How to verify a DIFC company

Most verification mistakes come from treating this as one check. It is two, and they answer different questions:

• “Does this company exist?” — the DIFC Public Register, kept by the Registrar of Companies[DIFC Registrar of Companies]. Every DIFC entity is on it, from banks to cafés.
• “May it handle my money?” — the DFSA Public Register[DFSA — Public Register]. Only firms authorised and licensed by the DFSA can provide financial services in or from the DIFC[DFSA — Alerts].

The gap between the two is where trouble lives. A firm can be genuinely DIFC-registered — real certificate, real Gate District address — and still have no permission whatsoever to take investments. A DIFC certificate presented as proof that a firm can manage your money is answering the wrong question, and counting on you not to notice.

• A consultancy, holding company or tech firm — DIFC register only. No financial services, no DFSA involvement[DFSA — Authorisation].
• Anyone offering investments, asset management, insurance, payments or banking — both. DIFC register for existence, DFSA register for permission[DFSA — Alerts].
• An audit firm — a third register entirely; see below.

If you are unsure whether what you are being offered is a financial service at all, the test is where the DFSA’s perimeter sits — handling client money, arranging deals, advising on investments[DFSA — Authorisation] — covered in full in how DFSA authorisation works.

Ask the firm for its exact legal name as registered and its DIFC registered number — and, if it claims DFSA authorisation, its DFSA reference number. Three reasons:

• Trading names and legal names differ, and the register holds legal names. Searching the brand you were shown can miss the entity — or worse, find a similarly named one.
• The registered number is unambiguous where names are not[DIFC — Public Register].
• A legitimate firm produces these instantly. Hesitation over its own registered number is an answer in itself.

Type difc.com into the browser yourself and open the Public Register. Search by entity name or registered number. Each entry shows four things worth reading properly[DIFC — Public Register]:

• Status. Active, Dissolved, or Inactive – Struck Off. This is the field that catches people: an incorporation certificate stays impressive-looking long after an entity is struck off. The register shows the position now.
• Type. Financial-related, non-financial, or retail — your first clue whether a DFSA check is even relevant.
• Permitted activities.The specific things the licence covers. A “Management Consultancies” entity offering you an investment product is operating outside its own licence — whatever its status says.
• Registered address. Compare it to the address on the proposal, the website and the email footer. Mismatches matter — see below.

What the register does not show — shareholders, beneficial owners, filed accounts — has its own page: what is visible on the DIFC public register and what is not.

If financial services are involved, type dfsa.ae yourself and open its Public Register. It is searchable and organised by category — Authorised Firms, Authorised Market Institutions, DNFBPs, External Fund Managers, Registered Auditors — with separate lists for withdrawn registrations in several categories[DFSA — Public Register].

Three details do the real work:

• The licence itself — which Financial Services the firm is authorised for. Authorisation is activity-specific, not general[DFSA — Authorisation]: a firm authorised to arrange deals is not thereby authorised to hold your money.
• Endorsements. The register records whether a firm may deal with or for Retail Clients and whether it may hold or control Client Assets[DFSA — Public Register]. If you are an ordinary individual investor, the Retail endorsement is the one that concerns you.
• The withdrawn lists. A firm that was authorised when a friend recommended it is not necessarily authorised today.

The register also covers individuals — including those the DFSA has restricted or prohibited[DFSA — Public Register] — which is worth a search when one persuasive person, rather than a firm, is doing the selling.

Finding the name on a register is not the end of verification, because scammers know you will look. The DFSA has published alerts about frauds that used a real Authorised Firm’s name, its DIFC address and its DFSA reference number — a genuine identity wrapped around a fake operation[DFSA — Alerts].

So match everything, character by character:

• The website domain against the one on the register entry. A hyphen, a different ending, an extra word — that is the whole scam.
• Email addresses — staff of a regulated firm do not write from free webmail accounts.
• Bank details— payment to an account that does not match the registered firm’s name is the step you cannot take back.
• The people — call the firm back on the number published on the register entry or its verified website, not the number that called you.

The DFSA maintains a public list of alerts about scams and potentially fraudulent practices, categorised as Unauthorised, Clone, Regulator or Authority impersonation and Clarification[DFSA — Alerts]. The categories are a taxonomy of what actually happens:

• Unauthorised — firms simply claiming a DFSA licence they do not hold.
• Clone — the sophisticated version. The DFSA has warned about a firm using a fraudulent, cloned copy of the DFSA’s own Public Register so its false claim looked verifiable[DFSA — Alerts]. This is why every check starts by typing the regulator’s address yourself. A verification link supplied by the firm you are verifying is worthless.
• Impersonation— fake notices and demands purporting to come from the DFSA itself, including one citing a “regulated certification and licence” employees supposedly needed[DFSA — Alerts]. The DFSA does not collect fees or fines through unsolicited messages.

Search the alerts list for any firm that gives you doubt. And if you run a legitimate DIFC firm, search it for your own name occasionally — impersonation targets real businesses, and firms usually learn they have been cloned from their own confused customers.

Audit has its own verification layer, and it works the same way. Any DIFC entity required to be audited must appoint an auditor registered with the DIFC Registrar of Companies[DIFC — Registered and Recognised Auditors], and auditors of DFSA-regulated firms must additionally be registered with the DFSA, whose register includes a withdrawn list[DFSA — Public Register]. Both are public. The full picture — including why only three of the couple-of-hundred registered firms are actually based in the Centre — is in DIFC auditors.

Verification tells you a firm is real and permitted. It does not tell you the firm is good, and it is worth being precise about the difference:

• Authorisation is not endorsement. The DFSA supervises firms; it does not vouch for their products or their prices.
• Regulation is not a guarantee against loss. Investments made through a fully authorised firm can still go to zero. What regulation changes is who is watching, what rules apply, and what recourse exists.
• An Active status is not a credit rating. The register says the entity exists in good standing with the Registrar — nothing about its solvency.

Passing these checks is the floor, not the decision. It earns a firm the right to be evaluated, nothing more.

The DFSA’s guidance is unambiguous: do not deal with or invest any money with a firm or individual until you have verified they are authentic and properly authorised — and if a firm falsely claims DFSA authorisation or DIFC registration, cease dealing with them and complain to the DFSA through its online Complaints Form[DFSA — Alerts].

Two practical additions. Keep the evidence — the emails, the documents, the payment requests — because the complaint is more useful with it. And if money has already moved, contact your bank immediately as well; recall attempts are time-critical in a way complaints are not.