DIFC and ADGM Authorisation Does Not Carry Across: What the 1 October DFSA Decision Means for Groups in Both Centres

On 1 October 2026 the Dubai Financial Services Authority (DFSA), which regulates financial services in the Dubai International Financial Centre (DIFC), published an enforcement decision against a wealth firm incorporated in Abu Dhabi Global Market (ADGM) and licensed there by the Financial Services Regulatory Authority (FSRA). The firm had never been authorised by the DFSA, yet its staff had advised prospective clients and arranged deals from a DIFC office. The DFSA found a breach of the Financial Services Prohibition in Article 41(1) of the Regulatory Law 2004.

None of the law here is new. What makes the case worth reading for any group with an entity in each centre is how ordinary the set-up was: a related company, a shared office, client meetings in the place that suited the client.

The primary source is the DFSA's media release of 1 October 2026, which points to the full Decision Notice in the Decision Notices section of the DFSA website. The decision was also reported by WAM, Gulf News and The National. We do not name the firm in this article.

What the DFSA decided on 1 October 2026

According to the DFSA, the firm provides financial services in ADGM under its FSRA licence, including advising on investments or credit and arranging deals in investments. It had never held DFSA authorisation for anything in or from the DIFC.

Between February and May 2024 the firm's employees worked from the offices of a related DIFC company, which the DFSA did not regulate. Prospective clients were invited to that DIFC office. There they received financial advice, were helped to onboard onto an investment platform, and handed over know-your-customer documents so that investment accounts could be opened. The DFSA classed this as two financial services carried on without authorisation: Advising on Financial Products and Arranging Deals in Investments.

The DFSA made two further findings. The DIFC office did not show that the DIFC company was separate from the ADGM firm, which could have led prospective clients to believe the ADGM firm was authorised by the DFSA. And the firm's senior management knew DFSA authorisation was needed, did not obtain it, and did not act on concerns raised by the firm's then Compliance Officer about the missing licence. The DFSA treated that awareness and inaction as aggravating factors. The firm agreed to settle, and the DFSA reduced the penalty to reflect the settlement.

The DFSA thanked the FSRA for its close cooperation in the investigation. Separate regulators, in other words, still share information.

The rule underneath: Article 41 and the "in or from" test

Article 41(1) of the Regulatory Law 2004 is the Financial Services Prohibition. As the DFSA puts it in its guidance on unauthorised business in the DIFC, a person cannot carry on a financial service in or from the DIFC unless it holds a DFSA licence that permits that particular financial service. Article 41A, the Financial Promotions Prohibition, adds that an unauthorised person generally cannot make a financial promotion in or from the DIFC, subject to limited exceptions in the DFSA's Rules.

Two words do most of the work. "In" catches activity physically carried on in the Centre, such as a client meeting in a DIFC office. "From" catches activity directed outwards from a DIFC base, such as an adviser sitting at a DIFC desk who calls clients elsewhere. Where the firm is incorporated, or which regulator licensed it, does not enter into the test.

ADGM runs the same logic in the other direction. The Financial Services and Markets Regulations 2015 contain a General Prohibition on carrying on a regulated activity in ADGM without FSRA authorisation or an exemption. So a DFSA-authorised firm that starts advising clients from an ADGM office has the mirror-image problem.

Authorisation is also activity by activity. A firm licensed by the DFSA to advise is not thereby licensed to manage assets or hold client money. The DFSA Public Register shows the financial services each Authorised Firm may provide, and the FSRA Public Register does the same for ADGM. Our guide to DIFC licence types explains how regulated and non-regulated DIFC licences differ.

Where two-centre groups tend to go wrong

There are good commercial reasons to hold entities in both cities, which we cover in our comparison of ADGM and DIFC in 2026. In our experience the structure chart is rarely the problem. The trouble starts when day-to-day practice drifts away from it.

Office space is the usual starting point. A group leases space in the DIFC through its non-regulated holding or service company, and the regulated team from Abu Dhabi starts using it for client meetings because it is convenient. Nobody decides to carry on a regulated activity in the DIFC; it happens one meeting at a time, which is close to the facts the DFSA described.

Staff are the next point of drift. People are often employed by one entity, seconded to a second and introduced to clients under a third entity's brand. When a regulator asks who was performing the regulated activity, the answer should be the same in the employment contract, the client file, the email signature and the diary. If it is not, the group will struggle to show that the right entity did the work.

