Regulatory Insights & Updates

Primo's monthly DIFC/DFSA and ADGM/FSRA regulatory updates. Select a year, month, and jurisdiction.

2026

September

DIFC / DFSA

DFSA Letter to MLROs on Compliance with Sanctions and Related Operational Risks

2 September 2026

What happened

On 2 September 2026 the DFSA issued a letter to the MLROs of Relevant Persons, copied to the Compliance Officers of Authorised Firms, on compliance with sanctions and related operational risks. The letter is to be read together with the DFSA's letter of 18 December 2023 on the same subject, whose expectations continue to apply. Firms are asked to identify every sanctions regime applicable to their business, with particular attention to UN Security Council regimes, the UN Consolidated List and the UAE Local Terrorist List; to look beyond list screening to evasion networks, indirect ownership or control, intermediaries and complex payment chains; and to keep sanctions policies, risk assessments and screening and monitoring systems current, with alerts investigated promptly and decisions documented. The DFSA further expects firms to plan for the operational consequences of sanctions, including disruption to payment, custody, banking, technology and data services and the resulting liquidity, legal, cyber and reputational risks.

Why it matters

The second half of the letter is the part most frameworks will not already cover. Sanctions arrangements are generally built around screening, investigation and escalation. The DFSA is now asking firms to treat sanctions as an operational resilience matter as well — to identify credible disruption scenarios and hold proportionate contingency arrangements against them — which is a governance and business continuity exercise rather than a compliance monitoring one.

What firms should do

Re-read the DFSA letter of 18 December 2023 alongside this one and confirm that the expectations in both are met.
Review the sanctions risk assessment so that it covers customers, beneficial owners, counterparties, intermediaries, transactions and geographic markets, and expressly addresses evasion networks, indirect ownership or control and complex payment chains.
Identify credible sanctions-driven disruption scenarios across payment, custody, banking, technology and data services, confirm that proportionate contingency arrangements exist and are documented, and report the outcome to senior management.

FTA Calls for Corporate Tax Returns and Payment Within the Statutory Deadline

2 September 2026

What happened

On 2 September 2026 the Federal Tax Authority called on all Taxable Persons subject to Corporate Tax to file their Tax Returns and pay the Corporate Tax due within nine months of the end of the relevant Tax Period. For Taxable Persons whose financial year ended on 31 December 2025, that deadline is 30 September 2026. Taxable Persons applying Small Business Relief must still submit a simplified Tax Return, and Exempt Persons required to register must file their annual declaration within the same nine-month window. The FTA also restated the obligation to retain the records supporting the return, including transaction records, asset and liability registers and ownership details.

Why it matters

Free zone status does not remove an entity from the Corporate Tax regime. Qualifying Free Zone Person relief affects the rate applied, not the obligation to register, file and retain records, so entities that expect a nil liability are still expected to file. The 30 September 2026 deadline falls within days of this update for any entity with a 31 December year end, and late payment attracts administrative penalties.

What firms should do

Confirm the filing and payment deadline for each entity by reference to its own Tax Period, and diarise 30 September 2026 for any entity with a 31 December 2025 year end.
Confirm that entities relying on Small Business Relief have prepared a simplified Tax Return, and that registered Exempt Persons have prepared their annual declaration.
Check that the records supporting the return — transactions, assets, liabilities and ownership — are complete and retrievable before the return is filed, not after a query.

FTA Issues Top-up Tax Guide on Excluded Entities and Investment Entities

3 September 2026

What happened

The Federal Tax Authority issued Top-up Tax Guide TTGEIE1, Excluded Entities and Investment Entities, on 26 August 2026, together with a companion guide on Scope and Registration (TTGREG1); it was circulated to firms on 3 September 2026. The guides address the UAE's Domestic Minimum Top-up Tax under Cabinet Decision No. 142 of 2024, which applies to Fiscal Years beginning on or after 1 January 2025. The guide confirms that an entity's status under the UAE Corporate Tax regime does not determine its status for Top-up Tax purposes, and that each entity must self-assess separately. It sets out the primary Excluded Entity categories — governmental entities, international organisations, non-profit organisations, pension funds, and investment funds or real estate investment vehicles that are Ultimate Parent Entities — together with the 95% and 85% ownership tests for secondary Excluded Entities. It confirms that Investment Entities located in the UAE generally fall outside the charging provisions while their revenue continues to count toward the EUR 750 million consolidated revenue threshold, and that a five-year, irrevocable election is available, entity by entity, not to treat a secondary Excluded Entity as excluded.

Why it matters

Fund managers, holding structures and family offices frequently sit inside groups that meet the EUR 750 million threshold. The point on which analysis most often goes wrong is the one the guide leads with: an entity exempt for Corporate Tax purposes is not thereby excluded for Top-up Tax purposes, and an entity assumed to be excluded may in fact be a Constituent Entity within the charge.

What firms should do

Test each UAE entity's Top-up Tax status separately from its Corporate Tax status, rather than assuming the two follow one another.
Where a group sits near the EUR 750 million threshold, confirm the revenue of Excluded Entities and Investment Entities has been included in the threshold test — exclusion from the charge is not exclusion from the count.
Where secondary Excluded Entity status is claimed, document the 95% or 85% ownership test entity by entity, and record whether the five-year election not to treat the entity as excluded has been made — it binds for the election year and the four following Fiscal Years.

ISIL (Da'esh) and Al-Qaida Sanctions Committee Amends Two Entries

4 September 2026

What happened

On 4 September 2026 the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) amended two entries on its ISIL (Da'esh) and Al-Qaida Sanctions List, by press release SC/16446: Sanaullah Ghafari (QDi.431), the leader of ISIL-Khorasan, and Abubakar Swalleh (QDi.436), an ISIL financial and logistical facilitator for East and Southern Africa. No names were added or removed. For QDi.436, the alias “Isaac Mupeta” — added as a low quality alias on 14 August 2026 — has been upgraded to a good quality alias, and the entry now records two national identification numbers: Uganda CM920231090NZA and a fraudulently acquired Zambian number, Z15105123.

Why it matters

An amendment that adds and removes no names is easily treated as low priority. It should not be. An upgraded alias is a stronger match criterion rather than a weaker one, and a fuzzy-match threshold configured to suppress low quality aliases may now be suppressing a good quality one. The fraudulently acquired Zambian identification number is of particular concern, because it may already sit in a customer file looking entirely genuine.

What firms should do

Ingest the amended list within the required timeframe, and confirm the ingestion captures alias-quality changes and not only names added or removed.
Re-screen customers, beneficial owners and counterparties against the amended QDi.436 identifiers: the good quality alias “Isaac Mupeta”, identification numbers CM920231090NZA and Z15105123, passport A00195974 and both recorded dates of birth.
Search identification records for the Zambian number Z15105123 as a document number in its own right, given that it was fraudulently acquired and may present as a genuine national identity document.

FTA Amends the VAT Executive Regulation — Cabinet Decision No. 149 of 2026

11 September 2026

What happened

Cabinet Decision No. 149 of 2026 amends the Executive Regulation of Federal Decree-Law No. 8 of 2017 on Value Added Tax. It was issued on 1 September 2026, announced by the Federal Tax Authority on 11 September 2026, and takes effect on 1 October 2026 — with one exception, the new input tax apportionment clauses in Article 55, which apply from the first Tax year commencing after 1 October 2027. The amendments reach Article 4 on composite supplies, Article 29 on the Profit Margin Scheme, Article 41 on zero-rated healthcare goods, Article 52 on place of residence, Article 53 on employee-related input tax, Article 54 on cash payments, Article 55 on input tax apportionment, Article 57 on the Capital Assets Scheme and Article 60 on tax credit notes.

Why it matters

Two changes reach firms that would not consider themselves affected by a VAT amendment, and both are live now rather than prospective. Amended Article 53(1)(c) permits recovery on goods and services provided to employees but expressly carves out accommodation provided by the employer, unless that provision is mandatory under decisions or directives of the Ministry of Human Resources and Emiratisation. A firm recovering input tax on staff accommodation outside a MOHRE mandate should assume recovery is blocked from 1 October. Amended Article 57(1) restates the Capital Asset definition as a business asset costing AED 5,000,000 or more excluding tax with an estimated useful life of at least ten years for a building or five years for other assets; some commentary has described this as an increase in the threshold, which does not appear to be right, as the pre-amendment article already used the same figure.

