Inside DFSA and FSRA Enforcement: How Financial-Crime Cases Actually Resolve

DFSA and FSRA enforcement actions can move from routine supervision to criminal referral with little warning. Understanding how each stage works — and where leverage exists — is critical for executives, boards, and institutions operating in the UAE's free zones.

The Legal Architecture: Two Regulators, Two Free Zones, One Federal Overlay

The Dubai International Financial Centre and the Abu Dhabi Global Market operate as financially and juridically distinct enclaves. The Dubai Financial Services Authority (DFSA) derives its powers from the Regulatory Law 2004 (DIFC Law No. 1/2004, as amended), the Markets Law 2012, and the DIFC Arbitration Law 2008. The Financial Services Regulatory Authority (FSRA) operates under ADGM's Financial Services and Markets Regulations 2015 (FSMR), as amended. Both regulators are empowered to impose fines, revoke licences, issue prohibition orders, and refer matters to their respective courts or — critically — to federal prosecutors.

The federal overlay cannot be ignored. Federal Decree-Law 10/2025, which came into force on 14 October 2025, replaced Federal Decree-Law 20/2018 entirely and now governs anti-money laundering, countering the financing of terrorism, and countering proliferation financing across the entire UAE, including within free zones. Cabinet Resolution 134/2025 (Executive Regulations, in force 14 December 2025) operationalises the statute. This means that a DFSA or FSRA enforcement case touching money flows, beneficial ownership, or sanctions exposure will inevitably engage federal criminal law, not merely free-zone regulatory law. Personal manager liability under Article 19 of FDL 10/2025 — which allows prosecution of senior executives whose wilful neglect facilitated a violation — has materially changed the risk calculus for C-suite individuals.

Capital-markets offences have also been recodified. Federal Decree-Law 33/2025 codifies insider dealing and market manipulation as criminal offences carrying penalties up to AED 200 million, and Federal Decree-Law 32/2025 formally establishes the Capital Markets Authority (CMA) to replace the SCA from 1 January 2026. Where a DFSA or FSRA investigation involves securities traded across both onshore and free-zone markets, the CMA and DFSA may act concurrently. There is no formal statutory protocol governing that overlap, making early legal coordination essential.

Beneficial ownership disclosure obligations under Cabinet Decision 109/2023 (25% threshold) apply to DIFC and ADGM entities in parallel with each regulator's own UBO requirements. Failure to maintain accurate registers is increasingly treated not merely as a filing deficiency but as a predicate indicator of potential concealment under FDL 10/2025.

How Investigations Begin: Supervisory Reviews, Suspicious Transaction Reports, and Cross-Border Requests

Most DFSA and FSRA investigations do not begin with a dawn raid. They begin with routine supervisory engagement: thematic reviews, periodic financial returns, or a regulatory visit that uncovers anomalies. Regulators will issue a formal notice under their respective investigation powers — DFSA Rule ENF 2.2 and FSRA FSMR Section 190 — compelling the production of documents, data, and witness attendance. Refusing or obstructing at this stage carries independent sanctions and can be treated as aggravating conduct in any later enforcement action.

A second trigger is the Suspicious Transaction Report (STR) system. Under FDL 10/2025 and Cabinet Resolution 134/2025, licensed financial institutions — including DIFC and ADGM-authorised firms — must file STRs with the UAE Financial Intelligence Unit (FIU) through the goAML platform. The FIU may share intelligence with the DFSA or FSRA, and it regularly does so. An STR filed against a DIFC bank by a counterpart institution can set off a supervisory inquiry before the subject entity is aware of any concern.

Cross-border mutual legal assistance is a third and growing trigger. The UAE's extradition and MLA framework under Federal Law 39/2006, as amended by Federal Decree-Law 38/2023, provides mechanisms for foreign jurisdictions — including the UK FCA, US DOJ, and Singapore MAS — to request evidence located in the UAE. Where that request relates to assets or transactions passing through DIFC or ADGM, the DFSA or FSRA may be asked to exercise their powers cooperatively. The regulator's response to an incoming MLA request is almost always disclosed to the subject only after production has occurred.

