107
Articles
14
Chapters
FSRA
Issuing authority
2015
Effective since
AI
Cited answers from article text
ADGM General Rules for Authorised Persons (GEN Rulebook) is one of the rulebooks issued by the Financial Services Regulatory Authority — ADGM. For compliance officers, legal teams, and advisors working under this regime, finding the right article quickly matters. Lexara indexes the full text of ADGM GEN Rulebook and makes it searchable two ways: full-text and keyword search for rapid lookup, and AI Explorer for natural-language questions answered with citations to the exact article.
107 articles in 14 chapters, each with a plain-English summary by Arakan. The full text of every article is in the Laws Browser.
Principle 12.2 The Principles for Authorised Persons
Authorised Persons must observe high standards of integrity and fair dealing in their conduct of business under the ADGM principles.
Principle 22.2 The Principles for Authorised Persons
Authorised Persons must act with due skill, care and diligence when conducting business, as required by the Principles for Authorised Persons.
Principle 32.2 The Principles for Authorised Persons
Authorised persons must ensure senior management manages affairs effectively and responsibly, and maintain adequate systems and controls.
Principle 42.2 The Principles for Authorised Persons
Authorised Persons must maintain and be able to demonstrate adequate financial, system and human resources under the ADGM Principles.
Principle 52.2 The Principles for Authorised Persons
Authorised Persons must observe proper standards of conduct in the ADGM Financial System under the ADGM principles for authorised persons.
Principle 62.2 The Principles for Authorised Persons
Authorized Persons must prioritize customer interests and ensure clear, fair, and non-misleading communication.
Principle 72.2 The Principles for Authorised Persons
Authorised Persons must identify, prevent or manage, or disclose conflicts of interest so that Customer interests are not adversely affected.
Principle 82.2 The Principles for Authorised Persons
Authorised Persons must take reasonable care to ensure the suitability of advice and discretionary decisions they provide or make.
Principle 92.2 The Principles for Authorised Persons
Authorised persons must arrange proper protection of customer assets and money for which they are responsible.
Principle 102.2 The Principles for Authorised Persons
Authorised Persons must deal openly and co-operatively with Regulators and keep the Regulator informed of significant matters.
Principle 112.2 The Principles for Authorised Persons
Authorised Persons must maintain a corporate governance framework appropriate to the nature, scale and complexity of their business.
Principle 122.2 The Principles for Authorised Persons
Authorised persons must maintain a remuneration structure and strategy aligned with long-term interests and proportionate to the business.
Principle 1-22.4 The Principles for Approved Persons
Approved Persons must observe high standards of integrity and fair dealing in every Controlled Function they perform under ADGM General Rulebook principles.
Principle 2-22.4 The Principles for Approved Persons
Approved Persons must act with due skill, care and diligence in performing every Controlled Function they hold.
Principle 3-22.4 The Principles for Approved Persons
Approved Persons must observe proper standards of market conduct in every Controlled Function they perform.
Principle 4-22.4 The Principles for Approved Persons
Approved Persons must deal openly and co-operatively with the Regulator and make appropriate disclosures to it.
Principle 5-22.4 The Principles for Approved Persons
An Approved Person with significant responsibility must ensure the business they oversee is organised so it can be managed and controlled effectively.
Principle 6-22.4 The Principles for Approved Persons
An Approved Person with significant responsibility must ensure the business they oversee complies with all applicable Regulations and Rules.
Rule 3.2.1-3.2.23.2 Apportionment of significant responsibilities
Governing bodies must apportion significant responsibilities between the governing body and senior management, appropriate to the firm's nature, scale and complexity.
Rule 3.2.33.2 Recording of apportionment
Those responsible for apportionment arrangements must keep an up-to-date apportionment record evidencing their awareness and acceptance, retained for six years from creation or supersession.