What firms should do

Obtain the consolidated Executive Regulation and identify which articles have changed, rather than working from the FTA's four-area summary alone.
Re-test input tax recovery on employee accommodation against amended Article 53(1)(c); where provision is not mandatory under a MOHRE decision or directive, treat recovery as blocked from 1 October 2026 and quantify the change. The alternative contractual-obligation limb operates only in cases and conditions the FTA has yet to specify.
Confirm whether any asset meets the amended Article 57(1) Capital Asset definition and revisit the adjustment-period calculations, and diarise the Article 55 apportionment clauses for the first Tax year commencing after 1 October 2027.

ISIL (Da'esh) and Al-Qaida Sanctions Committee Amends One Entity Entry

28 September 2026

What happened

On 28 September 2026 the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) amended one entry on its ISIL (Da'esh) and Al-Qaida Sanctions List, under press release SC/16465. The entry is an entity, QDe.168, listed since 7 March 2022, which operates under the umbrella of a formerly listed Al-Qaida affiliate, is principally active in three Syrian provinces and conducts operations across a further nine jurisdictions, and is recorded as cooperating with two other listed entities. The UAE EOCN circulated the update on 29 September 2026, reminding all Persons that under Cabinet Decision No. 74 of 2020 they must implement targeted financial sanctions and report the results of screening and the measures taken.

Why it matters

This is an amendment to an entity rather than an individual, and entity amendments are the ones screening systems absorb least well. The match is carried by the alias and original-script fields rather than by a personal name, and a system tuned for individuals may not re-screen entity aliases on ingestion. The entry carries aliases in Cyrillic and Arabic script and a former name, so a search on the current English name alone will not surface historic exposure.

What firms should do

Ingest the amended list within the timeframe required by Cabinet Decision No. 74 of 2020, and confirm the ingestion captured the amended entity record and not only individual entries.
Re-screen customers, beneficial owners and counterparties against the entity's aliases and former name, including the original-script forms, rather than the current English name alone.
Record the screening result and the measures taken, and file the report the Executive Office requires even where the result is nil.

DFSA Issues Seven Impersonation Alerts

8 – 29 September 2026

What happened

The DFSA published seven alerts during September. Five concerned impersonation of the DFSA itself: fake correspondence offering to process or release funds tied to blockchain and crypto transactions; an advance fee demanded to release supposed cash and gold holdings; fraudulent recruitment communications offering non-existent DFSA vacancies; and an entity falsely claiming to be a DFSA-licensed firm in the DIFC. Two concerned cloned Authorised Firms, through look-alike websites and trading platforms, forged documents and spoofed email addresses. A seventh concerned a DIFC-registered firm impersonated in a recruitment scam requiring candidates to pay for a fictitious certificate.

Why it matters

Seven alerts in a single month is a marked increase, and the pattern has shifted. The DFSA's name is now being used to manufacture a release condition — a fee, a verification payment, a certificate — rather than simply to lend credibility to an investment pitch. Two of the alerts concern genuine Authorised Firms, which makes this an operational matter for those firms and not only a consumer warning.

What firms should do

Circulate the alerts internally, particularly to client-facing and recruitment staff, and confirm that the firm's own domains, email signatures and job advertisements are distinguishable from the cloned versions described.
Where the firm's own brand is cloned, notify the DFSA, pursue domain takedown, and record the incident and the client communications issued in the incident log.
Remind clients through the usual channels that the DFSA does not hold, verify, settle or release client funds and never requires payment from job candidates.

How Primo Can Help

What Primo is doing

Primo continues to monitor regulatory developments across the DIFC and the wider UAE, and to translate them into practical, firm-specific actions.

This month that means testing sanctions frameworks against the DFSA's letter of 2 September, extending them from screening and escalation into operational resilience, refreshing screening configurations against the amended UN entries, and assessing Corporate Tax and Top-up Tax positions ahead of the September filing deadline.

Where required, we engage directly with your Senior Management, Board of Directors and Control Functions to ensure that regulatory changes are implemented, evidenced and embedded, not merely documented, and that your firm remains inspection-ready at all times.

What Primo can do

Primo provides end-to-end regulatory, risk and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance and regulatory engagement.

Whether you require support with sanctions and targeted financial sanctions frameworks, sanctions-driven operational resilience planning, Corporate Tax and Top-up Tax readiness, VAT recovery positions, or broader DFSA compliance obligations, Primo delivers practical, proportionate and regulator-focused solutions tailored to your business model and growth objectives.

ADGM / FSRA

FTA Calls for Corporate Tax Returns and Payment Within the Statutory Deadline

2 September 2026

What happened

Why it matters

What firms should do

Confirm the filing and payment deadline for each entity by reference to its own Tax Period, and diarise 30 September 2026 for any entity with a 31 December 2025 year end.
Confirm that entities relying on Small Business Relief have prepared a simplified Tax Return, and that registered Exempt Persons have prepared their annual declaration.
Check that the records supporting the return — transactions, assets, liabilities and ownership — are complete and retrievable before the return is filed, not after a query.

FTA Issues Top-up Tax Guide on Excluded Entities and Investment Entities

3 September 2026

What happened

Why it matters

What firms should do

Test each UAE entity's Top-up Tax status separately from its Corporate Tax status, rather than assuming the two follow one another.
Where a group sits near the EUR 750 million threshold, confirm the revenue of Excluded Entities and Investment Entities has been included in the threshold test — exclusion from the charge is not exclusion from the count.
Where secondary Excluded Entity status is claimed, document the 95% or 85% ownership test entity by entity, and record whether the five-year election not to treat the entity as excluded has been made — it binds for the election year and the four following Fiscal Years.

ISIL (Da'esh) and Al-Qaida Sanctions Committee Amends Two Entries

4 September 2026

What happened

Why it matters

What firms should do

Ingest the amended list within the required timeframe, and confirm the ingestion captures alias-quality changes and not only names added or removed.
Re-screen customers, beneficial owners and counterparties against the amended QDi.436 identifiers: the good quality alias “Isaac Mupeta”, identification numbers CM920231090NZA and Z15105123, passport A00195974 and both recorded dates of birth.
Search identification records for the Zambian number Z15105123 as a document number in its own right, given that it was fraudulently acquired and may present as a genuine national identity document.

FTA Amends the VAT Executive Regulation — Cabinet Decision No. 149 of 2026

11 September 2026

What happened

Why it matters

What firms should do

Obtain the consolidated Executive Regulation and identify which articles have changed, rather than working from the FTA's four-area summary alone.
Re-test input tax recovery on employee accommodation against amended Article 53(1)(c); where provision is not mandatory under a MOHRE decision or directive, treat recovery as blocked from 1 October 2026 and quantify the change. The alternative contractual-obligation limb operates only in cases and conditions the FTA has yet to specify.
Confirm whether any asset meets the amended Article 57(1) Capital Asset definition and revisit the adjustment-period calculations, and diarise the Article 55 apportionment clauses for the first Tax year commencing after 1 October 2027.

ADGM Registration Authority Consults on Undeveloped Commercial Land Regulations

14 September 2026

What happened

On 14 September 2026 the ADGM Registration Authority issued Consultation Paper No. 3 of 2026 on a proposal to enact Undeveloped Commercial Land Regulations 2026. The consultation closes on 4 October 2026. The Regulations would apply to vacant commercial plots that are capable of development and supported by the necessary infrastructure. Plot owners would have a six-month grace period in which to apply for a building permit; would have to submit evidence of a notice of commencement of construction and progress the construction within prescribed timeframes; and would face an undeveloped land fee calculated at 2% of the plot's fair market value where a qualifying plot remains undeveloped. Limited exemptions and extensions would be available where development is prevented by infrastructure, legal or administrative constraints.

Why it matters

This is a Registration Authority measure rather than an FSRA one, so it does not touch a Financial Services Permission. It does, however, reach any ADGM entity or group that holds a vacant commercial plot, and a fee set at 2% of fair market value is material enough to warrant a response while the consultation is open.

What firms should do

Confirm whether the firm or any group entity holds, or is in the course of acquiring, a vacant commercial plot in ADGM.
Where it does, assess exposure to the proposed 2% fee, the six-month building-permit grace period and the construction-progress evidence requirements.
Submit a consultation response before 4 October 2026 where the proposals affect the business, and diarise a check for the final Regulations once the consultation closes.

