Dubai Financial Services Authority (DFSA)

Overview

Official Full Name: Dubai Financial Services Authority

Short Name: DFSA

Establishment Year: 2004

Primary Regulatory Authority: DIFC Regulatory Law 2004 (DIFC Law No. 1 of 2004)

The Dubai Financial Services Authority (DFSA) is the independent regulator of financial services conducted in or from the Dubai International Financial Centre (DIFC), a purpose-built financial free zone located in Dubai, United Arab Emirates. As of August 2024, the DFSA regulated 837 licensed entities.

The DFSA operates as a Layer 1 regulator with binding legal authority within its jurisdiction. It maintains regulatory alignment with international standards and participates actively in global financial regulatory forums. The DFSA's scope extends to asset management, banking and credit services, securities, collective investment funds, custody and trust services, commodities futures trading, Islamic finance, insurance, and digital asset services.

Basic Identity

Classification

Inclusion Justification

What This Entity Oversees

Scope of Regulatory Mandate

The DFSA regulates a comprehensive range of financial services activities within the DIFC:

Core Services:

• Banking and credit services
• Investment and securities services
• Asset management and portfolio management
• Collective investment schemes and funds
• Custody and trust services
• Commodities futures trading
• Islamic financial business
• Insurance services
• Exchange operations (equities and commodities derivatives)

Ancillary Services:

• Investment advisory and broking
• Market data and information services
• Fund administration
• Compliance and risk management outsourcing

Authorization Framework

Firms seeking to conduct financial services in the DIFC must obtain authorization from the DFSA. The authorization process evaluates:

• Fit and proper criteria for directors, senior management, and controllers
• Capital adequacy and liquidity requirements
• Risk management and internal control systems
• Compliance and AML/CFT infrastructure
• Business continuity and operational resilience
• Consumer protection arrangements

Sources: DFSA Authorization Services, DFSA Laws and Rules

Supervisory Approach

The DFSA employs a risk-based supervisory framework with ongoing monitoring mechanisms:

Supervisory Tools:

• Regular mandatory reporting requirements from regulated firms
• On-site inspections and audit reviews
• Thematic examinations targeting specific risk areas
• Stress testing and financial resilience assessments
• Consumer complaint analysis and trend monitoring

Frequency:

• Risk-sensitive inspection intervals based on firm classification
• Enhanced monitoring for complex or higher-risk operations
• Regular assessment of compliance and control effectiveness

Regulatory Reporting

Licensed entities must comply with:

• Quarterly financial and prudential returns
• Annual audited financial statements
• Regulatory returns specific to license category
• AML/CFT transaction and suspicious activity reports
• Breach notification and operational incident reporting

The DFSA's public register of authorized firms is available at DFSA Public Register.

Sources: DFSA Supervision Overview

Consumer Complaint Framework

The DFSA maintains a dedicated consumer protection framework with mechanisms for complaint handling and redress:

Complaint Eligibility:

• Misconduct by DFSA-authorized firms
• Dissatisfaction with service or conduct
• Contraventions of DFSA laws or rules
• Conduct damaging to DIFC or financial services industry reputation

Complaint Process:

• Complainants should initially contact the authorized firm directly
• Direct resolution is often quicker and more efficient
• If unresolved, complainants may escalate to the DFSA

Consumer Protection Principles

DIFC Consumer Protection Law Framework:

• Prohibition of misleading or deceptive conduct
• Requirement for accurate and truthful product/service information
• Fair dealing obligations on authorized firms
• Transparent pricing and terms disclosure
• Prohibition of unfair contract terms

DFSA Requirements:

• All DIFC firms must establish adequate customer complaint mechanisms
• Transparent dispute resolution procedures
• Regular monitoring of complaint trends

Dispute Resolution

Financial disputes may be resolved through:

• Direct Negotiation: With the authorized firm
• DFSA Complaint Process: For regulatory breaches
• DIFC Courts: For contractual and civil disputes
• Arbitration: Through DIFC arbitration centers

Sources: DFSA Consumer Resources, DFSA Complaints Process

Crypto and Digital Assets

Regulatory Framework

The DFSA has developed a comprehensive framework for crypto-asset and token regulation in the DIFC, recognizing recognized crypto tokens and establishing strict criteria for stablecoins.

