How to Set Up a Financial Services Company in Dubai UAE: 2026 Complete Guide

Dubai hosts three distinct regulatory environments for financial services companies, each with its own licensing authority, capital requirements, legal framework, and market access profile. Choosing the right jurisdiction is the most consequential early decision in establishing a regulated financial services business in Dubai — it affects your client base, legal framework, operating cost structure, and long-term regulatory relationship for years. This guide covers all three regimes with side-by-side comparisons, complete capital tables, fit and proper requirements, step-by-step application guidance, and 2026 considerations including VARA licensing for virtual asset businesses and the CBUAE framework for payment services.

The financial services sector in Dubai has grown significantly in recent years. DIFC — the Dubai International Financial Centre — is ranked among the world's top 10 financial centres and hosts over 5,000 registered companies including international banks, asset managers, insurance companies, and fintech businesses. The SCA mainland regime has been substantially modernised to attract international financial services companies to the broader UAE market. ADGM in Abu Dhabi has emerged as a leading hub for private wealth management, fintech, and digital assets. Understanding how these three environments differ is essential for making the right setup decision.

The Three UAE Financial Services Regulatory Regimes: Full Comparison

SCA Licensing: UAE Mainland Financial Services

The Securities and Commodities Authority (SCA) is the UAE's federal financial services regulator for the mainland. It operates under UAE Federal Law No. 4 of 2000 on the Emirates Securities and Commodities Authority and Market, as amended. Operating any regulated financial activity without an SCA licence in the UAE mainland is a criminal offence carrying substantial fines and potential imprisonment.

SCA Regulated Activities and Capital Requirements

SCA Fit and Proper Assessment

Every proposed shareholder, director, member of the management board, and key person (CEO, CIO, CCO, MLRO) must pass the SCA's fit and proper assessment. The SCA evaluates five dimensions:

• Criminal background: no convictions for financial crime, fraud, dishonesty, or any related offence in any jurisdiction. This includes convictions that have been "spent" under home country laws — the SCA applies its own assessment independent of home country statutes of limitation.
• Regulatory history: no disqualification, suspension, public censure, or adverse regulatory findings from any financial regulator globally. Self-declaration is required, and false declarations are a separate ground for rejection.
• Financial probity: no personal insolvency, unpaid court judgements, or significant undisclosed personal liabilities. Financial probity for directors and major shareholders is assessed independently of the company's capital position.
• Qualifications and experience: the SCA expects relevant professional qualifications (CFA, CPA, CISI, ACCA) matched to the role proposed, combined with documented practical financial services experience. A proposed fund manager who has never managed a fund before, regardless of their academic qualifications, will face an uphill fit and proper assessment.
• Integrity references: the SCA typically requests 2–3 professional references from individuals in regulated financial services who can attest to the applicant's integrity, competence, and suitability for the proposed role.

DFSA Licensing: DIFC-Based Financial Services

The Dubai Financial Services Authority (DFSA) operates under English common law, recognising DIFC Courts as the governing jurisdiction for financial services disputes within DIFC. This legal framework is the primary reason international asset managers, insurance companies, and banks prefer DIFC as their UAE regulatory base: disputes are resolved under a familiar, internationally recognised legal system with deep precedent and strong enforceability.

DIFC hosts the majority of the GCC's international financial institutions, including branches of JPMorgan, Goldman Sachs, HSBC, UBS, Morgan Stanley, and hundreds of international and regional asset managers, insurers, and financial advisors. The co-location with other major financial institutions creates a network effect that is particularly valuable for businesses targeting institutional clients in the GCC region.

DFSA Licence Categories and Capital Requirements

DFSA Regulatory Sandbox and Innovation Testing

For fintech companies developing novel financial products, the DFSA operates an Innovation Testing Licence (ITL) that allows testing of products within DIFC under controlled DFSA supervision with reduced requirements during the testing phase. The ITL is time-limited and converts to a full DFSA licence upon successful completion of the testing programme.