FSRA Finalises Enhancements to its Funds Framework

16 September 2026

What happened

On 16 September 2026 the FSRA made and published rules amending COBS, FUNDS, GEN, GLO and PRU, finalising the enhancements consulted on in Consultation Paper No. 12 of 2025, with immediate effect, alongside Supplementary Guidance – Regulatory Framework for Specialised Fund Manager Categories. Three streamlined categories are created: the Sub-Threshold Fund Manager, whose Funds may not exceed USD 200 million in aggregate Committed Capital, may not admit Retail Clients and must have non-redeemable Units; the Institutional Fund Manager, which manages only Institutional Funds; and the Institutional Fund Asset Manager, an in-Group Managing Assets firm serving only Institutional Funds. Those three categories and Venture Capital Fund Managers are relieved of the GEN 3.3.13 to 3.3.15 systems and controls Rules and of the requirement to appoint a Finance Officer, and Institutional Fund Managers and Institutional Fund Asset Managers move to a reduced Expenditure Based Capital Minimum of 6/52nds of Annual Audited Expenditure with no professional indemnity insurance requirement. A new Employee Investment Vehicle regime permits fund staff to invest in their employer's Exempt Funds and Qualified Investor Funds outside the minimum subscription thresholds. The changes are not all relaxations: a Foreign Fund Manager may now manage only a closed-ended Qualified Investor Fund, must be regulated in a Recognised Jurisdiction and must submit to ADGM law and the ADGM Courts, the equivalence route having been withdrawn. On 17 September 2026 the FSRA followed with two letters. The letter to Venture Capital Fund Managers states that they are now categorised as Sub Threshold Fund Managers, must hold Capital Resources of USD 50,000, and must report Capital Resources through the Electronic Prudential Reporting System from 31 March 2027, moving to a new reporting schedule in January 2027. The letter to Foreign Fund Managers requires an ADGM-based Fund Administrator, an ADGM-licensed Corporate Service Provider and a UAE-resident natural person as a director of the Fund Vehicle, with only the first two applying to existing Foreign Fund Managers during the transition. Both letters require a compliance survey response by 27 November 2026 and full compliance by 31 March 2027.

Why it matters

This is the most consequential ADGM development of the month, and it cuts both ways. Existing firms gain optional routes into lighter categories with reduced prudential and governance burdens, but Foreign Fund Managers face new mandatory conditions on every Domestic Fund mandate they hold. The transition period for Venture Capital Fund Managers and Foreign Fund Managers closes on 31 March 2027, and the survey response falls well before that, on 27 November 2026.

What firms should do

Determine whether the firm qualifies as, and would benefit from becoming, a Sub-Threshold Fund Manager, an Institutional Fund Manager or an Institutional Fund Asset Manager - reading the Supplementary Guidance on Specialised Fund Manager Categories before deciding and submit the FSRA status-change form before varying any Financial Services Permission.
Foreign Fund Managers should read the 17 September letter against each Domestic Fund mandate alongside the recast FUNDS Chapter 7, confirm the Fund Administrator, Corporate Service Provider and UAE-resident director appointments, and plan Fund documentation amendments to complete before 31 March 2027.
Acknowledge the applicable letter and return the FSRA compliance survey by 27 November 2026 setting out the implementation plan; Venture Capital Fund Managers should confirm Capital Resources against the USD 50,000 figure and arrange Electronic Prudential Reporting System access ahead of the January 2027 reporting change.

ISIL (Da'esh) and Al-Qaida Sanctions Committee Amends One Entity Entry

28 September 2026

What happened

On 28 September 2026 the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) amended one entry on its ISIL (Da'esh) and Al-Qaida Sanctions List, under press release SC/16465. The entry is an entity, QDe.168, listed since 7 March 2022, which operates under the umbrella of a formerly listed Al-Qaida affiliate, is principally active in three Syrian provinces and conducts operations across a further nine jurisdictions, and is recorded as cooperating with two other listed entities. The UAE Executive Office for Control and Non-Proliferation circulated the update on 29 September 2026, reminding all Persons that under Cabinet Decision No. 74 of 2020 they must implement targeted financial sanctions and report the results of screening and the measures taken.

Why it matters

What firms should do

Ingest the amended list within the timeframe required by Cabinet Decision No. 74 of 2020, and confirm the ingestion captured the amended entity record and not only individual entries.
Re-screen customers, beneficial owners and counterparties against the entity's aliases and former name, including the original-script forms, rather than the current English name alone.
Record the screening result and the measures taken, and file the report the Executive Office requires even where the result is nil.

FSRA Alerts the Public to a Suspected Fraudulent Scheme by E-Community

30 September 2026

What happened

On 30 September 2026 the FSRA alerted the financial services community and the public to a suspected fraudulent scheme and false and misleading claims by an entity or purported entity named E-Community, operating from https://e-community.co. The website purports to offer trading in stocks, cryptocurrencies, commodities, currencies, indices and Contracts for Difference, invites investors including those based in the UAE to open trading accounts, and falsely claims to be based in ADGM and thereby regulated by the FSRA. The FSRA confirms that E-Community has never been granted a Financial Services Permission to carry on any Regulated Activity in or from ADGM, and has never been incorporated in ADGM or licensed to undertake any commercial activity there.

Why it matters

The claim being made is jurisdictional rather than product-specific: the entity is borrowing ADGM's standing rather than imitating a particular firm. That makes the public register the operative control, and it makes the alert relevant to any ADGM firm whose clients may encounter the site while comparing counterparties. A firm offering similar instruments should expect questions from clients who have seen it.

What firms should do

Confirm that no client, counterparty or introducer relationship touches E-Community or e-community.co, and screen for the domain in payment and onboarding records.
Reinforce with clients that an ADGM claim can be verified in seconds on the FSRA public register, and that only firms holding a Financial Services Permission may carry on Regulated Activities in or from ADGM.
Report any contact with the entity to the FSRA through the complaints channel, and record the check in the financial crime incident log.

How Primo Can Help

What Primo is doing

Primo continues to monitor regulatory developments across ADGM and the wider UAE, and to translate them into practical, firm-specific actions.

This month that means impact assessments against the FSRA's finalised Funds framework, mapping clients to the new Sub-Threshold, Institutional and Institutional Asset Manager categories, planning Foreign Fund Manager transitions ahead of 31 March 2027, and refreshing sanctions screening configurations against the amended UN entries.

What Primo can do

Primo provides end-to-end regulatory, risk and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance and regulatory engagement.

Whether you require support with the new fund manager categories, a Foreign Fund Manager transition plan, sanctions and targeted financial sanctions frameworks, Corporate Tax and Top-up Tax readiness, or broader FSRA compliance obligations, Primo delivers practical, proportionate and regulator-focused solutions tailored to your business model and growth objectives.

August

DIFC / DFSA

1988 Sanctions Committee Amends One Name on Its Sanctions List

27 August 2026

What happened

On 27 August 2026, the Security Council Committee established pursuant to resolution 1988 (2011) amended the entry for Abdul Salam Hanafi Ali Mardan Qul (TAi.027), a former Deputy Minister of Education under the Taliban regime, updating his passport details.

Why it matters

Continued amendments to senior Taliban-linked entries on the 1988 List reflect the Committee’s ongoing efforts to keep travel and identity data current for high-profile designated individuals with cross-border movement — relevant to firms with any Afghanistan-linked client exposure.

What firms should do

Update screening records for TAi.027 (Abdul Salam Hanafi) with the newly added passport identifier.
Re-screen any Afghanistan-linked clients, counterparties or correspondent relationships against the amended 1988 (Afghanistan/Taliban) Sanctions List.
Confirm screening tools pull the 1988 List alongside the ISIL/Al-Qaida list, since both feed into the UN Consolidated List firms are expected to screen against.

ISIL (Da’esh) and Al-Qaida Sanctions Committee Amends 21 Entries

18 August 2026

What happened

On 18 August 2026, the Committee amended 21 entries on its ISIL (Da’esh) and Al-Qaida Sanctions List — the largest set of amendments in the month. The revisions cover senior Jemaah Islamiyah figures (including Hambali, QDi.087), Abu Sayyaf Group members, Al-Qaida in the Islamic Maghreb (AQIM) leadership, and long-standing entities including Al-Qaida in the Arabian Peninsula (AQAP, QDe.129) and the Islamic Jihad Group (QDe.119), primarily updating listing histories, confirmed-deceased status, and address or alias details.

Why it matters

With 21 entries revised in a single update — including confirmed-deceased status changes and an updated leadership designation for AQAP — this is a significant refresh of some of the sanctions list’s longest-standing entries.

