Key takeaways
- DIFC Category 3A depends on regulated activities, not business labels.
- Agency execution and matched-principal dealing require different permission assessments.
- Base capital excludes operating expenditure and may not determine total requirements.
- DIFC establishment, DFSA authorisation and banking require separate decisions.
- Client asset responsibilities affect permissions, operational safeguards and prudential analysis.
- Overseas authorisation replaces neither DFSA approval nor destination-country regulatory analysis.
DIFC Category 3A requires activity-specific analysis because incorporation, financial permissions and prudential classification answer different questions.
DIFC Category 3A is a prudential classification within the Dubai Financial Services Authority framework. Agency dealing and qualifying alternative trading systems can fall within it. However, the firm’s specific permissions determine its authorised services, products and customers.
Prudential category
A prudential category groups financial firms under the Dubai Financial Services Authority’s capital and risk framework. It does not replace the firm’s individual financial service permissions.
Start with the contractual activity
A brokerage description says little about the firm’s legal responsibilities. For example, introducing investors differs from executing orders as agent. Taking a principal position creates another analysis, even where trades offset immediately.
Therefore, start with contracts and transaction diagrams rather than a preferred category. Identify who receives instructions, executes transactions and owes settlement obligations. Record whether the firm controls cash or investments at any stage.
A DIFC Category 3A assessment must also identify products, customer classifications and distribution countries. Professional Client business does not automatically permit Retail Client services. Similarly, a group license elsewhere does not authorise its Dubai subsidiary.
The financial services authorisation framework separates regulatory permission from commercial establishment. Accordingly, DIFC company formation creates the operating vehicle, not permission to execute investment transactions.
Design an authorisable operating business
The applicant needs credible management, documented controls and sufficient funding before launching. However, a complete application involves more than policies and incorporation documents. Its financial model must explain how the firm survives delayed revenue and unexpected expenditure.
Banking belongs in this design process because settlement arrangements can change the proposed operating model. An operating account cannot automatically support client-money segregation. Equally, a custodian’s involvement does not remove the firm’s contractual responsibilities.
DIFC Category 3A planning should therefore connect ownership, funding, people and technology from the beginning. Consider whether a subsidiary or branch fits the group’s responsibilities. Establish who makes decisions locally and who supplies outsourced services.
This draft does not represent live verification of September 2026 rules. Before publication, verify effective amendments, capital figures, fees and licensed-function requirements against official materials. The following assessment therefore avoids presenting unverified numerical regulatory requirements.
First, test the activities against the permission framework before allocating capital or committing to premises.
Which activities fit DIFC Category 3A?
DIFC incorporation versus DFSA authorisation
DIFC supplies the legal jurisdiction, while its Registrar of Companies handles entity registration. The DFSA supervises financial services.
Therefore, distinguish the applicant entity, its permissions and its prudential category. A DIFC financial services license is not ordinary incorporation.
Agency dealing and trading systems
Dealing in Investments as Agent and qualifying Operating an Alternative Trading System activities can engage Category 3A.
However, matched-principal dealing requires principal-dealing analysis, including Category 2 and applicable exceptions. Check the prudential category hierarchy before finalising permissions.
How DFSA categories compare
Mixed permissions require hierarchy analysis rather than selecting whichever category appears cheaper. This comparison is not an exhaustive permission schedule.
For example, consult the DIFC Cat 2 license guide where the firm contracts as principal.
| Category | Typical activities | Client assets | Business model | Capital considerations | Governance focus |
|---|---|---|---|---|---|
| 2 | Dealing in Investments as Principal | Permission-dependent | Principal dealer | Principal exposures and applicable exceptions | Trading risk and limits |
| 3A | Agency dealing; qualifying trading systems | Separate analysis required | Agency broker or platform | Applicable base and other PIB calculations | Execution and platform controls |
| 3B | Providing Custody outside relevant exceptions | Central to custody model | Custody provider | Custody-specific prudential assessment | Safeguarding and reconciliation |
| 3C | Managing Assets; Managing a Collective Investment Fund; specified fund custody | Depends on service and custody arrangements | Asset or fund manager | Service-specific requirements | Investment governance and conflicts |
| 4 | Advising on Financial Products; Arranging Deals in Investments | Do not assume holding permissions | Adviser or arranger | Permission-specific capital treatment | Advice, distribution and conflicts |
Products, customers and overseas distribution
Retail access, product eligibility and crypto activities need separate checks. Consequently, crypto company setup in Dubai cannot establish DFSA brokerage authorisation.
UK groups must assess the UK international-firm approach. Similarly, Cyprus, Germany, France and Netherlands distribution needs analysis under European third-country investment-services rules.
Client money changes the analysis
Holding, controlling, arranging and accepting responsibility for assets are different functions. However, third-party custody does not settle every responsibility question.
Map account ownership, withdrawal authority and contractual liability. These details can change permissions, capital analysis and Conduct of Business module safeguards.
Our working hours: Monday to Friday, 9 AM – 6 PM GMT+4
What funds a DIFC Category 3A firm?
Capital requirements under current PIB rules
DIFC Category 3A capital requirements need the applicable Prudential Investment, Insurance Intermediation and Banking Business module calculation.
