Choosing a DFSA Licence in the DIFC: Categories 1 to 5 Explained for Fintech Firms

–The DFSA assigns the category from the activities on the licence, so the choice of activities decides it

The Dubai Financial Services Authority places every Authorised Firm in a prudential category under section 1.3 of its Prudential Module, known as PIB. The DFSA assigns the category from the Financial Services the firm applies to carry on, and the highest-risk activity on the licence decides the result. A firm that only advises clients is in Category 4, while a firm that also manages client money or holds client assets moves into Category 3 or higher.

• Eight categories apply. Categories 1, 2, 3A, 3B, 3C, 3D, 4 and 5 range from deposit-taking banks to advisory firms, with Category 5 reserved for Islamic banks that manage unrestricted profit-sharing accounts.
• Capital rules changed in two stages. The DFSA adopted amendments to PIB on 21 May 2025, with one set taking effect on 1 July 2025 and a second on 1 July 2026.
• Advisory firms need the least capital. The base capital for a standard Category 4 firm is USD 30,000, rising to USD 140,000 for crowdfunding platforms and money transmission.
• Brokers now need less. The base capital for a Category 3A firm dealing as agent fell to USD 200,000, and operators of alternative trading systems moved from Category 4 to Category 3A.
• Activity-based capital applies from July 2026. Some Category 3 firms now hold capital calculated on assets under management, assets safeguarded and trading volume, where that figure exceeds base capital.
• Fintech firms have a testing route. The DFSA’s Innovation Testing Licence allows a firm to test a new product for six to 12 months under lighter requirements.

Who this applies to

This applies to founders, chief executives and finance directors of firms planning to provide financial services from the DIFC. It concerns asset managers, fund managers, brokers, wealth advisers, custodians, insurance brokers, payment and money services firms, crowdfunding platforms and crypto businesses in financial services and technology. It also concerns foreign banks and investment firms opening a DIFC branch.

Our corporate lawyers in Dubai advise firms on which activities to apply for, prepare DFSA applications and structure the DIFC entity that holds the licence. This article covers the DFSA categories only. Our guide to DIFC business setup covers company registration with the DIFC Registrar, and our article on DIFC licence types and activities covers the non-financial licences.

The legal framework

• DIFC Regulatory Law, DIFC Law No. 1 of 2004. It establishes the DFSA and prohibits any person from carrying on a Financial Service in or from the DIFC without a DFSA licence.
• The General Module of the DFSA Rulebook. It defines each Financial Service, such as Managing Assets, Arranging Deals in Investments and Providing Custody, and sets the authorisation requirements.
• The Prudential Module, PIB. Section 1.3 assigns each firm to a category, and Rule 3.6.2 sets the base capital for each category.
• PIB rule-making instruments No. 409 and No. 413 of 2025. These instruments amended the capital rules from 1 July 2025 and 1 July 2026 after Consultation Paper No. 161.

The administering bodies:

• The Dubai Financial Services Authority. It grants licences, assigns categories, approves key individuals and supervises Authorised Firms. Its authorisation services receive expressions of interest before a formal application.
• The DIFC Registrar of Companies. It incorporates the DIFC entity or registers the branch that will hold the DFSA licence.

What each DFSA category covers

PIB section 1.3 places a firm in the highest category whose activities appear on its licence. The categories below follow the DFSA’s numbering.

Categories 1, 2 and 5

Category 1 covers firms that accept deposits or manage an unrestricted profit-sharing investment account. These are banks, and their base capital is USD 10,000,000. Category 2 covers lenders, market makers and other firms that provide credit or deal in investments as principal, with base capital of USD 2,000,000.

From 1 July 2025, firms that deal as matched principal moved from Category 3A into Category 2. Matched principal means a firm that buys an investment only to fill a client order, and these firms kept their previous capital treatment. Category 5 applies to Islamic financial institutions that manage unrestricted profit-sharing investment accounts, and the base capital is USD 10,000,000.

Category 3A, 3B, 3C and 3D

Category 3A covers firms that deal in investments as agent, which means executing client orders without taking positions. Since 1 July 2025, operators of alternative trading systems also fall into Category 3A. The base capital is USD 200,000.

Category 3B covers custodians and trustees for funds, firms that provide custody of crypto tokens, and operators and administrators of employee money purchase schemes. Base capital varies by activity, from USD 500,000 to USD 2,000,000.

Category 3C covers asset managers, fund managers, firms managing restricted profit-sharing accounts, trustees of express trusts and issuers of stored value. Base capital depends on the activity, so asset managers and managers of public funds hold USD 140,000, while managers of exempt and qualified investor funds hold a lower figure. Category 3D covers money services firms other than stored value issuers and money transmitters, with base capital of USD 200,000.

Category 4

Category 4 covers firms that advise and arrange without holding client assets. The activities include Advising on Financial Products, Arranging Deals in Investments, Arranging Custody, Insurance Intermediation, Insurance Management, Providing Fund Administration, Arranging Credit and Advising on Credit. Our article on who needs a licence to give investment advice explains where advice becomes a regulated activity.

Operating a Crowdfunding Platform and Providing Money Transmission also fall into Category 4, but these two activities carry a higher base capital of USD 140,000, while other Category 4 firms hold USD 30,000.