What firms should do

Refresh screening data in full against the 18 August amendments rather than applying incremental patches, given the scale of this update.
Review any historical matches or hits against the amended individuals and entities for current status, including confirmed-deceased designations.
Note the updated leadership designation for Al-Qaida in the Arabian Peninsula (AQAP, QDe.129) and update any related-party screening accordingly.

ISIL (Da’esh) and Al-Qaida Sanctions Committee Amends a Further Four Entries

14 August 2026

What happened

On 14 August 2026, the Committee amended four further entries: updating the place of birth, address and listing history of Amin Muhammad Ul Haq Saam Khan (QDi.002); adding an alias for Abubakar Swalleh (QDi.436), an ISIL facilitator providing financial and logistic support in East and Southern Africa; updating the listing history of Hamida Nabaggala (QDi.439); and updating the listing history of the entity Islamic State in Iraq and the Levant – Khorasan (ISIL-K) (QDe.161).

Why it matters

The entries span individuals linked to core Al-Qaida leadership through to regional ISIL financing and facilitation networks in Central, East and Southern Africa, and the ISIL-K affiliate in South Asia — illustrating the geographic breadth firms must screen across, not just entries tied to their core markets.

What firms should do

Update screening records for QDi.002, QDi.436, QDi.439 and QDe.161 with the amended particulars.
Pay particular attention to Abubakar Swalleh (QDi.436) and Hamida Nabaggala (QDi.439), both linked to ISIL financing networks in Central, East and Southern Africa, given the elevated regional facilitation risk.
Ensure screening captures ISIL-K (QDe.161) under all listed aliases, given its use of multiple naming conventions across sources.

ISIL (Da’esh) and Al-Qaida Sanctions Committee Amends Four Entries

13 August 2026

What happened

On 13 August 2026, the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) amended four entries on its ISIL (Da’esh) and Al-Qaida Sanctions List: updating the aliases and listing history of Mohammed Salahaldin Abd El Halim Zidane, a.k.a. Sayf Al-Adl (QDi.001); adding an updated address for Adem Yilmaz (QDi.261); updating identification numbers for Shafi Sultan Mohammed Sultan Al-Ajmi (QDi.338); and updating the listing history of the entity Ummah Tameer E-Nau (UTN) (QDe.068).

Why it matters

The amendments refresh aliases, addresses and identifiers on entries that in some cases have stood since 2001 — a reminder that long-standing sanctions entries are still actively maintained, and that screening against outdated alias or address data can cause a true match to be missed.

What firms should do

Update screening records for QDi.001, QDi.261, QDi.338 and QDe.068 to capture the newly added aliases, addresses and identification numbers.
Re-run screening against the amended entries to check whether any historical or dormant partial matches now resolve differently.
Confirm screening tools draw from the current ISIL (Da’esh) and Al-Qaida Sanctions List rather than a cached or partial extract.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across DIFC and translate them into practical, firm-specific actions.

We are already conducting impact assessments, updating policies and procedures, enhancing governance frameworks, and aligning operational practices with the latest DFSA expectations — particularly in areas such as digital assets, conflicts of interest, cyber risk, and client asset protection.

Where required, we engage directly with your Senior Management, Board of Directors, and Control Functions to ensure that regulatory changes are implemented, evidenced, and embedded, not merely documented, and that your firm remains inspection-ready at all times.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Whether you require support with crypto asset regulation, fund structuring, operational resilience, cyber risk management, or broader DFSA compliance obligations, Primo delivers practical, proportionate, and regulator-focused solutions tailored to your business model and growth objectives.

Primo Advisors | DIFC / DFSA Regulatory Update | August 2026

ADGM / FSRA

1988 Sanctions Committee Amends One Name on Its Sanctions List

27 August 2026

What happened

Why it matters

What firms should do

Update screening records for TAi.027 (Abdul Salam Hanafi) with the newly added passport identifier.
Re-screen any Afghanistan-linked clients, counterparties or correspondent relationships against the amended 1988 (Afghanistan/Taliban) Sanctions List.
Confirm screening tools pull the 1988 List alongside the ISIL/Al-Qaida list, since both feed into the UN Consolidated List firms are expected to screen against.

ISIL (Da’esh) and Al-Qaida Sanctions Committee Amends 21 Entries

18 August 2026

What happened

Why it matters

What firms should do

Refresh screening data in full against the 18 August amendments rather than applying incremental patches, given the scale of this update.
Review any historical matches or hits against the amended individuals and entities for current status, including confirmed-deceased designations.
Note the updated leadership designation for Al-Qaida in the Arabian Peninsula (AQAP, QDe.129) and update any related-party screening accordingly.

ISIL (Da’esh) and Al-Qaida Sanctions Committee Amends a Further Four Entries

14 August 2026

What happened

Why it matters

What firms should do

Update screening records for QDi.002, QDi.436, QDi.439 and QDe.161 with the amended particulars.
Pay particular attention to Abubakar Swalleh (QDi.436) and Hamida Nabaggala (QDi.439), both linked to ISIL financing networks in Central, East and Southern Africa, given the elevated regional facilitation risk.
Ensure screening captures ISIL-K (QDe.161) under all listed aliases, given its use of multiple naming conventions across sources.

ADGM's FSRA Signs Memorandum of Understanding with GCGRA to Strengthen Regulatory Cooperation

14 August 2026

What happened

On 14 August 2026, the FSRA and the UAE's General Commercial Gaming Regulatory Authority (GCGRA) signed a Memorandum of Understanding formalising a framework for regulatory cooperation, covering supervisory coordination, policy dialogue, investigative assistance and regulatory information sharing within applicable confidentiality and legal requirements.

Why it matters

The MoU creates a formal channel between ADGM's financial regulator and the UAE's federal gaming regulator as the commercial gaming sector expands and increasingly interacts with regulated financial services such as payments and custody, supporting coordinated supervision and greater regulatory certainty for market participants operating across both perimeters.

What firms should do

Firms operating at the intersection of financial services and commercial gaming — payments, e-wallets or custody arrangements serving gaming operators — should expect closer information-sharing between FSRA and GCGRA and review cross-sector disclosures accordingly.
Where a group entity holds or is applying for both an FSRA licence and a GCGRA authorisation, ensure consistent representations are made to both regulators given the new cooperation channel.
Monitor for further joint guidance or supervisory statements as the FSRA/GCGRA cooperation framework is operationalised.

ISIL (Da’esh) and Al-Qaida Sanctions Committee Amends Four Entries

13 August 2026

What happened

Why it matters

What firms should do

Update screening records for QDi.001, QDi.261, QDi.338 and QDe.068 to capture the newly added aliases, addresses and identification numbers.
Re-run screening against the amended entries to check whether any historical or dormant partial matches now resolve differently.
Confirm screening tools draw from the current ISIL (Da’esh) and Al-Qaida Sanctions List rather than a cached or partial extract.

Coinbase Establishes Its Tokenization Hub in Abu Dhabi, with Financial Services Permission from the FSRA

11 August 2026

What happened

On 11 August 2026, Coinbase received a Financial Services Permission (FSP) from the FSRA to establish its international tokenization hub in ADGM, authorising it to arrange investment deals and provide custody services to facilitate the issuance and registration of tokenized securities. The tokens are fully backed by underlying shares, with token holders receiving full shareholder rights including dividends and voting rights, and the arrangement embeds ongoing sanctions screening with asset-freezing capability at wallet level.

Why it matters

The permission extends ADGM's virtual asset framework — one of the world's first, dating to 2018 — into large-scale tokenized securities issuance by a major global exchange, reinforcing Abu Dhabi's position as a hub for regulated, blockchain-enabled capital markets infrastructure.

What firms should do

Firms considering tokenized securities offerings should review Coinbase's FSP as a benchmark for the custody and arranging permissions required, and the sanctions-screening/asset-freeze functionality regulators expect embedded at wallet level.
Custodians and broker-dealers should assess whether their own token infrastructure supports equivalent shareholder-rights pass-through, including dividends and voting, for tokenized securities.
Monitor FSRA's continued expansion of its virtual asset regime as further large-scale institutional players enter the market.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across ADGM and translate them into practical, firm-specific actions.

We are already conducting impact assessments, updating policies and procedures, enhancing governance frameworks, and aligning operational practices with the latest FSRA expectations — particularly in areas such as digital assets, conflicts of interest, cyber risk, and client asset protection.