Then there is the service company itself. Using an unregulated company to employ people, hold leases and pay suppliers is normal. It goes wrong when that company's premises or people are used to carry on a regulated activity that no authorised entity in that centre is permitted to perform. A DIFC company that the DFSA does not regulate cannot lend its address to an ADGM licence.

Which entity is the client dealing with?

The DFSA's finding about the office not showing the separation between the two companies is the easiest part of this to fix, and it is the part we would look at first. Its alert on unauthorised business makes a related point: referring to a related firm incorporated in the DIFC that holds no financial services licence can leave people assuming they are dealing with a regulated firm. The same alert notes that using images of DIFC landmarks in promotional material is a common way of implying DFSA regulation.

So test the group the way a prospective client experiences it. Walk into reception and look at the signage. Read the website, the pitch deck, the engagement letter and the onboarding pack, and ask in each case whether the reader can tell which legal entity they are dealing with, where it is incorporated and which regulator, if any, authorises it, for which activities. Where two group companies share a name stem, every document should name the specific company and, where it helps, say that the other is a separate company.

Article 41A makes marketing part of the same exercise. Seminars, roadshows, newsletters and social media posts aimed at people in or from the DIFC are communications the DFSA can look at, even if no advice is given.

Registration is not authorisation

Atlas Corporate Services is a DFSA-registered corporate service provider. We are registered as a designated non-financial business or profession (DNFBP), a category the DFSA supervises mainly for anti-money laundering purposes, and the DFSA Public Register lists DNFBPs separately from Authorised Firms. That registration covers company formation and administration. It does not permit us, or any client entity we look after, to advise on investments, arrange deals or manage assets. Atlas does not give investment advice.

The same distinction applies to the entities in a structure. A foundation, a Prescribed Company or an SPV is a legal vehicle. Having a registered corporate service provider maintain it does not make it an authorised financial firm,. Our note on the Prescribed Company CSP requirement and our guide to DIFC corporate service providers explain what the corporate service provider role covers.

A self-check for groups with entities in both centres

We suggest working through these questions entity by entity, in this order. If you cannot answer one with confidence, that is the point to involve a regulatory lawyer.

1. List the regulated activities the group actually carries on, using the regulators' own terms (advising, arranging, managing, dealing) rather than a general description of the business.
2. Name the legal entity that performs each activity. Use the company name, not the brand.
3. Identify where each activity is carried on: where the adviser sits, where the client is met and where the work is done.
4. Check each entity's permissions on the DFSA or FSRA public register against that list, activity by activity.
5. Compare premises use with employment. Who uses which office, desks and meeting rooms, and which entity employs or engages them?
6. Review marketing and events for anything aimed at people in or from the other centre.
7. Read your names, signage, websites and documents as a client would, and fix anything that blurs one entity into another.
8. Record the result in a group chart and activity map, and have the board review it at least once a year. Our DIFC and ADGM corporate governance guide covers the board side.

The decision also shows why internal escalation matters. The DFSA weighed the fact that senior management did not act on the Compliance Officer's concerns. A board that receives a compliance warning about authorisation should minute it and decide, on the record, what to do about it.

When to bring in a regulatory lawyer

Whether something is a regulated activity, and whether an exclusion or exemption applies, is a legal judgement that depends on the facts. We would take regulatory legal advice before moving staff or opening desks in the other centre, before launching a service or investment platform that will reach clients in both, before adding a service company, branch or new brand to a regulated group, and before replying to any regulator's enquiry about who was doing what.

Applications for authorisation in either centre are for a qualified regulatory lawyer or adviser. Family offices should read this alongside our guide to family office structuring and governance, because whether a family office is managing the family's own affairs or providing services to others is a regulatory question in its own right.

How Atlas helps

We form and administer companies in the DIFC and ADGM, and we keep the records that let a two-centre group see itself clearly: group charts, registers of directors and shareholders, and secretarial calendars that tie each activity to a named entity. That map is usually the first thing a regulatory lawyer asks for, and it is the starting point for the self-check above. If you are setting up a new DIFC company, or want your existing structure documented through our company secretarial and governance service, we can do that and work alongside your regulatory adviser. We do not give regulatory advice or prepare authorisation applications.

This article is general information and does not constitute legal, tax or regulatory advice. It summarises the DFSA's published media release on an enforcement decision and does not replace the Decision Notice itself. Confirm the position for your group with a qualified regulatory adviser before acting.