FSRA Licensing: ADGM-Based Financial Services

The Financial Services Regulatory Authority (FSRA) operates within Abu Dhabi Global Market (ADGM), Abu Dhabi's international financial centre on Al Maryah Island. ADGM has grown substantially since its establishment in 2015 and is now a significant centre for private wealth management, digital assets, fintech, and alternative investments.

FSRA is particularly well-positioned for:

• Single and Multi-Family Offices (SFO/MFO): ADGM has specific, lighter-touch regulatory categories for family office structures, making it the preferred choice in the UAE for UHNW families managing their own wealth. The ADGM SFO regime allows management of a single family's assets without the full FSRA authorisation required of external fund managers.
• Digital asset businesses: ADGM's Digital Asset Framework and FSRA's Guidance on Crypto Asset Activities was one of the first comprehensive digital asset regulatory frameworks in the Middle East, making ADGM the original preferred base for digital asset businesses in Abu Dhabi.
• Private credit and alternative investments: ADGM has developed strong infrastructure for private credit funds, direct lending, and alternative investment structures including venture capital and private equity.
• Regulated crowdfunding and peer-to-peer lending: FSRA has specific frameworks for crowdfunding and P2P lending platforms, making ADGM a preferred base for lending-focused fintech businesses.

VARA: Digital Asset Financial Services in Dubai

The Virtual Assets Regulatory Authority (VARA) was established by Dubai Government in 2022 as Dubai's dedicated regulator for virtual asset service providers (VASPs). VARA operates independently from DFSA (which regulates within DIFC) and from FSRA (which regulates within ADGM), covering all virtual asset business in Dubai outside those two free zones.

VARA licensing is required for businesses conducting any of the following virtual asset activities in Dubai:

• Virtual Asset Exchange (VAX) services: operating a platform where users can buy, sell, or exchange virtual assets — including cryptocurrency exchanges and digital asset trading platforms.
• Virtual Asset Broker-Dealer: acting as a broker or dealer in virtual assets, executing transactions for clients or dealing on own account.
• Virtual Asset Custody: holding, safeguarding, or managing virtual assets on behalf of clients — including cold storage wallet services and custodian wallet providers.
• Virtual Asset Portfolio Management: managing a portfolio of virtual assets on behalf of clients, whether on a discretionary or advisory basis.
• Virtual Asset Advisory services: providing advice on the acquisition, disposal, or management of virtual assets.

VARA's regulatory framework includes a Minimum Viable Product (MVP) regime that allows VASPs to operate in a limited, supervised environment while completing full VARA authorisation — the digital asset equivalent of a regulatory sandbox.

CBUAE: Payment Services and Banking Regulation

For businesses building payment apps, digital wallets, remittance services, or payment aggregation platforms for UAE consumers, the UAE Central Bank (CBUAE) is the primary regulator under the Regulatory Framework for Stored Value Facilities (SVF) and the Payment Services Regulation:

Choosing the Right Regulatory Pathway

Use this decision framework to identify the most appropriate regulatory pathway for your financial services business:

Universal Licensing Requirements Across All Regimes

Despite their differences, all UAE financial services regulatory regimes share common baseline requirements:

• Fit and proper assessment for all key persons: shareholders, directors, and all key persons (CEO, CIO, CCO, MLRO) must pass the regulator's fit and proper assessment covering criminal background, regulatory history, financial probity, relevant qualifications, and professional references.
• Qualified senior management physically based in UAE: at minimum one UAE-based senior individual with documented and verifiable relevant financial services experience and appropriate professional qualifications must be resident and active in the UAE operation.
• Designated compliance officer (CCO/MLRO): a named individual responsible for regulatory compliance and AML/CFT must be appointed before the licence is granted. This individual must meet the regulator's qualification and experience requirements and may be subject to separate registration or approval.
• Comprehensive AML/CFT framework: a documented anti-money laundering and counter-terrorism financing framework is not optional. It must include: a business risk assessment, customer due diligence policies, enhanced due diligence procedures for high-risk clients, transaction monitoring procedures, suspicious activity reporting process (to UAE FIU via goAML), and staff training programme.
• Business plan with financial projections: a credible 3-year business plan including market analysis, target client identification, revenue projections, cost structure, and competitive positioning. Regulators do not approve business plans that are clearly not financially viable.
• Technology and systems description: evidence of appropriate, proportionate technology infrastructure for the proposed business activities — trading systems, client onboarding platform, record-keeping, portfolio management systems, compliance monitoring tools.
• Professional indemnity insurance: required for most financial advisory and management categories. Coverage level must be proportionate to the proposed business volume and client commitments.