Where required, we engage directly with your Senior Management, Board of Directors, and Control functions to ensure that regulatory changes are implemented, evidenced, and embedded, not merely documented, and that your firm always remains inspection ready.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Whether you require support with crypto asset regulation, fund structuring, operational resilience, cyber risk management, or broader FSRA compliance obligations, Primo delivers practical, proportionate, and regulator-focused solutions tailored to your business model and growth objectives.

Primo Advisors | ADGM / FSRA Regulatory Update | August 2026

July

DIFC / DFSA

UN Security Council Sanctions List Updates

9 – 31 July 2026

What happened

Four separate UN sanctions committees updated their lists in July: on 9 July the ISIL (Da’esh) and Al-Qaida Sanctions Committee amended the entry for Hamidah Nabaggala (QDi.439), updating her date of birth and identification details; on 17 July the 1533 Sanctions Committee added six individuals and two entities linked to the Alliance Fleuve Congo, M23, FDLR, ADF and Twirwaneho armed groups in the Democratic Republic of the Congo; on 24 July the Libya Sanctions Committee added the vessel Avax (IMO 9058713) for illicit petroleum exports; and on 31 July the 1988 Sanctions Committee amended five entries on its Afghanistan/Taliban list, including updated identity and passport details for senior figures such as Sirajuddin Haqqani.

Why it matters

Four separate sanctions regimes changed within the same month — spanning Afghanistan, Libya, the Democratic Republic of the Congo, and ISIL/Al-Qaida — underscoring how frequently UN sanctions lists move and how easily a firm's screening can fall out of date if updates aren't captured across every relevant regime, not just the ones tied to a firm's core markets.

What firms should do

Update sanctions screening systems against all four list changes: the 1988 (Afghanistan/Taliban), Libya, 1533 (DRC), and ISIL/Al-Qaida Sanctions Lists.
Re-screen existing clients, counterparties, and any vessel or entity exposure against the amended and newly added entries.
Confirm screening tools are pulling from the UN Consolidated List rather than a single regime's list in isolation.
Record the screening date, method, and outcome to evidence compliance with DFSA AML/CFT expectations.

CP174 — Token Definitions, Credit Rating Agencies, and Regulatory Reporting

9 July 2026

What happened

DFSA is narrowing Fiat Crypto Token and Privacy Token/Device definitions, simplifying the Investment Token test to capture hybrid on-chain/off-chain instruments, easing CRA conflict-of-interest and disclosure rules, and updating PIB reporting templates for recent prudential changes.

Why it matters

The token definition changes could reclassify existing products — particularly stablecoins and hybrid DLT instruments — and firms will need to re-check marketing and classification. CRA firms gain relief from duplicative disclosure, while all Authorised Firms under PIB reporting should expect new data fields.

What firms should do

Re-assess Crypto Token and Investment Token classifications, especially fiat-backed and hybrid on-chain/off-chain instruments.
CRAs should update conflict-of-interest and disclosure policies to reflect the narrower rules.
Authorised Firms under PIB reporting should prepare for updated templates and DFSA testing.
Submit responses via the DFSA's online form by 24 August 2026.

DFSA's 9th Audit Monitoring Report

9 July 2026

What happened

Audit fees rose 74% to US$ 33.5 million and file gradings improved, but DFSA flagged five recurring gaps — supporting the audit opinion, investment valuation, related parties, revenue recognition, and understanding the entity — plus growing reliance on audit managers over Audit Principals. PLC auditors also published first-ever transparency reports on governance and quality management.

Why it matters

The findings show improving technical standards but persistent gaps in documentation and professional scepticism in higher-risk areas. Firms that haven't embedded fixes from prior cycles, or that lean too heavily on audit managers, are exposed to regulatory action as DFSA sharpens its focus on tone at the top and oversight quality.

What firms should do

Benchmark file gradings and remediation plans against the five thematic findings.
Ensure Audit Principals demonstrate active, documented leadership in high-risk and judgemental areas.
Move auditor selection and reappointment to a quality-centric basis using transparency reports.
Prepare for 2026 inspections on Systems of Quality Management, AI use, and revenue recognition.

CP173 — Overhaul of the Collective Investment Fund Framework

7 July 2026

What happened

DFSA is replacing rigid private fund classifications with a flexible, risk-based model, simplifying manager authorisation, updating master-feeder structures, scrapping the external fund manager regime, and widening employee investment in private funds — plus early views on tokenisation and long-term funds.

Why it matters

This is the most significant review of the funds framework since 2010. It reshapes how private funds are classified and licensed, removes an entire regulatory regime, and signals DFSA's direction on tokenisation and retail access to illiquid assets — with real structural and licensing implications for existing fund managers.

What firms should do

Assess how the new risk-based fund classification affects existing specialist private fund structures.
Firms operating under the external fund manager regime should plan their transition to full authorisation.
Review licensing scope if dealing as agent or arranging activities are currently held separately.
Submit responses via the DFSA's online form by 7 September 2026.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across DIFC and translate them into practical, firm-specific actions.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Primo Advisors | DIFC / DFSA Regulatory Update | July 2026

ADGM / FSRA

UN Security Council Sanctions List Updates

9 – 31 July 2026

What happened

Four UN sanctions committees updated their lists in July: on 9 July, ISIL (Da’esh)/Al-Qaida amended the entry for Hamidah Nabaggala (QDi.439); on 17 July, the 1533 Committee added six individuals and two entities linked to AFC, M23, FDLR, ADF and Twirwaneho in the DRC; on 24 July, the Libya Committee added the vessel Avax (IMO 9058713) for illicit petroleum exports; and on 31 July, the 1988 Committee amended five Afghanistan/Taliban entries, including Sirajuddin Haqqani's identity and passport details.

Why it matters

Four sanctions regimes changed in one month — Afghanistan, Libya, the DRC and ISIL/Al-Qaida — a reminder that screening must cover every relevant regime, not just those tied to a firm's core markets.

What firms should do

Update screening against all four list changes: 1988 (Afghanistan/Taliban), Libya, 1533 (DRC), and ISIL/Al-Qaida.
Re-screen clients, counterparties and any vessel/entity exposure against the amended and added entries.
Confirm screening tools pull from the UN Consolidated List, not a single regime in isolation.
Record the screening date, method and outcome as FSRA AML/CFT compliance evidence.

ADGM's RA Activates Broker Classification Framework

31 July 2026

What happened

The Registration Authority (RA) activated its Broker Classification Framework for real estate brokers in ADGM, recognising high performers against transaction activity, continuous professional development and customer feedback. The RA will run workshops with brokerages to support the framework and guide further development.

Why it matters

This applies to real estate brokers and brokerages in ADGM specifically, not financial services firms generally. It creates a criteria-based recognition mechanism tying a broker's standing to activity, CPD and client feedback — raising the bar on demonstrable professionalism and giving buyers, sellers, owners and tenants a visible quality signal.

What firms should do

Review the classification criteria — transaction activity, CPD and customer feedback — and assess your standing against them.
Keep CPD records and transaction history ready for the RA's assessment.
Strengthen customer feedback capture, since feedback now feeds directly into classification.
Attend RA workshops and engagement sessions to stay ahead of further guidance.

Consultation Paper 2 of 2026 — Proposed Enhancements to Transfer Schemes

27 July 2026

What happened

FSRA issued Consultation Paper No. 2 of 2026, proposing to limit mandatory Court sanctioning under Part 7 of FSMR to insurance business transfers only, excluding intragroup transfers with full policyholder consent and reinsurance transfers with cedant consent. All other Transfer Schemes — including banking and non-insurance transfers — could instead proceed as a “Modified Transfer Scheme” under proposed GEN Chapter 8A: advance FSRA notice, direct client notice and public notice, with Banks and the two exclusions also needing FSRA no-objection. Comments close 21 September 2026.

Why it matters

This changes who needs Court sanctioning at all — today every transfer does; under the proposal only insurance transfers (barring the two exclusions) still will. Most transfers currently seen in ADGM, including by Banks, would gain a faster, lower-cost route, while notice requirements and an FSRA no-objection preserve client protection.

What firms should do

Assess whether a planned transfer, restructuring or intragroup reorganisation would qualify as a Modified Transfer Scheme under proposed GEN Chapter 8A.
Insurers/reinsurers: check whether your transfer falls within the two exclusions — if not, mandatory Court sanctioning still applies.
Banks: note the added requirement to obtain FSRA no-objection even under the modified route.
Submit responses to CP2 of 2026 to fsra.consultation@adgm.com by 21 September 2026.