Recognized Crypto Tokens

As of September 2024, the DFSA has recognized five crypto tokens for regulated activities:

1. Bitcoin (BTC)
2. Ethereum (ETH)
3. Litecoin (LTC)
4. Toncoin (TON)
5. Ripple (XRP)

Recognition is based on evaluation of:

• Market transparency and disclosure practices
• Governance structures and decision-making
• Liquidity and trading volume
• Volatility assessment and risk mitigation
• Cybersecurity measures
• Financial crime prevention capabilities

Stablecoin Regulation

Single-Fiat-Backed Stablecoins:

Strict criteria apply:

• Price Stability: Mechanism to maintain stable peg to backing currency
• Full Reserve Requirement: 100% backing by fiat reserves [UNVERIFIED - specific percentage confirmation needed]
• Independent Audits: Regular third-party verification of reserve holdings
• Segregated Accounts: Reserves held in segregated accounts at regulated financial institutions
• Monthly Disclosure: Public disclosure of reserve holdings and composition
• Responsible Party: Designated party responsible for investor protection and redemption

Prohibited Asset Categories

The DIFC crypto framework explicitly prohibits:

• Algorithmic stablecoins — those using algorithmic mechanisms instead of cash backing
• Privacy tokens — tokens designed for enhanced transaction privacy (Monero, Zcash models)

These are considered to pose excessive financial crime and market integrity risks.

Token Classification and Regulation

Crypto Token Definition:

Cryptographically secured digital representations of value, rights, or obligations, including:

• Medium of exchange tokens
• Payment and settlement tokens
• Investment tokens
• Utility tokens

Recognition Criteria Assessment:

The DFSA evaluates:

• Transparency of token mechanics and issuance
• Governance structures and decision-making
• Liquidity and market infrastructure
• Volatility and risk characteristics
• Cybersecurity and operational security
• Financial crime prevention and AML/CFT capability

Digital Asset Service Provider Licensing

Requires verification from official sources Crypto service providers operating in the DIFC may require licenses depending on the specific services offered (trading, custody, asset management, etc.). [UNVERIFIED - specific license categories for crypto service providers to be confirmed]

Sources: DFSA Crypto Token Regulation Explainer, Norton Rose Fulbright DFSA Crypto Guidance

Regulatory Powers

Enforcement Strategy

The DFSA's Enforcement function aims to achieve "credible deterrence" by ensuring that misconduct is detected, penalized, and deterred through:

• Decisive and swift action against breaches
• Misconduct prevention and cessation
• Asset freezing to provide restitution for harm
• Systems and controls remediation
• Public censure and deterrent sanctions

Enforcement Powers

The DFSA possesses comprehensive statutory enforcement powers under the Regulatory Law 2004:

Available Sanctions:

• Financial penalties (fines) with no statutory upper limit
• Public censures and reprimands
• License suspension or revocation
• Conditional authorizations and restrictions
• Prohibition orders against individuals
• Asset preservation and restitution orders

Penalty Determination:

• No statutory maximum fine amount
• Penalties determined based on all facts and circumstances
• Consideration of intent, severity, duration, and harm caused
• Precedent alignment and deterrence effectiveness

Fixed Penalty Notice (FPN) Regime

Effective April 15, 2024, the DFSA introduced a fixed penalty regime for specified reporting requirement breaches:

• First Contravention: USD 2,500
• Second Contravention: USD 7,500
• Third or Subsequent Contraventions: USD 15,000

Recent Enforcement Activity

• 2024 Total Fines: Exceeded USD 2.5 million across multiple enforcement actions
• Enforcement Focus: AML/CFT compliance, financial crime prevention, reporting accuracy

Sources: DFSA Enforcement Overview, DFSA Fixed Penalty Regime

Regulatory Role and Function

Legal Foundation

Statutory Foundation

The DFSA's regulatory powers derive from the DIFC Regulatory Law 2004 (DIFC Law No. 1 of 2004), which establishes the authority's jurisdiction, supervisory powers, and enforcement mechanisms.

Key Statutory Powers:

• Supervision and investigation of regulated persons and entities
• Authorization and licensing of financial services firms
• Rule-making authority under Article 23 of the Regulatory Law 2004
• Imposition of restrictions, suspensions, and sanctions including financial penalties
• Registration authority for auditors and designated non-financial businesses and professions (DNFBP)
• Decision-making process definition for regulatory approvals

Supporting Legislation:

• Markets Law 2012 (DIFC Law No. 1 of 2012) — securities and market conduct
• Collective Investments Law 2010 — fund and pooled investment regulation
• Law Regulating Islamic Financial Business 2004 — Islamic finance framework
• Trust Law 2005 — trust and fiduciary services
• Investment Trust Law 2006 — investment trust structures

Sources: DFSA Regulatory Law 2004, DFSA Legal Framework

Licensing and Authorization Relevance

The Dubai Financial Services Authority (DFSA) issues authorizations within its regulatory mandate in United Arab Emirates:

[Specific license types and requirements require verification from official sources]

Payments and Money Movement Relevance

Regulatory Categories

The DFSA regulates money services businesses and payment service providers through a tiered licensing structure based on capital requirements and service scope:

