ADGM or DIFC? Why UAE Due Diligence Should Verify Where a Financial Firm Is Authorised to Operate

A recent enforcement action by the Dubai Financial Services Authority highlights an important point for businesses and investors carrying out due diligence in the UAE: confirming that a financial firm is regulated may not, by itself, establish that it is authorised to provide the services being offered.

On 1 October 2026, the Dubai Financial Services Authority (DFSA) announced that it had fined Vault Wealth Limited USD 109,200 for carrying on financial services in or from the Dubai International Financial Centre (DIFC) without DFSA authorisation.

Vault Wealth was incorporated in Abu Dhabi Global Market (ADGM) and licensed there by the Financial Services Regulatory Authority (FSRA).

The issue was therefore not that the company had no regulatory status.

It was that its existing authorisation did not permit it to provide the relevant financial services in or from DIFC.

For anyone assessing a financial firm, investment opportunity or prospective counterparty in the UAE, the case provides a useful due-diligence lesson: “regulated” should not always be treated as a simple yes-or-no question.

Different UAE Financial Centres Have Different Regulatory Frameworks

The UAE has developed several important financial and commercial centres, each operating within its own legal and regulatory framework.

Two of the most prominent are DIFC in Dubai and ADGM in Abu Dhabi.

Financial services conducted in or from DIFC are regulated by the DFSA, while financial services within ADGM fall under the Financial Services Regulatory Authority.

A firm may therefore have legitimate regulatory authorisation within one jurisdiction without automatically having permission to carry on the same activity from another.

That distinction can be particularly important where businesses operate across the UAE, use connected entities in different jurisdictions or present themselves under a common group brand.

What Happened in the Vault Wealth Case?

According to the DFSA, Vault Wealth Limited was incorporated in ADGM and licensed by the FSRA to provide financial services including advising on investments or credit and arranging deals in investments.

However, the firm had never been authorised by the DFSA to provide financial services in or from DIFC.

The regulator found that, between February and May 2024, employees of Vault Wealth worked from the DIFC offices of a related company.

Prospective clients were invited to those offices, where financial advice was provided and clients were assisted with onboarding onto an investment platform.

The DFSA also said that the office did not indicate that the DIFC entity was separate from Vault Wealth, which could have led prospective clients to believe that the firm was authorised by the DFSA to provide financial services from DIFC.

The case illustrates why the presence of a licence somewhere within a business or corporate group should not automatically be assumed to cover every entity, location or activity associated with that organisation.

Regulatory Status Is More Than a Licence Search

Checking whether a firm appears on a regulatory register is an important part of due diligence.

But in some circumstances it should be the beginning of the enquiry rather than the end.

A more detailed assessment may need to establish:

• The exact legal entity providing the service.
• Where that entity is incorporated.
• Which regulator has authorised it.
• The jurisdiction covered by that authorisation.
• The financial activities the firm is permitted to conduct.
• Whether any restrictions or conditions apply.
• Whether the entity named in contracts matches the regulated entity.
• Whether another company within the same group holds the relevant authorisation.
• Whether the business is operating from a location covered by its regulatory permissions.

These distinctions can become particularly important where companies use similar names, shared branding, common websites or connected entities across different jurisdictions.

Verify the Exact Legal Entity

One of the most important steps in corporate due diligence is identifying the precise company with which a client or investor is dealing.

A business group may contain several entities with very similar names.

One company might hold a regulatory licence, another might employ staff, another might operate the website and another might enter into the client agreement.

Those differences are not necessarily problematic.

They do, however, need to be understood.

Where financial services are involved, it may be appropriate to compare information provided by the firm against authoritative regulatory and corporate sources.

Questions may include:

• What is the full legal name of the contracting entity?
• Does that exact entity appear on the relevant regulatory register?
• Which permissions are recorded?
• Does the address correspond with the location from which services are being provided?
• Are similarly named companies separate legal entities?
• What relationship exists between the regulated and unregulated entities?

This type of verification forms part of broader Due Diligence Services in the UAE, particularly where regulatory status is relevant to an investment, transaction or proposed business relationship.

Check What the Authorisation Actually Covers

Regulatory authorisation is not necessarily unrestricted.

Financial-services permissions can apply to specific activities.

A firm authorised to perform one type of regulated activity should not automatically be assumed to have permission to perform another.

The Vault Wealth case illustrates this point clearly. The DFSA identified activities including advising on financial products and arranging deals in investments.

When conducting due diligence, the relevant question may therefore be more precise than:

“Is this company regulated?”

It may instead be:

“Is this exact legal entity authorised by the relevant regulator to provide this particular service from this jurisdiction?”

That is a substantially more useful question.

Branding Can Make Corporate Structures Difficult to Interpret

Corporate groups frequently present themselves to customers using a single brand.

From a commercial perspective, that may make sense.

From a due-diligence perspective, it can sometimes make it harder to determine which company performs which role.

Websites, marketing material, email addresses and office premises may all refer primarily to a group or brand rather than the full legal entity.

The underlying corporate and regulatory structure may be more complicated.

This is why due diligence should not rely exclusively on marketing material or representations made by the organisation itself.

Independent verification can help establish how the entities are connected and which company is responsible for the activity under consideration.

Regulatory Verification Is Only One Part of Due Diligence

Regulatory status is important, particularly when assessing a financial-services firm.

It does not provide a complete picture of the business.

Conflict Advisory Group has previously examined this distinction in DIFC Fund Due Diligence: What Investors Should Verify Beyond Regulatory Status.

Depending on the nature and value of a proposed relationship, wider enquiries may also consider:

• Ownership and beneficial ownership.
• Directors and senior management.
• Corporate history.
• Connected companies.
• Litigation and insolvency.
• Regulatory enforcement.
• Adverse media.
• Conflicts of interest.
• Material commercial representations.
• Relevant counterparties and service providers.

The objective is not simply to establish whether a company exists or has obtained a licence.

It is to understand the organisation that sits behind the proposed relationship and whether important claims can be independently supported.

When Enhanced Due Diligence May Be Appropriate

The appropriate level of investigation should always be proportionate to the decision being made.

A routine supplier relationship may not justify the same level of enquiry as a significant investment, acquisition or high-value financial arrangement.

Where the proposed relationship carries greater financial, regulatory or reputational exposure, deeper enquiries may be appropriate.

Our guide to UAE Enhanced Due Diligence: When Standard KYC Is Not Enough explains some of the circumstances in which additional scrutiny may be warranted.

For financial firms, this can include examining regulatory permissions alongside corporate ownership, management backgrounds, reputation, connected entities and the substance of the proposed transaction.

Independent Due Diligence in the UAE

The recent DFSA enforcement action provides a useful reminder that regulatory status needs to be understood in context.

A legitimate licence may establish that a firm is authorised for particular activities within a particular regulatory framework.

It should not necessarily be interpreted as permission to conduct every financial activity throughout the UAE.

Conflict Advisory Group provides Due Diligence Services in the UAE for businesses, investors, family offices and professional advisers seeking to verify companies, principals, investments and counterparties.

Depending on the requirement, enquiries can include corporate ownership and structure, regulatory history, litigation, adverse media, management backgrounds and independent verification of material representations.

Our reporting distinguishes verified information from allegations, potential connections and matters that remain unresolved, providing clients with a clearer factual basis for commercial decision-making.

If you are considering a UAE-linked investment, transaction or business relationship and require independent due diligence, contact Conflict Advisory Group to discuss the appropriate scope in confidence.