Rule 3.2.3(4)-retRecord Retention — Record of apportionment of significant responsibilities
Firms must keep a record of apportionment of significant responsibilities for six years from the date it is established or superseded by a more up-to-date record.
Rule 3.3.13.3 General requirement
Firms must establish and maintain systems and controls, including financial and risk controls, to manage affairs effectively and responsibly, and undertake regular reviews of them.
Rule 3.3.2-3.3.33.3 Organisation
Firms must maintain clear organisational and reporting lines, with defined, documented and allocated responsibilities across the organisation.
Rule 3.3.4-3.3.53.3 Risk management
Firms must establish and maintain risk management systems and controls to identify, assess, mitigate and monitor risks to the business.
Rule 3.3.6-3.3.123.3 Compliance function
A firm must establish and maintain a compliance function that monitors compliance with rules and regulations and reports to its governing body and senior management.
Rule 3.3.13-3.3.153.3 Internal audit
An internal audit function, proportionate to the nature, scale and complexity of the business, must review systems and controls; this does not apply to Venture Capital Fund managers.
Rule 3.3.16-3.3.183.3 Business plan
Authorized Persons must maintain an up-to-date business plan that reflects their activities, resources, and strategy.
Rule 3.3.19-3.3.203.3 Staff and agents
Firms must ensure employees and agents are suitable, adequately trained and supervised, including complaints-handling obligations.
Rule 3.3.21-3.3.233.3 Conflicts of interest
Authorised persons must establish systems and controls to identify and manage conflicts of interest between the firm, its employees and its customers.
Rule 3.3.24-3.3.263.3 Information barriers
Firms must establish information barriers controlling the flow of confidential and inside information where needed to manage conflicts of interest.
Rule 3.3.27-3.3.323.3 Outsourcing
Firms outsourcing functions, including CDD outsourcing, must retain responsibility and maintain adequate oversight and controls over the outsourced function and provider.
Rule 3.3.33-3.3.363.3 Business continuity
Firms must maintain a business continuity plan (BCP) to ensure operations continue following a disruptive event.
Rule 3.3.37-3.3.393.3 Records
Firms must maintain records demonstrating compliance and be able to reproduce them in hard copy and English within three business days when the Regulator requests.
Rule 3.3.403.3 Fraud and financial crime
Authorised Persons must establish systems and controls to counter the risk of being used for fraud or other financial crime.
Rule 3.3.41-3.3.41A3.3 Corporate governance
Firms must maintain a corporate governance framework, and banks, insurers and PSIAU managers must meet minimum non-executive director requirements on their governing body.
Rule 3.3.423.3 Remuneration
Firms must maintain a proportionate remuneration policy covering the Governing Body, senior management, key control function persons and major risk-taking employees.
Rule 3.4.1-3.4.53.4 Protected Disclosure policies and procedures
Firms must establish and maintain protected disclosure (whistleblowing) policies and procedures enabling employees to report concerns and protecting them from detriment.
Rule 3.4.63.4 Records of Protected Disclosures
An entity must keep records of Protected Disclosures (whistleblowing reports) for at least six years from the date all related matters are completed and closed.
Rule 3.4.6-retRecord Retention — Records of Protected Disclosures (whistleblowing)
Records of Protected Disclosures (whistleblowing) must be retained for six years from the date all matters relevant to the disclosure are completed and closed.
Rule 3.5 (24-hour notification)3.5 Cyber Incident Notification
Entities subject to the ADGM GEN Rulebook must notify the Regulator of a cyber incident within 24 hours of becoming aware of it.
Rule 3.5 (Anti-malware/Network/Access/Authentication/Encryption/Physical)3.5 Technical Controls
Regulated firms must implement technical controls covering anti-malware, network security, least-privilege access, authentication and encryption, and physical data-centre access controls.
Rule 3.5 (Framework)3.5 Cyber Risk Management Framework
Firms must establish, implement and maintain a cyber risk management framework proportionate to the nature, scale and complexity of their business.
