DFSA General Module (GEN)chapter by chapter

2.2.5

Confirm the Licence endorsement restricts the firm to insurance underwriting activities only before adding any other Financial Service.

2.2.6

Verify the Islamic Financial Business endorsement is in place before offering or continuing to manage PSIAs.

2.2.7

Confirm the endorsement before launching or continuing to manage any Islamic Fund.

2.2.7A(1)

Confirm both Fund Manager status and the Fund Platform endorsement before establishing or operating any Incorporated Cell on the platform.

2.2.8(1)

Check for the Retail Client endorsement before onboarding any Retail Client for a given Financial Service.

2.2.9

Maintain single-purpose licensing for Representative Office firms and monitor for any proposed activity or licence variation that would breach exclusivity.

2.2.10A(1)

Confirm the endorsement (or existing custody authorisation) before holding or controlling any Client Assets.

2.2.10B

Confirm the endorsement before handling client premium or claims monies.

2.2.10C

Confirm the Long-Term Insurance endorsement before intermediating any Long-Term Insurance contract.

2.2.10D

Confirm and maintain DIFC Body Corporate incorporation status for the licensed crowdfunding entity.

2.2.10E

Ensure Crowdfunding Operators do not offer or perform any of the four prohibited Financial Services.

2.2.10F

Restrict the platform's permitted investment types to exclude the three listed categories.

2.2.10G

Ensure any currency-exchange or Payment-Instrument activity is offered only as an ancillary part of another licensed Financial Service, not as a stand-alone service.

2.2.10H(1)

Identify whether any administered/operated Scheme receives mandatory Dubai-law employer contributions; if so, confirm it is DIFC-established or that a valid Exemption Certificate is held (see Rule 2.3.7).

2.3.2(1)

Before treating an activity as excluded from licensing, identify which limb of the exclusion is relied upon and verify all conditions of that limb are met.

2.3.2(2)

Verify and document that all five conditions are met before relying on this exclusion for Commodity Derivatives dealing.

2.3.3

Verify and document the voting-rights/control threshold and principal-capacity condition before treating a share transaction as excluded.

2.3.4(1)

Document trustee capacity for each transaction relied upon as excluded.

2.3.4(2)

Track and verify the number of trusts for which the individual acts before relying on the exclusion; cease relying on it once a third trust is taken on.

2.3.5(1)

Confirm Family Office licence validity and the scope of activity before continuing to rely on the exclusion.

2.3.5(2)

Confirm and document that trust services are restricted to the single Family before, and while, relying on the exclusion.

2.3.6

Verify the authorisation status of the Fund Manager/Agent before relying on this exclusion for passported fund promotion activity in the DIFC.

2.3.7

Obtain and keep current the required Exemption Certificate before relying on the exclusion; re-verify certificate validity periodically.

2.6.4(2)-(3)

Design and document the technical/accounting segregation of the closed-loop monetary value from any general-purpose stored value before excluding it from Money Services licensing.

2.7.5

Track the holding period of Units subscribed under this exclusion and confirm the 12-month threshold is met before any disposal.

2.8.2

Confirm all three conditions and document the basis for reliance on the exclusion before treating dealing-as-agent activity as excluded.

2.8.3

Confirm and document that the firm's order-handling process is limited to receipt/transmission only, with no execution authority or client-binding commitment.

2.9.2

Assess whether the firm is/proposes to become a transaction party (excluded) versus a branch arranging for its own head office/other branch (not excluded, requires Arranging authorisation) before classifying the activity.

2.9.7

Confirm all four conditions before relying on the exclusion, with specific attention to the Long-Term Insurance carve-out.

2.10.2

Obtain a written appointment instrument and confirm day-to-day decision-making sits with an Authorised Firm/Regulated Financial Institution before relying on the exclusion.

2.11.3

Confirm all three conditions and document reliance on the exclusion.

2.12.3

Verify the Fund Manager's Fund Platform endorsement and confirm the ICC's role is limited to infrastructure provision before relying on the exclusion.

2.14.2

Confirm the absence of Group/legal-entity affiliation and absence of introduction remuneration before relying on the exclusion; if remuneration or affiliation exists, obtain Arranging Custody authorisation.

2.22.1(4)

Confirm that any Crypto Token trading facility operated by the firm is structured and licensed as an MTF only, and prohibit design or operation of a discretionary-rules (OTF-style) facility for Crypto Tokens.

2.26.1(4)

Ensure marketing materials, referrals and information provided through the Representative Office exclude any Crypto Token, Crypto Token-related Investments, and any Financial Service relating to Crypto Tokens or such Investments.

3.4.1(1)

Confirm the firm holds a valid DFSA Licence before making or issuing any Financial Promotion in/from the DIFC; block promotional activity by unauthorised branches/entities.

3.4.1(2)

Restrict Representative Office marketing content to services/products of related Group entities offered outside the DIFC.

3.5.1(1)(a)

Review all promotional/marketing content against the clear, fair, not-misleading standard before release.

3.5.1(1)(b)

Ensure firm name, address and regulatory status disclosure is embedded in every Financial Promotion template.

3.5.1(1)(c)

Apply Professional-Client-only distribution controls and mandatory eligibility statement on relevant promotions.

3.5.1(1)(d)(i)

Ensure retail-facing past-performance/forecast content presents a balanced view (risks and benefits).

3.5.1(1)(d)(ii)

Disclose data sources and key assumptions underlying any past-performance or forecast claims in plain language.

3.5.1(1)(d)(iii)

Insert mandatory prominent past-performance warning statement into relevant promotions.

3.5.2

Prohibit liability-limitation/disclaimer language in Financial Promotions that seeks to exclude DFSA-law duties.

3.5.3

Conduct and document due diligence on the offshore issuer/provider of any Restricted Speculative Investment before promoting it.

3.5.4

Verify Token classification against App 2 Investment definitions before using investment-suggestive terminology in promotions.

3.6.1(a)

Confirm the approved-by statement is clearly and prominently included before granting approval.

3.6.1(b)

Verify the promotion satisfies all Section 3.5 content requirements before approving it.

3.6.2

Confirm Licence endorsement and scope cover the retail financial service/product before approving retail-directed promotions.

3.6.3

Periodically re-review previously approved promotions (especially live/ongoing campaigns) for continued compliance.

3A.2.1(1)(a)

Confirm the Crypto Token has passed the required suitability assessment (or DFSA fiat-token approval) before carrying on any related Financial Service.

3A.2.1(1)(b)

Verify Crypto Token suitability status before making/approving any related Financial Promotion.

3A.2.1(1)(c)

Confirm Crypto Token suitability before any Offer to the Public.

3A.2.1(1)(d)

Confirm suitability status of underlying Crypto Tokens before managing, administering, or promoting a Fund with Crypto Token exposure.

3A.2.1(1)(e)

Extend the Crypto Token suitability check to any Derivative or instrument referencing a Crypto Token before dealing, promoting or offering it.

3A.2.1(2)(a)

Perform and document a suitability assessment (characteristics, regulatory status, market size/liquidity, technology, DFSA compliance impact) for each non-fiat Crypto Token before use.

3A.2.1(2)(b)

Confirm the Fiat Crypto Token appears on the DFSA's published list of suitable Fiat Crypto Tokens before use.

3A.2.1A(a)

Publish and maintain an up-to-date suitable Crypto Token list (name, identifier, DLT platform) accessible to existing and prospective Clients.