Takeover Regulations (Takeover Code) Rules 2026

20 July 2026

What happened

The Takeover Panel enacted the first comprehensive Takeover Code under the Takeover Regulations 2015, covering approach and announcement requirements, independent advice, offer terms and conduct, profit forecasts, asset valuations, offer timetables, restrictions following offers, and schemes of arrangement. The Rules took effect immediately on publication.

Why it matters

This is ADGM's first detailed takeover rulebook, giving the Panel clear enforcement powers — including compensation rulings, private and public censure, and referral to other regulators — for breaches during M&A activity involving ADGM-incorporated public companies.

What firms should do

Listed and public companies incorporated in ADGM should review the new Code against any live or anticipated takeover situations.
Boards and advisers should familiarise themselves with the announcement, offer document, and conduct-during-offer requirements before engaging in takeover activity.
Ensure profit forecasts, asset valuations, and offer timetables are prepared in line with the new Code's specific requirements.
Build in Panel consultation early where a transaction may trigger dual jurisdiction with another regulator.

FSRA Notice 117/2026 — Reminder on Key AML/TFS Obligations and goAML Reporting

14 July 2026

What happened

FCCP reminded all Relevant Persons of their obligations to establish AML/CFT systems and controls, complete two-stage registration on the FIU's goAML platform, and submit the correct report type — including STRs, SARs, REARs, and time-bound reports such as PNMRs (5 business days), CNMRs (24-hour asset freeze), and HRCA/HRC reports (3 business days before engagement or transaction).

Why it matters

Reporting deadlines under the goAML framework are strict and time-critical, particularly for name-match and high-risk jurisdiction reports and FSRA has confirmed it will take enforcement action against firms that fail to comply with these AML/TFS obligations.

What firms should do

Confirm your entity and MLRO/deputy MLRO are fully registered on goAML (both SACM pre-registration and portal registration stages).
Map internal escalation processes against each report type and its specific trigger and deadline, especially PNMR, CNMR, HRCA, and HRC.
Ensure annual AML risk assessments, red flag registers, and training are up to date and tailored to your business.
Maintain STR/SAR records for the required six-year retention period and notify FCCP by email upon submission.

ADGM's FSRA Publishes Its 2025 Annual Report

13 July 2026

What happened

FSRA issued 95 Financial Services Permissions and 120 In-Principle Approvals in 2025, up 22% and 32% year-on-year respectively and signed 5 new international MoUs. The report highlights continued investment in RegTech and SupTech to support data-driven, efficient supervision as ADGM's ecosystem grows in scale and sophistication.

Why it matters

Strong growth in authorisations signals deepening confidence in ADGM as a financial centre, but it also means the FSRA is scaling up its supervisory technology and international cooperation — firms should expect more data-driven, intensive oversight as the regulated population expands.

What firms should do

Review the Annual Report's supervisory priorities and benchmark your firm's compliance posture accordingly.
Prepare for increased use of RegTech/SupTech-driven supervision, including more data-intensive reporting expectations.
New entrants and applicants should factor in the growing volume of Financial Services Permissions and In-Principle Approvals when planning authorisation timelines.

ADGM RA Publishes Amendments to the Commercial Legislation

9 July 2026

What happened

The Registration Authority now requires public disclosure of nominee status for shareholders and directors, granting the Registrar express powers to obtain beneficial ownership information for trusts, restricting cash payments above prescribed thresholds for DNFPBs, and extending beneficial ownership requirements to registered branches of foreign entities.

Why it matters

These targeted amendments strengthen ADGM's beneficial ownership transparency and AML/CFT framework in line with international standards and take effect immediately upon publication — with direct implications for corporate structuring, nominee arrangements, and cash-handling practices.

What firms should do

Review shareholder and director registers to ensure nominee status is accurately disclosed.
Trusts connected to ADGM should be prepared to provide beneficial ownership information to the Registrar on request.
Legal, accounting, company service, and real estate businesses should review cash acceptance policies against new thresholds.
Branches of foreign legal persons should confirm they can maintain and produce beneficial ownership information on their foreign parent.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across ADGM and translate them into practical, firm-specific actions.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Primo Advisors | ADGM / FSRA Regulatory Update | July 2026

June

DIFC / DFSA

Amendments to Legislation – Jul 2026: PIB and COB

2 Jul 2026

What happened

DFSA made PIB RMI (No. 441) and COB RMI (No. 442) 2026, both effective 2 July 2026. PIB now bases K-ASA/K-AUM on month-end values instead of daily averages; COB removes the trade-settlement-date basis for Client Money reconciliations.

Why it matters

The PIB change eases the operational burden of calculating K-ASA/K-AUM by moving from daily to monthly data points. The COB change removes a prescriptive reconciliation basis, giving firms more flexibility provided substantive requirements are still met.

What firms should do

Update K-ASA and K-AUM calculation processes to use month-end business day values rather than daily averages, effective 2 July 2026.
Review Client Money reconciliation procedures to reflect the removal of the trade settlement date basis requirement under COB Appendix 5.
Ensure internal policies, systems documentation, and control testing are updated to align with the renumbered PIB and COB provisions.

DFSA Conduct Supervisory Pulse on Personal Account Dealing

29 Jun 2026

What happened

DFSA published its first Conduct Supervisory Pulse, covering findings from a thematic review of brokerage firms' PAD arrangements across six areas: policies, governance, monitoring, compliance oversight, training, and record keeping. It found 18% of firms lacked documented PAD policies and 32% kept no PAD register, with over-reliance on employee attestations.

Why it matters

The review reflects rapid brokerage sector growth (firms up 68%, profitability up 276% since 2022–2023), raising conduct risks from weak PAD controls, including conflicts of interest and market abuse. Further Pulses on best execution and record keeping will follow.

What firms should do

Benchmark existing PAD policies and procedures against the positive and negative indicators identified in the Pulse, ensuring they are proportionate to business scale and complexity.
Strengthen independent verification and post-trade monitoring rather than relying solely on employee declarations and attestations.
Ensure PAD registers, pre-clearance processes, escalation procedures, and training are properly documented and incorporated into Compliance Monitoring Programmes and internal audit coverage.

Consultation Paper 3 – Updated Data Protection Regulations

22 Jun 2026

What happened

DIFCA published CP 3 of 2026 proposing a new "Safety" concept in Regulation 10 for Autonomous Systems, clarifying the Autonomous Systems Officer (ASO) role, and adding Regulation 11 for Commissioner-recognised accreditation frameworks. Comments due 15 July 2026.

Why it matters

The amendments raise the bar for firms deploying AI-driven Systems that process Personal Data, formalising the ASO role and creating a certification-recognition regime. Firms should expect greater scrutiny of governance, safety testing, and certification evidence.

What firms should do

Review AI Systems against the proposed Regulation 10 "Safety" requirements.
Assess whether an ASO will be required and begin identifying suitable internal expertise or recruitment needs.
Consider submitting comments to DIFCA before the 15 July 2026 deadline, particularly on the ASO obligations and the proposed accreditation and certification framework.

Outcomes of the FATF Plenary, 17–19 Jun 2026

19 Jun 2026

What happened

FATF concluded its final Plenary under the Mexican Presidency: added Bosnia and Herzegovina and Iraq to the grey list, removed Algeria and Namibia, adopted Canada/Türkiye evaluations, and approved new work on payment transparency and virtual assets.

Why it matters

Grey list changes directly affect DIFC firms' due diligence and risk-rating for counterparties linked to the newly listed or delisted jurisdictions. The broader initiatives on payment transparency and virtual assets signal future AML/CFT expectations.

What firms should do

Update due diligence and risk ratings for Bosnia and Herzegovina, Iraq, Algeria, and Namibia.
Monitor forthcoming FATF publications on payment transparency (Recommendation 16), virtual assets/VASPs, and decentralised finance for relevance to product offerings.
Brief compliance/MLRO teams on the UK Presidency's fraud-focused priorities.

DFSA Dear SEO Letter – Regulatory Expectations on Artificial Intelligence Risk Management

4 Jun 2026

What happened

The DFSA issued a Dear SEO Letter on AI risk management expectations in the DIFC. No new rules apply; the letter clarifies how existing requirements and the 2021 Enabling Technologies Guidelines cover AI governance, risk management, and outsourcing.

Why it matters

AI adoption is accelerating across Authorised Firms, especially Generative AI. The DFSA will hold firms accountable for AI risks using its existing toolkit and expects senior management to understand AI-related risks and dependencies.