Category 4 — Money Transmission

• Capital requirement: USD 140,000
• Target: Remittance specialists and money transmitters
• Scope: Cross-border fund transfers without balance retention
• Suitable for: Corridor operators, salary processing, one-off international transfers
• Key requirement: Risk-based AML/KYC aligned with DFSA and UAE federal standards

Category 3D — Payment Accounts & Cards

• Capital requirement: USD 200,000
• Scope: Payment account creation, maintenance, and personal payment instrument issuance
• Services: Debit cards, branded payment instruments, transaction execution
• Requirements: Enhanced prudential standards, segregated customer fund holding
• Compliance: Quarterly and annual financial statement submission demonstrating solvency

Category 3C — Stored Value

• Capital requirement: USD 500,000+
• Scope: Electronic money and prepaid card issuance
• Services: Stored monetary value platforms, in-app balances, e-wallets
• Rationale: DFSA treats stored value as functional cash equivalent, requiring highest prudential standards
• Requirements: Monthly reporting, suspicious transaction reporting, robust operational controls

Compliance Framework

All DFSA-licensed money services businesses must maintain:

• AML/KYC Procedures: Risk-based anti-money laundering and customer identification aligned with federal UAE and DFSA standards
• Financial Reporting: Quarterly and annual financial statements demonstrating solvency and sound financial management
• Suspicious Activity Reporting: Prompt reporting of detected suspicious or unusual transactions
• Customer Fund Protection: Segregated accounts and protection mechanisms for customer deposits

Sources: Money Services Business Licenses Guide, Payment Service Provider Licensing

Payment Systems Governed or Overseen

The Dubai Financial Services Authority (DFSA) has the following relationship to payment infrastructure in United Arab Emirates:

This entity's role in payment systems is primarily regulatory and supervisory rather than operational. It does not directly operate national payment infrastructure but contributes to the regulatory framework governing payment activities in United Arab Emirates.

Relationship to Other Regulators

Global Regulatory Participation

The DFSA actively engages in international regulatory forums and maintains supervisory alignment with international standards:

IOSCO Participation

International Organization of Securities Commissions:

• Full member participation in IOSCO working groups
• Dedicated participation in FinTech Taskforce
• Working groups on: AI risk assessment, crypto-asset regulation, market integrity

Assessment Results:

• IMF assessment concluded DFSA has "Fully Implemented" 27 of 29 IOSCO Principles
• "Broadly Implemented" rating on remaining 2 principles
• High alignment with international securities regulatory standards

FATF Engagement

Financial Action Task Force:

• DFSA leadership serves as global assessor for FATF Mutual Evaluations
• Participation in international AML/CFT standard-setting
• Regular engagement with mutual evaluation processes

Supervisory College Initiatives

DFSA Regulatory College (2025 Inaugural):

• Convened 18 international financial authorities for knowledge-sharing
• Launched during Dubai FinTech Summit 2025
• Focus areas: AI and cybersecurity risks, post-quantum cryptography, agentic AI
• Mechanism: Proactive dialogue and supervisory alignment

Global Financial Innovation Network

Participation in initiatives addressing:

• Cross-border fintech challenges
• Innovation-focused regulatory approaches
• Emerging technology governance

Sources: DFSA International Assessment, DFSA Regulatory College 2025

Geography and Jurisdiction Notes

Important Departments and Divisions

Key Public Resources

Leadership

Chief Executive Officer (Current)

Name: Mark Steward

Appointment Date: May 19, 2025

Term: 3 years

Background: Over 30 years of international regulatory experience across Australia, UK, and Hong Kong. Previous position: Executive Director of Enforcement and Market Oversight at the UK's Financial Conduct Authority (FCA), responsible for all FCA enforcement and Listing Authority functions.

Previous CEO

Name: Ian Johnston

Service Periods:

• 2012-2018 (first term)
• 2022-2025 (second term)

Background: Originally trained as lawyer; held senior positions in Australian financial sector including CEO of major trustee company; joined Australian Securities and Investments Commission (ASIC) in 1999 as Executive Director of Financial Services Regulation.

Sources: DFSA CEO Appointment, DFSA Executive Team

Contact Information

Physical Address:

Level 13, West Wing

The Gate, DIFC

Dubai, United Arab Emirates

Postal Address:

PO Box 75850

Dubai, UAE

Telephone:

+971 (0) 4 362 1500

Office Hours:

Monday to Friday: 8:00 AM — 5:00 PM (GST)

Website:

https://www.dfsa.ae/

Contact Portal:

DFSA Contact Us

Public Resources

• Public Register of Authorized Firms: DFSA Firms Register
• Consumer Complaints: DFSA Consumer Center
• Regulatory Laws and Rules: DFSA Laws and Rules
• Legislation Library: DFSA Legislation

Notes on Naming and Language