How much capital a firm must hold after the 2025 and 2026 changes

Under the amendments that took effect on 1 July 2025, Category 3A and 3C firms that hold no client assets, insurance monies or fund property no longer calculate the expenditure-based capital minimum. That minimum is a figure based on a firm’s annual operating costs, and these firms must instead hold liquid assets at least equal to their base capital.

The expenditure-based minimum

Firms that still hold client assets continue to calculate the expenditure-based minimum. The 2025 amendments reduced the factor from 18/52 to 13/52 of annual audited expenditure, which means a firm holds roughly three months of costs rather than four. Non-cash items such as depreciation no longer count in the calculation.

Activity-based capital from 1 July 2026

From 1 July 2026, firms subject to the new activity-based capital requirement calculate it from three measures. The DFSA applies 0.02% to average assets under management, 0.06% to average assets safeguarded and administered, and 0.10% to average daily cash trades. Derivatives trades attract 0.01%. A firm then holds the greatest of its activity-based requirement, its expenditure-based minimum where that applies, and its base capital.

Professional indemnity insurance

The 2026 amendments removed the professional indemnity insurance requirement for Category 3C and 3D firms. They set minimum cover standards for Category 3B and Category 4 firms. Our article on professional indemnity insurance for regulated firms covers policy terms in more detail.

Licensing routes for fintech firms

A fintech firm in the DIFC can take one of three routes, and the right one depends on whether the product is a regulated Financial Service. The routes differ in cost, time and what the firm may do with clients.

A full DFSA licence

A firm offering a regulated service to clients needs a full licence in the category its activities require. A payments firm that only transmits money falls into Category 4, while a firm issuing stored value falls into Category 3C. Our article on CBUAE payment services licensing covers the separate rules for payment firms serving the UAE mainland.

The Innovation Testing Licence

The DFSA launched the Innovation Testing Licence on 24 May 2017. It is a restricted licence that allows a fintech firm to test a new product within the DIFC for six to 12 months under conditions set for that firm. At the end of testing, the firm must meet full authorisation requirements or stop the regulated activity. Our article on the regulatory sandbox in the DIFC and ADGM compares the two programmes.

The DIFC Innovation Licence

The DIFC Innovation Licence is a commercial licence issued by the DIFC Authority to technology companies. It does not authorise any Financial Service, so a software firm that builds tools for banks may hold it, but it may not advise clients, arrange deals or hold client money under it.

Representative offices and crypto firms

A foreign financial institution that only wants to market its services from the DIFC can apply to the DFSA for a Representative Office instead of a full licence. A Representative Office may promote the products of its head office or group. It may not carry on any Financial Service in or from the DIFC, so it does not receive a prudential category.

Crypto businesses follow the same category system. Since the DFSA’s crypto token regime took effect on 1 November 2022, a firm that deals in, arranges or manages crypto tokens applies for the same Financial Services as any other investment firm. Only tokens the DFSA has recognised may be used in those activities. A firm that holds crypto tokens for clients needs custody permission in Category 3B. Our article on setting up a crypto fund in the DIFC covers the fund side of that regime.

Common mistakes when choosing a DFSA category

Applying for more activities than the firm needs. Each activity on the licence can raise the category and the capital. A firm that adds Managing Assets to an advisory licence moves from Category 4 into Category 3C.

Holding client money by accident. A Category 4 firm that receives client funds into its own account may be treated as holding client assets. The DFSA may then require higher capital and client money rules the firm has not budgeted for.

Treating the Innovation Licence as a financial licence. The DIFC Innovation Licence does not permit any Financial Service. A firm that serves clients under it may breach the prohibition in the Regulatory Law.

Relying on the old capital figures. Guides published before July 2025 show the earlier figures. A business plan based on them can show too much or too little of the capital the DFSA will require.

Overlooking key individuals. The DFSA approves a Senior Executive Officer, a Compliance Officer, a Money Laundering Reporting Officer and a Finance Officer for most firms. A licence application without suitable candidates for these roles will not progress.

What firms should do next

• List the exact services. Write down every service the firm will offer to clients, because the DFSA assigns the category from that list.
• Map each service to a Financial Service. Match each service to its definition in the General Module before choosing the licence scope.
• Check whether you will hold client assets. Decide how client money and assets will be handled, because this decides the capital and conduct rules.
• Model capital under the 2026 rules. Calculate base capital, the expenditure-based minimum and the activity-based requirement, and plan for the highest.
• Choose the testing route where the product is new. Consider the Innovation Testing Licence where the regulatory treatment of a product is uncertain.
• Identify key individuals early. Recruit candidates for the approved roles before filing, because the DFSA assesses them as part of the application.

How do you choose the right DFSA licence category?

The DFSA chooses the category for you, based on the Financial Services on your licence. Your real decision is which activities to apply for, and that decision sets your capital, your conduct rules and your supervision.

The main risk is a mismatch between the licence and the business. A firm that applies too narrowly cannot offer the services it planned, and a firm that applies too widely carries capital and compliance costs it does not need.

The commercial consequence is time and money. Changing the scope of a licence after authorisation requires a further application to the DFSA. Getting the scope right before filing keeps the capital plan accurate and the licence aligned with revenue.

For firms planning a DIFC financial services business, our corporate and commercial team advises on licence scope, DFSA applications and the structure of the DIFC entity.