DFSA Conduct of Business Module (COB)chapter by chapter

2.1.2(5)

Build a classification rule/flag in the client onboarding and CRM systems that automatically designates Employee Money Purchase Scheme members, beneficiaries and participating employers as Retail Clients.

2.3.1(1)

Implement a mandatory pre-transaction client classification step/checklist in the onboarding workflow that must be completed and evidenced before any Financial Service is provided.

2.3.1(3)

Add an agency-relationship check to onboarding due diligence requiring identification of the underlying principal and classification of that principal as the Client of record.

2.3.1(4)

Configure onboarding procedures for trust relationships to designate the trustee as the Client of record in KYC/CRM systems.

2.3.2

Build a default classification rule in the CRM/onboarding system that assigns Retail Client status automatically unless Professional Client or Market Counterparty criteria are affirmatively met and documented.

2.3.3(2)

Establish an ongoing monitoring trigger/process for Professional Client eligibility (periodic re-assessment plus event triggers) and a notification template to inform affected clients promptly.

2.3.9(2)

Create a standard Market Counterparty notification letter/template and a tracking log for the objection/response period before finalising the classification.

2.4.1(1)

Develop a standard Professional Client opt-in/opt-out disclosure notice covering the right to elect Retail status, comparative protections, and the election deadline; embed its issuance as a mandatory onboarding step.

2.4.1(3)

Set up a client-initiated re-classification request process/form and workflow to update classification records promptly upon request.

2.4.1(4)

Prepare a standard notice explaining that the firm lacks a Retail Endorsement/does not serve Retail Clients, including consequences (e.g. inability to continue the service, referral options).

2.4.2(a)

Build a net-asset calculation template/checklist for Professional Client assessments that explicitly excludes primary residence value, with a field recording which property (if any) is treated as the primary residence.

2.4.3(1)

Create a documented knowledge-and-experience assessment questionnaire/scorecard covering each of the factors listed in Rule 2.4.3(1)(a)-(g).

2.4.3(2)

Extend the knowledge-and-experience questionnaire process to require identification and assessment of the specific authorised signatories/decision-makers of an Undertaking client.

2.4.4(3)

Develop a gap-analysis methodology/checklist comparing the classification standards of the head office/branch/Group member against DFSA COB chapter 2 requirements, with a remediation log for identified gaps.

2.4.5(2)(a)

Establish a Group-bundle classification protocol requiring cross-check of the classification applied by the firm against the classifications used by other Group members providing the bundled services.

2.4.5(2)(b)

Produce a client-facing disclosure document (e.g. within the client agreement) explaining the Group bundling arrangement and each entity's role.

2.4.5(2)(c)

Maintain a Group bundling risk register documenting identified risks and mitigation measures for each bundled-service arrangement.

2.5.1

Implement a dedicated client classification record-keeping repository capturing classification workpapers and a notice/despatch log for all chapter 2 notices.

2.5.2(1)

Configure records/document management system retention rules to hold client classification records for a minimum of six years post relationship termination, with archiving/deletion controls.

2.5.3(1)

Establish data-access/record-sharing agreements with head office/branches/Group members guaranteeing DFSA access to relevant classification records on request.

2.5.3(2)

Set up an escalation and DFSA-notification protocol triggered whenever record access is lost or impaired.

3.2.1

Establish a communications/financial-promotions review and sign-off policy requiring all client-facing communications to be checked for clarity, fairness and accuracy before issue.

3.2.2

Legal/Compliance review of all client agreements, terms of business and communications to remove any clauses purporting to exclude or limit statutory/regulatory duties or liabilities.

3.2.3

Client communications/dispatch procedure that directs required regulatory information to the client's own registered address/contact, with a process for capturing and retaining written redirection instructions.

3.2.4(1)

Standard marketing material template/checklist mandating inclusion of firm name, regulatory status wording, and (where applicable) the Professional Client/Market Counterparty restriction statement.

3.2.4(3)(a)

Third-party marketing due-diligence and compliance-review process before distributing marketing material for products/services offered by others.

3.2.4(3)(b)

Ongoing monitoring process to detect regulatory breaches by third parties whose products/services are marketed, with a trigger to halt distribution immediately on becoming aware of a breach.

3.2.5

Client-classification-based distribution controls (e.g. segmented mailing lists, access controls) and third-party distributor agreements/oversight to prevent misdirected or non-compliant use of marketing material.

3.2.6

Standard disclosure wording and content requirements built into all performance-reporting/marketing templates aimed at Retail Clients (source disclosure, assumptions, prominent risk warning).

3.3.2(1)(a)

Client onboarding control requiring execution of a compliant Client Agreement (containing all App2 key information) before any Financial Service is provided.

3.3.2(1)(b)

Pre-contract disclosure process delivering the key information/App2 content to the prospective client with adequate time before signing.

3.3.2(3)(a)

Documented verbal/written impracticability-explanation procedure for time-critical transactions executed without a prior Client Agreement.

3.3.2(3)(b)

Follow-up control that tracks and closes out execution of the Client Agreement for clients onboarded under the impracticability exception.

3.3.3

Client Agreement amendment/notification procedure with a minimum 14-day notice period to affected Retail Clients.

3.3.4(2)

Legal review confirming head-office/other-branch Client Agreements adequately cover the Branch's services, plus a document-retrieval process to produce the agreement to the DFSA on request.

3.3.4(3)

Legal review of Group Client Agreements used for Rule 2.4.5 services to confirm required content and enforceability wording, plus document-retrieval arrangements for DFSA requests.

3.3.4(4)

Escalation/notification procedure to alert the DFSA immediately upon loss of access to a relied-upon Client Agreement.

3.4.2(1)

Documented suitability assessment process/questionnaire capturing client needs, objectives, financial situation, risk tolerance, knowledge and experience, completed before any recommendation or discretionary trade.

3.4.2(2)

Standard 'limited suitability' warning notice template requiring client signature, issued and executed before any limited-suitability recommendation/discretionary service begins.

3.4.2(3)

Periodic portfolio suitability review process for discretionary accounts, re-assessing continued alignment with client circumstances.

3.4.2(4)

One-off remediation exercise to identify legacy 'no suitability' warnings and either reissue a compliant limited-suitability warning or complete a full suitability assessment.

3.4.3

Periodic client data refresh/KYC review process (trigger-based updates plus scheduled periodic reviews) to keep client records current.

3.5.1(1)

Conflicts of interest policy and conflicts register/identification process covering firm-client and client-client conflicts.

3.5.1(2)

Documented conflict-management toolkit comprising Chinese Wall arrangements, client disclosure templates, and an independence policy, applied case-by-case.

3.5.1(3)

Escalation and decline-to-act protocol for conflicts that cannot be adequately managed.

3.5.3(1)

Inducements/gifts-and-entertainment policy with approval thresholds, a register of inducements given/received, and periodic monitoring.

3.5.3(2)

Standard commission/inducement disclosure statement generated and provided to Retail Clients before recommendation/execution, unless an exception applies.

3.5.3(4)

Summary disclosure template that includes a statement offering detailed information on request, plus a request-handling process to supply the detail on demand.

3.5.4

Soft Dollar Agreement approval process that assesses and documents whether proposed goods/services fall within the permitted categories before acceptance.

3.5.5

Pre-trade compliance checklist confirming all Soft Dollar Agreement conditions (written agreement, best execution, competitiveness, adequate commission coverage, and disclosures) are satisfied before dealing through the arrangement.

3.5.6

Pre-transaction Soft Dollar Agreement disclosure statement provided to clients where applicable, referencing the firm's/Group's policy.

3.5.7(1)-(2)

Annual Soft Dollar Agreement client reporting pack covering the required percentage, value, summary and total-commission disclosures.

3.6.1

Firm-wide record retention policy and document management system enforcing a minimum six-year retention (with the correct trigger date per record type) for marketing material, client agreements, advice/recommendation records, suitability files, and inducement/Soft Dollar records.

4.2.1(a)

Deposit-taking control that screens and blocks deposit acceptance from UAE onshore market sources.

4.2.1(b)

Currency control preventing acceptance of deposits denominated in AED.

4.2.1(c)

FX transaction control blocking AED-denominated currency/FX transactions.

4.2.1(d)

Client-classification control preventing deposit acceptance from clients classified as Retail Clients.

4.3.1(1)

Credit-eligibility control verifying client classification (Professional/Market Counterparty, or Retail Client that is an Undertaking) and confirming business purpose before extending any Credit Facility.

4.3.1(2)(a)

Currency control preventing extension of credit facilities denominated in AED.

4.3.1(2)(b)

FX transaction control blocking AED-related currency/FX transactions connected to credit provision.

5.2.2

Legal/regulatory horizon-scanning and training programme ensuring staff maintain current knowledge of applicable DIFC trust-related laws and Rules.

5.2.3

Documented corporate governance framework (board/management structure, policies, committee charters) for the Trust Service Provider.

5.2.4

Service-level standards/turnaround-time targets for onboarding, transfers and closures of trust relationships, with an exceptions log for delays.

5.2.5

Information-gathering checklist/process to be completed before any exercise of discretionary trustee powers.

5.2.6

Proper-purpose test/documentation requirement embedded in the discretion-exercise decision process.

5.2.7

Scheduled periodic client/trust review programme to refresh understanding of each client's business and affairs.

5.2.8

Trustee oversight/monitoring process confirming trustee decisions align with fiduciary duties under the governing trust law.

5.2.9

Delegation policy requiring legal review, scope-limitation, and ongoing monitoring of any Power of Attorney or other delegation arrangement.

5.3.1

Formal periodic trust-relationship review procedure with defined review intervals.

5.5.1

Dual-control staffing structure with two suitably skilled/experienced individuals responsible for managing the trust business.

5.5.2

Succession/back-up management arrangement with a designated deputy empowered and equipped to challenge the senior person's decisions.

5.6.1

Board/management internal reporting pack (MI) covering legal compliance status, financial soundness, client-service-agreement adherence, trustee conduct, client-affairs monitoring (including financial-crime red flags), asset safeguarding, and staff resourcing/training.

5.7.1

Adviser-selection documentation template capturing selection criteria and rationale for each third-party adviser engaged.

5.7.2

Adviser performance monitoring and periodic review process with a documented ability/process to replace underperforming advisers.

5.8.1

Recruitment/appointment vetting process verifying qualifications and experience of staff and recommended persons (e.g. trustees) before appointment.

5.8.2

Authorisation matrix/segregation-of-duties framework matching transaction/decision types to staff/trustee competency levels.

5.8.3

Role-specific fiduciary-duty training programme covering relevant jurisdictions for all officers, employees, agents and recommended trustees.

5.8.4

CPD programme and tracking system for all relevant trust services staff.

5.9.1(a)

Books-and-records system/architecture capable of full transaction recreation and per-client asset/liability tracking for trust business.

5.9.1(b)

Periodic trust/company accounts preparation process with a defined preparation schedule.

5.9.1(c)

Jurisdiction-specific accounting-standard identification and compliance process for each administered trust/company.

5.9.1(d)

Service-provider/agent register capturing sufficient detail (identity, mandate, terms) for each trust.

5.10.1(a)

KYC/CDD documentary-evidence collection and verification process covering settlors, trustees, and principal named beneficiaries for every trust.

5.10.1(b)

Enhanced due-diligence process to identify and verify distribution recipients and persons named in letters of wishes for discretionary trusts.

5.10.2

Source-of-funds verification and documentation process applied to trust settlements, company capitalisations, and related transactions.

5.11.1

Fit-and-proper assessment process for non-employee trustee appointments.

5.11.2

DFSA notification procedure for non-employee trustee appointments with required content (name, address, date).

5.11.3

Pre-appointment competency and resourcing assessment for prospective non-employee trustees.

5.11.4

Immediate DFSA notification procedure for trustee termination/resignation events, including reasons and replacement-trustee arrangements.

5.11.5

Written trustee undertaking/agreement obtained from every non-employee trustee binding them to employee-equivalent legal/regulatory requirements.

6.2.1(a)(i)

Written PA dealing policy/notice issued to all relevant employees and incorporated into employment contracts/service agreements.

6.2.1(a)(ii)

PA transaction pre-clearance/approval process with a written sign-off log.

6.2.1(a)(iii)

Conflict-check step embedded in the PA transaction pre-clearance procedure (e.g., cross-check against restricted/watch lists and client order books).

6.2.1(b)

Mechanism for employees to report PA transactions promptly (e.g., duplicate contract notes, self-reporting forms, or a data feed from approved brokers).

6.2.1(c)

Dedicated employee/staff account flagging or coding in the account opening and trading systems.

6.2.2

Specific anti-circumvention clauses included in the PA dealing policy/notice.

6.2.4

Analyst PA-dealing restriction tied to research production status (e.g., embargo list/blackout mechanism linked to the research pipeline).

6.2.5

Central PA dealing record-keeping repository with retention tagging by trigger date.

6.3.2(a)

Documented supervisory framework for investment analysts (reporting lines, sign-off, oversight).