3A.2.1A(b)

Establish a recurring review cycle (DFSA expects at least every six months) to reassess suitability of each Crypto Token in use.

3A.2.1A(b)(i)

Trigger immediate cessation (or documented reasonable steps toward cessation) of activity relating to any Crypto Token that fails a suitability review.

3A.2.1A(b)(ii)

Remove/update the published suitable Crypto Token list promptly following any negative suitability determination.

3A.2.1A(c)

Maintain complete suitability assessment files sufficient to justify the conclusion to the DFSA on request.

3A.2.1A(d)

Prepare and submit the monthly Crypto Token information return via the DFSA portal within the 14-day deadline.

3A.2.2(a)

Screen products/services and technology used to ensure no Privacy Token or Privacy Device involvement.

3A.2.2(b)

Screen all Crypto Token related promotions to exclude Privacy Tokens/Devices before making or approving them.

3A.2.2(c)

Confirm no Privacy Token features exist before conducting any public offer of a Crypto Token.

3A.2.2(d)

Screen Fund investment exposures for Privacy Token holdings before undertaking Fund management/trustee/promotion activities.

3A.2.2(e)

Screen Derivatives/instruments for underlying Privacy Token exposure before any related activity.

3A.2.3(a)

Screen Crypto Tokens for algorithmic price-stabilisation features before carrying on any related Financial Service.

3A.2.3(b)

Screen promotions to exclude Algorithmic Tokens before making or approving them.

3A.2.3(c)

Confirm Token is not algorithmic-stabilised before conducting a public offer.

3A.2.3(d)

Screen Fund investment exposures for Algorithmic Token holdings before Fund management/trustee/promotion activities.

3A.2.3(e)

Screen Derivatives/instruments for underlying Algorithmic Token exposure before any related activity.

3A.2.4(1)

Prevent unregulated Utility Token/NFT business lines from operating alongside regulated Financial Services, absent the Custody exception.

3A.2.5(1)(a)

Restrict Crypto Token use in Money Services operations to the permitted Fiat Crypto Token exception, with client funds never held in Crypto Token form under the client's name.

3A.2.5(1)(b)

Confirm Money Services Provider licence scope excludes dealing/arranging activities in Crypto Tokens and prevent such activity.

3A.2.6

Conduct and document due diligence on any third party before referring clients for Crypto Token-related services.

Principle 1 (4.2.1)

Establish an integrity/fair-dealing Code of Conduct and embed it into governance, HR and business processes so that decisions and dealings with customers and counterparties reflect high ethical standards.

Principle 2 (4.2.2)

Implement operating procedures, competence standards and quality-control checks so that business activities are carried out with appropriate skill and care.

Principle 3 (4.2.3)

Design, document and maintain a systems-and-controls framework (governance structure, policies, IT systems, control procedures) covering the firm's regulated activities.

Principle 4 (4.2.4)

Perform periodic resource-adequacy assessments (capital/financial, IT/systems capacity, staffing and competence) and maintain records evidencing adequacy.

Principle 5 (4.2.5)

Maintain policies and controls preventing market abuse, insider dealing and other improper market practices, including trade surveillance and staff dealing rules.

Principle 6 (4.2.6)

Implement customer communications and financial promotions controls (review/sign-off process) ensuring all customer-facing information is clear, fair and not misleading.

Principle 7 (4.2.7)

Maintain a conflicts-of-interest policy and conflicts register, with procedures to identify, prevent/manage or disclose conflicts as they arise.

Principle 8 (4.2.8)

Implement a suitability assessment process (fact-find, risk profiling, product suitability checks) applied before advice is given or discretionary decisions are made.

Principle 9 (4.2.9)

Maintain client asset/client money segregation, safe-custody and reconciliation arrangements consistent with the firm's accepted responsibility for those assets.

Principle 10 (4.2.10)

Maintain a regulatory notification policy/procedure identifying reportable/significant events and setting escalation timelines for informing the DFSA.

Principle 11 (4.2.11)

Establish and maintain a corporate governance framework (board structure, committees, policies) proportionate to the firm's business, consistent with GEN Rule 5.3.30 requirements.

Principle 12 (4.2.12)

Design and maintain a remuneration policy linking pay structures/incentives to long-term firm performance and risk outcomes, proportionate to the firm's size and complexity.

Principle 1 (4.4.1)

Require the individual to complete integrity/ethics training and personally attest to compliance with the firm's Code of Conduct on an ongoing basis.

Principle 2 (4.4.2)

Ensure the individual maintains required competence (qualifications, CPD) and follows documented procedures when performing their role.

Principle 3 (4.4.3)

Require the individual to comply with the firm's market conduct/personal account dealing policy and complete related training.

Principle 4 (4.4.4)

Ensure the individual responds promptly and candidly to DFSA queries, examinations and information requests relevant to their role.

Principle 5 (4.4.5)

Ensure the individual designs/maintains an adequate organisational structure, reporting lines and controls for the business area under their responsibility.

Principle 6 (4.4.6)

Ensure the individual implements compliance monitoring/reporting for their business area and acts on identified compliance gaps.

Principle 7 (4.4.7)

Ensure the individual identifies and escalates DFSA-notifiable information/events without delay through the firm's regulatory notification process.

5.2.1

Design and document a responsibility-apportionment map/matrix (e.g. RACI) covering the Governing Body and senior management that satisfies all four statutory criteria.

5.2.2

Formally designate, in the firm's governance documentation, the individual/body (SEO or Governing Body) who owns apportionment decisions and systems-and-controls oversight.

5.2.3(1)

Create and keep current a formal apportionment record documenting how responsibilities are apportioned and allocated.

5.2.3(2)

Obtain and file signed acknowledgements from each Governing Body member and senior manager confirming awareness and acceptance of their allocated responsibilities.

5.2.3(3)

Where shared responsibilities exist, document precisely the split/division of duties between the co-responsible individuals within the apportionment record.

5.2.3(4)

Retain each version of the apportionment record (including superseded versions) for a minimum of six years from its creation or supersession date.

5.3.1(1)

Design, document and implement a firm-wide systems-and-controls framework covering financial and risk management, approved by senior management/Governing Body.

5.3.1(2)

Schedule and perform periodic reviews of the systems-and-controls framework to confirm continued adequacy and effectiveness.

5.3.2(1)

Produce and maintain an organisational chart/RACI matrix defining roles, responsibilities and reporting lines for the Governing Body, senior management and Persons Undertaking Key Control Functions, and communicate it to all relevant Employees.

5.3.2(2)

Maintain an internal record identifying client-facing Employees and their accountability/supervisory lines.

5.3.2(3)

Publish and maintain a public register (physical, open for inspection, or on the firm's website) of Employees who deliver Financial Services to customers.

5.3.2(4)

Ensure the public register/website entries are complete and current, showing commencement date and permitted services for each listed Employee.

5.3.3

Perform a segregation-of-duties analysis across key functions and implement controls (e.g. dual sign-off, restricted system access) to prevent conflicting duties being combined in one individual.

5.3.4

Implement a risk management framework covering risk identification, assessment, mitigation, control and monitoring across the firm's activities.

5.3.5

Develop and maintain a suite of risk management policies and procedures addressing the firm's material risk types.

5.3.6(1)

Appoint a designated risk officer/adviser (e.g. Head of Risk) responsible for advising the Governing Body and senior management on the firm's risk exposures.