Rule 3.5 (Governance)3.5 Governance
Governing bodies and senior management must oversee cyber risk and ensure clear accountability for cyber risk management.
Rule 3.5 (Identification/Assessment)3.5 Identification and Assessment
Firms must identify and assess cyber risks and vulnerabilities affecting their systems, data and operations on an ongoing basis.
Rule 3.5 (Monitoring/Testing/Detection/Response/Recovery)3.5 Monitoring, Testing, Detection and Response
Entities must maintain continuous cyber incident monitoring, testing, detection, response and recovery capability, including a Cyber Incident Response Plan reviewed annually and after each incident.
Rule 3.5 (Third-Party)3.5 Third-Party Cyber Risk
Firms must assess and manage cyber risk arising from third-party service providers and outsourced arrangements.
Rule 3.5 (Training)3.5 Training
Employers must provide cyber security training and awareness to their employees.
Rule 3.63.6 Climate-related financial risk
Firms must assess the materiality of climate-related financial risk to their business and manage identified risks proportionately.
Rule 4.3.1-4.3.34.3 Emergency
An Authorised Person facing an emergency beyond its control is not in breach if it takes practical steps to mitigate losses and notifies the Regulator as soon as practical.
Rule 4.4.1-4.4.44.4 Disclosure of regulatory status
Key business documents must not misrepresent regulatory status, must carry the prescribed ADGM Financial Services Regulatory Authority regulation disclosure, and may not reproduce the regulator's logo without permission.
Rule 4.5.1-4.5.34.5 Location of offices
Body corporates and partnerships incorporated or established in ADGM must maintain their head office or registered office within ADGM.
Rule 4.6.1-4.6.34.6 Close Links
The regulator must be satisfied that close links do not hinder effective supervision, and the entity must submit a close links report or notification when requested.
Rule 4.84.8 Communication with the Regulator
Firms must conduct all communication with the Regulator in the English language, as a required language for regulatory correspondence.
Rule 5.2.1-5.2.115.2 Financial Services Permission application
Applicants for Financial Services Permission must apply in the prescribed form and notify the Regulator of any material change in circumstances while the application is pending.
Rule 5.2.7-5.2.95.2 Threshold Conditions - ongoing satisfaction
Authorised firms must demonstrate and continuously maintain adequate resources, fitness and propriety, effective supervisability and adequate compliance arrangements on an ongoing basis.
Rule 5.3.1-5.3.95.3 Controlled Functions
Only Approved Persons may perform Controlled Functions, and firms must notify the Regulator within 10 days of any withdrawal or variation of a Controlled Function.
Rule 5.5.1-5.5.65.5 Mandatory appointments
Firms must appoint and maintain Approved Persons as Senior Executive Officer, Finance Officer, Compliance Officer and Money Laundering Reporting Officer at all times, with SEO, CO and MLRO required to be UAE resident.
Rule 5.6.1-5.6.135.6 Assessment of Approved Person competence
Firms must assess fitness, propriety and competence of individuals before lodging an Approved Person application, and ensure Approved Persons keep AML knowledge for SEO, MLRO and CO.
Rule 5.6.145.6 Records of competence assessment
Firms must keep records of each individual's competence assessment process for a minimum of six years from the date of the assessment.
Rule 5.6.14(2)-retRecord Retention — Records of Approved Person competence assessment process
Records of Approved Person competence assessment processes must be retained for six years from the date of the assessment.
Rule 6.2.1-6.2.46.2 Financial statements
Entities must prepare annual financial statements under IFRS, or IFRS for SMEs where eligible, approved and signed by a director or partner.
Rule 6.3.1-6.3.46.3 Accounting Records
Firms must maintain accounting records explaining transactions and financial position, retain them six years, and produce them to regulators within three business days.
Rule 6.3.4(1)-retRecord Retention — Accounting Records
Accounting records must be retained for six years from the date to which the records relate.