6.3.2(b)

Conflicts of interest management process specific to research production (e.g., information barriers/Chinese walls).

6.3.2(c)

Independent review/sign-off step confirming research objectivity prior to release.

6.3.2(d)

Standard disclosure template/checklist embedded in the research publication workflow.

6.3.3(a)

Standard 'intended audience' statement in the research report template.

6.3.3(b)

Template sections requiring sourcing/assumptions disclosure and fact/opinion labelling.

6.3.3(c)

Mandatory publication-date field in the research template.

6.3.3(d)

Mandatory 'rating period' field in the research template.

6.3.3(e)

Standard rating-methodology explanation appended to all research reports.

6.3.3(f)

Periodically-calculated ratings-distribution statistics table inserted into research reports.

6.3.3(g)

Standard retail-restriction warning clause in the research template for professional-only research.

6.3.4(a)

Analyst interest declaration process feeding into the research disclosure section.

6.3.4(b)

Standard disclosure statement on analyst reporting/remuneration structure where relevant.

6.3.4(c)

Pre-publication shareholding threshold check against the issuer.

6.3.4(ca)

Pre-publication crypto token holding threshold check.

6.3.4(d)

Corporate broker relationship check feeding into the disclosure section.

6.3.4(e)

Reverse shareholding check (issuer's stake in the firm) prior to publication.

6.3.4(f)

Corporate finance mandate register check prior to publication.

6.3.4(g)

Market-making status check prior to publication.

6.3.5(a)

Quiet-period restriction control in the research publication approval workflow.

6.3.5(b)

Quiet-period restriction on analyst public appearances/media engagements.

6.3.6(1)

Own-account dealing restriction/blackout linked to research release timing, with defined exceptions.

6.3.7

Deal-specific conflicts management plan/information barrier for offer mandates.

6.3.8(a)

Standard allocation-process disclosure document provided to corporate finance clients.

6.3.8(b)

Target investor identification methodology disclosure.

6.3.8(c)

Documented recommendation-preparation process and responsible personnel disclosed to the client.

6.3.8(d)

Conflict-of-interest disclosure clause covering self-placement scenarios.

6.4.1(2)

Best-execution check applied to residual, non-instructed elements of execution-only orders.

6.4.2(1)

Best execution policy and price-check control applied at the point of execution.

6.4.3(a)

Fee discount application check in the execution pricing process.

6.4.3(b)

Mark-up/mark-down disclosure control embedded in the pricing/execution process.

6.4.3(c)

Multi-venue price comparison and best-price execution routing logic.

6.5.2(1)

Non-market price transaction screening and justification procedure.

6.5.3

Standing record-keeping requirement for non-market price transaction assessments.

6.6.2(a)

Pre-aggregation disadvantage assessment step.

6.6.2(b)

Standard aggregation risk disclosure in client terms of business/order documentation.

6.6.2(c)

Pre-trade allocation record created for every aggregated order.

6.6.2(d)

Documented aggregation and allocation policy, including partial-fill handling.

6.6.3(a)

Prompt post-execution allocation process/timeliness control.

6.6.3(b)

Allocation reconciliation against the pre-trade allocation record.

6.6.3(c)

Fair allocation control/testing (e.g., pro-rata methodology, periodic fairness testing).

6.6.3(d)

Standardized allocation record template capturing all required data fields.

6.6.4

Retention schedule/archiving control for aggregation and allocation records.

6.7.1(1)

Call/electronic communication recording system covering all transaction-related channels (phone, chat, email, mobile devices used for dealing).

6.7.2(1)

Records retrieval capability/system with a defined response time for regulator or internal requests.

6.7.2(2)

Format/legibility standards and reproduction capability (e.g., readable file formats, decoding tools where needed) for stored records.

6.7.2(3)

Access controls and audit trails preventing/detecting unauthorised record alteration.

6.7.3

Retention setting of at least 6 months on the communications recording system.

6.7.4(1)

Order-receipt/decision record capturing the App1 A1.1.1 data fields.

6.7.4(2)

Execution record capturing the App1 A1.1.2 data fields.

6.7.4(3)

Order-transmission record capturing the App1 A1.1.3 data fields.

6.7.5

Retention configuration of at least 6 years for order and transaction records.

6.8.2(1)

Churning/excessive-trading surveillance on discretionary accounts and advisory recommendations.

6.8.3(1)

Timely execution monitoring control with exception reporting for delays.

6.8.4

Order sequencing/priority control ensuring fair handling (e.g., first-in-first-out or equivalent).

6.8.6(1)-(2)

Post-execution allocation control matching each execution to the correct client/firm account per the defined basis.

6.8.7(a)

Pre-trade risk controls (position/credit limit checks) on the DEA infrastructure.

6.8.7(b)

Ongoing DEA controls monitoring and periodic effectiveness review/testing programme.

6.9.2(1)

Automated confirmation note generation and dispatch process with a 2-business-day SLA.

6.9.2(2)

Confirmation note process for averaged/series transactions keyed to the final transaction date.

6.9.2(3)

Confirmation note template populated with the App3 A3.1 mandatory data fields.

6.9.3

Retention configuration of at least 6 years for confirmation note copies.

6.10.2(1)-(2)

Automated periodic statement generation and dispatch process with client/account-specific frequency settings.

6.10.4

Retention configuration of at least 6 years for periodic statement copies.

6.11.2(1)

Compliance mapping confirming client-money-holding status triggers full application of the sections 6.12/6.14 requirements.

6.11.2(2)

Compliance mapping confirming custody-holding status triggers full application of the section 6.13/6.14 requirements.

6.11.2(3)

Limited custody-arranging compliance checklist covering custodian due diligence, client disclosure, and specified record-keeping.

6.11.3(1)

Client asset segregation, identification tagging, and security controls (physical and system-based).

6.11.3(2)(a)

Central mandate register listing all client mandates/authorities and applicable conditions.

6.11.3(2)(b)

Documented instruction-handling procedure and authority matrix for mandated accounts.

6.11.3(2)(c)

Transaction-level authority check and recording control for mandate-based dealing.

6.12.1(a)

Standard written deposit-notification disclosure for bank clients whose funds are held as deposits with the firm.

6.12.1A(2)

Documented methodology for estimating the Money-Services-attributable portion of mixed-purpose funds.

6.12.2(1)

Category 4 client money prohibition control embedded in product/account onboarding.

6.12.2(2)

Full Client Money Provisions (App5) compliance framework (segregation, reconciliation, banking arrangements, etc.).

6.12.2(3)

Written consent capture process for Market Counterparty client money exclusion.

6.12.3(1)(a)

Standard written disclosure statement on loss of Client Money Provisions protection.

6.12.3(1)(b)

Standard disclosure clause on commingling/use of excluded client money.

6.12.3(1)(c)

Distribution-event treatment disclosure clause tailored to the firm's Domestic/non-Domestic status.

6.12.3(2)

Written acknowledgement capture process, separate from the initial consent to exclusion.

6.12.4

Distribution Event response plan/procedure aligned to the Client Money Distribution Rules.

6.12.5(1)(a)

Consolidated client money/client assets compliance evidence file.

6.12.5(1)(b)

Detailed client money ledger/general ledger entries with supporting documentation for every movement.

6.12.5(1)(c)

Cheque receipt-and-forwarding log tracking receipt date and forwarding date.

6.13.1

Establish an asset-classification procedure that tags client-held investments as 'Client Investments' in books and records, with an exclusion test for Fund Property.

6.13.1A

Extend the asset-classification/wallet-tagging framework to Crypto Tokens, tagging each as 'Client Crypto Token' unless Fund Property.

6.13.2

Implement a documented safeguarding framework (custody systems, access controls, segregation, security protocols) covering Client Investments and Client Crypto Tokens.

6.13.3(1)

Implement and document compliance with all applicable App6 Safe Custody Provisions (registration, reconciliation, statements, permissions, etc.).

6.13.4

Produce a standard Collateral disclosure document covering all required items, issued before Collateral is taken from a Client.

6.13.5

Use a standard third-party notification letter/agreement clause covering segregation and lien-limitation wording for every third-party Collateral deposit.

6.13.6(1)

Establish a third-party due-diligence/suitability assessment process (financial standing, regulatory status, custody controls) applied before appointment and on an ongoing basis.

6.13.6(2)

Maintain a documented suitability assessment file for each third-party Collateral holder, retrievable on request.

6.13.7(1)

Implement ongoing monitoring of third-party custodians' safeguarding arrangements (periodic confirmations, review of custodian audit/assurance reports).

6.13.7(2)

Establish an escalation/withdrawal procedure triggered by safeguarding failures, with a Client written-consent override process.

6.13.8

Implement a six-monthly Collateral statement generation and distribution process compliant with A6.8 content requirements.

6.13.9

Implement a Collateral reconciliation process (internal records vs third-party/custodian records) per A6.9 methodology and frequency.

6.13.10(1)

Maintain a double-entry bookkeeping-based ledger system recording all Client Investment/Crypto Token/Collateral transactions with narratives, chronological entries and current balances.

6.13.10(2)

Implement a document/data retention policy with a minimum six-year retention period and secure archiving for these records.

6.14.1

Create and maintain a dedicated, indexed Client Assets Pack containing all components specified in Rule 6.14.2.

6.14.2(a)

Create and maintain an index/master document mapping the location and retrieval method for every Pack component.

6.14.2(b)

Include current copies of the master Client Account lists (money and custody) in the Pack.

6.14.2(c)

Include the latest Client Money and Collateral/Custody reconciliation records in the Pack.

6.14.2(d)

Compile and file all Client written permissions/consents for use of safe custody assets into the Pack.

6.14.2(e)

Maintain a Third Party Agent register (full name, address, phone, email, and Client Account numbers) as a Pack component.

6.14.2(f)

File copies of all executed TPA agreements, side letters and acknowledgment letters in the Pack.

6.14.2(g)

Maintain a register of outsourced/operational third parties and branches with function descriptions, access instructions and transfer procedures.

6.14.2(h)

File copies of all executed operational third-party agreements and side letters in the Pack.

6.14.2(i)

Maintain a 'key persons' register identifying staff critical to Client Asset operations and reconciliations, with role descriptions.

6.14.2(j)

Include the current version of the firm's Client Asset systems/controls policies and procedures in the Pack.

6.14.3(1)

Implement a periodic review schedule/checklist for the Client Assets Pack.

6.14.3(2)

Implement a change-trigger process flagging relevant events (e.g. new TPA, staff change, new agreement) and updating the Pack within 5 business days.

6.14.4(2)(a)

Establish and document retrieval arrangements/procedures (contact points, access rights, handover protocol) enabling an insolvency officer to access the Pack within 48 hours.

6.14.4(2)(b)

Maintain internal retrieval capability (indexing, access rights, storage systems) enabling staff to produce any Pack document to DFSA within 48 hours.

6.14.4(3)

Store these three specific Pack components in a readily/immediately accessible format and location, distinct from the standard 48-hour retrieval arrangement.

6.14.5

Implement business-continuity/system-resilience arrangements (e.g. escrow, third-party hosting, continuity contracts) ensuring the relevant IT systems survive an insolvency event.

6.15.1

Produce a standard Direct Long-Term Insurance disclosure statement covering all required content items, issued to each Retail Client as part of the advice/arrangement.

6.16.3

Implement a documented appropriateness assessment process/questionnaire (knowledge, experience, financial capacity criteria) that must be completed and passed before any RSI account is opened or trade executed for a Retail Client.

6.16.4(1)

Produce a standard RSI risk-warning document containing the three mandated statements.

6.16.4(2)

Ensure the risk-warning delivery process issues the warning as a discrete document, with sufficient lead time before account opening, separate from other onboarding paperwork.

6.16.4(3)(a)

Customize the risk warning template per product type to identify the specific RSI type and underlying reference factor offered.

6.16.4(3)(b)

Implement a data process to calculate the firm-wide loss-percentage statistic across all RSI Retail Client accounts over the trailing 12 months and embed it in the risk warning.

6.16.4(4)

Build a Group-level data-sharing process to obtain and disclose Group-wide RSI account loss statistics during the firm's first 12 months of business.

6.16.4(6)

Implement a quarterly client-communication process updating RSI Retail Clients with the latest loss-percentage statistics.

6.16.5(1)

Embed a standard prominent risk-warning banner/text at the top of every page of RSI marketing materials, websites, and distributed communications.

6.16.5(2)

Draft product-specific, plain-language risk-warning content for marketing materials, reviewed for clarity/comprehensibility.

6.16.5(3)

Implement technical/UX requirements so the risk warning is a fixed/sticky header visible during scroll and appears on every linked page of the website/app.

6.16.6(1)

Configure the trading platform/margin engine to enforce the applicable minimum Margin percentage by asset class before any position can be opened for Retail Clients.

6.16.7(1)

Implement real-time monitoring/alerting in the trading system tracking net equity against the 50% Margin threshold for every Retail Client account.