5.3.7

Design and implement a compliance programme (policies, monitoring, controls) that both ensures and evidences ongoing compliance with applicable DIFC legislation.

5.3.8

Produce and maintain a compliance function charter/manual describing its organisation, responsibilities and procedures.

5.3.9

Assess and provide adequate staffing/resourcing to the compliance function so it can operate independently and objectively.

5.3.10

Grant the Compliance Officer unrestricted access rights to relevant records/systems and standing access to the Governing Body and senior management.

5.3.11

Implement a compliance breach identification, escalation and remediation process, including a monitoring plan.

5.3.12

Document the compliance monitoring/reporting methodology and maintain a breach register recording all identified legislative breaches.

5.3.13(1)

Establish an internal audit function (in-house or outsourced) with a mandate to test systems and controls.

5.3.13(2)

Structure internal audit reporting lines so the function operates independently of operational/business management (e.g. reporting directly to the Governing Body/Audit Committee).

5.3.14

Grant Internal Audit unrestricted access to records/systems and a direct escalation channel to the Governing Body or Audit Committee.

5.3.15

Produce and maintain an internal audit charter/manual describing the function's organisation, responsibilities and procedures.

5.3.16(1)

Prepare a business plan addressing how the firm will manage risks to itself and its customers.

5.3.16(2)

Ensure the business plan explicitly covers current activities and a rolling 12-month forecast of business activities.

5.3.16(3)

Maintain the business plan as a living document, updating it whenever there is a material change in the business or its operating environment.

5.3.17

Design a management information (MI) framework/reporting pack that delivers relevant, accurate, timely information to the Governing Body and senior management.

5.3.18

Implement due diligence/vetting procedures (e.g. background checks, fit-and-proper assessments) for anyone acting on the firm's behalf, including agents and appointed representatives.

5.3.19(1)

Assess and document the fitness, propriety, competence and training status of all Relevant Employees before assignment and on an ongoing basis.

5.3.19(2)

Build a documented framework (policies, checklists, record-keeping) evidencing ongoing compliance with the Relevant Employee suitability requirement.

5.3.19A(1)

Track and ensure completion of at least 15 CPD hours per calendar year for the SEO, Compliance Officer and MLRO.

5.3.19A(3)

Define CPD relevance criteria and structured-activity standards, and require the SEO/Compliance Officer/MLRO to maintain their own CPD activity records.

5.3.20

Implement market abuse and financial crime prevention systems and controls (surveillance, policies, training) covering the firm and its Employees.

5.3.21(3)(a)

Perform and document due diligence on prospective outsourcing service providers before engagement (financial stability, capability, control environment, regulatory standing).

5.3.21(3)(b)

Establish ongoing supervision/oversight arrangements (KPIs, service level monitoring, periodic reviews) for each outsourced function.

5.3.21(3)(c)

Establish an incident/issue management process for outsourcing-related failures that could cause (or have caused) a regulatory breach, including remediation and escalation.

5.3.22(1)

Notify the DFSA of any new material outsourcing arrangement.

5.3.22(2)(a)

Develop and maintain a comprehensive outsourcing policy, contingency plan and risk management programme for material outsourcing arrangements.

5.3.22(2)(b)

Ensure every material outsourcing arrangement is governed by a written, appropriately-drafted contract before services commence.

5.3.22(2)(c)

Assess each material outsourcing arrangement to confirm it does not impair the firm's ability to meet customer/DFSA obligations or hinder DFSA's supervisory access.

5.3.22(3)

Include mandatory clauses in all material outsourcing contracts requiring the service provider to provide DFSA-related information/premises access and to cooperate openly with the DFSA.

5.3.23(1)

Develop and implement a business continuity and disaster recovery plan covering critical business functions and systems.

5.3.23(2)

Schedule and perform regular testing of the business continuity/disaster recovery plan, updating it based on test results and business changes.

5.3.24(1)

Identify all record categories subject to DIFC legislative requirements (including Accounting Records and corporate governance records) and ensure they are created and retained.

5.3.24(2)

Ensure records systems (including electronic storage) allow retrieval and paper reproduction of any required record within 3 business days.

5.3.25

Maintain required regulatory records in English (unless the Rule 5.3.26 exception for records relating to business from an overseas establishment applies).

5.3.27

Implement a records management framework/policy covering record adequacy, access controls, retention periods and security.

5.3.28

Implement fraud prevention/detection controls and a reporting procedure for suspected fraud and financial crime to the relevant authorities.

5.3.30(2)(a)

Define and document the Governing Body's responsibility for setting/approving business objectives and strategy, and its oversight role over management, in board terms of reference.

5.3.30(2)(b)

Assess Governing Body composition (skills, expertise, capacity) and ensure appointments maintain an adequate mix to discharge Board duties effectively.

5.3.30(2)(c)

Establish Governing Body governance practices/procedures (charters, committee structures, secretariat support) and ensure adequate resourcing/budget for Board functions.

5.3.30(3)

Define senior management's day-to-day management mandate and ensure it operates within the objectives/strategy set by the Governing Body.

5.3.31(1)

Design, approve and document a remuneration policy that aligns pay with risk outcomes and covers all specified categories of Employees, and monitor its ongoing operation.

5.3.31(2)

Prepare and disclose remuneration structure/strategy information to the DFSA and relevant stakeholders (e.g. via annual report/accounting statements) sufficient to demonstrate ongoing compliance.

5.4.2(1)(a)

Establish and maintain a whistleblowing policy with clear internal reporting channels for regulatory concerns.

5.4.2(1)(b)

Build an assessment and escalation workflow for whistleblowing reports, including escalation to senior management, the DFSA or another authority where necessary.

5.4.2(2)

Ensure the whistleblowing policy exists as a formal written document.

5.4.2(3)

Schedule and conduct periodic reviews of the whistleblowing policy and procedures.

5.4.3

Maintain a whistleblowing register/case file recording each report received and its outcome.

5.5.2(1)

Develop an enterprise Cyber Risk Management Framework (CRMF).

5.5.2(2) - Governing Body approval

Submit the CRMF to the Governing Body/Board for formal approval.

5.5.2(2) - in writing

Ensure the CRMF exists as a formal written document.

5.5.2(3)(a)

Calibrate cyber risk controls proportionate to the firm's risk profile.

5.5.2(3)(b)

Define and document roles, responsibilities and accountability for cyber risk decision-making, including during incidents.

5.5.2(4)(a)

Implement a cyber risk identification and assessment system.

5.5.2(4)(b)

Implement the protective control suite for ICT assets (anti-malware, network security, access control, encryption, etc.).

5.5.2(4)(c)

Implement an incident detection, management and response system.

5.5.2(5)

Conduct an annual (or more frequent) review of the CRMF.

5.5.2(6)

Integrate the CRMF into the firm's enterprise risk management (ERM) framework.

5.5.3(1)(a)

Perform cyber security due diligence on prospective ICT vendors before engagement.

5.5.3(1)(b)(i)

Insert cyber security compliance clauses into ICT vendor contracts.

5.5.3(1)(b)(ii)

Include a mandatory incident-notification clause in ICT vendor contracts.

5.5.3(1)(b)(iii)

Include a vendor cooperation/remediation obligation clause in contracts.

5.5.3(1)(b)(iv)

Include an audit/verification rights clause in ICT vendor contracts.