What firms should do

Map AI use cases against the governance, risk, and outsourcing obligations in the letter.
Assess senior management's understanding of AI-related risks.
Review third-party AI arrangements, including associated cyber risk.

Amendments to Legislation – Oct 2025: Operational Risk (PIB)

10 Oct 2025 - Effective from 1 Jul 2026

What happened

FSA's PIB Instrument No. 414/2025 (effective 1 Jul 2026) moves to a single BI-based Operational Risk Capital methodology, narrows the Operational Risk definition (excluding strategic/reputational risk), and updates IRAP and Table 10 disclosures.

Why it matters

This overhauls the Operational Risk capital framework for Category 1, 2 and 5 firms, replacing three optional methodologies with one standardised BI-based calculation. Firms using the Standardised or Alternative Standardised Approach must transition before 1 Jul 2026.

What firms should do

Confirm whether the firm falls in Category 1, 2 or 5.
Start recalculating capital under the new BI methodology before 1 Jul 2026.
Update IRAP and Table 10 disclosures for the revised Operational Risk definition.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across DIFC and translate them into practical, firm-specific actions.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Primo Advisors | DIFC / DFSA Regulatory Update | June 2026

ADGM / FSRA

Amendments to ADGM Commercial Legislation

26 Jun 2026

What happened

On 4 Jun 2026 ADGM Board enacted, and on 26 Jun published, amendments to the Administrative, Beneficial Ownership, Commercial Licensing, Companies and DLT Foundations Regulations, plus two new rulebooks: CLR Conditions of Licence and Branch Registration Rules 2026(A) and LLP Rules 2026 (replacing LLP Rules 2025(A)). Key changes: a "supplementary operating address" option; Court-enforced trustee beneficial ownership disclosure; nominee director/shareholder filing duties; registered email as formal address for service; and a new CLR false statement offence.

Why it matters

These changes affect nearly every ADGM entity: new address, beneficial ownership, nominee disclosure and LLP governance rules mean updated filings and controls are needed.

What firms should do

Review the Registrar's supplementary operating address policy and assess if existing/planned premises qualify instead of a branch.
Trustees with any ADGM connection should prepare to respond to Registrar information requests identifying the beneficial owners of a trust.
Update company filings and registers to capture new director and nominee shareholder/director statements, and registered email address particulars where relevant.
Review LLP governance documents, agreements and filings against the new LLP Rules 2026.

Reminder on Managing Exposure to Unlicensed Virtual Asset Activities

22 Jun 2026

What happened

FSRA's FCCPD issued Notice No. FSRA/FCCP/107/2026 to SEOs, MLROs and Principal Representatives of RPs. Pursuant to Notice No. FSRA/FCCP/165/2025, it reiterates the need for ADGM RPs to maintain effective systems and controls to identify, assess, manage and mitigate exposure to unlicensed VASP activity.

Why it matters

Unlicensed virtual asset (VA) activity conducted or facilitated through an ADGM firm's relationships, products, services, delivery channels or transactions creates direct regulatory and reputational exposure. FSRA expects RPs to remain vigilant, including against false claims of association with ADGM or licensing by FSRA.

What firms should do

Confirm no unlicensed VA activity is conducted or facilitated through any relationship, product, service, channel or transaction without proper licensing.
Embed controls, with effective oversight and clear escalation/investigation processes, to detect exposure to unlicensed VASPs.
Notify FSRA via the Complaints portal (and other competent authorities where applicable) upon identifying or suspecting unlicensed VA activity, including false claims of ADGM/FSRA association or licensing.

Outcomes of the Financial Action Task Force (FATF) Plenary, 17–19 Jun 2026

19 Jun 2026

What happened

Why it matters

What firms should do

Update due diligence and risk ratings for Bosnia and Herzegovina, Iraq, Algeria, and Namibia.
Monitor forthcoming FATF publications on payment transparency (Recommendation 16), virtual assets/VASPs, and decentralised finance for relevance to product offerings.
Brief compliance/MLRO teams on the UK Presidency's fraud-focused priorities.

UAEFIU Regulation on the Postponement or Suspension of Suspicious Transactions and Freezing of Funds

10 Jun 2026

What happened

FSRA's FCCPD issued Notice No. FSRA/FCCP/96/2026, reminding all ADGM RPs, including FIs, VASPs and DNFBPs, of their obligations under UAEFIU Regulation No. (1) of 2026 on the Postponement or Suspension of Suspicious Transactions and Freezing of Funds, issued under Federal Decree-Law No. (10) of 2025 on AML/CFT/CPF and Cabinet Decision No. (134) of 2025. The notice should be read with FCCP Notice 83 of 2026 (the IEMS User Guide).

Why it matters

Timely, accurate compliance with UAEFIU reporting obligations, Suspension Orders, Freezing Orders and Monitoring Orders underpins the UAE's AML/CFT/CPF framework and helps prevent the dissipation of suspected criminal proceeds. FSRA has confirmed it will take appropriate action against RPs for contraventions of applicable legislation.

What firms should do

Review and, where necessary, update policies, procedures, systems and governance arrangements to ensure compliance with the UAE FIU Regulation.
Ensure MLROs and compliance teams are familiar with IEMS and the procedures for urgent reporting of suspicions and implementing Suspension, Freezing and Monitoring Orders (see FCCP Notice 83 of 2026).
Access and review the full UAEFIU Regulation via the link published on the FCCP website, referenced in the notice.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across ADGM and translate them into practical, firm-specific actions.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Primo Advisors | ADGM / FSRA Regulatory Update | June 2026

May

DIFC / DFSA

DFSA PIB Rulemaking Instrument – Operational Risk Framework Enhancements

10 Oct 2025 - Effective from 1 July 2026

What happened

The DFSA issued PIB Rule-Making Instrument (No. 414) 2025, effective 1 July 2026, introducing amendments to enhance the operational risk framework and capital calculation methodology.

Key changes:

Operational Risk Framework: Strengthened requirements for firms to maintain robust operational risk systems covering governance, controls, and resilience (IT, outsourcing, business continuity).
Capital Framework (BI Approach): Introduction of a Business Indicator (BI) model with tiered coefficients (12%–18%), replacing the flat 15% approach, alongside a more granular formula (ILDC, SC, FC).
Measurement Enhancements: Expanded BI components, defined exclusions (e.g. insurance, admin costs), and inclusion of M&A activity and forward-looking estimates.
Legacy Framework Removed: Removal of simplified gross income approach, fixed 15% calculation, and previous treatment of negative income.
Governance & Disclosure: Enhanced oversight requirements and introduction of disclosures on operational risk frameworks, capital metrics, and BI components.

Why it matters

These amendments significantly increase the granularity, transparency, and governance expectations around operational risk and capital adequacy. Firms will need to transition from simpler income-based models to more data-driven, component-based methodologies, with greater regulatory scrutiny on risk measurement and disclosures.

What firms should do

Assess current operational risk and capital frameworks against revised PIB requirements.
Transition to the BI-based capital calculation methodology and validate data availability.
Enhance governance oversight and ensure senior management engagement.
Update IRAP frameworks to cover all relevant risk categories.
Prepare for enhanced disclosure requirements and reporting expectations.

DFSA Rulemaking Instruments – Notice of Amendments

11 May 2026

What happened

The DFSA Board issued multiple Rulemaking Instruments introducing amendments across key DFSA modules, with changes scheduled to come into force on 1 January 2027. The updates cover the General Module (GEN), Prudential – Investment, Insurance Intermediation and Banking (PIB), and Islamic Finance Rules (IFR), with detailed amendments provided in respective appendices.

Key changes:

GEN Module: Strengthened risk management and governance requirements, including mandatory independent risk functions for complex firms, enhanced senior management accountability and oversight of risk culture, expanded internal audit scope, and enhanced management information systems for accurate and timely risk reporting.
PIB Module: Enhanced prudential framework covering risk appetite governance (Board-approved and documented), capital composition (including IFRS 9 provisions), and more prescriptive requirements across credit (including exposure classification), concentration, liquidity and funding, and operational risks, including integration of emerging risks (e.g. climate).
IFR Module: Refinements to Islamic finance regulatory requirements, including Sharia governance, product structuring, and compliance oversight frameworks.

Why it matters

These amendments affect multiple core regulatory modules and may impact governance, prudential compliance, and Islamic finance operations. Firms must assess cross-module implications and ensure readiness ahead of the 2027 implementation date.