6.16.7(2)

Implement an automated (or promptly manual) margin close-out process that liquidates all open positions upon breach of the 50% threshold, executed to best-execution standards.

6.16.8

Configure the trading/margin system to automatically cap Client losses at account balance (zero out/write off any negative balance) and prohibit debt recovery beyond account funds.

6.16.9(1)

Establish and enforce a policy prohibiting bonuses, rebates, trading credits, gifts or other incentives linked to RSI trading for Retail Clients, applicable to staff and persons acting for the firm.

6.16.9(2)

Implement specific controls (e.g. approval workflow for promotions, monitoring of sales incentive schemes, surveillance of communications) targeting the incentive prohibition.

6.16.10

Implement payment-source verification controls (e.g. debit-card-only processing, source-of-funds checks) to prevent credit card/third-party credit funding of Margin.

6.16.11

Ensure each RSI product offered has either documented transparent third-party pricing or a firm-operated two-way quote system, verified before product launch.

6.16.12(1)

Implement a referral-source vetting policy that screens referrers' regulatory status and prohibits paying/rewarding unregulated referrers.

6.16.12(2)

Implement specific controls (referral intake approval workflow, reward-payment monitoring) targeting this prohibition.

6.16.13(1)

Implement an issuer due-diligence process assessing whether prospective RSI issuers meet the Authorised Firm/substantially-similar-regime test before the firm deals as agent, arranges, or advises on their products.

6.16.13(2)

Extend the issuer due-diligence process to cover referral arrangements, confirming issuer status before referring any Retail Client.

6.16.14(1)

Maintain a consolidated RSI compliance record-keeping framework covering appropriateness assessments, risk warnings, margin/close-out records, incentive controls, referral due diligence, etc.

6.16.14(2)

Apply a minimum six-year retention rule to all RSI compliance records within the document/data retention policy.

7.2.2(1)

Risk-location screening control in underwriting/policy issuance workflow that blocks or flags contracts covering State-based risks not falling within the DIFC/FFZ or reinsurance exceptions.

7.2.2(2)

Pre-placement risk-location check embedded in the intermediary's new business acceptance process.

7.2.2(3)

Pre-engagement risk-location check embedded in the Insurance Manager's client/contract onboarding process.

7.2.3

Business-line composition control that monitors the classes of General Insurance Business written alongside Long-Term Insurance Business.

7.2.4

Cell-attribution control within the policy administration/accounting system ensuring every contract of insurance is booked to a specific Cell.

7.2.5

Activity-approval control requiring any proposed non-core activity to be assessed against the 'direct connection' test before it is undertaken.

7.2.6

DFSA approval tracking control that blocks underwriting on behalf of any Non-DIFC insurer for Retail Client business until written DFSA approval for that specific insurer is on file.

7.3.1(1)

Financial promotions/communications review and sign-off process (marketing material, client letters, digital content) against a clear/fair/not-misleading standard.

7.3.1(2)

Contract/wording review control that screens all client agreements and communications for clauses purporting to limit or exclude DFSA-legislation duties or liabilities.

7.3.1(3)

Marketing material approval workflow applying section 3.2 requirements specifically to Direct Long-Term Insurance marketing content.

7.4.1

Standardised duty-of-disclosure explanation script/document (proposal form wording, verbal script, or disclosure notice) covering the duty and the consequences of non-disclosure.

7.4.2

Standard wording/notice on proposal and claim forms (or verbal script) explaining the Client's responsibility for accuracy of information provided.

7.4.3

Escalation procedure for suspected inadequate client disclosure, including a follow-up request template and a decision framework for declining to act.

7.5.1(1)-(2)

Standard pre-contract disclosure statement/template capturing insurer identity, firm identity and claims-notification contact details.

7.5.2(1)-(2)

Ownership-interest conflict disclosure statement covering cross-shareholdings of 10% or more between the firm and any insurer(s) it deals with.

7.5.3(1)

Standard 'basis of advice' disclosure statement classifying the intermediary's market-analysis basis for Retail Client engagements.

7.5.3(2)

Maintained, up-to-date list of insurers dealt with, ready to be issued to a Retail Client on request.

7.5.3(3)

Standard capacity-disclosure statement (agent vs independent broker) issued before service commencement.

7.6.1

Standard cost-disclosure statement/quotation template itemising premiums, fees, charges and taxes payable by the Client.

7.6.2

Credit-facility cost disclosure addendum used whenever premium financing is offered to a Retail Client.

7.6.3

Pre-imposition disclosure control requiring sign-off and client notification before any new cost/fee/charge is applied to an existing arrangement.

7.6.4(1)

Commission/economic-benefit disclosure process able to produce a client-specific breakdown of commissions and benefits received on request.

7.7.1

Pre-sale information pack/checklist ensuring comprehensive, timely delivery of product information ahead of the Client's decision.

7.7.2(a)

Key features document template covering cover/benefits, restrictions/exclusions/conditions, and period of cover for each product line.

7.7.2(b)

Comparison disclosure template explaining differences and relative costs across similar insurance options presented to the Client.

7.7.3

Long-Term Insurance disclosure document template covering bonus methodology, surrender/paid-up values, unit-linked definitions, projection basis and material investment risk factors.

7.8.1

Suitability assessment process (per section 3.4) applied specifically to Direct Long-Term Insurance business with Retail Clients.

7.8.2(1)

General Insurance suitability check embedded in the recommendation/sales process for Retail Clients.

7.8.2(2)

Fact-find/needs-analysis form capturing the Retail Client's circumstances and objectives for General Insurance recommendations.

7.8.3

Mismatch-disclosure script/document used whenever a recommended contract does not fully meet the Client's identified requirements.

7.8.4

Written 'instruction contrary to advice' confirmation form to be completed before proceeding against the firm's own advice.

7.9.1(1)

Conflicts of interest policy and register with procedures for identifying and managing conflicts affecting Clients.

7.9.1(2)

Written conflict-of-interest disclosure template (general disclosure statement and transaction-specific disclosure).

7.9.1(3)

Escalation and decision procedure for declining to act where a conflict cannot be adequately managed.

7.10.1

Insurer due-diligence/legal-capacity check performed before placement, covering the insurer's and risk's jurisdictional legality.

7.10.2

Quotation accuracy/verification step confirming terms quoted are actually obtainable from the insurer before issue to the Client.

7.10.3(1)

Contract documentation and finalisation workflow with defined turnaround targets for capturing agreed terms and issuing the finalised contract.

7.10.3(2)

Confirmation-of-cover issuance process triggered on binding of new business and on any policy change.

7.10.3(3)

Follow-up policy documentation dispatch process for cases where full documents were not bundled with the confirmation of cover.

7.11.1(1)

Policy amendment processing workflow with turnaround targets and standard premium/charge disclosure on amendment.

7.11.1(2)

Amendment confirmation and return-premium remittance process triggered on completion of each policy amendment.

7.11.2

Automated renewal/expiry notification process with a defined advance-notice period ahead of each policy's renewal/expiry date.

7.11.3

Post-termination document release process responding to Client requests for policy documentation and information.

7.11.4(a)

Claims guidance service/script for responding to Client requests for help in pursuing a claim.

7.11.4(b)

Claims handling procedure with fairness standards, processing time targets, and a defined client progress-update cadence.

7.11.4(c)

Written notification template for informing a Client, with reasons, that part of a claim cannot be dealt with by the Intermediary.

7.11.4(d)

Claims settlement forwarding process with a defined turnaround from agreement of settlement to funds/forwarding to the Client.

7.11.5(a)

Claims handling procedure embedding fairness standards and processing time targets for claims handled directly by the Insurer.

7.11.5(b)

Defined client progress-update cadence for open claims (e.g. milestone or time-based updates).

7.11.5(c)

Claims rejection review/sign-off control requiring documented justification before any claim is declined.

7.11.5(d)

Partial-acceptance notification template setting out accepted amount/scope and reasons for the rejected portion.

7.11.5(e)

Claims settlement processing workflow with a defined turnaround target from claim acceptance to payment.

7.12.5(1)(a)

Segregated Insurance Bank Account(s) opened and maintained with an Eligible Bank, distinct from the firm's own funds.

7.12.5(1)(b)

Standardised IBA account-naming control applied when opening or renaming any Insurance Bank Account.

7.12.5(1)(c)

Bank notice/acknowledgement letter template requesting no-combination/no-set-off confirmation, issued before operating any new IBA.

7.12.5(1)(d)

Cash-handling process ensuring Insurance Monies received are banked directly into the IBA without passing through other accounts or delay.

7.12.5(1)(e)

IBA transaction-purpose control restricting all IBA debits/credits to the permitted purpose list.

7.12.5(1)(f)

Client money resourcing/reconciliation calculation comparing IBA + Approved Assets + recoverable debtors against amounts due to insurance creditors.

7.12.5(1)(g)

Deficiency escalation and remediation procedure triggered immediately upon identification of a client money shortfall.

7.12.5(2)

Confirmation-deadline tracking control that triggers a mandatory bank switch if no written confirmation is received within 40 business days.

7.12.6

IBA loan/overdraft approval control verifying all three conditions (designation, purpose compliance, temporary/prompt repayment) before any facility is drawn.

7.12.7

Asset-holding control restricting Insurance Monies to IBAs or defined Approved Assets only.

7.12.8

Approved Asset registration/custody control verifying correct titling or custodial arrangement for every Approved Asset held.

7.12.9

Proceeds-routing control ensuring non-interest proceeds from Approved Asset transactions are deposited into the IBA.

7.12.9A(1)

Offshore-IBA disclosure notice template covering all five required disclosure points, issued before Insurance Monies are held offshore.

7.12.9A(2)

Client objection-handling process with a 20-day deadline to transfer or return monies following an objection to offshore holding.

7.12.10

Bank notice/confirmation process for Approved Assets custody, mirroring the IBA no-set-off confirmation requirement, completed before Approved Assets are used to hold Insurance Monies.

7.12.11

Security-pledge approval control ensuring Approved Assets are only pledged as security where the underlying facility meets the 7.12.6 conditions.

7.12.12

Credit-rating monitoring control for Approved Assets with a mandatory disposal trigger and 30-day deadline on downgrade below the minimum threshold.

7.12.13

Derivatives-use restriction control limiting any derivative transactions involving Insurance Monies to prudent FX risk management purposes only.

7.12.14

Untraceable-client-balance write-off procedure requiring documented tracing efforts, a six-year ageing check, and a resourcing-requirement check before any credit is taken.

7.12.15

Six-year record retention schedule specifically for sums withdrawn/realised under the 7.12.14 untraced-client credit process.

8.2.1

Establish a rating-quality assurance framework (analytical standards, review checkpoints) ensuring every rating is based on complete, fair analysis of available relevant information.

8.2.2

Implement an independence and conflicts-of-interest governance framework covering ownership structure, business relationships and Employee conflicts affecting rating decisions.

8.2.3

Maintain a transparency and responsible-conduct framework (disclosure standards, due-diligence procedures) governing rating activities.

8.3.1(1)

Develop and maintain a documented Rating Process Policy covering analysis standards, methodology/model documentation and analyst-adherence controls.

8.3.1(4)

Implement an on-going monitoring/testing programme (e.g. compliance monitoring plan or internal audit) over the rating-process policies and controls.

8.3.2(a)-(c)

Build and maintain a methodology/model governance framework including validation testing and a periodic review cycle.

8.3.2(d)

Publish current methodologies/models and any material changes via the CRA's public disclosure channel (e.g. website).

8.3.3

Establish analyst competency, access-provisioning and conduct standards: recruitment/training criteria, data access rights, QA review of methodology application, bias-avoidance measures and an integrity code.

8.3.4(a)

Define and document that final rating decisions are made by the CRA via a formal Rating Committee, not by individual analysts.

8.3.4(b)

Implement information quality-assessment controls (source verification, data-quality checks) applied before information is used in a rating.

8.3.4(c)

Build a rating-content review/sign-off checklist confirming completeness, accuracy and required limitation disclosures before publication.

8.3.4(d)

Implement a 'no-rating' escalation/decision protocol for cases involving inadequate information or excessive complexity.

8.3.5(1)

Establish an on-going surveillance programme with dedicated resourcing, a scheduled review cycle and event-triggered review procedures.

8.3.5(3)

Implement a Rating Action notice template and prompt publication/distribution process.

8.3.5(4)

Implement an immediate-withdrawal protocol triggered when information adequacy can no longer be assured.

8.4.1(a)

Maintain a legal/regulatory compliance monitoring programme covering all jurisdictions in which rating activities are carried out.

8.4.1(b)

Establish fair-dealing conduct standards and a complaints-handling process covering Rating Subjects, investors and other users.

8.4.1(c)

Implement a prohibition on pre-rating outcome assurances, including staff training and pre-engagement communication controls.

8.5.1(a)

Maintain a documented code of conduct/ethics promoting independence and objectivity in rating decisions.

8.5.1(b)

Implement rating-decision governance controls (e.g. a Rating Committee protocol) restricting inputs to methodology-relevant factors only.