5.5.3(1)(c)

Establish an ongoing vendor oversight/supervision programme using independent verification rather than vendor self-certification.

5.5.3(2)

Maintain internal accountability for cyber risk compliance notwithstanding outsourcing of ICT services.

5.5.4(1)

Formalise Board/senior management ultimate accountability for cyber risk oversight.

5.5.4(2)(a)

Board/senior management to oversee ongoing identification, assessment and management of cyber risk.

5.5.4(2)(b)

Create a defined senior management governance structure (e.g. CISO role, cyber risk committee) for cyber risk oversight.

5.5.4(2)(c)

Define and document a formal Cyber Risk appetite/tolerance statement aligned to the enterprise risk appetite.

5.5.4(2)(d)

Ensure adequately experienced/qualified personnel are assigned to cyber risk management roles.

5.5.5(1)

Build and maintain an ICT asset register with confidentiality/criticality classification.

5.5.5(2)

Perform regular cyber risk assessments of ICT assets.

5.5.5(3)(a)

Identify potential cyber threat sources/vectors as part of the risk assessment.

5.5.5(3)(b)

Evaluate residual cyber risk after considering existing controls.

5.5.5(3)(c)

Quantify the business impact of residual cyber risk.

5.5.6(a)

Deploy and maintain anti-malware software across ICT assets.

5.5.6(b)

Configure automatic/regular updates of anti-malware signature/definition files.

5.5.7(1)

Implement perimeter network security controls (firewalls, IDS/IPS, VPN gateways, etc.).

5.5.7(2)

Deploy network monitoring/detection procedures (e.g. SIEM, log review).

5.5.8(1)

Implement an access rights management programme.

5.5.8(2)(a)(i)

Implement least-privilege access provisioning controls.

5.5.8(2)(a)(ii)

Implement immediate access revocation upon termination, role change or cessation of need.

5.5.8(2)(b)

Conduct periodic user access reviews/recertification.

5.5.9(a)

Enforce a strong password policy (complexity, length, expiry, lockout).

5.5.9(b)

Deploy MFA on all internet-facing systems/networks.

5.5.9(c)

Deploy MFA for all privileged/administrator accounts.

5.5.9(d)

Implement encrypted communication channels (e.g. TLS/VPN) for user connections.

5.5.10(1)

Establish a cyber-risk-aware change management process.

5.5.10(2)(a)

Require testing of all IT system/network changes prior to production release.

5.5.10(2)(b)

Require formal approval sign-off before implementing IT changes.

5.5.10(2)(c)

Maintain an expedited/emergency change process for urgent security fixes.

5.5.11(1)

Implement a patch/vulnerability management process.

5.5.11(2)(a)

Classify software updates/patches by criticality level.

5.5.11(2)(b)

Apply software updates within defined SLAs based on criticality.

5.5.11(2)(c)

Prioritise deployment of critical/high-severity patches ahead of others.

5.5.11(3)

Route all software updates through the formal change management process.

5.5.12(1)

Deploy encryption for sensitive data at rest and in transit.

5.5.12(2)

Calibrate encryption strength/key length based on data sensitivity classification.

5.5.13(1)

Restrict physical data centre/server room access to authorised personnel only.

5.5.13(2)(a)

Implement a formal physical access request/approval process.

5.5.13(2)(b)

Implement immediate physical access revocation upon change of role or termination.

5.5.13(3)

Deploy physical security measures (badges, biometrics, CCTV, escorts) for data centres/server rooms.

5.5.14(1)

Develop and maintain a cybersecurity training and awareness programme.

5.5.14(2)(a)

Deliver mandatory annual cybersecurity training to relevant employees.

5.5.14(2)(b)

Build ongoing cyber awareness initiatives (e.g. phishing simulations, bulletins) to develop detection/reporting competency.

5.5.14(2)(c)

Communicate individual cyber security responsibilities to all employees, e.g. via policy acknowledgment.

5.5.15(a)

Establish a cyber resilience testing programme.

5.5.15(b)

Conduct resilience testing on a regular schedule, with internet-facing systems tested at least annually.

5.5.15(c)

Establish a remediation process for issues identified during resilience testing.

5.5.16(1)

Implement continuous security monitoring (SOC/SIEM) of IT systems and networks.

5.5.16(2)

Establish an incident escalation process with a defined point of contact.

5.5.17(1)

Develop and maintain a Cyber Incident Response Plan (CIRP).

5.5.17(2)

Ensure the CIRP specifies timely response/recovery procedures aligned with Rule 5.5.18 actions.

5.5.17(3)

Conduct regular testing of the CIRP (tabletop exercises, simulations).

5.5.17(4)(a)

Ensure the CIRP is documented in writing.

5.5.17(4)(b)

Perform an annual review of the CIRP.

5.5.17(4)(c)

Trigger a post-incident review of the CIRP after any major Cyber Incident.

5.5.18(1)

Investigate all detected Cyber Incidents to determine their nature and extent.

5.5.18(2)(a)

Execute immediate containment actions during an ongoing Cyber Incident investigation.

5.5.18(2)(b)

Initiate recovery processes per the CIRP during the incident.

5.5.18(3)(a)

Eliminate residual harmful effects following a Cyber Incident.

5.5.18(3)(b)

Restore affected IT systems/networks to operation.

5.5.18(3)(c)

Recover any data corrupted as a result of the Cyber Incident.

5.5.18(3)(d)

Identify and mitigate exploited vulnerabilities post-incident.

5.5.18(3)(e)

Implement longer-term remediation to prevent recurrence of similar incidents.

5.5.18(3)(f)

Execute the internal/external communications plan following a Cyber Incident.

5.5.19

Notify the DFSA of material Cyber Incidents within 72 hours using the DFSA portal notification form.

6.3.1(3)

Notify the DFSA as soon as practical whenever an emergency (outside the firm's/employees' control, unavoidable by reasonable steps) prevents compliance with a Rule, including the remedial steps taken/proposed.

6.4.1

Review all external-facing communications and materials to ensure the firm's regulatory status is never misstated or implied incorrectly.

6.4.2(1)

Embed the required disclosure statement ('Regulated by the Dubai Financial Services Authority' or 'Regulated by the DFSA') on all key business documents (letterhead, terms of business, client agreements, promotional materials, business cards, prospectuses, websites).

6.4.2(4)

Obtain express written permission from the DFSA before using the DFSA logo on any document or website, and comply with any usage conditions imposed.

6.4.2(5)

Apply the same regulatory status disclosure and DFSA logo controls to all documents/materials relating to operation and administration of an Official List of Securities.

6.5.1(1)

Maintain both the head office (day-to-day management/control and authorised activities) and the registered office in the DIFC at all times.

6.5.1(2)

Maintain both the head office and registered office of the partnership in the DIFC at all times.

6.5.1(3)(a)

Ensure the Branch maintains a genuine principal place of business in the DIFC where its authorised Financial Services are actually carried on (not a 'brass plate' office).

6.5.1(3)(b)

Register and maintain the Branch's DIFC place of business as its official address for service of communications and notices, and keep the DFSA/registers updated if it changes.

6.5.1(4)

Prepare and submit evidence as part of the licence application demonstrating that the office location requirements will be met upon authorisation.

6.6.1(2)

Maintain an up-to-date register of Close Links and be ready to prepare and submit a Close Links report/notification in the DFSA-specified form whenever requested.