Crypto-asset businesses licensed under VARA Rulebooks 2.0 (May 2025) or ADGM's digital-asset framework face an additional supervisory layer. The Travel Rule now applies to virtual-asset transfers at an AED 3,500 threshold under Cabinet Resolution 134/2025. VARA and FSRA supervisors are treating Travel Rule non-compliance as a substantive AML failure, not a technical breach, which means the investigation pathway can escalate rapidly to enforcement.

The Enforcement Process: Warning Notices, Decision Notices, and the Right to Refer

DFSA enforcement procedure follows a structured sequence broadly analogous to UK FCA practice. Once the DFSA's Enforcement Division concludes its investigation, it issues a Warning Notice setting out the proposed action — typically a fine, a public censure, a withdrawal of authorisation, or a combination. The subject has a defined period (currently 28 days under DFSA ENF 4.3) to make written representations and, in most cases, to request an oral hearing. This is the most important procedural juncture: representations that are well-evidenced, legally framed, and engage directly with the DFSA's published penalty policy (ENF 6) can materially affect both the characterisation of the conduct and the quantum of any fine.

If representations do not resolve the matter, the DFSA issues a Decision Notice. This is a binding administrative determination. The subject may refer the Decision Notice to the DIFC Court of First Instance, which exercises judicial review jurisdiction over DFSA decisions. Appeals on questions of law are available to the DIFC Court of Appeal. In practice, referrals to the DIFC Court are rare — most matters settle at the Warning Notice stage — but the threat of a contested referral remains a genuine negotiating lever, particularly where the DFSA's penalty calculation is susceptible to challenge.

FSRA procedure under the FSMR follows a closely parallel structure. FSRA issues a Decision Notice (FSMR Section 198) which may be referred to the ADGM Financial Markets Tribunal (FMT). The FMT is an independent body and has shown willingness to scrutinise regulatory reasoning; practitioners should not treat a referral to the FMT as futile. ADGM's enforcement decisions are published unless the FSRA agrees to keep the outcome confidential — a concession that is available in limited circumstances and should always be negotiated.

Both regulators maintain public registers of enforcement outcomes. A publicised Decision Notice has significant reputational consequences that often exceed the direct financial penalty, particularly for institutions seeking to retain or attract regulated business. Managing the public narrative — including the timing and content of any press release — is a substantive part of the enforcement resolution process and must be addressed in settlement negotiations.

Settlements and Disgorgement: How Financial Penalties Are Calculated and Negotiated

Neither the DFSA nor the FSRA is required to litigate enforcement matters to conclusion. Both regulators actively encourage early cooperation and settlement, and both publish penalty policies that award explicit credit for early admissions, remediation, and self-reporting. Under DFSA ENF 6, the regulator assesses a base penalty by reference to the revenue generated by the breach or the loss caused to consumers, applies a multiplier for culpability and market impact, and then adjusts for mitigating and aggravating factors. A subject that self-reports, cooperates fully, and implements remediation at an early stage can achieve reductions of 30% or more on the gross penalty figure. Tactical delay, partial disclosure, or adversarial posture during investigation will be treated as aggravating and can increase the final figure substantially.

Disgorgement — the recovery of profits or benefits derived from the breach — operates separately from punitive fines. The DFSA may order disgorgement in addition to a penalty, and both elements are subject to negotiation. Where the disgorgement calculation is based on attributing all revenue from a business line to a compliance failure, there is frequently scope to challenge the attribution methodology. For example, where a market-abuse case involves a small number of impugned transactions within a legitimately profitable book, a well-argued representation can often reduce the disgorgement base significantly.

CBUAE-supervised institutions facing parallel enforcement face a different scale. The Central Bank of the UAE, under CBUAE Law No. 6/2025, now holds administrative fine authority of up to AED 1 billion per violation. While DFSA and FSRA fines have historically been lower in absolute terms, the reputational and licensing consequences within the free zones are, for most institutions, the more commercially significant risk. For FDL 10/2025 violations prosecuted federally, fines reach AED 100 million with no statute of limitations on money-laundering offences.