8.5.1(c)

Establish a conflicts-of-interest identification, register and mitigation/disclosure framework.

8.5.2(1)

Implement a prohibition/control preventing provision of consultancy or advisory services to Rating Subjects and their Related Parties.

8.5.2(3)

Define an approved ancillary-services catalogue supported by a documented COI assessment and mitigation controls for each service type.

8.5.2(4)

Implement operational/functional separation arrangements (staffing, systems, premises) between the CRA and any Group entity providing such services.

8.5.3

Implement a fee-arrangement approval control prohibiting contingent/success-based fee structures.

8.5.4

Implement a firm-level restricted-list/trading-prohibition control covering Rating Subjects and their Related Parties.

8.6.1

Establish a personal-relationship/independence policy, including disclosure of personal relationships with Rating Subjects, with conflict-avoidance requirements.

8.6.2(1)

Implement a segregation-of-duties control between analytical staff and fee-negotiation/commercial staff.

8.6.2(2)

Implement personal-account-dealing (PAD) restrictions covering involved employees and their close relatives with respect to relevant Rating Subjects.

8.6.3(1)

Implement a material-interest disclosure and recusal control for rating-team staffing.

8.6.4

Implement a 'look-back' review procedure triggered by a departing analyst's move to a Rating Subject/Related Party.

8.6.5

Design reporting-line and remuneration structures for rating staff that are independent of commercial/business-generation functions.

8.6.6

Implement remuneration/performance-appraisal design controls that exclude rating-related revenue metrics for relevant staff.

8.6.7

Establish a periodic (at least annual) formal review programme of remuneration policies affecting rating staff.

8.7.1(1)

Establish a disclosure policy and publication process covering ratings, distribution policy, and methodology/assumption information.

8.7.2

Implement a communications review/approval control (marketing, press releases, public statements) to ensure clarity and fairness.

8.8.1(1)(a)

Implement a rating publication process ensuring prompt, non-selective, free public release.

8.8.1(1)(b)-(e)

Build a rating-report content template/checklist embedding all required disclosure elements.

8.8.1(2)

Implement a press-release content checklist/template aligned to the underlying rating.

8.8.1(3)

Implement a pre-publication notice process to the Rating Subject with a defined minimum notice window.

8.8.1(4)

Ensure all mandatorily published information is also posted on the firm's public website.

8.8.2(1)

Implement an annual fee-disclosure process covering unrelated-benefit disclosure and single-client revenue-concentration monitoring/disclosure.

8.8.3

Add a mandatory public/non-public information-status disclosure to structured-finance rating reports.

8.9.1(a)

Implement a confidential-information use policy and purpose-limitation controls.

8.9.1(b)

Implement a confidential-information disclosure control requiring documented consent or a legal basis before any external disclosure.

8.9.1(c)

Implement pre-publication confidentiality controls restricting knowledge/disclosure of pending Rating Actions to authorised persons only.

8.9.2

Extend confidentiality controls explicitly to all external-facing channels (press, conferences, informal conversations, future-employer communications).

8.9.3(a)

Implement physical and information security controls (access controls, data security, asset protection) safeguarding CRA property and records.

8.9.3(b)

Implement a third-party information-sharing control requiring Compliance clearance consistent with the 8.9.1(b) exceptions.

8.10.1(1)(a)

Implement a rating-file record-keeping system capturing all required elements per rating with a minimum six-year retention period.

8.10.1(1)(b)

Maintain a dedicated fee-accounting record set for all services provided, retained for at least six years.

8.10.1(1)(c)

Maintain subscriber-level accounting records retained for at least six years.

8.10.1(1)(d)

Maintain a version-controlled archive of all rating procedures, methodologies, models and assumptions, including historical versions.

8.10.1(1)(e)

Implement a communications archiving system capturing internal/external (including electronic) communications relevant to rating activities.

9.2.1(1)

Maintain a documented ATS operating framework (rulebook/policy suite) covering the five pillars: Operating Rules, Access Criteria, Investment Criteria, Technology Resources and Proper Markets arrangements.

9.2.1(2)

Implement a breach-identification and DFSA-reporting procedure specifically covering breaches of the Operating Rules.

9.2.2(1)(a)-(d)

Draft Operating Rules and obtain legal review/opinion confirming objectivity, non-discrimination, clarity/fairness and binding enforceability, including through member agreements.

9.2.2(1)(e)

Publish the MTF Operating Rules on a publicly accessible website/portal and ensure their application involves no discretion.

9.2.2(2)

Include specific member-conduct obligations and staff/access-person professional-standards requirements within the Operating Rules.

9.2.2(3)

Maintain a content checklist confirming the Operating Rules cover all six mandated categories of content.

9.2.3(3)

Prepare and submit a material-change notification pack to the DFSA at least 30 days before implementation.

9.3.1(2)(a)-(c)

Obtain a signed jurisdiction and governing-law submission agreement from each prospective (c)/(d) member before admission.

9.3.1(2)(d)

Require and verify appointment of a DIFC process agent for each such member and monitor that the appointment remains in place on an ongoing basis.

9.3.1(3)

Conduct and document a member due-diligence assessment covering repute, competence/experience and organisational/financial/technological resources before admission.

9.3.1(4)

Conduct a Token-member due-diligence assessment covering repute/competence, resource adequacy and operational risk.

9.3.2

Embed Direct Electronic Access eligibility restrictions in the Operating Rules and member agreements, with verification of sub-delegate users.

9.3.3

Implement pre-trade risk controls/thresholds, DEA order-tagging/identification capability, and a kill-switch for DEA participants.

9.3.4

Implement an ongoing member-compliance monitoring/surveillance programme with remediation tracking.

9.4.1(a)

Implement an instrument/token admission eligibility-screening and approval process against the specified routes, with ongoing monitoring of Reporting Entity compliance for Security Tokens.

9.4.1(b)

Maintain an instrument information/disclosure facility accessible to members and their clients.

9.4.2(1)&(3)

Perform, and periodically refresh, Price Information Provider due-diligence assessments against the criteria in Rule 9.4.2(3).

9.5.1(1)(a)

Maintain adequately resourced and capacity-tested trading/IT infrastructure for the facility.

9.5.1(1)(b)

Set and enforce minimum technology/connectivity standards for members and participants.

9.5.1(2)

Establish an IT governance framework comprising change-management procedures, a pre-production testing protocol aligned to AMI App 1, system performance monitoring/reporting, and resilience/BCP/data-integrity controls.

9.5.2(1)

Establish a periodic systems and controls review cycle scaled to the business's risk profile.

9.5.2(2)

Document and maintain a formal SDLC/testing methodology aligned with recognised industry standards.

9.6.1(1)(c)

Implement an instrument suspension/removal procedure triggered by ongoing eligibility breaches.

9.6.1(1)(g)

Implement and validate a documented, non-discretionary order-matching algorithm.

9.6.2

Implement a pre-trade market-data dissemination feed (order-book depth, best bid/offer) available continuously during trading hours.

9.6.3

Implement a post-trade market-data publication feed meeting near-real-time and non-discretionary access standards.

9.6.4(1)

Conduct capacity and stress testing of trading systems and document resilience controls within the Operating Rules.

9.6.4(2)(a)

Implement automated pre-trade order validation/rejection controls (price and size collars).

9.6.4(2)(b)

Implement circuit-breaker/trading-halt functionality with defined trigger thresholds.

9.6.4(2)(c)

Implement a documented trade cancellation/amendment procedure and supporting system capability.

9.6.5(1)&(3)

Publish a comprehensive Error Trade Policy within the Operating Rules and implement supporting system capability to action it.

9.6.5(4)

Implement error-trade prevention controls, detection/surveillance alerts, and a rectification workflow linked to disorderly-market assessment.

9.6.6(1)(a)

Implement short-sale order flagging/monitoring controls and related procedures.

9.6.6(1)(b)

Implement position concentration monitoring, thresholds and alerts.

9.6.6(2)

Embed member powers (e.g. forced close-out, position limits, sanctions) in the Operating Rules to manage unsettled-position risk.

9.6.7

Implement a foreign-ownership-restriction monitoring system with automated breach alerts and a suspend/reinstate trading procedure.

9.6.8(1)(a)

Establish an eligibility due-diligence and written-agreement process for liquidity incentive scheme participants.

9.6.8(1)(b)

Submit the liquidity incentive scheme proposal to the DFSA for approval before launch.

9.6.8(3)

Prepare and lodge a scheme-notification statement with the DFSA at least 10 days before the expected approval date.

9.6.8(5)

Issue a market notice/announcement of the approved scheme.

9.6.9(1)(a)

Implement a market abuse surveillance system (trade/order surveillance, alerts, case management).

9.6.9(1)(b)

Implement an immediate DFSA notification procedure for suspected Market Abuse.

9.6.9(2)(a)

Draft and publish a Market Abuse Prevention Regime as part of the Operating Rules.

9.6.9(2)(b)&(3)

Establish a member Market Abuse compliance oversight programme covering the five minimum elements.

9.6.10(1)(a)

Add a Market Abuse control-adequacy assessment to the member onboarding due-diligence process.

9.6.10(1)(b)

Implement a periodic member compliance review programme for Market Abuse regime adherence.

9.6.10(1)(c)

Implement a remediation-enforcement procedure for member Market Abuse regime breaches.

9.6.10(2)

Implement a DFSA notification trigger for material member Market Abuse breaches and non-rectification cases.

9.6.11(1)(a)

Establish/contract satisfactory clearing and settlement arrangements for all facility transactions.

9.6.11(1)(b)

Publish/disclose clearing and settlement arrangement details to members.

9.6.11(2)(a)

Vet and approve clearing/settlement providers against licensing/equivalence criteria before use.

9.6.11(2)(b)

Submit clearing/settlement arrangement (and change) notifications to the DFSA at least 30 days in advance and await non-objection.

9.6.11(3)

Restrict MTF Crypto Token clearing/settlement rails to fiat currency or approved Suitable Fiat Crypto Tokens.

9.7.1

Implement a prohibition and system control preventing the ATS Operator (or its proprietary desks) from trading against facility orders using own capital.

9.8.1

Review and control marketing/branding naming conventions for each facility to ensure compliant terminology use.

10.2.1(1)(a)

Establish CSD rules/procedures and accounting controls safeguarding securities issue integrity.

10.2.1(1)(b)

Establish safekeeping/transfer risk-management rules and procedures (custody controls, transfer authorisation controls).

10.2.1(2)

Ensure book-entry recording of securities is completed before trade date for all securities issues.

10.2.1(3)(a)

Implement access controls and system safeguards preventing unauthorised issuance/deletion entries.

10.2.1(3)(b)

Implement an intraday reconciliation process between securities-issue totals and participant account records.

10.2.1(3)(c)

Establish cooperation/information-sharing agreements or protocols with issuers, registrars, agents and other CSDs involved in reconciliation.

10.2.1(3)(d)

Implement controls preventing securities account overdrafts/debit balances (pre-trade/pre-settlement checks).

10.2.2(1)(a)

Conduct a pre-link risk identification and assessment (credit, concentration, liquidity, operational).

10.2.2(1)(b)

Implement ongoing risk monitoring/management systems and controls for each CSD link.

10.2.2(1)(c)

Compile a CSD-link compliance dossier evidencing satisfaction of all Rule 10.2.2(2) requirements and present/submit it to the DFSA prior to establishment.

10.2.2(2)(a)

Negotiate and embed risk-mitigation provisions in the CSD link agreement.

10.2.2(2)(b)

Obtain and verify evidence that each linked CSD operates robust daily reconciliation procedures.

10.2.2(2)(c)

Implement intermediary-risk measurement/monitoring systems and controls where an intermediary is used to operate the link.

10.2.2(2)(d)

Implement DVP settlement for linked-CSD transactions where feasible, or prepare and submit a reasoned non-DVP notification to the DFSA where not feasible.

10.2.2(2)(e)

Configure interoperable settlement infrastructure to provide identical transfer-order entry moments, order irrevocability, and settlement finality.

11.3.1(1)

Publish a standing Risk Warning statement covering the five prescribed risk categories on the website home/landing page and any app or portal used to access the service.

11.3.1(2)

Add a Property Investment Crowdfunding-specific risk warning section to the website/platform disclosures.

11.3.2(1)-(2)

Build and publish a default/failure-rate statistics page or report, together with documented assumptions underlying the expected rates.

11.3.2(3)-(4)

Implement a quarterly arrears-ageing report generation and publication process with a 7-day post-quarter-end deadline.

11.3.3(1)

Maintain a comprehensive 'How the Service Works' disclosure document/webpage covering all items in Rule 11.3.3(1)(a)-(r).

11.3.3(2)

Produce Property Investment Crowdfunding-specific disclosure content (property selection criteria, SPV structure) for the public website and per-investment disclosure content (income, rights, service providers, expenses, term) for the investor-facing platform.