6.9.1

Ensure all correspondence, submissions, filings and verbal/written communications with the DFSA are in English.

6.10.2

Use the DFSA's online electronic portal/system for any application, notification, report or return that can be submitted online, rather than paper/email submission.

6.10.3(a)

Submit all non-online-capable filings, notifications, reports or returns to the DFSA in writing.

6.10.3(b)

Include the firm's full legal name and DFSA authorisation/registration number on every written submission to the DFSA.

6.10.3(c)

Address written DFSA submissions to the correct department depending on the subject matter of the filing.

6.10.3(d)

Deliver written DFSA submissions only via an approved channel: post, hand delivery, or email to a DFSA-provided address.

6.10.4

Retain proof of submission/delivery (portal confirmation, courier receipt, sent-email record, hand-delivery acknowledgement) for every DFSA filing.

7.2.1

Submit a Licence application to the DFSA before commencing any Financial Service activity in or from the DIFC.

7.2.2(2)

Confirm and document that the applicant entity is a Body Corporate before submitting an insurance-related Licence application.

7.2.2(4)

Confirm and document that the applicant entity is a Body Corporate before submitting a Fund Manager/Trustee Licence application.

7.2.2(5)

Confirm and document DIFC Companies Law incorporation before submitting the application for this Financial Service.

7.2.2(6)

Confirm and document DIFC Companies Law incorporation before submitting the application for this Financial Service.

7.2.2(7)

Confirm and document DIFC Companies Law incorporation for Crypto Token-related applications, or establish eligibility for the branch exemption.

7.2.2(8)(b)-(e)

Assemble and maintain evidence of head office licensing/supervision, branch capital arrangements, cyber security insurance and (where applicable) PI insurance before and during branch operation.

7.2.4

Complete and submit the correct AFN application forms as part of the Licence application.

7.2.5

Prepare and submit evidence of adequate financial/other resources, fitness and propriety, and compliance arrangements (policies and procedures) as part of the Licence application.

7.3.1(a)

Establish and document adequate systems and controls for dealing with Retail Clients before applying for a Retail Client endorsement.

7.3.1(b)

Establish COB-compliant policies and procedures for Retail Client business before applying for the endorsement.

7.3.1(c)

Establish a training and competence framework for Employees dealing with Retail Clients before applying for the endorsement.

7.3.1(d)

Establish and document Complaint handling policies and procedures before applying for the Retail Client endorsement.

7.3.2

Satisfy and document compliance with the App 5 requirements before applying for a Trade Repository endorsement.

7.3.3

Establish and document Client Asset systems and controls meeting COB 6.11-6.14 before applying for the Client Assets endorsement.

7.3.4

Establish and document Insurance Monies handling systems and controls meeting COB 7.12 before applying for the endorsement.

7.3.5

Demonstrate and document adequate skills/knowledge of Long-Term Insurance underlying investments before applying for the endorsement.

7.3.6(a)

Confirm the applicant holds the necessary Fund Manager authorisation before applying for the Fund Platform endorsement.

7.3.6(b)

Establish and document the Incorporated Cell Company's systems and controls for managing/winding up Incorporated Cells, aligned with the Collective Investment Law 2010 and CIR, before applying for the endorsement.

7.5.1(1)

Appoint and continuously maintain Authorised Individuals in the SEO, Finance Officer, Compliance Officer and MLRO roles at all times.

7.5.1(2)(b)

Ensure the SEO and Compliance Officer roles are never held by the same individual at a Credit Rating Agency.

7.5.1A(1)

Perform and document a documented assessment (effectiveness, fitness and propriety, conflicts of interest) before permitting any individual to combine Licensed Functions.

7.5.1A(2)

Check every proposed dual-role appointment against the Rule 7.5.1A(2) combination Table and refuse/avoid any prohibited combination.

7.5.1B

Assess and document effectiveness and conflicts-of-interest considerations before appointing an individual who already holds a Licensed Function at another Authorised Firm.

7.5.2

Ensure SEO, Compliance Officer and MLRO appointees are U.A.E. residents, or obtain a DFSA waiver before appointing a non-resident.

7.5.3

Ensure the Compliance Officer and MLRO of a Trust Service Provider do not simultaneously act as trustees.

7.5.4

Register every Director of the Body Corporate with the DFSA as a Licensed Director, and register any new Director promptly on appointment.

7.5.5(1)(a)

Register every individual Partner with the DFSA as a Licensed Partner.

7.5.5(1)(b)

Identify and register an individual nominee of any corporate Partner as a Licensed Partner.

7.5.5(2)(a)

Register every individual General Partner with the DFSA as a Licensed Partner.

7.5.5(2)(b)

Identify and register an individual nominee of any corporate General Partner as a Licensed Partner.

7.6.1(1)

Conduct and document a fitness-and-propriety assessment of a candidate before lodging an Authorised Individual application with the DFSA.

7.6.1(2)

Follow the App7 fitness-and-propriety assessment criteria/process when evaluating any Authorised Individual candidate.

7.6.2

Verify and document AML knowledge (e.g. via training records) for any candidate for SEO, MLRO or Compliance Officer before lodging the application.

7.6.3

Complete and submit the required Authorised Individual application form jointly via the DFSA electronic portal for every candidate.

7.6.4

Ensure the individual candidate provides all information/documentation needed to satisfy the DFSA of their fitness and propriety.

7.6.7

Verify that any individual assigned to perform a Licensed Function holds current Authorised Individual status before they commence (or continue) in that role, unless a section 11.6 exemption applies.

7.7.1(1)

Maintain ongoing evidence that each Authorised Individual remains fit and proper, competent, and up to date with relevant developments.

7.7.1(2)

Conduct a formal annual review of each Authorised Individual's continued fitness and propriety and competence.

7.7.2

Design, implement and maintain systems and controls (policies, procedures, monitoring tools) supporting compliance with all Chapter 7 Authorised Individual requirements.

7.7.3(1)

Maintain complete records of every fitness-and-propriety and competence assessment conducted for each Authorised Individual under Chapter 7.

7.7.3(2)

Retain each Authorised Individual assessment record for at least six years from its date and be ready to produce it to the DFSA on request.

8.2.1

Prepare annual financial statements covering the full financial year.

8.2.2(1)

Apply IFRS as the accounting framework for financial statement preparation unless a permitted exception applies.

8.2.4

Obtain formal Governing Body approval and signature of the financial statements before finalisation.

8.3.1

Maintain complete and current accounting records covering all transactions.

8.3.2

Structure accounting records/systems to support Governing Body oversight of statutory compliance.

8.3.3(a)

Retain accounting records for a minimum six-year period.

8.3.3(b)

Ensure accounting records can be accessed/inspected by the DFSA or Auditor on request.

8.3.3(c)

Maintain capability to reproduce accounting records in hard copy/English within 3 business days of a DFSA request.

8.3.4

Prepare and file regulatory returns per PIB/PIN rules and deadlines.

8.3.5(1)

Set the first financial year-end date within 18 months of incorporation.

8.3.5(2)

Notify DFSA of the determined first financial year-end date promptly after determination.

8.3.5(3)

Set subsequent financial year-ends consistently at 12-month intervals (plus or minus 7 days) from the prior year-end.

8.3.6(1)

Obtain DFSA's prior written consent before changing the financial year end.

8.3.6(2)

Prepare a written consent application stating reasons for the financial year-end change.

