In a share acquisition, the licence remains with the Authorised Firm while the incoming controller follows GEN 11.8. A person reaching 10 per cent or significant influence over a DIFC-incorporated Domestic Firm requires prior written DFSA approval, with further approval at the 30 and 50 per cent thresholds. GEN 11.8.7 provides a 90-day decision framework from a duly completed application. SKY7 coordinates register review, the controller file, transaction conditions, officer continuity and the completion sequence.
Current developments
Dated DIFC changes to track
-
Crypto Token framework - 12 January 2026
Firms now make and maintain the documented suitability assessment under GEN 3A.2.1; the DFSA no longer maintains a prescribed Recognised Crypto Token list.
-
Collective Investment Fund consultation - 7 July 2026
CP 173 proposes a substantial refresh of the funds framework, including risk-based changes and tokenisation topics. It is a proposal until final rules are made.
-
Current rulebook versions - July 2026
GEN and PIB received July 2026 versions, while FER is version 35 dated April 2026. SKY7 maps each mandate against the live modules and applicable figures.
Go deeper
DIFC routes and transaction guides
DFSA categories, capital and fees
The detailed route guide covers Categories 1 to 5, PIB base capital, FER charges, resident officers and the five-stage process.
Buying a DFSA-licensed firm
GEN 11.8 controller thresholds, the 90-day framework and the share-acquisition sequence for a DIFC Authorised Firm.
DFSA Crypto Token rules after January 2026
Firm-led suitability under GEN 3A.2.1, Crypto Token fee hooks and the boundary with VARA.
ADGM and DIFC brokerage compared
Category 3A activity triggers, capital, fees, resident functions and business fit across the two financial centres.
The complete UAE regulator map
Place the DIFC alongside ADGM, VARA and the federal CBUAE and CMA perimeters before choosing the operating base.
Primary sources
Official DIFC and DFSA sources
-
Regulatory Law and GEN
The DIFC legal database publishes the Regulatory Law 2004, and the DFSA Rulebook's GEN module defines Financial Services, authorisation, mandatory appointments and controller rules.
-
PIB, PIN and FER
PIB contains categories and capital for investment, banking and intermediation firms, PIN governs insurers, and FER sets application and annual DFSA fees.
-
COB, CIR and AMI
The conduct, funds and market-infrastructure modules supply the client, fund, custody, venue and continuing-obligation rules for the relevant permission.
-
DFSA authorisation services and public register
dfsa.ae publishes the authorisation stages, forms and public records for firms, individuals, funds, markets, auditors and DNFBPs.
-
DIFC laws and Registrar material
difc.com publishes Federal Law No. 8 of 2004, DIFC laws, entity guidance and the Registrar's commercial framework.
01 What is the difference between the DFSA and the DIFC Registrar?
The DFSA licenses and supervises Financial Services in or from the DIFC. The DIFC Registrar handles the legal entity and commercial-registration layer. A regulated business normally coordinates both workstreams.
02 How is the prudential category selected?
It follows the highest-impact Financial Service on the licence. PIB then supplies the base and the applicable risk- or expenditure-based calculation, while insurers and market institutions follow their specialist prudential modules.
03 Can one DFSA licence cover several services?
Yes. The licence records each Financial Service, endorsement, client scope and condition granted. Every additional activity expands the application evidence, capital analysis, fees and operating controls.
04 How does DIFC Crypto Token activity work after January 2026?
The firm holds the underlying Financial Service and assesses each Crypto Token against GEN 3A.2.1 on a reasoned, documented and ongoing basis. Fiat Crypto Tokens follow the DFSA's dedicated assessment policy.
05 Can a DFSA Authorised Firm be acquired?
Yes. The buyer acquires shares in the firm and follows GEN 11.8 for the incoming controller. The licence remains with the entity, and completion is sequenced around the DFSA's written decision and any conditions.
06 Does the DIFC permission cover mainland UAE activity?
It covers the Financial Services granted in or from the DIFC. Mainland UAE banking, payments, securities and virtual-asset activity are mapped to CBUAE, CMA or VARA as applicable, while each foreign market applies its own access rules.
Reviewed by the SKY7 advisory team. Last reviewed: 18 July 2026. This page is general information, not legal, regulatory, tax, investment or financial advice. The permission map, capital references and controller thresholds are stated as of July 2026 from the DFSA Rulebook and official DIFC sources. The Crypto Token rules changed on 12 January 2026, CP 173 remains a consultation, and rulebook modules continue to move. SKY7 confirms the live licence scope, rules, fees and public register for each mandate. Final authorisation and controller approval remain DFSA decisions.
Tell us what you need
Map the DIFC permission before building the file
Send the activity model, client types, funds flow, custody design and ownership chain. SKY7 will identify the DFSA Financial Services, prudential category, corporate route and adjacent UAE permissions, then scope a fresh authorisation or acquisition mandate. Fees are on request.