Rule 6.3.5-6.3.76.3 Financial year
Firms must notify the Regulator of their first financial year-end, and must obtain Regulator consent before changing it (domestic firms) or give advance notice (non-domestic firms).
Rule 6.4.1-6.4.66.4 Appointment and termination of Auditors
Regulated entities must appoint a suitably skilled and independent auditor, promptly notify the regulator of appointments, terminations and resignations, fill vacancies, and replace the auditor when the regulator requests.
Rule 6.5.16.5 Co-operation with Auditors
Co-operation with auditors requires providing the Auditor required information and access, allowing record copying, and not interfering with the Auditor's duties.
Rule 6.6.1-6.6.96.6 Audit reports
Auditors must produce the applicable auditor's reports, such as financial statement, client money and safe custody reports, and submit them to the Regulator within four months of financial year end.
Rule 7.2.1-7.2.27.2 Complaints handling procedures (Retail)
Firms must maintain written policies and procedures for investigating and resolving Retail Client Complaints fairly, consistently, and promptly.
Rule 7.2.3-7.2.97.2 Receipt and resolution of Complaints (Retail)
Firms must acknowledge retail complaints promptly, give complainants handler contact details and a procedure summary, update them on progress, and promptly advise resolution and redress terms.
Rule 7.2.7-7.2.87.2 Complaint handler independence
Complaint handlers must be independent: not involved in the underlying matter, impartial, and holding sufficient authority, or access to it, to resolve the complaint.
Rule 7.2.9-7.2.107.2 Referral of Complaints to another AP/Recognised Body
Where another Authorised Person or Recognised Body is responsible for a complaint, the firm must obtain the complainant's consent and refer it, giving the complainant notice.
Rule 7.2.11-7.2.137.2 Retail Client awareness and retention
Complaints procedures must be provided free of charge; records of complaints must be maintained for at least 6 years from receipt.
Rule 7.2.12-retRecord Retention — Complaints records (Retail Clients)
Retail clients' complaints records must be retained for six years from the date of receipt of the complaint.
Rule 7.2.147.2 Systems and controls for recurring issues
Firms must maintain systems and controls to identify recurring or systemic problems arising from complaints and to remedy those problems.
Rule 7.3.17.3 Complaints recording (Professional Clients)
Firms must maintain written policies and procedures for recording Complaints from Professional Clients, ensuring they are handled fairly, consistently and promptly.
Rule 7.3.27.3 Retention of Professional Client Complaints records
Maintain records of Professional Client complaints for at least 6 years from receipt.
Rule 7.3.2-retRecord Retention — Complaints records (Professional Clients)
Firms must keep complaints records for Professional Clients for six years from the date the complaint was received.
Rule 8.1.1-8.1.48.1 Information gathering and Regulator access
Firms must provide information, documents and access to the Regulator on reasonable request, make employees available, answer truthfully and promptly, and address any secrecy or data protection restrictions.
Rule 8.2.3-8.2.98.2 Waivers and Modifications
Applicants must apply in writing for a waiver or modification with prescribed content, and notify the regulator immediately of any material change affecting a waiver's relevance.
Rule 8.3.1-8.3.38.3 Change of scope of Financial Services Permission
Firms must provide written details of proposed changes when applying to change the scope of a Financial Services Permission or to vary or withdraw a condition or restriction.
Rule 8.4.18.4 Withdrawal of Financial Services Permission
Firms requesting withdrawal of their financial services permission must state reasons, cessation date, discharge of customer obligations, and trust service transfer arrangements where applicable.
Rule 8.5.2-8.5.38.5 Changes to Approved Person status
Approved Persons must submit prescribed applications to extend, vary, or withdraw a condition or restriction, or to withdraw Approved Person status or a Controlled Function authorisation.
Rule 8.6.1-8.6.28.6 Temporary cover
A firm may appoint a non-Approved Person alternate for temporary or unforeseen absence, for up to 26 weeks in any 12 months, and must notify the Regulator of the appointment.