8.3.6(3)

Obtain Auditor's written confirmation on non-distortion of financial position when requested by DFSA.

8.3.7

Notify DFSA with reasonable advance notice of any intended financial year change (non-Domestic Firms).

8.4.1(a)

File Auditor appointment notification via AFN.

8.4.1(b)

Conduct due diligence on prospective Auditor's competence and capacity before appointment.

8.4.1(c)

Verify and monitor the Auditor's DFSA Registered Auditor status for the duration of the engagement.

8.4.2

File immediate DFSA notification upon Auditor termination or resignation.

8.4.3

Promptly appoint a replacement Auditor to fill any vacancy.

8.4.4(1)

Assess and confirm Auditor/audit staff independence and absence of conflicts of interest.

8.4.4(2)

Report Auditor independence/conflict issues to DFSA upon discovery.

8.4.5

Supply Auditor skills/experience/independence information to DFSA upon request (Branch firms).

8.5.1(a)

Supply requested information to the Auditor promptly.

8.5.1(b)

Grant Auditor timely access to relevant records/information.

8.5.1(c)

Permit the Auditor to copy accessed records/information.

8.5.1(d)

Ensure no staff action obstructs or interferes with the Auditor's work.

8.5.1(e)

Escalate significant financial-position matters to the Auditor.

8.5.1(f)

Provide additional reasonable assistance requested by the Auditor.

8.6.1(a)

Formally engage the Auditor in writing to conduct the financial statement audit and issue the Auditor's Report.

8.6.1(b)

Instruct Auditor in writing to produce Regulatory Returns Auditor's Report.

8.6.1(c)

Instruct Auditor to produce Client Money Auditor's Report (where applicable).

8.6.1(d)

Instruct Auditor to produce Insurance Monies Auditor's Report (where applicable).

8.6.1(e)

Instruct Auditor to produce Safe Custody Investment Auditor's Report (where applicable).

8.6.1(f)

Instruct Auditor to produce Safe Custody Crypto Token Auditor's Report (where applicable).

8.6.1(g)

Instruct Auditor to produce Money Services Auditor's Report (where applicable).

8.6.2

Submit all required Auditor's reports to DFSA within the specified deadline.

8.6.3(1)

Provide requested audited financial statements/Auditor's Report to any requester, unless the firm qualifies for the Category 3B/3C/4 exemption.

9.2.1

Establish and maintain a Retail Client complaints handling policy covering investigation, resolution and redress/compensation.

9.2.2

Document the complaints procedures in writing embedding fairness, consistency and promptness standards.

9.2.3(a)

Send a written acknowledgment of the complaint promptly upon receipt (DFSA guidance: within 7 days).

9.2.3(b)

Include handler contact details, procedure summary and free-copy availability statement in the complaint acknowledgment/response.

9.2.3(c)

Investigate and assess the substance of each complaint received.

9.2.4

Provide progress updates to complainants where the investigation is ongoing (DFSA expects updates where resolution exceeds 30 days).

9.2.5(a)

Issue a written final response letter promptly upon concluding the complaint investigation.

9.2.5(b)

Set out clear redress terms in the final response where redress is offered.

9.2.5(c)

Execute/pay the agreed redress once the complainant accepts the terms.

9.2.6

Advise dissatisfied complainants of alternative resolution avenues and supply contact details on request.

9.2.7

Assign complaints to staff independent of the matter complained about, ensuring impartial handling.

9.2.8

Ensure complaint handlers hold, or have escalation access to, sufficient authority to resolve complaints.

9.2.10(a)

Notify complainant in writing of intended referral and obtain written consent before referring.

9.2.10(b)

Execute the referral in writing promptly once consent is obtained.

9.2.10(c)

Confirm referral completion and provide receiving-party contact details to the complainant.

9.2.10(d)

Continue handling any non-referred portion of the complaint under the standard complaints process.

9.2.11

Make the complaints handling procedures document available on request at no cost to Retail Clients.

9.2.12

Retain complaints records for a minimum six-year period from the receipt date.

9.2.13

Ensure each complaints register/file entry captures the prescribed data fields.

9.2.14

Implement systems/controls for complaints trend analysis and remediation of systemic issues.

9.3.1

Establish a complaints recording policy/procedure for Professional Client complaints.

9.3.2

Retain Professional Client complaint records for at least six years from receipt.

9.4.3(1)

Resolve and respond to Money Services complaints in writing within 15 business days.

9.4.3(2)

Issue a holding reply with delay reasons and a revised response deadline when the 15-day deadline cannot be met.

9.4.3(3)(a)

Include a referral-rights notice (to the independent complaints handling service) in the outcome letter.

9.4.3(3)(b)

Provide scheme details and access instructions in the outcome letter.

9.4.3(3)(c)

Disclose the firm's commitment to bear the scheme's application fee (subject to Rule 9.4.4(c)) in the outcome letter.

9.4.4(a)

Establish/maintain access arrangements to an independent complaints handling service (e.g., small claims tribunal) for Money Services clients.

9.4.4(b)

Ensure Clients can readily access/contact the independent complaints handling service.

9.4.4(c)

Pay the scheme's application fee upfront; recover from the Client only if the complaint is ultimately unsuccessful.

10.3.8

Confirm the firm's Licence classification on the Public Register reflects the automatic re-classification and matches internal records.

10.3.10

Note the historical exemption when reviewing pre-commencement-date Long-Term Insurance files; no new disclosure action required for that historical business.

10.4.1(2)

Identify any Non-DIFC Scheme relying on this transitional relief and actively monitor the status/expiry or revocation of its Certificate of Compliance so Rule 2.2.10H compliance begins immediately when the exemption ends.

10.4.1(3)

Track the end of the six-month transitional period and ensure full compliance with Rule 7.2.2(5) from that date onward.

10.5.1(2)

Identify all Crypto Tokens the firm uses that relied on recognition under the Previous Regime and confirm they fall within the deemed 'Suitable Crypto Token' status for the three-month Transitional Period.

10.5.1(3)

Continuously monitor deemed Suitable Crypto Tokens throughout the Transitional Period for significant events/developments affecting their qualifying status, and take the Rule 3A.2.1A(b)(i) actions immediately if the criteria are no longer met.

11.1.2(a)-(f)

Establish a process to respond promptly and fully to DFSA information requests, provide access to records/premises, make staff available, and answer questions truthfully and completely.

11.1.3

Implement staff training/policies ensuring Employees understand and comply with their obligations to cooperate with the DFSA.

11.1.4

Assess applicable secrecy/data protection laws affecting DFSA-required records and, where restrictions exist, maintain accessible copies in a compliant jurisdiction.

11.1.5(1)

Maintain the ability to promptly furnish the DFSA with information previously provided by the firm or its auditor to any Financial Services Regulator, upon request.

11.1.5(2)

Coordinate with Group entities to obtain and provide to the DFSA, on request, information those entities gave to a Financial Services Regulator.

11.2.3

Submit waiver applications to the DFSA using the correct AFN form when relief from a Rule is sought.

11.2.4

Ensure every waiver application includes all required content elements (firm details, Rule reference, explanation/reason, duration, publication preference and justification, supporting facts).

11.2.5

Monitor circumstances relevant to a pending waiver application and immediately notify the DFSA of any material change.