Settlement agreements in DFSA and FSRA cases are documented in a formal Settlement Agreement and reflected in a modified Decision Notice. There is no equivalent of a US-style deferred prosecution agreement at the free-zone level, although the DFSA has, in a number of cases, accepted undertakings in lieu of formal enforcement action where the firm has demonstrated credible and irreversible remediation. Practitioners should present a remediation plan — ideally with an independent compliance monitor already appointed — before the Warning Notice stage if possible, as this maximises the prospect of an undertaking rather than a public fine.

Criminal Referrals: When Free-Zone Enforcement Becomes Federal Prosecution

The boundary between DFSA or FSRA administrative enforcement and federal criminal prosecution is not a hard line. Both regulators have memoranda of understanding with the UAE Public Prosecution and with the Attorney General's Office, and both are required — not merely permitted — to refer cases involving suspected money laundering, terrorist financing, or proliferation financing to federal prosecutors under FDL 10/2025. A regulatory investigation that began as a market-conduct matter can become a criminal file if the underlying facts reveal structuring, layering, or concealment consistent with ML offences.

The applicable criminal procedure framework is Federal Decree-Law 38/2022, in force from 1 March 2023, as amended by FDL 45/2023. This statute governs arrest, detention, evidence collection, and trial procedure in federal courts. Pre-trial detention periods in white-collar cases — particularly those with an ML element — can extend significantly, and travel bans are routinely imposed at the investigative stage without prior notice to the subject. Executives based in DIFC who receive a federal criminal summons face personal exposure that the free-zone regulatory framework cannot shield against.

Market-abuse offences under FDL 33/2025 are criminal offences triable in federal courts (or, for DIFC-nexus matters, in the DIFC Court with concurrent jurisdiction questions that remain unsettled). Penalties reach AED 200 million and include imprisonment. Where the DFSA has already completed an administrative enforcement action on the same facts, the double-jeopardy analysis is genuinely complex: the UAE does not have a statutory ne bis in idem principle that clearly bars a subsequent federal prosecution following a free-zone regulatory resolution. Practitioners must therefore structure any DFSA or FSRA settlement to include, where possible, explicit representations from the relevant prosecutor's office that no parallel criminal action is contemplated — though obtaining such representations requires direct engagement with the federal Public Prosecution, which is a separate and distinct process from the regulatory settlement.

Bankruptcy offences present a related risk. Under Federal Decree-Law 51/2023, which created the dedicated Bankruptcy Court (in force 1 May 2024), fraudulent or negligent bankruptcy is a criminal offence. Executives whose companies enter insolvency proceedings after a period of regulatory enforcement are at risk of sequential exposure: first the DFSA or FSRA action, then a bankruptcy criminal referral if the court-appointed insolvency trustee identifies preferential transfers or concealment of assets. Coordinating the regulatory defence with the insolvency strategy is essential from the outset.

Asset Freezing, Cross-Border Recovery, and Enforcement of Judgments

The DFSA has statutory power to apply to the DIFC Court for an injunction freezing assets of a regulated or formerly regulated person pending investigation or enforcement. This power, exercised under DIFC Law No. 1/2004 as amended, can be deployed on an ex parte basis where there is a real risk of dissipation. The threshold applied by the DIFC Court broadly tracks the American Cyanamid balance-of-convenience test, and in financial-crime contexts the court has shown considerable willingness to grant interim relief at short notice. Respondents have the right to apply promptly to discharge or vary the order, and the strength of that application will depend heavily on presenting a credible evidential account of the assets' legitimate provenance.

DIFC Court Law 2/2025 has materially expanded the court's reach. Worldwide freezing orders in support of foreign proceedings are now expressly available without any requirement to demonstrate a local-asset nexus. This follows and codifies the principle emerging from ADGM's A17 v B17 [2025], where the ADGM Court granted a worldwide freezing order in support of foreign arbitral proceedings. The practical consequence is that a DFSA referral to foreign regulators can trigger parallel worldwide freezing proceedings in both the DIFC and ADGM Courts, with enforcement against assets held in jurisdictions that recognise those courts' judgments.