What firms should do

Review amendments across GEN, PIB, and IFR modules.
Identify impacted areas across governance, prudential requirements, and Sharia-compliant activities.
Update policies, procedures, and controls in line with revised requirements.
Initiate implementation planning to meet the 1 January 2027 effective date.

UAE Proliferation Financing (PF) National Risk Assessment 2026 Report

7 May 2026

What happened

UAE published its Proliferation Financing (PF) NRA 2026, identifying PF as a medium-high national risk, driven by sanctions evasion linked to high-risk jurisdictions (e.g. DPRK and Iran), with exposure arising from trade finance, virtual assets, and complex ownership structures.

Why it matters

The NRA highlights increased expectations on firms to identify, assess, and mitigate proliferation financing risks, particularly in trade finance and virtual asset activities, aligning with UAE national priorities and sanctions compliance obligations.

What firms should do

Update enterprise risk assessments to incorporate PF risks.
Enhance screening and monitoring for sanctions evasion typologies.
Strengthen due diligence on ownership structures and high-risk jurisdictions.
Review exposure to VASPs, trade finance, and cross-border transactions.

UAE Joint Quality Management Audit Inspections

6 May 2026

What happened

The Ministry of Economy and Tourism, Capital Market Authority, and DFSA launched the first joint Quality Management audit inspections, introducing a coordinated cross‑regulator inspection model, formalised information‑sharing under MoUs, and a unified focus on assessing audit firms' compliance with ISQM 1 standards to enhance consistency, audit quality, and financial reporting oversight across the UAE.

Why it matters

This marks a significant shift toward integrated regulatory oversight of audit firms, increasing scrutiny on audit quality management systems and ensuring consistent application of international standards across UAE financial markets.

What firms should do

Assess compliance with ISQM 1 requirements and document quality management frameworks.
Ensure audit governance, policies, and controls align with regulatory expectations.
Prepare for potential cross-regulator inspections and information requests.
Strengthen internal audit quality monitoring and documentation processes.

DFSA Consultation Paper CP172 – Enhancements to Islamic Finance Rules

4 May 2026

What happened

DFSA issued CP172, proposing enhancements to the Islamic Finance Rules by clarifying when firms require an Islamic endorsement (including "holding out" scenarios), introducing additional guidance on Islamic Financial Business activities, and strengthening Takaful disclosure requirements (including moving disclosures to COB and defining Takaful).

Why it matters

The proposals enhance regulatory clarity and consistency in Islamic finance, particularly around when firms require Islamic endorsement and how Islamic products (especially Takaful) must be disclosed, reducing ambiguity and supervisory risk.

What firms should do

Assess whether their activities could constitute "holding out" Islamic Financial Business.
Review marketing, advisory, and product representations for Shari'a positioning.
Prepare for revised Takaful disclosure requirements under COB.
Submit responses to the consultation by 19 June 2026 where relevant.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across DIFC and translate them into practical, firm-specific actions.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Primo Advisors | DIFC / DFSA Regulatory Update | May 2026

ADGM / FSRA

ADGM FSRA Finalises Enhancements to its Anti-Money Laundering framework

21 May 2026

What happened

FSRA finalised enhancements to its AML framework by updating both the Financial Services and Markets Regulations and FSRA Rulebooks (AML, GEN and GLO), introducing strengthened governance and MLRO accountability, enhanced risk-based CDD and sanctions controls (including virtual asset requirements), and revised DNFBP registration and supervisory powers aligned with UAE Federal AML laws and FATF standards.

Why it matters

The amendments strengthen ADGM's alignment with international AML and transparency standards, particularly in relation to beneficial ownership, trust and foundation structures, and corporate governance. Restrictions on non-profit activities and the express prohibition of bearer shares reduce misuse risks, while clearer filing obligations improve regulatory certainty and compliance expectations for entities operating in ADGM.

What firms should do

Conduct a comprehensive gap analysis across AML, GEN, and FSMR requirements.
Review and enhance AML governance, policies, and MLRO oversight structures.
Update CDD, DNFBP, and third-party reliance frameworks.
Ensure alignment with UAE Federal AML legislation and FATF standards.

ADGM 2026 Update – Legal Persons & Arrangements (LPA) Risk Assessment

14 May 2026

What happened

ADGM published its 2026 LPA Risk Assessment update, confirming a broadly stable risk profile while introducing a refined five-point risk scale, identifying higher-risk structures (e.g. private companies and foundations), and highlighting vulnerabilities around complex ownership, nominee arrangements, and UBO opacity requiring enhanced scrutiny.

Why it matters

The update reinforces expectations for firms to strengthen UBO transparency, risk assessments, and monitoring of complex structures, aligning with UAE AML/CFT and FATF priorities.

What firms should do

Update entity risk assessments to reflect LPA findings.
Enhance due diligence for complex and higher-risk legal structures.
Strengthen UBO verification and transparency controls.
Monitor exposure to nominee arrangements and cross-border structures.

FSRA Notice No. 83 of 2026 – IEMS User Guide Obligations

13 May 2026

What happened

FSRA issued Notice No. 83 of 2026, reinforcing IEMS obligations by requiring timely and accurate responses to UAE FIU enquiries, enhanced documentation standards, strengthened internal controls and escalation procedures, and immediate compliance with instructions (including freeze orders).

Why it matters

The notice strengthens supervisory expectations around FIU engagement and AML/CFT/CPF compliance, with enforcement risk for delayed, incomplete, or inaccurate responses to regulatory enquiries.

What firms should do

Review and update procedures for handling IEMS/goAML requests.
Ensure clear internal escalation and response workflows.
Train relevant staff on FIU engagement and documentation requirements.
Implement controls to ensure timely submission and compliance with instructions.

UAE Proliferation Financing (PF) National Risk Assessment 2026 Report

7 May 2026

What happened

Why it matters

What firms should do

Update enterprise risk assessments to incorporate PF risks.
Enhance screening and monitoring for sanctions evasion typologies.
Strengthen due diligence on ownership structures and high-risk jurisdictions.
Review exposure to VASPs, trade finance, and cross-border transactions.

How Primo Can Help

What Primo is doing

Primo continues to proactively monitor regulatory developments across ADGM and translate them into practical, firm-specific actions.

What Primo can do

Primo provides end-to-end regulatory, risk, and compliance support to help navigate evolving supervisory expectations with clarity and confidence.

We assist firms at every stage — from initial regulatory assessments and licensing, through framework design and implementation, to ongoing compliance, governance, and regulatory engagement.

Primo Advisors | ADGM / FSRA Regulatory Update | May 2026

Regulatory Insights & Updates

DIFC / DFSA UPDATE

How Primo Can Help

ADGM / FSRA UPDATE

How Primo Can Help

DIFC / DFSA UPDATE

How Primo Can Help

ADGM / FSRA UPDATE

How Primo Can Help

DIFC / DFSA UPDATE

How Primo Can Help

ADGM / FSRA UPDATE

How Primo Can Help

DIFC / DFSA UPDATE

How Primo Can Help

ADGM / FSRA UPDATE

How Primo Can Help

DIFC / DFSA UPDATE

How Primo Can Help

ADGM / FSRA UPDATE

How Primo Can Help

Primo Advisors Limited

Locations

Contact

Your reputationis our success

Three roles open now, in Dubai and Abu Dhabi

Three things we do well

Getting licensed

Staying compliant

Finance, risk and internal audit

Where are you right now?

First, we tell you honestly whether the licence you have in mind is the right one

First, we read what you already have

First, we work out the order of things

Small enough to know your file. Big enough to cover both centres.

What you can expect from us

A named person

Built for your firm

The hard news first

Tell us about your firm

What we do, in plain terms

How an engagement runs

A conversation

A written scope

The work, with a named person

For group compliance teams

Who we work with

Questions we hear most

Tell us about your firm

Thirteen people, two offices, one file per client

Where to find us

Dubai (DIFC)

Abu Dhabi (ADGM)

Regulatory updates

Talk to us

Dubai (DIFC)

Abu Dhabi (ADGM)

Working at Primo

Open positions

Finance Officer

What you will do

What we need

KYC Associate and Administrator

What you will do

What we need

GRC Consultant

What you will do

What we need

Apply

Compliance outsourcing for DIFC and ADGM firms

What we do

Who it suits

Often combined with

How it works

Review

Approval

Monitoring

Cover

Why Primo

Talk to us

Your reputation
is our success