NRF Insights on the DFSA’s Business Plan for 2025-26

Artificial Intelligence

Looking over the hill it is not difficult to see that the single biggest disruptor to the financial services sector in generations has arrived in the form of artificial intelligence (AI). AI should, in theory, make financial institutions more efficient and effective, and therefore drive profit growth. However, AI raises questions about how the technology itself, as well as its outputs, should be monitored for compliance with relevant rules and regulations.

In a recent radio interview with a local Dubai radio station, the DFSA’s Chief Executive, Ian Johnston, was clear that the DFSA is not planning to introduce rules to regulate the use of AI, but would approach the use of AI as another risk factor that Firms would need to manage as part of their existing regulatory obligations. This is consistent with the approach being espoused by the Financial Conduct Authority (FCA) in the UK, where its CEO Nikhil Rathi has gone on record repeatedly to emphasis the FCA’s view that AI and tech governance should follow existing regulatory rules and market integrity frameworks, rather than be regulated in itself.¹

What this approach will mean in practice is yet to be seen, but the DFSA’s Business Plan discloses the DFSA’s intention to “provide further direction on regulatory expectations for the use of AI in financial services” in the coming year. We hope that the proposed direction will address some of the key issues surrounding AI in the financial sector, such as the potential for customer bias in AI outcomes, and governance of the technology itself.

Internally, the DFSA appear to be embracing digital transformation as part of its efforts to streamline and automate processes using AI solutions. The Business Plan discloses the DFSA’s plans to utilise automated solutions as part of the initial assessment of applications for Authorisation, with a view to making this process more efficient for businesses.

Growth of the Wealth Management Sector

The DFSA regulates over 900 firms within the DIFC, with the wealth management sector (WMS) making up around 78% of them. Perhaps reflecting the significant increase in the WMS over the last three years, the Business Plan sets out the DFSA’s intentions to launch thematic and sectoral reviews of the different business models now being deployed by the WMS in or from the DIFC.

The DFSA continues to have a keen interest in governance arrangements in the WMS. This includes seeking to understand the process by which clients are onboarded and subsequently assessed for product suitability at point of sale, client asset protection and the relevant marketing practices being deployed by wealth managers. We note that client classification and suitability have been an area of focus for regulatory enforcement action in the UAE recently, and therefore pose a particular risk to those DIFC firms in the WMS who may not be meeting either the DFSA’s rules or, crucially, its expectations in this area.

Review of the Funds sector

The Business Plan highlights the rapid growth of the funds sector in the DIFC and the importance of DFSA regulations staying up-to-date and in line with international standards. Enabling firms to conduct business in the DIFC while providing investors with the right level of protection is key to the DFSA.

As such, the Business Plan confirms the DFSA’s intention to undertake a holistic review and consultation on changes to its Funds regime. It is not yet clear where changes will be made, but it appears that the requirements surrounding customer and asset-type classification are currently under the microscope.

Banking and Audit

The DFSA will continue to focus on credit and liquidity risks. In addition, it intends to increase its scrutiny of operational resilience frameworks surrounding IT security and cyber breaches. Of particular interest to the DFSA is the governance and risk management frameworks around critical third parties (e.g. external cloud providers). This focus on operational resilience feeds into the general tech-related focus of the Business Plan, and is consistent with the concerns of many regulators in similar jurisdictions.

Tokenisation and cryptocurrency frameworks

Having introduced comprehensive frameworks for regulating both Investment Tokens and Crypto Tokens in 2021 and 2022 respectively, the DFSA plans to continue to evolve these frameworks alongside market developments and to adopt a more risk-tolerant outlook. In this regard, the DFSA remains keen to encourage opportunities within the tokenisation and cryptocurrency spheres. Its issuance of licences to firms seeking to offer Investment Tokens, albeit mostly to existing financial institutions extending their operations to incorporate tokenisation, is testament to this.

We note that following the publication of the Business Plan, the DFSA announced the recognition of two new Crypto Tokens (USDC and EURC).

Financial crime

Following the Financial Action Task Force (FATF)’s removal of the UAE from its ‘grey list’ in February 2024, the DFSA plans to continue working closely with the DIFC, the Central Bank of the UAE, and other relevant government authorities, to prepare for the next FATF mutual evaluation, which is due in 2026.

We expect that the recent upward trend in enforcement action will continue as the DFSA targets firm misconduct and seeks to demonstrate its capacity to effectively enforce its rules – a core requirement of the FATF evaluation process.

Conclusion

By prioritising technological advancement whilst implementing reviews and updates of the WMS and the funds framework, the DFSA is attempting to balance both the future and present of financial services regulation in the DIFC. This is a positive approach for the jurisdiction, which appears well placed to continue to develop its status as a leading global financial hub while ensuring investor protection and market integrity.

This article has been written by Middle East Partner and Head of Financial Services Regulatory Matthew Shanahan, Counsel Karl Masi and International Trainee Matthew Leech.

Should you have any queries or questions, please get in touch with one the key contacts listed below.