11.3.4

Maintain a corporate structure/policy ensuring any unregulated crowdfunding activity (e.g. reward/donation-based) is conducted through a separate legal entity, not the Authorised Firm.

11.3.5

Implement an onboarding eligibility check confirming borrower/Issuer legal entity status as a Body Corporate before platform access is granted.

11.3.6(1)

Implement a mandatory pre-onboarding due diligence process/checklist for all borrowers, Issuers and sellers.

11.3.6(2)

Build a standardised due diligence checklist/template capturing each of the ten verification items in Rule 11.3.6(2)(a)-(j), including external credit-agency and background checks.

11.3.6(3)

Build a property-specific due diligence checklist covering seller identity, title verification, property condition survey, construction-completion confirmation, and lettability/planning-permission check.

11.3.7(1)

Produce a standardised per-listing disclosure profile/factsheet for each borrower/Issuer covering all items in Rule 11.3.7(1)(a)-(n) before the listing goes live.

11.3.7(2)

Produce a standardised per-property disclosure profile covering all items in Rule 11.3.7(2)(a)-(h), incorporating the independent valuation report, before the property is listed.

11.3.7A(2)

Build a standard financial-ratio calculation template computing all seven prescribed ratios from the borrower's financial data for disclosure on the platform.

11.3.7A(3)

Standardise the ratio disclosure format/template to include explanatory notes, multi-year coverage, comparability formatting, and an audited/unaudited flag.

11.3.7A(4)

Implement a ratio-verification control (internal review or third-party engagement) and a corresponding verification-statement disclosure alongside published ratios.

11.3.8(1)(a)

Implement a marketing approval control ensuring no external advertisement names or details a specific live proposal beyond the permitted limited information (area/price for property; industry, purpose, funding amount for loan/investment).

11.3.8(1)(b)

Include contractual restrictions in Client Agreements with borrowers/Issuers/sellers prohibiting off-platform advertising of specific proposals, and monitor for breaches.

11.3.9(3)

Implement a material-change response workflow with platform disclosure, direct notification to committed lenders/investors, a 5-business-day reconfirmation window, and automatic cancellation logic for non-reconfirmation.

11.3.9(4)

Implement a post-commitment-period material-change disclosure process covering change details, rights impact and proposed operator action.

11.3.10

Include an exclusivity clause in Client Agreements with borrowers/Issuers/sellers prohibiting parallel listings on other crowdfunding platforms during the commitment period, and monitor compliance.

11.3.11

Implement platform functionality/controls ensuring simultaneous, uniform release of listing information to all eligible lenders/investors (no early or selective access).

11.3.12

Publish a standing disclosure notice on the platform (near/within the auto-lending/investing feature) warning of preferential access risk.

11.3.13

Publish a standing 'no suitability assessment' disclosure within the auto-lending/investing feature interface.

11.3.14

Implement a staff-dealing/conflicts policy prohibiting personal transactions on the platform by staff and family members, with a personal account dealing declaration and monitoring mechanism.

11.3.15(a)

Publish a standing disclaimer on the forum stating it is not due-diligence-checked by the operator, with a reference/link to the forum from relevant proposal pages.

11.3.15(b)

Implement access controls on the forum restricting posting rights to verified platform Clients only.

11.3.15(c)

Ensure forum design provides uniform visibility of posts to all Client users with no tiered/preferential access.

11.3.15(d)

Build a mandatory affiliation/compensation disclosure prompt or posting rule into the forum posting process (e.g. terms of use, posting checkbox).

11.3.15(e)

Implement forum content moderation controls (manual review and/or automated filtering) to detect misleading or fraudulent posts.

11.3.15(f)

Implement a takedown procedure enabling immediate removal/amendment of non-compliant forum posts upon detection.

11.3.15(g)

Establish an internal policy restricting operator staff forum activity to moderation-only actions, with no promotional or discussion participation.

11.3.16(a)-(e)

Build eligibility and information-access controls into the transfer/resale facility restricting participation to existing platform Clients transferring whole positions in platform-originated loans/Investments, with full information disclosure to transferees.

11.3.16(f)

Implement a cost-based fee-setting methodology for the transfer facility, with periodic cost-recovery reconciliation.

11.3.17(1)

Implement and document IT resilience, business continuity/disaster recovery, and data integrity controls (e.g. redundancy, backups, BCP/DR plan, data validation controls).

11.3.17(2)

Establish an annual IT control adequacy review cycle.

11.3.18

Develop and maintain a documented business cessation/wind-down plan, including third-party arrangements needed to implement it.

11.3.19

Establish an annual business cessation plan review and update cycle.

11.3.20

Implement payment-processing controls that block or reject credit-card payments from Retail Clients (e.g. card-type validation at the payment gateway), while permitting debit cards.

11.4.1

Use a standardised, legally vetted written loan agreement template generated/executed for every loan transacted on the platform.

11.4.2

Implement automated pre-transaction limit checks in the platform enforcing the per-borrower and annual aggregate lending caps for Retail Clients.

11.5.1

Implement a mandatory signed risk-acknowledgement form (electronic or physical) as a gating step before Investment commitment for every Retail Client Investment.

11.5.2

Implement a cooling-off withdrawal mechanism on the platform allowing penalty-free cancellation for at least 48 hours after the commitment period ends.

11.5.3

Implement automated pre-transaction limit checks enforcing the per-Investment and annual aggregate investment caps for Retail Clients.

11.6.2

Implement a property eligibility screening checklist confirming single-title-deed status and residential-use classification before listing.

11.6.3(1)-(2)

Establish a panel of pre-vetted independent valuers (checked for independence and lack of relation to operator or seller) and commission a valuation for every property before listing.

11.6.3(3)

Require valuers to deliver reports against a defined content checklist covering all items in Rule 11.6.3(3)(a)-(f) before acceptance.

11.6.3(4)

Implement a valuation-currency control tracking valuation date against listing date and sale date to ensure the three-month window is met.

11.6.3(5)

Implement a publication workflow that posts the valuation report to the platform immediately upon receipt/finalisation.

11.6.4

Implement a mandatory signed risk-acknowledgement form as a gating step before property Investment commitment for every Retail Client.

11.6.5

Implement a cooling-off withdrawal mechanism for property Investments allowing penalty-free cancellation for at least 48 hours after the commitment period ends.

11.6.6

Implement an SPV-formation process requiring a dedicated, single-property SPV to be incorporated and hold title before/at listing.

11.6.7(a)

Verify sole ownership of each property by its SPV as part of the pre-listing eligibility check.

11.6.7(b)

Verify at listing that 100% of the SPV shares/interests representing the property are offered, rejecting partial-interest listings.

11.6.8

Implement automated pre-transaction limit checks enforcing the per-property and annual aggregate investment caps for Retail Clients.

11.6.9

Implement a remuneration-source policy and third-party payment screening to ensure no fees are accepted from real estate agents, property managers, valuers, custodians or other service providers, and that all remuneration originates only from platform investors/sellers.

11.6.10

Implement a title/encumbrance monitoring control to confirm no mortgage or security interest is created over platform properties after listing.

12.2.1(a)

Maintain a documented conflicts-of-interest policy specific to the Scheme requiring member interests to be prioritised over firm interests.

12.2.1(b)

Information barriers and confidentiality controls restricting use of Scheme-related data to Scheme purposes only.

12.2.1(c)

Staff training and confidentiality/code-of-conduct undertakings covering misuse of Scheme information, with disciplinary sanctions for breach.

12.2.1(d)

Related Party Transaction (RPT) approval and market-benchmarking policy.

12.2.1(e)

Breach identification and DFSA notification procedure with defined materiality criteria.

12.2.2(a)

Pre-launch DFSA Scheme approval application pack (constitution, structure, key documents).

12.2.2(b)

Material-change assessment and DFSA re-approval procedure for Scheme amendments.

12.2.2A(2)(a)

Employer oversight-function charter confirming the employer's assumption of Supervisory Body-equivalent duties.

12.2.2A(2)(b)

Employer information-provision protocol delivering regular Scheme operating information to employers performing oversight.

12.2.2A(2)(c)

Constitution drafting requirement embedding the employer's appoint/remove-Operator power.

12.2.2A(2)(d)

Constitution covenant clause requiring employer fee negotiation and performance assessment rights.

12.2.3(a)

Dual-jurisdiction compliance monitoring programme mapping DIFC and host-jurisdiction requirements applicable to the Non-DIFC Scheme.

12.2.3(b)

Event-driven DFSA notification procedure for host-jurisdiction compliance-impact events.

12.2.4(a)

Scheme management procedures manual aligned to the Constitution and applicable legal requirements.

12.2.4(b)

Operator duties checklist derived from the Constitution, assigned to responsible roles.

12.2.4(c)

Administrator oversight framework (SLA/KPI monitoring) confirming Constitution/law-compliant performance.

12.2.5(a)

Legal compliance review/sign-off of the Constitution against DFSA legislation prior to adoption and on amendment.

12.2.5(b)

Mandatory Constitution clause confirming irrevocable holding of Scheme property for Members.

12.2.5(c)

Benefit-payment rules in the Constitution cross-checked against applicable legislation.

12.2.5(d)

Constitution clause establishing unpaid employer contributions as a recoverable Scheme debt, plus a debt-recovery procedure.

12.2.7

Third-party due diligence and authorisation verification procedure for Scheme-related delegates/outsource providers.

12.3.1

Standardised pre-membership disclosure document/pack covering all mandated information items.

12.3.2

Material-change notification procedure for pre-membership disclosure information.

12.3.3

Custody and asset-segregation arrangement with an Eligible Custodian, including clear Scheme-property identification/tagging.

12.3.4(a)

Annual Scheme property valuation process feeding into the annual report.

12.3.4(b)

Member-level benefit valuation and disclosure process aligned to the Constitution's valuation periods.

12.3.5(a)

Value-for-money assessment framework for Scheme fees/charges, benchmarked against recognised good-practice standards.

12.3.5(b)

Comparative fee benchmarking analysis against similar schemes in comparable jurisdictions.

12.3.5(c)

Fee-ceiling compliance check embedded in fee-setting and fee-change processes.

12.3.5(d)

Legal sign-off confirming each fee/charge type has an express basis in the Constitution/law/agreement before being levied.

12.3.5(e)

Fee disclosure communication issued at Member enrolment and upon any fee change.

12.3.5(f)

DFSA pre-approval procedure for material fee increases.

12.3.6(2)

Ring-fenced accounting treatment ensuring employer administration-cost payments are applied only to defray Scheme costs.

12.3.6A(a)

Salary Sacrifice agreement and employer-remittance process for voluntary contributions.

12.3.6A(b)

Unified contribution management process/system applying identical investment and administration handling to voluntary and mandatory contributions, while keeping them separately identifiable.

12.3.6A(c)

Voluntary contribution withdrawal control validating frequency/amount limits and Core Benefit impact before approving any withdrawal.

12.3.7

Payment Schedule document produced and maintained for every Participating Employer.

12.3.8(1)

Automated payment-due monitoring and Member notification process for missed employer contributions.

12.3.8(2)

Administrator-to-Operator escalation process for missed employer contributions.

12.3.9(1)(a)-(b)

Investment Platform product shelf including a capital-preservation option and a Shari'a-compliant option among the suite offered.

12.3.9(1)(c)

Investment option monitoring and removal procedure triggered by non-compliance with platform criteria.

12.3.9(1)(d)

Member protection/transition plan for investment option removals (e.g., default reinvestment, member communication, transition timelines).

12.3.9(2)

Mandatory Professional Adviser consultation step embedded in the investment option governance process.

12.3.9(3)

Documented rationale requirement for decisions that depart from Professional Adviser advice.

12.3.9(4)

Professional Adviser appointment due-diligence checklist covering authorisation, expertise and independence.

12.3.10(a)

Standard-form Investment Manager Agreement incorporating all mandated content items.

12.3.10(b)

Investment option information hub/document library accessible to Members and prospective Members.

12.3.10(c)

Free investment-switching facility with defined switching windows/intervals.

12.3.11(a)-(c)

Member register system maintained at the DIFC principal place of business with the required data fields.

12.3.11(d)

Register access request procedure for Members/Participating Employers.

12.3.12

Member/Employer enquiry-handling procedure with defined service standards (in addition to GEN 9.2 complaints handling).

12.4.1

Annual Scheme financial statements prepared under IFRS (or a DFSA-approved standard).

12.4.2(a)-(b)

Annual and half-year Scheme financial reporting process under IFRS/approved standard.

12.4.2(c)

Detailed Scheme accounting records system capturing all mandated data categories.

12.4.2(d)

Records retention policy specifying a minimum six-year retention period for Scheme accounting records.

12.4.2(e)

Accounting records access protocol for the Registered Auditor and DFSA.

12.4.3

Annual Member statement production and distribution process.

12.4.4

Exit statement generation process triggered by Member exit.

12.4.5(a)

Formal Scheme Auditor appointment.

12.4.5(b)

Audit engagement terms mandating IAASB-standard audit methodology.

12.4.5(c)

Annual Auditor's Report deliverable requirement.