Rule 8.7.1-8.7.48.7 Withdrawal of Approved Person status
Firms must request withdrawal of an Approved Person's status within 7 days after the individual ceases a Controlled Function, giving reasons for dismissal or resignation where applicable.
Rule 8.8.4-8.8.128.8 Controllers - prior approval and notification
Obtain prior written approval from the Regulator for control changes over Domestic Firms, and submit annual Controllers report by deadline.
Rule 8.10.2-8.10.68.10 Core notifications
Firms must give the Regulator reasonable advance notice of changes to name, address or legal structure, and notify immediately of significant regulatory matters like breaches.
Rule 8.10.6A8.10 Major acquisition or subsidiary establishment
Category 1, 2 and 5 Authorised Persons must notify the Regulator in writing before establishing or acquiring a subsidiary or material investment, with Domestic Firms giving 45 days' advance notice.
Rule 8.10.78.10 Fraud and errors
A firm must immediately notify the Regulator of employee fraud against a Customer, serious fraud against the AP, significant accounting irregularities, or serious employee misconduct concerning honesty or integrity.
Rule 8.10.8-8.10.108.10 Other Regulators, actions and insolvency
Notify the Regulator immediately regarding authorization changes, investigations, significant legal proceedings, or insolvency events.
Rule 8.10.11-8.10.128.10 Accuracy of information and corrections
Anyone supplying information to the Regulator must keep it accurate, complete and fairly based, and immediately notify and correct any information that was or may have been false or misleading.
Rule 8.10.148.10 Corporate governance/Remuneration changes
Regulated entities must promptly notify the regulator of significant changes to their corporate governance framework or remuneration structure or strategy, with branches notifying only where relevant.
Rule 8.11.18.11 Provision of notifications and reports - format
Notifications must be in writing, state the Approved Person's name and FSP number, go to the relevant department by approved method, and obtain proof of receipt.
Rule 8.12.1-8.12.58.12 Skilled Person reports
Firms must appoint and pay for a Skilled Person nominated or approved by the regulator when required, and ensure cooperation and contract terms allowing the Skilled Person to report to the regulator.
Rule 9.2.1-9.3.49.2-9.3 FSP application (Representative Office)
Non-ADGM regulated firms seeking a representative office must apply for Financial Services Permission in prescribed form, be incorporated and regulated by a non-ADGM regulator, and limit activity to marketing.
Rule 9.6.1-9.6.49.6 Principles for Representative Offices
A Representative Office must observe integrity, fair dealing, due skill, care and diligence, adequate resources, and open, co-operative relations with Regulators.
Rule 9.7.1-9.7.29.7 General provisions
ADGM firms must maintain a place of business in ADGM and must not share offices with an Authorised Person, represent other parties beyond themselves or their group, or let staff be employed by another Authorised Person or Recognised Body.
Rule 9.8.1-9.8.49.8 Fitness and propriety / Principal Representative
Licensed entities must stay fit and proper, keep a UAE-resident Principal Representative at all times, and appoint a successor within 28 days of a vacancy or regulator objection.
Rule 9.9.19.9 Dealing with property
Persons must not hold or control money or property belonging to another person, except for ordinary business operating expenses.
Rule 9.10.19.10 Solvency notification
A regulated institution must notify the Regulator immediately once it becomes aware that it is unlikely to remain solvent or is insolvent.
Rule 9.11.1-9.11.39.11 Disclosure of regulatory status
Representative offices must not misrepresent their regulatory status, key business documents must disclose regulation as a Representative Office, and the Regulator's logo may not be reproduced without permission.
Rule 9.12.1-9.12.59.12 Marketing Material requirements
Communications and marketing material must be clear, fair and not misleading, identify the Representative Office and its regulatory status, and carry a prescribed foreign-jurisdiction warning for offering documents.