Therefore, assess base, expenditure-based and applicable risk-based or activity-based requirements. Confirm their interaction rather than assuming one universal formula.
Eligible capital and operating runway
Accounting equity alone does not establish eligible capital resources. Examine funding instruments, deductions, loss absorption and liquidity requirements.
Consequently, forecasts must show regulatory headroom after expenditure and losses. Shareholder funding also needs documented provenance and realistic availability.
Incorporation and regulatory fees
Separate DIFC incorporation from DFSA application charges and annual supervision fees. Verify the Fees module against every proposed permission.
DIFC Category 3A fees are not total funding. Therefore, request current schedules and distinguish committed capital from non-refundable expenditure.
Key insight
Separate five funding commitments
- DIFC incorporation creates an establishment expense separate from regulatory capital.
- DFSA application charges differ from recurring supervision fees.
- Eligible capital resources must satisfy the applicable PIB framework.
- Compliance, MLRO and Finance Officer functions create recurring expenditure.
- Office, technology, audit and banking require separate operating budgets.
People and professional expenditure
Budget authorised individuals, compliance, MLRO, finance, audit and professional services separately. Distinguish recruitment and documentation costs from recurring retainers.
For example, accounting and bookkeeping services support records but do not replace regulatory finance accountability.
Premises and operating infrastructure
Include office deposits, technology, applicable insurance and banking charges. However, transaction volumes and staffing prevent credible fixed all-in pricing.
Tax also affects forecasts. The free-zone corporate tax guide explains conditional treatment, not automatic exemption.
For Qualifying Free Zone Persons, qualifying income attracts 0%; taxable income outside that definition attracts 9%. Confirm continuing eligibility separately.
Conditional free-zone corporate tax rates
These rates concern Qualifying Free Zone Persons, not automatic treatment for every DIFC firm.
"Map each contractual responsibility before choosing a category. Then fund the capital requirement and operating runway separately."
What governance does the DFSA expect?
Authorised individuals and accountable management
A DIFC regulated company needs identifiable decision-makers with relevant competence. However, job titles alone do not establish licensed-function approval.
Use this management matrix when checking the current General module. Match each proposed responsibility to approval requirements and entity-specific exceptions.
| Role | Responsibility | Approval analysis |
|---|---|---|
| Senior Executive Officer | Directs the regulated business | Assess applicable licensed-function authorisation |
| Compliance Officer | Oversees regulatory compliance | Assess individual authorisation and scope |
| Money Laundering Reporting Officer | Owns AML oversight and reporting | Assess individual authorisation and suitability |
| Finance Officer | Oversees financial and prudential reporting | Assess licensed-function requirements |
| Directors | Provide board oversight and challenge | Check director functions and applicable exceptions |
| Responsible management | Owns delegated operational decisions | Map actual functions, not labels alone |
Role combinations and outsourcing
Do not assume one person can cover every control function. Combinations require sufficient competence, capacity, independence and conflict management.
Similarly, verify residence, location and outsourcing conditions under the General module and authorisation requirements. Seek required regulatory acceptance before relying on external appointments.
The regulatory business plan
A regulatory business plan differs from an incorporation plan. It explains proposed permissions, products, customers, countries and revenue generation.
For example, connect onboarding decisions to order execution, settlement and counterparties. Identify which group entity contracts with each customer.
Financial and operational delivery
Integrate projections, capital, staffing, technology and banking into that operating model. Explain governance, risk ownership, compliance and conflicts.
Consequently, outsourced functions need budgets and accountable owners. A Swiss parent’s support requires documented responsibilities, not assumptions about group availability.
AML controls matching the business
DFSA Category 3A planning needs a written AML/CFT manual reflecting the AML module and applicable federal legislation.
Therefore, build the AML compliance framework around customer identification, KYC, corporate KYB and documented risk classification. Trace beneficial ownership through natural persons and apply enhanced due diligence where required.
Screening, monitoring and suspicious activity
Screen customers for politically exposed person status and applicable sanctions. Distinguish mandatory UAE and UN measures from additional banking expectations.
For example, consider a broker receiving settlement funds from an unrelated overseas company. Its monitoring system should flag the mismatch. The MLRO investigates and assesses suspicious activity reporting to the UAE Financial Intelligence Unit through goAML.
Compliance oversight and outsourced providers
Compliance monitoring should test onboarding, execution, record keeping and conflicts. Therefore, require evidence that controls work, not merely policy acknowledgements.
Outsourcing contracts need service standards, access rights, incident escalation and exit arrangements. Separately, AISP and PISP licensing in DIFC illustrates why payment functionality needs its own perimeter assessment.
Client money operational safeguards
DIFC Category 3A does not automatically permit client-money handling. Document holding, control and responsibility before selecting safeguarding arrangements.
Where applicable, establish segregation, reconciliations, authorised access and reporting. However, naming a third-party custodian does not explain who resolves settlement failures. Contracts must allocate responsibilities and escalation routes clearly.
DIFC office and operational substance
Plan physical premises and decision-making capacity through the DIFC establishment framework. Registration alone cannot demonstrate operational substance.