12.5.1(a)

Prudent financial resource management framework/policy for the Scheme.

12.5.1(b)

Liquidity adequacy monitoring against forecast benefit payments and operating expenses.

12.5.2

Documented Scheme Liquidity Management Policy addressing liquid buffers, illiquid-asset limits, access to credit lines, and the specified input factors.

12.5.3(a)

Liquidity measurement, monitoring and stress-testing mechanism/toolset.

12.5.3(b)

Periodic adequacy assessment of liquidity policies under normal and stressed scenarios.

12.5.3(c)

Remediation action-tracking process for identified liquidity gaps/failures.

12.5.4(a)

Defined liquidity stress triggers and corresponding response measures (early-warning indicators/escalation thresholds).

12.5.4(b)

Prompt DFSA notification procedure for identified liquidity stress events.

13.2.1

Configure payment processing systems and client agreements to capture and enforce the agreed settlement currency for each transaction.

13.2.2(1)

Implement a policy and operational controls prohibiting cash handling in money services transactions, with a defined carve-out procedure for UAE Stored Value cash-out.

13.2.3

Maintain settlement accounts only with Central Bank-licensed banks for AED transactions and verify banking partners' licensing status.

13.3.1

Maintain a compliance evidence file/audit trail for each Money Service requirement sufficient to discharge the burden of proof in a dispute.

13.3.2

Establish third-party oversight controls (due diligence, contractual performance obligations, monitoring) for any outsourced parts of payment transaction execution.

13.3.3

Design and maintain client disclosure templates/delivery channels that meet the accessibility, durability, language and timing standards for all Chapter 13 disclosures.

13.4.1(a)

Implement the full A7.1 disclosure content and delivery requirements into client-facing documentation for money services.

13.4.1(b)

Implement the specific A7.1.1-A7.1.4 disclosure content into arranging/advising client documentation.

13.5.1

Incorporate the A7.2 rights/obligations framework (e.g. liability, authorisation, refund provisions) into client contracts and operational procedures.

13.5.2(a)

Apply the complete A7.2 rights/obligations framework to Payment Initiation Services client relationships.

13.5.2(b)

Identify and implement only the specified A7.2 sub-rules (A7.2.2, A7.2.3, A7.2.14, A7.2.15) into AIS client documentation and processes.

13.5.3

Perform a legal consistency review of all Client Agreement templates against App7 A7.2 and remove/amend any conflicting clauses.

13.6.1

Implement A7.3 requirements (e.g. safeguarding of funds, redemption rights, disclosure) into Stored Value product design and operations.

13.7.1

Implement client-onboarding eligibility checks/controls to restrict Payment Account provision to permitted client categories and purposes.

14.1.1(a)

Deploy permissioned-access DLT architecture with role-based access controls restricting who can access/update facility records.

14.1.1(b)(i)

Develop and document access/eligibility criteria (fit-and-proper style standards) for persons permitted to access or update the DLT-based facility records.

14.1.1(b)(ii)

Implement a network security and compatibility risk-assessment and mitigation framework covering all systems interfacing with the DLT application.

14.1.1(b)(iii)

Implement a due diligence and ongoing monitoring programme covering access-criteria compliance and security risk measures for facility participants/systems.

14.1.1(c)

Conduct and document a fit-for-purpose assessment of the DLT application against the rights/obligations it needs to support (e.g. voting, dividends).

14.1.1(d)

Benchmark the firm's DLT technology design and governance framework against recognised industry best practices and standards.

14.2.2(a)

Apply full Client classification and associated Client-protection obligations (e.g. KYC, disclosures, complaint handling) to each Direct Access Member.

14.2.2(b)

Draft/update Operating Rules to clearly articulate mutual duties and accountability mechanisms between the ATS Operator and Direct Access Members.

14.2.2(c)

Establish an investor redress/complaints mechanism compliant with GEN chapter 9 and publish/disclose it to all trading members.

14.2.2(d)

Publish a prominent DLT/Digital Wallet risk disclosure on the trading facility (e.g. platform landing page, member onboarding materials).

14.2.3(1)(a)

Implement UBO identification and verification procedures for corporate Direct Access Members as part of onboarding.

14.2.3(1)(b)

Implement a CDD/AML-CTF onboarding procedure that must be completed and cleared before a Direct Access Member is granted trading access.

14.2.3(1)(c)

Implement automated market surveillance tools/procedures to detect and escalate potential market manipulation or abuse by Direct Access Members.

14.2.3(1)(d)

Implement a listing/admission control ensuring only Investment Tokens with adequate (prospectus and ongoing) disclosure under MKT chapters 2, 4 and 6 are admitted and remain compliant.

14.2.3(2)(a)

Design and implement a collateral/margin management framework calibrated to the facility's settlement cycle.

14.2.3(2)(b)

Implement order-tagging and kill-switch functionality allowing identification and suspension of Direct Access Member orders/trading.

14.2.3(2)(c)

Implement technical and contractual controls (e.g. authentication, prohibition clauses, monitoring) preventing unauthorised third-party access via Direct Access Members' accounts.

14.2.3(2)(d)

Implement an Operating Rules compliance monitoring and remediation process for Direct Access Members.

14.2.3(3)

Resource and equip a front-line trading surveillance function (staff and systems) dedicated to monitoring Direct Access Member trading activity.

14.2.3(4)

Scope the annual technology audit engagement to explicitly cover DLT-embedded market integrity/AML/CTF/investor protection controls.

14.3.3(1)(a)

Conduct resilience, reliability and compatibility testing of the custody DLT application against trading/clearing facilities it interfaces with.

14.3.3(1)(b)

Implement client-level segregation architecture (e.g. segregated wallets/sub-accounts and ledger tagging) for custodied Investment Tokens.

14.3.3(1)(c)

Implement client instruction confirmation controls, transaction record-keeping systems, and a periodic reconciliation process for custodied Investment Tokens.

14.3.3(2)(a)

Perform and document a compatibility and risk assessment of the Digital Wallet architecture used for custody.

14.3.3(2)(b)

Implement and maintain a cyber security and data protection control framework (encryption, access controls, secure transmission protocols) for the custody technology.

14.3.3(2)(c)

Implement key management controls covering key generation, storage, password protection and encryption standards for cryptographic keys.

14.3.3(2)(d)

Implement risk-specific controls for each key storage/usage method used (e.g. hot/cold wallets, multi-signature, HSMs) including backup and recovery procedures.

14.3.3(2)(e)

Verify and document technical compatibility between the custody technology and each relevant trading/clearing facility's Operating Rules/protocols.

14.3.4

Establish a third-party custody provider due diligence and approval process verifying authorisation/regulatory equivalence before appointment.

14.3.5

Ensure the scope of the annual technology audit/report explicitly covers and confirms compliance with Rule 14.3.3 custody requirements.

14.4.2(1)-(2)

Produce and maintain a compliant key features document template for each Investment Token covering all mandated content elements (a)-(h).

14.4.2(3)

Build a pre-service disclosure timing control into the client onboarding/transaction workflow ensuring the key features document is delivered before service commencement.

14.5.1(2)(a)

Establish an annual independent technology audit programme with a qualified external auditor covering Chapter 14 technology resources/governance requirements.

14.5.1(2)(b)

Implement a regulatory filing control to submit the annual technology audit report to the DFSA within the 4-month deadline.

14.5.1(2)(c)

Maintain a documented due diligence file evaluating and confirming the auditor's relevant qualifications/expertise (e.g. CISA, CISM, CISSP, ISO/IEC 27000 accreditation) prior to appointment.

15.2.1

Map and implement all applicable ATS Operator obligations under COB 14.2 (access criteria, surveillance, systems resilience, fair access, etc.) into the Crypto MTF's operating rules and systems, excluding Rule 14.2.3(1)(d).

15.3.1(1)

Implement a pre-listing control that blocks admission to trading until a compliant key features document is published on the firm's website.

15.3.1(2)(a)-(n)

Maintain a key features document template/content checklist covering all mandated items (a)-(n) and populate it for each Crypto Token prior to listing.

15.3.2(1)

Implement an ongoing information monitoring and refresh process (or maintain reliable hyperlinks) for token-related data published on the website.

15.3.2(2)(a)-(f)

Build and maintain a data page/feed for each listed token covering all six minimum data points, sourced and refreshed regularly.

15.3.3(a)

Design and permanently display a due-diligence disclaimer banner on the forum.

15.3.3(b)

Implement access controls restricting forum posting rights to verified MTF members.

15.3.3(c)

Ensure the forum platform design provides non-discriminatory, equal visibility of posted content to all users.

15.3.3(d)

Build a mandatory disclosure prompt/field into the forum posting workflow requiring affiliation/compensation declarations.

15.3.3(e)

Implement forum content monitoring/moderation controls (manual or automated surveillance) to detect misleading, fraudulent or market-abuse-related posts.

15.3.3(f)

Establish a rapid takedown procedure for non-compliant forum posts.

15.3.3(g)

Set an internal policy/code of conduct prohibiting staff participation in forum discussions beyond moderation.

15.4.2

Extend the firm's existing COB 14.3 Digital Wallet Service Provider policies/controls (key management, segregation, reconciliation, etc.) to cover Crypto Token custody.

15.4.3

Perform and document due diligence confirming the appointed third-party custodian's regulatory status before appointment.

15.4.4

Implement an automated/manual transfer-confirmation notice process capturing all three required data points.

15.4.5(1)

Implement an incident-response procedure for erroneous/unauthorised transfers with a three-business-day remediation SLA.

15.4.5(2)(a)

Develop and maintain a documented detection-and-rectification policy/procedure for erroneous transfers.

15.4.5(2)(b)

Put in place and document a compensation arrangement sized to cover potential custody transfer losses.

15.4.5(3)

Conduct a formal annual adequacy review of the erroneous-transfer procedures and compensation arrangement.

15.4.6

Build a quarterly regulatory reporting process compiling the four required data points and submitting to DFSA within the two-week deadline.

15.4.7(1)

Ensure Client Agreements explicitly set out permitted grounds for restricting access, and implement an internal approval control requiring documented reasonable grounds before any restriction is applied.

15.4.7(2)

Implement a case-tracking process that triggers reinstatement of access promptly once the restriction grounds are resolved.

15.4.8

Implement a Client incident-notification procedure for major operational/security incidents.

15.5.1(1)

Implement a pre-service control requiring delivery of the key features document to the Client before onboarding/service provision.

15.5.1(2)

Implement a document review/refresh cycle for key features documents to keep them current.

15.5.1(3)

Define and enforce a minimum lead time for providing the key features document ahead of service provision within onboarding procedures.

15.5.1(5)

Implement a due diligence/review checklist for verifying third-party-prepared key features documents before use.

15.5.2(a)

Implement a version-control check confirming the white paper is current before distribution.

15.5.2(b)

Add author and publication-date attribution to all disseminated white paper materials/cover notes.

15.5.2(c)

Attach a standard disclaimer statement (non-preparation/non-verification and reliability caution) to all white paper distributions.

15.5.3(1)

Build and publish a standard risk-warning statement covering all six required elements on the firm's website.

15.5.3(2)

Embed the standard risk warning into all marketing/communication templates for Crypto Token materials.

15.5.3(3)

Implement technical/UI controls ensuring the risk warning is a fixed/sticky element visible on scroll and replicated across all linked pages.

15.6.2(2)

Design and implement a documented appropriateness assessment (knowledge/experience test plus loss-bearing capacity check) as a mandatory pre-trade gate for Retail Clients.

15.6.3(a)

Implement a policy and system control prohibiting extension of credit facilities to Retail Clients for Crypto Token trading.

15.6.3(b)

Implement payment controls (card-type verification/blocking of credit card transactions, source-of-funds checks) to prevent credit-funded purchases.

15.6.4(1)

Prohibit incentive-based promotions (bonuses, rebates, trading credits, gifts) targeted at Retail Client crypto trading in marketing/sales policy.

15.6.4(2)

Embed incentive-prohibition controls into systems, third-party/affiliate agreements, and staff conduct policies.

15.6.5(1)

Prohibit and control against launching Crypto Token lending products/facilities outside the permitted staking exception.

15.6.5(3)(a)

Develop and complete a borrower due diligence questionnaire/assessment covering all specified factors before onboarding a staking borrower.

15.6.5(3)(b)

Develop a standard staking risk-disclosure statement containing all required content elements and issue it to Clients before staking begins.

15.6.5(3)(c)

Implement a written consent capture step (e-signature or equivalent) in the staking onboarding workflow.

15.6.5(5)

Implement a change-monitoring and Client-notification process for material changes to staking arrangements (mechanism, fees, risks, etc.).

15.6.6

Review all marketing, website, and product terminology to eliminate prohibited terms unless the firm holds an MTF licence for Crypto Tokens.

15.6.7(1)

Implement a system control enforcing a minimum 50% Margin requirement before any Retail position can be opened.

15.6.7(2)

Implement real-time net equity monitoring against the 50% threshold for all Retail Derivative accounts.