SCA Licensing: Full Step-by-Step Process

1. Determine the specific SCA licence category for your intended activities — confirm with SCA directly if your activities span multiple categories.
2. Incorporate a UAE mainland LLC with DED. The SCA licence is issued to the LLC; you cannot obtain an SCA licence through a free zone entity (only an SCA licence can be obtained through an SCA-registered mainland entity).
3. Appoint qualified management: CEO, CCO (Chief Compliance Officer)/MLRO, and the proposed licensed persons for the regulated activities. All must have documented, verifiable qualifications and experience.
4. Prepare the regulatory application package: business plan, AML/CFT manual, compliance framework document, organisational chart, all key person CVs and certifications, shareholder KYC, source of capital documentation.
5. Submit the complete application through the SCA electronic portal and pay the applicable application fee.
6. SCA conducts an initial completeness review and typically issues an Information Request (IR) within 3–6 weeks requesting clarifications or additional documentation.
7. Respond to the IR promptly within the SCA's stated deadline (typically 30 working days).
8. SCA conducts fit and proper interviews with key persons — usually by video call or in person at the SCA offices.
9. Provide evidence of capital adequacy: a bank letter confirming that the required capital is available, unencumbered, in the name of the LLC, in a UAE bank account.
10. Meet any in-principle approval conditions, which may include system demonstrations, additional documentation, or formal commitment letters.
11. Receive the final SCA Regulated Activity Certificate — begin operations under SCA supervision and ongoing reporting obligations.

Annual Compliance Obligations After Authorisation

AML/CFT Compliance for UAE Financial Services Firms

UAE-licensed financial services companies are regulated financial institutions (not merely DNFBPs) under UAE AML Law. This means a higher standard of AML/CFT obligation applies:

• Customer identification and verification (KYC): full identity verification for all clients before establishing any relationship. For individuals: passport, address proof, source of funds, and purpose of relationship. For legal entities: corporate documents, UBO verification to natural person level, source of corporate funds, and purpose of relationship.
• Enhanced Due Diligence (EDD) triggers: politically exposed persons (PEPs), clients from FATF high-risk jurisdictions, clients with unusual or complex ownership structures, transactions involving high-risk sectors (crypto, precious metals, arms) all trigger EDD — a more intensive investigation and documentation requirement before onboarding.
• Ongoing transaction monitoring: a documented system for monitoring client transactions against their declared activity profile, flagging unusual transactions for compliance review. This may be a manual review process for small firms or an automated transaction monitoring system for larger operations.
• Suspicious Activity Reports (SARs) and goAML: mandatory registration on the UAE FIU's goAML platform. Mandatory filing of SAR when the compliance function identifies reasonable grounds to suspect ML or TF activity, regardless of whether the transaction is completed.
• 5-year recordkeeping: all AML/CFT records — KYC documentation, transaction records, SAR decisions (even where a SAR was considered but not filed), training records — must be retained for minimum 5 years from the date of the transaction or end of the client relationship.

Real-World Examples

UK Asset Manager Establishing GCC Distribution Hub

A UK-based fund manager with AED 1.5 billion in AUM decides to establish a UAE presence to directly serve GCC institutional investors. After reviewing the options, the firm chooses DIFC and DFSA Category 3A authorisation (managing investments) for the English common law framework, the DFSA's international recognition among institutional LPs, and DIFC's co-location with other major institutional investors. The DFSA authorisation process takes 9 months. The managing partner undergoes DFSA fit and proper assessment. Capital of AED 7.35 million (USD 2M) is injected into the DIFC entity. Total regulatory costs in year 1: approximately AED 1.2 million (capital, regulatory fees, legal, compliance, audit).