Accordingly, document management presence, employees, authorised individuals and accessible books and records. Verify applicable location requirements before signing employment contracts. The regulator must understand where staff perform material functions and how management supervises them.
Get the most relevant information about business life in Dubai
Ask Aston VIP about DFSA authorisation
Assess the category before committing
Aston VIP assesses activities, contractual responsibilities and permission mapping before recommending a prudential category.
Therefore, we test DIFC Category 3A suitability before coordinating establishment and DFSA application preparation.
Coordinate the application workstreams
We coordinate business planning, projections, governance, premises and compliance policy drafting. Pre-banking review covers KYC file preparation and UBO documentation.
In addition, bank matching and introductions to relationship managers follow the operating model. We do not guarantee regulatory approvals or license grants. We do not guarantee bank account approvals.
Our role is to prepare clients properly and introduce them to appropriate institutions. Regulators and banks retain independent decision-making authority.
Send the proposed operating model
Send the business model, proposed financial services, target clients and countries served. Include ownership, expected assets and transaction volumes.
Also explain client-money or asset arrangements, existing authorisations and the management team. Provide the expected launch date as a planning assumption. Aston VIP can then assess the category before preparing a proposal.
To discuss your situation, speak with our team.
"Send the operating model before requesting a price. The permission analysis should determine the proposal, not follow it."
Does Category 3A cover matched-principal dealing?
Matched-principal dealing needs DFSA principal-dealing analysis, including Category 2 and applicable exceptions. By contrast, qualifying alternative trading systems can fall within DIFC Category 3A. Confirm the system’s activities and exact permissions.
How does expenditure affect capital requirements?
Expenditure-based calculations can increase DIFC Category 3A capital requirements beyond the applicable base requirement. Therefore, model expenditure using PIB definitions and adjustments. Assess other applicable calculations and liquidity separately.
Can Category 3A firms handle client assets?
DFSA permissions and applicable conditions determine whether a Category 3A firm can handle client money or arrange custody. However, arranging custody differs from providing custody. Map contractual responsibility and account control before selecting safeguards.
Can compliance and MLRO roles combine?
Combining Compliance Officer and MLRO roles requires assessment under DFSA requirements and any necessary regulatory acceptance. Demonstrate competence, capacity and conflict management. Therefore, do not assume outsourcing or combination automatically satisfies both functions.
How long does Category 3A authorisation take?
A DIFC Category 3A application has no guaranteed approval period. DFSA assessment depends on completeness, management suitability and responses. Additionally, capital, premises and operational conditions affect readiness.
Does overseas authorisation replace local assessment?
Overseas authorisation replaces neither DFSA approval nor UAE bank due diligence. However, a regulated group’s history can support its application evidence. Destination-country rules still govern cross-border distribution.
- Map proposed contracts and client flows to individual DFSA financial service permissions.
- Verify effective PIB, GEN, COB, AML and FER requirements before committing funds.
- Reconcile capital, operating expenditure, management appointments and banking dependencies in one readiness plan.
- Send Aston VIP the operating model for category assessment before requesting a licensing proposal.
How do DFSA applications reach operational readiness?
Application stages and realistic timing
Begin with activity assessment and structuring, then coordinate DIFC entity work and the DFSA submission.
Next come regulatory questions, management assessment and conditions. Final approval follows satisfaction of applicable requirements, not merely application acceptance.
Capital, premises and launch readiness
Complete documentation, capital funding, office arrangements and operational testing. However, do not confuse incorporation timing with financial services authorisation.
No verified processing indication supports a promised launch date here. Therefore, coordinate DIFC company formation with regulatory dependencies rather than advertising a fixed timetable.
Preparing a DIFC brokerage bank account
Emirates NBD, ADCB and HSBC UAE represent potential assessment routes, not assured providers. Their risk appetites and services differ.
Consequently, plan the DIFC brokerage bank account during operating-model design. The international banking AML risk framework explains relevant due-diligence principles.
Banking evidence and expected flows
Prepare ownership charts, UBO evidence, regulatory status, capital provenance and projections. Distinguish transaction-specific source of funds from accumulated source of wealth.
Additionally, forecast 12-month volumes, currencies, countries and counterparties. Explain Indian funding or Singapore and Hong Kong settlement connections specifically. Banks retain review, restriction and closure rights.
Why applications attract further questions
Wrong categories, unclear activities and inexperienced management create information gaps. Weak compliance documents, unexplained ownership and funding compound them.
Similarly, unrealistic projections, inadequate capital, ambiguous client money and weak outsourcing invite questions. Changing the model during assessment adds work. None automatically establishes rejection.
Prepare before approaching the DFSA
Assemble one consistent evidence pack before requesting substantive assessment. Reconcile permissions, contracts and forecasts across every document.
For a DIFC Category 3A proposal, prepare the following readiness materials.
- Document proposed activities, customers, products and transaction flows.
- Provide ownership charts, UBO evidence and management CVs.
- Complete the regulatory business plan, financial model and capital plan.
- Prepare AML, compliance, technology and outsourcing documentation.
- Define office requirements, staffing responsibilities and the banking plan.