15.6.7(3)

Implement an automated (or controlled manual) close-out process triggered by breach of the net equity threshold, applying best execution standards.

15.6.8

Configure account terms and systems so Retail Derivative losses cannot exceed the funds in the trading account (no negative-balance recovery from Retail Clients).

15.6.9

Implement a whitelist control restricting acceptable Margin assets to fiat currencies and DFSA-suitable Fiat Crypto Tokens.

15.6.10(a)

Extend the credit-facility prohibition control to cover Crypto Token Derivative trading.

15.6.10(b)

Implement payment controls to detect/block credit card or third-party credit funding of Margin payments.

15.7.2(a)

Configure and maintain permissioned-access architecture for the DLT platform used.

15.7.2(b)

Document and implement access criteria, risk controls, and a due diligence/monitoring programme for all persons permitted to update DLT records.

15.7.2(c)

Conduct and document a fit-for-purpose technology assessment of the DLT platform.

15.7.2(d)

Benchmark technology design/governance against recognised industry best practices/standards (e.g. security, fork-handling, outage management as noted in Guidance).

15.8.1(2)(a)

Engage a qualified independent technology auditor annually and obtain a formal written audit report.

15.8.1(2)(b)

Implement a regulatory filing process to submit the audit report to DFSA within the 4-month deadline.

15.8.1(2)(c)

Maintain a due diligence file evidencing the auditor's credentials/expertise and the firm's selection process.

A1.1.1

Order-receipt/decision record capturing: (a) client identity and account number; (b) date/time (local jurisdiction) instructions were received or the decision to deal was taken; (c) identity of the employee who received the instructions or made the decision; (d) the Investment/Crypto Token, including quantity or value and any price limit; (e) whether it is a purchase or sale.

A1.1.2

Execution record capturing: (a) client identity/account number for whom Executed, or indication it was an Own Account Transaction; (b) counterparty name; (c) execution date/time (local jurisdiction); (d) identity of the employee executing the transaction; (e) the Investment/Crypto Token including quantity or value and price; (f) purchase or sale indicator.

A1.1.3

Order-transmission record capturing: (a) identity of the person instructed; (b) terms of the instruction; (c) date and time the instruction was given.

A2.1.1

Build a Client Agreement assembly/completeness checklist in the document-generation system that maps each service/activity flag on the client record to the mandatory content modules (core info under A2.1.2, plus applicable addenda under A2.1.3-A2.1.8), and blocks issuance of an agreement missing a required module.

A2.1.2(1)(a)

Include a dedicated, current clause in the Retail Client Agreement template covering firm/group identification details; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(1)(b)

Include a dedicated, current clause in the Retail Client Agreement template covering regulatory status statement; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(1)(c)

Include a dedicated, current clause in the Retail Client Agreement template covering commencement/amendment/termination terms; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(1)(d)

Include a dedicated, current clause in the Retail Client Agreement template covering service description and restrictions statement; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(1)(e)

Include a dedicated, current clause in the Retail Client Agreement template covering fee/cost/charges disclosure; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(1)(f)

Include a dedicated, current clause in the Retail Client Agreement template covering conflicts of interest disclosure specific to that client relationship; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(1)(g)

Include a dedicated, current clause in the Retail Client Agreement template covering Soft Dollar Agreement disclosure; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(1)(h)

Include a dedicated, current clause in the Retail Client Agreement template covering complaints handling summary and free-copy-on-request statement; keep the clause synchronised with the underlying source data (e.g. fee schedule, conflicts register, complaints procedure) so it does not go stale.

A2.1.2(2)

Configure the document-generation system so Professional Client Agreements automatically pull only the (a),(b),(c),(e) content modules from the core-information library, rather than the full Retail Client set.

A2.1.3(a)

Include a dedicated clause in the Investment Business Client Agreement addendum covering instruction-giving and acknowledgement arrangements, consistent with the firm's actual dealing/execution practice.

A2.1.3(b)

Include a dedicated clause in the Investment Business Client Agreement addendum covering agreed investment parameters, consistent with the firm's actual dealing/execution practice.

A2.1.3(c)

Include a dedicated clause in the Investment Business Client Agreement addendum covering trade notification arrangements, consistent with the firm's actual dealing/execution practice.

A2.1.3(d)

Include a dedicated clause in the Investment Business Client Agreement addendum covering principal-dealing disclosure, consistent with the firm's actual dealing/execution practice.

A2.1.3(e)

Include a dedicated clause in the Investment Business Client Agreement addendum covering periodic statement frequency and performance-measurement basis, consistent with the firm's actual dealing/execution practice.

A2.1.3(f)

Include a dedicated clause in the Investment Business Client Agreement addendum covering best-execution waiver disclosure, consistent with the firm's actual dealing/execution practice.

A2.1.3(g)

Include a dedicated clause in the Investment Business Client Agreement addendum covering asset valuation basis, consistent with the firm's actual dealing/execution practice.

A2.1.4(a)

Populate the agreement with the client's confirmed initial portfolio value at inception.

A2.1.4(b)

Populate the agreement with the confirmed initial asset composition of the portfolio.

A2.1.4(c)

Include the agreed periodic-statement reporting cycle (e.g. quarterly) in the Client Agreement, consistent with section 6.10's periodic statement requirements.

A2.1.4(d)(i)

Draft a discretion-scope clause setting out concentration/single-holding limits applicable to the mandate (or confirming none apply), consistent with the agreed investment mandate.

A2.1.4(d)(ii)

Draft a borrowing/margin-lending authorisation clause covering the circumstances, limits, limit-breach circumstances, and margin lending terms applicable to the mandate (or confirm no such authority exists).

A2.1.4(d)(iii)

Include a clause confirming the firm's transaction authority under the mandate and any specified limitations on it.

A2.1.4(d)(iv)

Add an explicit underwriting-authority clause to the discretionary Investment Management agreement template stating either (i) the firm has no authority to commit the Client to underwriting, or (ii) the specific Securities-category restrictions and financial limits that apply. Build a control that blocks any underwriting/sub-underwriting commitment on a Client's behalf unless this clause is presen

A2.1.5(a)

Draft a loan/investment administration clause covering payment transfer mechanics and the overdue/default escalation process.

A2.1.5(b)

Draft a clause describing the limit-monitoring mechanism (e.g. system-enforced caps, client self-certification) used to keep the Retail Client within applicable limits.

A2.1.5(c)

Include a clause requiring a fresh risk acknowledgement form before each Investment, and build a system control preventing investment completion without a current signed form.

A2.1.5(d)

Draft a contingency/wind-down disclosure clause consistent with the firm's business cessation plan (see also Rule 11.3.18).

A2.1.6(a)

Include a dedicated clause in the borrower/Issuer/seller agreement template covering the exclusivity restriction clause.

A2.1.6(b)

Include a dedicated clause in the borrower/Issuer/seller agreement template covering the anti-circumvention/connected-party restriction clause.

A2.1.6(c)

Include a dedicated clause in the borrower/Issuer/seller agreement template covering the off-platform solicitation restriction clause.

A2.1.6(d)

Include a dedicated clause in the borrower/Issuer/seller agreement template covering the material-change notification requirement.

A2.1.6(e)

Include a dedicated clause in the borrower/Issuer/seller agreement template covering the post-funding material-change obligations clause.

A2.1.6(f)

Include a dedicated clause in the borrower/Issuer/seller agreement template covering the annual financial statements obligation.

A2.1.7(a)

Draft a unilateral variation/termination clause specifying the grounds and notice requirements.

A2.1.7(b)

Build the currency/rate/fee disclosure into the agreement template and ensure the rate/fee figures are kept current.

A2.1.7(c)

Add a clear 'indicative rate' labelling requirement to the agreement template and to any rate quotation screens/documents.

A2.1.7(d)(i)

Include the six-month notification deadline and 'without delay' requirement in the redress-procedure clause, and configure claims-intake systems to check claims against this deadline.

A2.1.7(d)(ii)

Include the fraud/gross-negligence full-liability provision in the redress-procedure clause and in the claims-assessment methodology used by the claims team.

A2.1.8(a)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the transfer fee/charges disclosure, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(b)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the required-information disclosure for transfers, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(c)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the transfer-consent form/procedure disclosure, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(d)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the expected transfer-time disclosure, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(e)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the transfer-completion definition, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(f)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the communications-format disclosure, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(g)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the unauthorised-transfer redress policy disclosure, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(h)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the compromise-event policy disclosure, kept consistent with the firm's actual custody/security operating procedures.

A2.1.8(i)

Include a dedicated clause in the Crypto Token custody Client Agreement addendum covering the client-contact procedure for suspected/actual compromise, kept consistent with the firm's actual custody/security operating procedures.

A3.1.1(1)

Confirmation note must include: (a) firm name/address; (b) principal or agent capacity; (c) client name/account number/identifier; (d) description of the Investment/Crypto Token/Fund incl. amount invested or units; (e) sale or purchase indicator; (f) execution price/unit price; (g) Execution-Only statement where applicable; (h) transaction date/time; (i) total amount payable and due date; (j) firm

A3.1.2

Derivative confirmation note must include: (a) maturity/delivery/expiry date; (b) for Options, exercise date or reference to the last exercise date; (c) whether exercise creates a sale or purchase in the underlying; (d) the Option strike price; (e) where closing out an open Futures position, full details of the opening and closing contracts and the resulting profit/loss to the client (difference a

A4.1.1

Periodic statement must contain: (a) number, description and value of each Investment/Crypto Token; (b) amount of cash held; (c) total value of the portfolio; (d) statement of the basis on which each Investment/Crypto Token's value was calculated.

A4.1.2

Discretionary periodic statement must additionally include: (a) investments loaned to third parties or charged to secure borrowings at the closing date; (b) aggregate interest paid/received on loans/borrowings during the period; (c) details of each transaction entered into for the portfolio during the period; (d) aggregate money and investments transferred into and out of the portfolio; (e) aggreg

A4.1.3

Contingent liability periodic statement must additionally include: (a) aggregate money transferred into/out of the portfolio during the valuation period; (b) unrealised profit/loss on each open position at the account period end (before commission); (c) realised profit/loss on each position closed during the account period (after commission); (d) aggregate cash, collateral value, management fees a

A5.2.2(a)

Implement and maintain a documented Client Money compliance framework covering all requirements of APP5.

A5.2.2(b)

Design and maintain systems/controls (IT systems, logs, checklists) specifically able to generate evidence of compliance with each Client Money Provision.

A5.3.1

Operational process to transfer/bank all client money receipts into designated Client Accounts within one business day.

A5.3.2

Control to prevent/flag deposits of firm's own money into Client Accounts outside the permitted exceptions.

A5.3.3(1)(a),(d)

Maintain a control log recording any deposit of firm money into a Client Account under the minimum-sum or shortfall-funding exceptions, with justification.

A5.3.3(1)(b)

Process to identify mixed remittances on receipt and transfer the firm's own-money portion out of the Client Account within one day of expected clearance.

A5.3.3(1)(c)

Monthly interest reconciliation to identify excess interest credited above amounts due to clients, and a process for removing the excess within 25 days.

A5.3.4

Implement a monitoring control that flags non-client money sitting in Client Accounts and triggers prompt removal.

A5.3.5

Provide payers/counterparties with correct Client Account payment details in advance, and set up a notification mechanism so the firm is alerted promptly when such payments are made.

A5.4.1

Standard account-opening checklist ensuring every new Client Account meets all four structural naming/holding criteria before use.

A5.4.2(1),(2)

Maintain and keep current a centralized Client Account master register capturing the five required data fields.

A5.4.2(3)

Records retention control ensuring closed Client Account master-list data is archived and kept for a minimum six-year period.

A5.5.2

Ageing control that tracks unsettled temporary-holding/DvP client money and triggers transfer into a Client Account (or equivalent safeguarding of Investments/Crypto Tokens) once the 3-day threshold is reached.

A5.5.3(1),(2)

Cheque/payment order receipt register capturing the three mandated data fields, retained for six years.

A5.6.1(1),(2)

Formal Third Party Agent due diligence assessment (checklist/questionnaire covering all specified factors) completed and approved before onboarding any new Third Party Agent.

A5.6.1(3)

Periodic (e.g., annual or risk-based) re-assessment of each approved Third Party Agent's continued suitability.

A5.6.2

Maintain a readily retrievable evidence file per Third Party Agent that substantiates the suitability conclusion for regulatory inspection.

A5.7.1(1)

Pre-transfer control verifying that any transfer of Client Money to a Third Party Agent falls within one of the three permitted purposes/agent types.

A5.7.1(2)

Ageing/monitoring control to identify and recall excess Client Money held with Third Party Agents beyond transaction/obligation completion.

A5.7.2

Standard written Third Party Agent acknowledgement letter (no set-off/lien, correct account title) obtained and filed prior to first use of the account.

A5.8.1

Documented withdrawal authorisation procedure with defined approval levels/segregation of duties for all Client Account withdrawals.