Asset recovery in ML cases is governed by FDL 10/2025 and the Criminal Procedure Law (FDL 38/2022). Federal courts have broad confiscation powers, and the UAE has active bilateral arrangements for the enforcement of confiscation orders. Executives who have transferred assets out of the UAE prior to an investigation must take advice on whether those transfers are susceptible to attack as fraudulent or ML-motivated: under FDL 10/2025, there is no limitation period for ML offences, meaning transfers made years before the investigation may remain vulnerable.

Strategic Considerations: Privilege, Internal Investigations, and Managing Parallel Processes

Legal professional privilege is recognised in both DIFC and ADGM, though the precise scope is defined by each jurisdiction's evidence and procedure rules rather than by a single federal statute. In-house counsel communications attract privilege only where the dominant purpose is the obtaining of legal advice, and regulators have in the past challenged privilege claims over investigation reports prepared by compliance teams or by external forensic accountants. Where internal investigation materials are created under the direction of external legal counsel with a clear privilege mandate from the outset, protection is substantially stronger. This structuring decision must be made before investigation commences — retrofitting a privilege claim over documents already produced to the regulator is rarely effective.

Parallel processes present the most acute strategic challenge. A DFSA investigation, a federal AML inquiry, an ADGM civil claim by a counterpart, and a foreign regulatory request can run simultaneously on overlapping facts. Evidence produced voluntarily to the DFSA can, in principle, be shared with federal prosecutors under the applicable MOU. Statements made to the DFSA by individuals who are subsequently prosecuted criminally raise self-incrimination concerns that the UAE legal framework does not resolve as clearly as, for example, the UK's statutory compelled-evidence protections. Practitioners must advise individual executives that their interests may diverge materially from those of the institution at an early stage, and separate representation should be arranged promptly.

Cooperation credit is real but must be managed carefully. Both the DFSA and FSRA will reduce penalties for genuine, proactive cooperation — but cooperation that inadvertently produces evidence supporting a more serious characterisation of the conduct is not in the client's interest. The sequencing of disclosures, the framing of remediation plans, and the decision on whether to self-report a breach before the regulator discovers it independently (which typically attracts greater credit) are all matters of tactical judgment that must be taken with full visibility of the factual record.

For VARA-licensed entities and digital-asset businesses, an additional consideration arises from the Travel Rule threshold set by Cabinet Resolution 134/2025 at AED 3,500. Supervisory data generated by Travel Rule compliance systems — counterpart wallet identification, transaction metadata, source-of-funds records — is increasingly being used by VARA and FSRA supervisors as an investigative dataset. Businesses that have not stress-tested their Travel Rule data against the regulator's likely analytical approach are operating with incomplete visibility of their own enforcement exposure.

Practical checklist

• Appoint external legal counsel with a clear privilege mandate before producing any documents to DFSA or FSRA.
• Separate legal representation for individual executives and the institution at the first sign of personal exposure.
• Audit beneficial ownership registers immediately against Cabinet Decision 109/2023 before any supervisory visit.
• Assess whether self-reporting a breach will attract cooperation credit under DFSA ENF 6 or FSRA penalty policy.
• Engage directly with federal Public Prosecution before finalising any free-zone regulatory settlement involving AML facts.
• Review Travel Rule compliance data under Cabinet Resolution 134/2025 as a potential supervisory exposure indicator.
• Coordinate insolvency strategy with regulatory defence from outset where company financial distress is also present.
• Consider ex parte freezing-order risk under DIFC Court Law 2/2025 when assets are held across multiple jurisdictions.

Frequently asked questions

Related guides

• Personally Named in a UAE Financial-Crime Investigation? A Director and CFO Survival Guide
• Off-Plan Property and Escrow Fraud in Dubai: Recovering Your Money
• Letter of Credit and Bank Guarantee Fraud: When Can You Injunct Payment in the UAE?
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.