Boutique Investment Advisory Firm

A financial professional with 18 years of investment banking experience at regional banks establishes a boutique investment advisory firm targeting UAE-based HNW clients with personalised portfolio advisory services. He chooses the SCA advisory licence (mainland) for direct UAE retail and professional client access. With AED 300,000 in paid-up capital, a qualified compliance officer, a robust business plan, and a comprehensive AML/CFT manual, the SCA licence is obtained in 4 months from first application to certificate issuance. Year 1 compliance costs (regulatory fees, audit, compliance officer, professional indemnity): approximately AED 200,000.

Dubai Fintech — Consumer Lending Platform

A fintech company building an SME lending platform for UAE-based small businesses seeks CBUAE authorisation. The lending activity requires careful regulatory analysis: direct lending from a balance sheet requires CBUAE banking or financing company authorisation; marketplace/P2P lending may be structured differently. The company spends 3 months on regulatory design before submitting to CBUAE, eventually receiving authorisation for a financing company after 15 months and meeting a AED 3 million capital requirement. Alternative: an ADGM FSRA crowdfunding licence for a P2P structure was considered but rejected as the target market is mainland UAE SMEs.

Total Cost Estimates

Common Mistakes

• Treating the regulatory timeline as theoretical. Financial services licensing takes 3–18 months from complete application submission to first client revenue. Planning to generate revenue before licensing is complete creates significant business and financial risk. Budget for 12–18 months of operating costs before first regulatory income.
• Choosing the wrong regulatory regime for the target client base. SCA is for UAE mainland retail and professional clients. DFSA and FSRA are for institutional and international-focused entities. A business that incorporates in DIFC hoping to serve mainland UAE retail clients will face friction because its DFSA licence does not directly authorise UAE mainland retail activities.
• Appointing unqualified key persons to save management costs. Regulators conduct genuine fit and proper assessments and have seen every attempt to present a paper-qualified nominee. Key persons must have real, documented, verifiable qualifications and experience relevant to the licence category. Fit and proper failures at the person stage are among the most common causes of licence application rejections.
• Underestimating ongoing compliance costs. Many first-time regulated entity founders budget carefully for the setup costs but underestimate the annual compliance costs: regulatory fees (AED 10,000–200,000 per year depending on category), mandatory external audit (AED 30,000–150,000), compliance officer costs (AED 120,000–350,000 per year for a qualified full-time CCO), AML/CFT systems, and staff training.
• Not having a genuinely operational AML/CFT framework. Regulators review compliance frameworks for genuine operationality, not just documentation. A compliance manual that has clearly been produced as a template and never adapted to the actual business consistently draws adverse regulator attention.

Expert Insights from MSZ Consultancy

Financial services licensing in Dubai is one of the most substantive business setup processes we handle — not because of the company formation, which is standard, but because of the regulatory depth required. The clients who succeed in getting licensed quickly are those who treat the regulatory application as an investment of time and preparation, not as a compliance hurdle to clear as quickly as possible.

The most common avoidable mistakes in financial services licensing we see are: appointing qualified nominees who won't actually work in the business (regulators assess genuine business substance, not paper appointments); producing AML/CFT documentation that is clearly a template (regulators have seen thousands of these and know immediately whether it is a live document or a produced-for-application exercise); and underestimating the timeline (most failed attempts to self-licence financial services businesses in Dubai cite a 6-month timeline that turns into an 18-month process — budget for 12–18 months and be pleasantly surprised if it's faster).

Conclusion

Setting up a regulated financial services company in Dubai in 2026 is a well-defined process with transparent requirements across all three regulatory regimes. The right choice of regulatory pathway — SCA for UAE domestic client-facing business, DFSA for international institutional access, FSRA for private wealth and digital assets — is the most important early decision. Capital requirements are substantial but appropriate for the activities involved. The ongoing compliance overhead is real and recurring. But for businesses that achieve licensing, Dubai provides access to one of the world's largest concentrations of investable capital — from GCC sovereign wealth, to UAE HNW families, to a rapidly growing institutional investor base — in a well-regulated, internationally recognised financial centre.

Planning to set up a regulated financial company in Dubai? Contact MSZ Consultancy for a free regulatory pathway assessment, entity structure review, and end-to-end licensing application support.