A5.8.2

Withdrawal control validating that every payment out of a Client Account matches one of the permitted payout grounds.

A5.8.3

Control to keep cheque/payable-order amounts reflected as Client Money in the ledger/reconciliation until cleared confirmation is received.

A5.8.4

System control preventing cross-client application of Client Money and requiring firm funding of any client debit shortfall instead.

A5.8.5

Automated/manual control that detects and prevents debit or off-setting balances arising on Client Accounts.

A5.9.1

Standard Client Money disclosure statement/notice (in the client agreement or a separate disclosure document) covering all nine mandated disclosure items, issued to each client before any Client Money is received.

A5.10.1(1),(2)

Automated Client Money statement generation and distribution process covering the three mandated content elements, at the required frequency per client type.

A5.10.1(3)

Statement production deadline control ensuring statements are finalised within 25 days of the relevant statement date.

A5.11.1(1),(2)

Documented monthly Client Money reconciliation process incorporating all five required data components.

A5.11.1(3)(a),(b)

Three-way reconciliation control (client ledgers vs. cash book vs. Third Party Agent statements) plus a daily minimum-balance adequacy check.

A5.11.1(3)(c)

Discrepancy investigation and remediation workflow triggered automatically by any unreconciled reconciliation item.

A5.11.1(4)

Reconciliation completion deadline control ensuring each reconciliation is finished within 10 days of its reconciliation date.

A5.11.1(5)

Daily reconciliation process specific to Money Services business lines.

A5.11.2

Segregation-of-duties control ensuring staff who operate Client Accounts or have payment authority do not perform the reconciliations.

A5.11.3(1),(2)

Senior-level reconciliation review and sign-off with a written confirmation statement retained for each reconciliation cycle.

A5.11.4

DFSA notification procedure triggered when a reconciliation discrepancy is assessed as material and remains unresolved.

A5.12.1(1),(2)

Remediation action plan and DFSA report prepared in response to any Auditor's Report finding, submitted within the 30-day deadline.

A5.13.2(a)

Distribution-event waterfall procedure (Priority 1) for full or pro-rata payout of Client Account funds to Segregated Clients.

A5.13.2(b)

Distribution-event waterfall procedure (Priority 2) applying the firm's other assets/money to cover any Segregated Client shortfall.

A5.13.2(c)

Distribution-event waterfall procedure (Priority 3) for payout to other Clients from remaining firm money.

A5.13.2(d)

Final-stage distribution procedure aligned with Insolvency Law 2019 requirements or DFSA direction.

A5.13.3

Collateral liquidation procedure feeding proceeds into the distribution waterfall.

A5.14.1

Breach identification and DFSA notification procedure with a one-day reporting deadline for any Client Money Provisions breach.

A6.2.2(a)

Maintain a documented safe custody compliance framework mapping each Safe Custody Provision to internal policy/procedure.

A6.2.2(b)

Design and implement systems and controls (IT systems, checklists, logs) capable of producing evidence of compliance on demand.

A6.3.1

Implement recording and registration procedures (register of holdings, custody ledger, wallet/key management for crypto) appropriate to the asset type.

A6.3.2

Establish segregated accounts/records that keep client Safe Custody assets separate from the firm's proprietary assets at all times.

A6.4.1

Establish Client Accounts as the default legal title for holding client Safe Custody assets, with a documented exception process (with justification) for cases where market practice or law prevents this.

A6.4.2

Ensure every Client Account is opened and titled in compliance with the structural criteria (correct holder, correct name/entity, 'Client Account' or distinguishing title).

A6.4.3(1)-(2)

Create and maintain a centralized master list/register of all Client Accounts with the required data fields, updated whenever accounts are opened or closed.

A6.4.3(3)

Implement a records retention schedule ensuring master list entries are retained for at least six years post-closure, including for archived/closed accounts.

A6.4.4

Implement a control that blocks any use (e.g., lending, collateralisation, transfer) of client Safe Custody assets unless prior written client permission is on file.

A6.4.5(a)

Build a permission-capture control/workflow requiring documented client written consent before any use of the client's safe custody assets.

A6.4.5(b)

Maintain a collateral/stock-lending register recording each pledge or loan of client assets, counterparties, and terms.

A6.4.5(c)

Implement a tracking and reconciliation process to ensure borrowed/used client assets are returned in equivalent form and quantity to the correct Client Account.

A6.4.5(d)

Perform a client-impact assessment before/after each use event to confirm no economic or entitlement disadvantage to the client (e.g., dividends, entitlements preserved).

A6.5.1(1)

Conduct and document a formal suitability due-diligence assessment of each prospective Third Party Agent prior to placing any client assets with it.

A6.5.1(2)

Set a periodic review schedule (e.g., annual) to reassess each Third Party Agent's continued suitability.

A6.5.1(3)

Include an 'equivalence of protection' assessment (segregation, reporting, insolvency protection etc.) as a mandatory element of the Third Party Agent due diligence.

A6.5.2(1)

Conduct and document a formal suitability due-diligence assessment of each non-DIFC custodian before arranging custody through it.

A6.5.2(2)

Include an 'equivalence of protection' assessment as a mandatory element of the non-DIFC custodian due diligence.

A6.5.3(1)

Build a standardised due diligence checklist covering all eight A6.5.3(1) factors for use in every Third Party Agent/non-DIFC custodian assessment.

A6.5.3(2)

Extend due diligence for crypto-custody Third Party Agents to cover crypto-specific authorisation status, key management/storage security policies, and technology robustness.

A6.5.4

Maintain a complete, retrievable evidentiary file supporting each suitability conclusion, ready for regulator inspection.

A6.6.1

Negotiate and obtain a written safe custody agreement/acknowledgement letter from each Third Party Agent containing all the specified contractual protections before any client assets are transferred.

A6.6.2(1)-(2)

Establish a records repository for all Safe Custody Agreements and related instructions, with a minimum six-year retention rule.

A6.7.1(1)

Include the cross-border custody risk disclosure and insolvency-information-on-request statement in client disclosure documents issued before arranging custody.

A6.7.1(2)(a)-(g)

Prepare a comprehensive client custody disclosure statement/pack covering items (a) through (g) and issue it to each client before custody commences.

A6.7.1(2)(h)-(l)

Extend the client custody disclosure pack to cover asset-pooling/mixing risk, cross-border holding risk, Group-affiliation of custodians, and the firm's default-liability position.

A6.8.1(1)

Set up an automated statement generation and distribution process on the required frequency (monthly for Retail; per agreed schedule for Professional Clients).

A6.8.1(2)(a)-(c)

Configure the statement template to include the three mandated content elements (holdings, collateral with valuation, client money) as at the statement date.

A6.8.1(3)

Implement a production timeline/SLA ensuring statements are finalised within 25 business days of the statement date.

A6.9.1(a)

Implement a reconciliation programme covering all six record/statement pairings in the A6.9.1 table, each executed at its mandated frequency (Investments: monthly/six-monthly/monthly; Crypto Tokens: daily/daily/daily).

A6.9.1(b)

Configure reconciliation processes and system logic to use settlement date, not trade date, as the reconciliation reference point.

A6.9.2

Implement segregation of duties so that staff responsible for operating Client Accounts or with authority over Safe Custody assets do not perform the reconciliations.

A6.9.3(1)

Designate a senior reviewer role responsible for reviewing every reconciliation output.

A6.9.3(2)

Create a standard written attestation template for the senior reviewer to complete after each reconciliation review.

A6.9.4

Establish a materiality threshold/escalation trigger and a DFSA notification procedure for unrectified material reconciliation discrepancies (including cumulative/longstanding discrepancies).

A6.10.1(1)

Establish a post-audit remediation reporting process: for each auditor finding, document remedial actions taken and preventive measures, and prepare a report to the DFSA.

A6.10.1(2)

Set a 30-day-from-audit-submission deadline tracker for the DFSA remediation report.

A6.11.1

Implement a breach-identification and same/next-day DFSA notification process for any Safe Custody Provisions non-compliance.

A7.1.1(a)-(f)

Prepare a Money Services disclosure document/Client Agreement section covering all six elements in A7.1.1(a)-(f), issued to Users before or at service commencement.

A7.1.2(a)-(c)

Prepare and maintain a fees, charges and FX-rate disclosure schedule covering all fee types and rate-change notification procedures, issued to Users.

A7.1.3(a)-(c)

Include a communications-methods and copy-request-rights section in the Client Agreement/disclosure pack.

A7.1.4(a)-(h)

Prepare a Payment Instrument safeguards and liability disclosure covering all eight A7.1.4 elements, issued to each User at instrument issuance.

A7.1.5(a)-(f)

Configure transaction-confirmation notices/receipts to automatically include all six required data elements for every Payment Transaction.

A7.2.1(1)

Establish a fee-setting and periodic fee-reasonableness review process (e.g., benchmarking against market/cost).

A7.2.1(2)

Implement a rate/fee-quote accuracy control ensuring the rate/fee quoted to the User matches what is applied at execution, with tolerance monitoring.

A7.2.1(3)

Configure transaction-charging logic (SHA-type charging) as the default, with an override only where payer/payee have agreed otherwise on file.

A7.2.1(4)

Restrict the firm's fee schedule/billing system to only levy failure-related charges for the three permitted categories.

A7.2.1(5)

Ensure Stored Value redemption fee terms are documented in the Client Agreement and billing logic only applies fees per the early-termination/late-redemption criteria.

A7.2.1(6)

Implement a rate-change notification process (e.g., real-time or same-day notice) and a rule that rate changes favour the User where ambiguous.

A7.2.1(7)(a)-(b)

Configure termination fee logic to be proportionate and time-limited (waived after 6 months), and implement an automatic prepaid-amount reimbursement process on termination.

A7.2.2

Implement consent-capture and consent-withdrawal controls in the payments system consistent with agreed consent forms and withdrawal terms.

A7.2.3(a)-(e)

Implement data-access governance controls (least-privilege access, purpose limitation, credential security) and embed required protective clauses in Payment Account Provider contracts.

A7.2.4(1)-(3)

Implement an access-restriction workflow requiring documented grounds, User notification (pre or immediate post), and a restoration trigger/review process.

A7.2.5(1)(a)-(d)

Implement Payment Instrument issuance controls: no unsolicited issuance (except authorised replacements), secure credential delivery, and an always-available loss/fraud reporting channel communicated to Users.

A7.2.5(2)

Establish an incident investigation process to determine whether a loss occurred within the firm's control and assign liability/compensation accordingly.

A7.2.6(1)

Implement a rapid remediation process to reverse/correct incorrect debits within the 3-business-day statutory window.

A7.2.6(2)

Configure the loss-liability charging logic to cap User liability at $50 and apply the statutory exceptions (undetectable loss, firm negligence/misconduct) waiving the charge.

A7.2.7(1)(a)-(c)

Implement fund-blocking controls limited to the authorised exact amount, automatic release-on-receipt logic, and a 10-business-day refund/justification process for disputed transaction amounts.

A7.2.7(2)

Build the three statutory refund-exclusion checks into the refund-assessment workflow.

A7.2.8

Implement a system control preventing any debit from being posted before the associated Payment Order is received/logged.

A7.2.9(1)-(2)

Implement a refusal-notification workflow that issues notice by the next business day with reasons and rectification guidance where applicable.

A7.2.9(3)

Restrict refusal grounds in operational procedures to only those documented in the Client Agreement or legal prohibition.

A7.2.10

Implement a revocation function/process allowing Users to cancel eligible future-dated Payment Orders up to the cut-off (one business day before execution).

A7.2.11

Implement full-amount (no-deduction) transfer processing logic, with charge deduction only where a documented payer/payee agreement exists.

A7.2.12(a)-(c)

Implement value-dating controls in the payments system ensuring credit/debit timing complies with the same-business-day crediting and accurate debit-timing rules, plus payee-side timely submission procedures.

A7.2.13(2)

Implement a funds-recovery procedure triggered whenever a transaction fails or misdirects due to an incorrect unique identifier.

A7.2.15

Implement an incident response plan with defined triggers for 'major' incidents, User notification templates, and a DFSA notification procedure.

A7.2.16

Configure Payment Account product terms and systems to prevent any interest or return accrual on Payment Account balances.

A7.2.17

Implement account-purpose monitoring/controls to detect and prevent non-payment use of Payment Accounts (e.g., as a savings/deposit account).

A7.3.1(a)

Implement automated Stored Value issuance processing that credits Stored Value at par value immediately upon receipt of User funds.

A7.3.1(b)

Implement a redemption process that honours at-par redemption requests and applies the 6-year post-termination cut-off rule.

A7.3.2

Configure Stored Value product terms and systems to exclude any interest or return accrual on Stored Value balances.

A7.3.3(a)

Implement a real-time balance-limit control that blocks Stored Value issuance/top-ups that would push an individual User's balance above $5,000.

A7.3.3(b)

Implement a per-transaction limit control that blocks any Stored Value Payment Transaction exceeding $1,000.