Rule 9.139.13 Record keeping
Firms must maintain sufficient records of each activity and function, including issued marketing material, and retain those records for a minimum period of six years.
Rule 9.13-retRecord Retention — Representative Office records (incl. Marketing Material issued)
Representative Offices must retain records, including marketing material issued, for six years from the date of creation or issuance.
Rule 9.15.1-9.15.39.15 Regulatory notifications
Firms must notify the Regulator as soon as reasonably practical of changes to name, legal status, Controllers or address, any Rule breach, or materially adverse fitness and propriety information.
Rule A2.1.1A2.1 Disclosure of market data
Entities must provide comprehensive, sufficiently detailed market data to relevant regulatory authorities and the public to enhance market transparency.
Rule A2.1.2A2.1 Processes and procedures
A firm must maintain effective processes and procedures to provide data to relevant authorities in a timely and appropriate manner.
Rule A2.1.3A2.1 Information systems
Requires firms to maintain robust information systems that provide accurate and timely current and historical data in an easily analysable format.
ADGM GEN Rulebook's 208 indexed articles break down by obligation type as follows.
Compliance — 42 articles
Compliance / Legal — 23 articles
HR / Compliance — 18 articles
Senior Management / Compliance — 8 articles
Compliance / Senior Management — 8 articles
Compliance / HR — 8 articles
ADGM GEN Rulebook spans the following regulatory topics, as tagged by Lexara.
adgm
fsra
gen
governance
principles
senior management
systems controls
reporting
authorised persons
Instead of reading through ADGM GEN Rulebook article by article, Lexara's AI Explorer lets you ask a question in plain English and get a cited answer — with the specific article referenced.
Ask in plain English — no need to know the article number in advance
Every answer cites the specific article it draws from, with a direct link
Responses include the relevant article text, not just a paraphrase
Cross-reference ADGM GEN Rulebook against other Financial Services Regulatory Authority — ADGM rulebooks in a single query
How Lexara works
Laws Browser
Browse the full article corpus for any UAE authority. Filter by law, chapter, or topic tag.
Full-text search
Keyword and semantic search across 7,000+ indexed articles from 20+ UAE regulators.
AI Explorer
Ask a regulatory question in plain English. Get a cited answer grounded in the actual statutory text.
Trigger layer
Structured deadline data per article — event type, offset, recurrence. No manual calendar parsing.
What is ADGM General Rules for Authorised Persons (GEN Rulebook)?
ADGM General Rules for Authorised Persons (GEN Rulebook) is issued by the Financial Services Regulatory Authority — ADGM and has applied since 1 October 2015. It has 107 articles across 14 chapters.
What does ADGM GEN Rulebook cover?
It is organised into: Ch.2 - Principles for Authorised Persons; Ch.2 - Principles for Approved Persons; Ch.3.2 - Allocation of Responsibilities; Ch.3.3 - Systems and Controls; Ch.3.4 - Whistleblowing; Ch.3.5 - Cyber Risk Management; Ch.3.6 - Climate-Related Financial Risk; Ch.4 - General Provisions; Ch.5 - Authorisation and Threshold Conditions; Ch.6 - Accounting and Auditing; Ch.7 - Complaints Handling and Dispute Resolution; Ch.8 - Supervision; and 2 more.
Who issues ADGM GEN Rulebook?
The Financial Services Regulatory Authority — ADGM. Always check the authority's official publication for the binding text.
Can I search ADGM GEN Rulebook and ask questions about it?
Yes. Lexara searches the full text of all 107 articles and answers plain-English questions with a citation to the exact article.
Leave your details and a compliance adviser who works with ADGM GEN Rulebook will call you back. There's no charge to ask.
Arakan Lexara Weekly
Key developments and what they mean, what firms are asked to do, and the deadlines coming up — from the DFSA, FSRA, VARA, CBUAE, FTA and more. Read the latest