DFSA licence

The DFSA describes the mechanics precisely: in order to conduct Financial Services in or from the DIFC, individuals or entities need to seek authorisation, and authorisation is given in the form of a licence which is issued electronically by the DFSA, and specifies the type of Financial Services that can be conducted[DFSA — Authorisation].

Read that as three separate facts:

• It is a permission, not a status. You are permitted to do named things.
• The scope is defined on the licence. Anything outside it is unauthorised, however reasonable it feels commercially.
• Scope is chosen at application. Which means the single most consequential decision you make is what to ask for.

Ask for the narrowest scope that covers what you will actually launch. Extra permissions are not free options — they bring obligations you carry every year, and in some cases higher fees. The DFSA’s published fund manager fees illustrate the point: managing Qualified Investor Funds only sits at roughly half the licence fee of Exempt and Public Funds[DFSA — Collective Investment Funds].

Roughly, and not linearly:

• Scope the activity. Which Financial Services do you actually need? See the financial licence perimeter.
• Engage early. The DFSA publishes a route to register an expression of interest, after which a DFSA Supervisor will contact those that make a submission[DFSA — Authorisation]. Using it beats filing cold.
• Build the regulatory business plan — the model, clients, flows, risks and controls. This is the centre of the file.
• Name the individuals and prepare their applications alongside the firm’s.
• Evidence financial resources appropriate to the permissions sought.
• Prepare systems, controls and policies that describe your business rather than a template.
• Answer questions — there will be rounds, and your response speed drives the timetable more than anything the DFSA controls.
• Meet in-principle conditions, then complete premises, capital and operational readiness before the licence issues.

Incorporation with the Registrar runs in parallel, and the commercial licence is issued with the certificate[DIFC Registrar of Companies] — but remember it does not itself authorise Financial Services[DIFC Registrar of Companies].

The DFSA authorises Authorised Individuals as a distinct class alongside Authorised Firms[DFSA — Authorisation]. In practice this is what governs your launch date.

The people who will hold senior and compliance functions have to be identified and assessed, and for several roles they need to be resident and genuinely available. Founders routinely assume they can name someone provisional and recruit properly after approval. The calibre and availability of the named individuals is part of what is being assessed.

What to do about it: identify your senior team and compliance function before filing. Be realistic about whether a part-time arrangement satisfies the requirement for your permissions. If you are recruiting, add visa and relocation time to the plan — see DIFC employee visas.

The DFSA conducts initial assessments to ensure firms adhere to its standards of conduct and business[DFSA — Authorisation], and describes its approach as “To be a risk-based regulator and to avoid unnecessary regulatory burden”, with compliance obligations proportionate to the risks being mitigated and a focus on outcomes rather than the way they should be achieved[DFSA — How we regulate].

Two implications people miss:

Proportionate does not mean light. It means calibrated to your risk. A narrow advisory permission carries a different weight of obligation from deposit-taking — but the standard applied to the risks you do carry does not soften because you are small.

Outcomes-focused means you must explain the how. A policy document is not evidence that a control works. Applications that read as generic manuals attract the most questions, and questions are what consume the calendar.

Supervision is one of the DFSA’s six standing functions, alongside policy and rulemaking, authorisation, recognition, enforcement and international co-operation[DFSA — How we regulate]. It operates a continuous risk management cycle that identifies, assesses, prioritises and mitigates risks, monitors regional and international markets, and undertakes thematic work across its regulated community[DFSA — How we regulate].

From inside a firm that means regular reporting, periodic engagement with a supervisor, thematic reviews that arrive because of something happening in your sector, and obligations to notify when material things change — ownership, controllers, senior individuals, business model.

Budget for it. A compliance function is an operating cost, not a setup cost. Firms that treat compliance as a document produced once for the application discover the difference at their first supervisory engagement.

Note too that the DFSA rulemaking power sits with its Board under the Regulatory Law 2004, and rulemaking normally includes public consultation[DFSA — How we regulate] — so the rules you are licensed under can change, with notice.

Where the DFSA publishes fees, use them. Its fund manager licence fees are published by scope, and the spread is wide — Venture Capital Funds only sits at the bottom, Qualified Investor Funds and an internally managed Investment Company in the middle, Exempt, Public and Credit Funds at the top — with matching annual fees[DFSA — Collective Investment Funds]. Per-fund fees are separate[DFSA — Collective Investment Funds], and full tables are on the fund formation page.

Beyond that, the honest position is that the licence fee is rarely the largest number. Regulatory capital held continuously, salaried compliance and MLRO functions, audit, governance and premises usually dominate. DIFC’s own registry fees are published separately in the ROC Table of Fees[DIFC — Handbooks & Fees].

We do not publish capital figures here, because they scale with your prudential category and activity and any general number would be invented precision. Take them from the DFSA against your actual permissions.

• Assuming a foreign licence carries over. There is no passport into the DIFC. Home regulation is relevant to the assessment, not a substitute for it.
• Requesting permissions “just in case”. Every extra permission is an obligation for the life of the firm.
• Filing before ready. The clock does not start earlier in any useful sense; you simply spend the time answering questions.
• Writing the business plan for investors. The regulator is assessing risk, not vision.
• Naming uncommitted individuals. The people are part of the assessment.
• Template policies. Outcomes-focused regulation requires you to explain how your arrangements work.
• Budgeting for authorisation but not supervision. The second is permanent.
• Not testing the External Fund Manager route first if you are a fund manager[DFSA — Collective Investment Funds].