11.2.6

Monitor circumstances relevant to any granted waiver on an ongoing basis and immediately notify the DFSA of any material change affecting its continuing relevance.

11.3.2

Apply the same fitness/propriety, resourcing, compliance-arrangements and information-provision standards used for initial licensing when preparing an application to change Licence scope or vary/withdraw a condition or restriction.

11.3.3

Prepare and submit written details of the proposed Licence-scope change (or condition/restriction variation or withdrawal) to the DFSA.

11.4.1(a)-(e)

Prepare and submit a comprehensive written Licence-withdrawal request addressing reasons for withdrawal, cessation of Financial Services, cessation date, discharge of customer obligations, and (if applicable) Trust Service transition arrangements.

11.5.2

Submit requests concerning conditions/restrictions in writing, and requests to withdraw Authorised Individual status or Licensed Function authorisation via the correct AFN form.

11.5.3

Confirm the Article 29 FMT-reference period has expired before submitting a request to vary or withdraw a condition or restriction.

11.6.1(1)

Before appointing temporary cover, verify the absence qualifies as temporary/unforeseen, confirm the 26-week/12-month cap will not be exceeded, and complete a documented skills/experience assessment of the proposed cover individual.

11.6.1(2)

Exclude Licensed Director and Licensed Partner functions from any temporary-cover appointment arrangement.

11.6.1(3)

Implement oversight to ensure the temporary cover individual adheres to all Rules applicable to Authorised Individuals during the cover period.

11.6.1(4)

Notify the DFSA in writing of the name and contact details of any individual appointed to provide temporary cover.

11.6.1(5)

Plan and execute the permanent appointment of an Authorised Individual to the relevant function before the temporary cover period ends.

11.7.1

Submit a withdrawal request for the Authorised Individual's status to the DFSA within 7 days of the individual ceasing employment in the Licensed Function.

11.7.2

Complete the appropriate AFN withdrawal form, including full disclosure of any fitness and propriety concerns regarding the departing individual.

11.7.3

Provide the DFSA with a written statement setting out the reason(s) for the dismissal or requested resignation of the Authorised Individual.

11.7.4

Arrange appointment of a replacement trustee and confirm this appointment to the DFSA in writing.

11.8.1(3)

Apply the Branch-style notification regime (rather than Domestic Firm prior-approval regime) to control changes for Credit Rating Agencies, regardless of their actual DIFC establishment status.

11.8.4(1)

Require any prospective Controller (or existing Controller seeking to cross the 30% or 50% thresholds) to obtain DFSA prior written approval before the acquisition or increase takes effect.

11.8.5(1)

Complete and submit the appropriate AFN form when seeking approval to become or increase control as a Controller.

11.8.8(1)

Track and comply with all conditions attached to a DFSA Controller-approval notice on an ongoing basis.

11.8.8(2)

Halt and refrain from completing any proposed acquisition of control after receiving a DFSA notice declaring the Person an unacceptable Controller.

11.8.9

File the appropriate AFN notification with the DFSA before/upon proposing to cease being a Controller or decreasing a holding from above 50% to 50% or below.

11.8.10(1)-(3)

File the required AFN notification with the DFSA before completing any qualifying change in control of a Branch (new Controller, cessation, or threshold crossing).

11.8.11(1)

Implement and maintain systems and controls to continuously monitor Controller changes and Controller conduct/circumstances relevant to fitness and propriety.

11.8.11(2)

Notify the DFSA in writing as soon as possible after becoming aware of a qualifying Controller change or adverse development, unless the exception in 11.8.11(3) applies.

11.8.12(1)-(2)

Prepare and submit an annual Controllers report to the DFSA within 4 months of the financial year end, listing each Controller's name and current percentage holding.

11.8.13(4)

Comply on an ongoing basis with any conditions imposed by a DFSA final notice regarding Controller approval.

11.8.13(5)

Dispose of the relevant shareholding/control interest within the DFSA-specified period following an unacceptable-Controller final notice.

11.10.2(a)

Notify the DFSA with reasonable advance notice before a change in its registered/trading name.

11.10.2(b)

Notify the DFSA with reasonable advance notice before a change in a business/trading name used in the DIFC.

11.10.2(c)

Notify the DFSA with reasonable advance notice before a change of its DIFC principal place of business address.

11.10.2(d)

Notify the DFSA with reasonable advance notice before a change of the Branch's registered/head office address.

11.10.2(e)

Notify the DFSA with reasonable advance notice before a change in its legal structure.

11.10.2(f)

Notify the DFSA with reasonable advance notice before a change in an Authorised Individual's name or a material fitness-and-propriety matter.

11.10.3

Notify the DFSA with reasonable advance notice before establishing or closing any branch office worldwide.

11.10.4

Submit a detailed business plan for the proposed branch together with the Rule 11.10.3 notice.

11.10.5(2)

Do not proceed with establishing the branch if the DFSA has objected.

11.10.7(a)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, the Authorised Person's failure to satisfy the fit and proper requirements.

11.10.7(b)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, any matter which could have a significant adverse effect on the Authorised Person's reputation.

11.10.7(c)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, any matter which could result in serious adverse financial consequences to the financial system or to other firms.

11.10.7(d)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, a significant breach of a Rule by the Authorised Person or any of its Employees.

11.10.7(e)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, a breach by the Authorised Person or any of its Employees of any requirement imposed by applicable law.

11.10.7(f)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, any proposed restructuring, merger, acquisition, reorganisation or business expansion which could have a significant impact on the Authorised Person's risk profile or resources (subject to Rule 11.10.8).

11.10.7(g)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, any significant failure in the Authorised Person's systems or controls, including a failure reported by the firm's auditor.

11.10.7(h)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, any action that would result in a material change in the capital adequacy or solvency of the Authorised Firm.

11.10.7(i)

Notify the DFSA immediately upon becoming aware of, or having reasonable grounds to believe, non-compliance with Rules due to an emergency outside the Authorised Person's control and the steps being taken.

11.10.8(1)

Assess whether a proposed acquisition is a Major Acquisition and, if so, follow the applicable notification process (11.10.9 or 11.10.10).

11.10.9(1)(a)(i)

Submit written notification of the proposed Major Acquisition to the DFSA at least 45 days prior to completion.

11.10.9(1)(a)(ii)

Provide the DFSA with all relevant information needed to assess the proposed Major Acquisition.

11.10.9(1)(b)

Do not complete the Major Acquisition until DFSA clearance is obtained (or the 45-day period lapses without objection) and any DFSA conditions are satisfied.

11.10.10(1)(a)

Notify the DFSA in writing of any Major Acquisition per the home regulator's applicable notification requirement.

11.10.10(1)(b)

Where no home regulator notification requirement exists, follow the Rule 11.10.9 process (45-day advance written notice, information provision, no-objection/condition compliance).

11.10.10(2)(a)

Submit the DFSA notification simultaneously with the home regulator notification.

11.10.10(2)(b)

Ensure the DFSA receives the same information package given to the home regulator.

11.10.10(2)(c)

Forward copies of home regulator correspondence about the Major Acquisition notification to the DFSA promptly upon receipt.

11.10.11(1)

Respond promptly to DFSA requests for additional Major Acquisition information.

11.10.12A(1)

Notify the DFSA immediately upon forming reasonable grounds to suspect an order or transaction may constitute Market Abuse.

11.10.12A(2)

Ensure the notification includes sufficient transaction details and the reasoning for suspicion.

11.10.12A(3)

Maintain confidentiality of the Market Abuse notification; do not tip off the client or other involved parties.

11.10.13(a)

Notify the DFSA immediately when it becomes aware that an Employee may have committed a fraud against one of its customers.

11.10.13(b)

Notify the DFSA immediately when a serious fraud has been committed against it.

11.10.13(c)

Notify the DFSA immediately when it has reason to believe that a Person is acting with intent to commit a serious fraud against it.

11.10.13(d)

Notify the DFSA immediately when it identifies significant irregularities in its accounting or other records, whether or not there is evidence of fraud.

11.10.13(e)

Notify the DFSA immediately when it suspects that one of its Employees connected with its Financial Services may be guilty of serious misconduct concerning his honesty or integrity.

11.10.14(a)

Notify the DFSA immediately of the granting or refusal of any application for, or revocation of, authorisation to carry on financial services in any jurisdiction outside the DIFC.

11.10.14(b)

Notify the DFSA immediately of the granting, withdrawal or refusal of an application for, or revocation of, its membership of any regulated exchange or clearing house.

11.10.14(c)

Notify the DFSA immediately of becoming aware that a Financial Services Regulator has started an investigation into its affairs.

11.10.14(d)

Notify the DFSA immediately of the appointment of inspectors, howsoever named, by a Financial Services Regulator to investigate its affairs.

11.10.14(e)

Notify the DFSA immediately of the imposition of disciplinary measures or sanctions on it in relation to its financial services by any Financial Services Regulator or any regulated exchange or clearing house.

11.10.15(a)

Notify the DFSA immediately upon being served with significant civil proceedings.

11.10.15(b)

Notify the DFSA immediately of any fraud/dishonesty prosecution or conviction, or tax evasion penalty.

11.10.16(a)

Notify the DFSA immediately upon the calling of a meeting to consider a resolution for winding up the Authorised Person.

11.10.16(b)

Notify the DFSA immediately upon an application to dissolve the Authorised Person or to strike it from the DIFC register of Companies, or a comparable register in another jurisdiction.

11.10.16(c)

Notify the DFSA immediately upon the presentation of a petition for the winding up of the Authorised Person.

11.10.16(d)

Notify the DFSA immediately upon the making of, or any proposals for, a composition or arrangement with creditors of the Authorised Person.

11.10.16(e)

Notify the DFSA immediately upon the application of any person against the Authorised Person for the commencement of any insolvency proceedings, or the appointment of any receiver, administrator or provisional liquidator under the law of any country.

11.10.17

Implement reasonable steps/controls to verify accuracy and completeness of all information submitted to the DFSA.

11.10.18(1)(a)

Notify the DFSA immediately on discovering that previously submitted information may have been false, misleading, incomplete or inaccurate.

11.10.18(1)(b)

Notify the DFSA immediately when previously submitted information has or may have materially changed.

11.10.18(2)-(3)

Include full details/explanation in the notification and follow up promptly with corrected information if not immediately available.

11.10.19

Notify the DFSA immediately of significant actual or prospective changes in a Cell's business type/scale or Cell share ownership.

11.10.20(1)-(2)

Notify the DFSA as soon as practicable of significant corporate governance or remuneration structure/strategy changes (Branches: only if relevant to Branch operations).

11.12.2(1)

On receipt of a DFSA notice requiring an independent expert report, arrange for the report to be produced in the specified form and timetable.

11.12.2(3)

Appoint an independent expert who has been nominated or approved by the DFSA.

11.12.2(4)

Fund/pay all fees and costs of the independent expert engaged to produce the report.

11.12.3(a)

Ensure the appointed independent expert co-operates with the DFSA throughout the engagement.

11.12.3(b)

Provide the independent expert with all reasonably required assistance (access to staff, records, systems) during the engagement.

11.12.4(a)

Include contractual terms obliging the independent expert to report specified concerns (contraventions, fit-and-proper issues, going-concern doubts) directly to the DFSA.

11.12.4(b)

Include a contractual deadline requiring the independent expert to deliver the report within the DFSA's specified timeframe.

11.12.4(c)

Include a confidentiality-waiver clause in the independent expert contract to permit disclosure to the DFSA.

11.12.5(a)

Ensure the independent expert engagement contract specifies DIFC law as the governing law.

11.12.5(b)

Ensure the contract grants the DFSA an express right to enforce the Rule 11.12.4 provisions.

11.12.5(c)

Ensure the contract restricts the independent expert's available defences/set-off/counterclaim in DFSA enforcement proceedings to matters relevant to the Rule 11.12.4 provisions.

11.12.5(d)

Where an arbitration clause exists, ensure the contract expressly excludes the DFSA from being bound by it when enforcing its rights.

11.12.5(e)

Ensure the contract makes the Rule 11.12.4 provisions irrevocable, and unable to be varied or rescinded without DFSA consent.

14.1.4

Pay any Fixed Penalty Notice issued by the DFSA in full within 14 days of the date the notice is given.

A2.4.1(4)

Before lodging a written application for a DFSA declaration on the classification of a financial instrument under A2.4.1(1), prepare and include an analysis addressing each of the four factors in A2.4.1(3) (economic effect; target investor class; comparative regulatory treatment in other jurisdictions; impact on issuers/marketers).

A5.1.1

Establish and maintain a data disclosure process that publishes comprehensive, sufficiently detailed market data (e.g. aggregate open positions, transaction volumes/values, categorised breakdowns) to the public, and provides more granular participant-level data to relevant regulatory authorities.

A5.1.2

Design, implement and maintain documented processes and procedures for timely, appropriate data provision to relevant regulatory authorities, including to support enhanced monitoring, special actions or official proceedings relating to troubled or failed participants.

A5.1.3

Implement and maintain robust information/IT systems capable of accurately capturing and retrieving current and historical data, and outputting it promptly in an easily analysable format.

A7.1.1(1)

Conduct and document a structured fitness and propriety assessment covering integrity, competence/capability, financial soundness, and the individual's proposed role before appointing or reassessing an Authorised Individual.

A7.1.1(2)(a)

Collect and record evidence of the individual's knowledge and skills relevant to the Licensed/Designated Function being performed or proposed.

A7.1.1(2)(b)

Independently verify all information gathered on the individual (e.g. via reference checks, qualification checks, document authentication) before relying on it in the assessment.

A7.1.1(2)(c)

Confirm and record the individual's relevant professional/regulatory qualifications against the requirements of the Licensed/Designated Function.

A7.1.1(2)(d)

Assess and document the individual's relevant work experience against the requirements of the proposed role.

A7.1.1(2)(e)

Assess the individual's familiarity with, and training on, the Authorised Firm's relevant internal systems and procedures for their business area.

A7.1.2

Screen individuals for bankruptcy, serious criminal convictions and mental/physical incapacity as part of the fit and proper assessment; disqualify from fit and proper status if any condition applies.

RET-5.2.3(4)

Retain for 6 years. Trigger: Date the record was established, or superseded by a more up-to-date record.

RET-7.7.3(2)

Retain for 6 years. Trigger: Date of the assessment.

RET-8.3.3(a)

Retain for 6 years. Trigger: Date to which the record relates.

RET-9.2.12

Retain for 6 years. Trigger: Date of receipt of the Complaint.

RET-9.3.2

Retain for 6 years. Trigger: Date of receipt of the Complaint.