DFSA Authorisation Checklist for Brokerage Firms

Your brokerage has picked Dubai. The entity plan is drafted, the MT5 white label is scoped, and investors want a launch date. What stands between you and your first client is a DFSA licence application: a staged authorisation process run by the Dubai Financial Services Authority (DFSA), the independent regulator of the Dubai International Financial Centre (DIFC). To apply, you need a defined financial services scope, a DIFC entity, a regulatory business plan, approved individuals in mandatory roles, base capital, and compliant systems. Most applications take 6 to 12 months from first enquiry to licence.

That timeline is not dead time. The brokers that launch fastest use the application window to build the two assets clients actually see: the trading platform and the website. This DFSA authorisation checklist covers the regulatory workstream step by step, plus the part most guides skip: which elements of your launch must stay inactive or carefully worded until the licence is issued.

Define the Financial Services and Licence Scope

Every DFSA licence application starts with defining which Financial Services the firm will carry on, because scope determines which of the DFSA licence categories applies, along with base capital, staffing, and systems obligations. Get this wrong and you either overpay for permissions you never use or return to the regulator mid-application to extend scope, adding months.

For a brokerage, the usual building blocks are dealing in investments (as agent or as matched principal), arranging deals in investments, and holding client assets. Each permission you add raises the bar for capital and controls. A firm that only arranges and advises faces far lighter requirements than one that holds client money and executes trades.

Licence Categories and Base Capital Requirements

Base capital follows category. The figures below reflect the DFSA's 2025 prudential reforms (Consultation Paper 161), which took effect in phases from 1 July 2025:

The 2025 reduction of the Category 3A base capital requirement to USD 200,000 changed the economics of a DIFC broker licence for smaller firms. Confirm current figures with the DFSA before you commit a financial model; they are set in the PIB module of the Rulebook and do change.

Retail vs Professional Client Endorsements

Decide early whether you will serve retail clients. A retail endorsement brings materially higher scrutiny: stronger disclosure, complaints handling, product governance, and typically more back-and-forth during review. Many brokers launch professional-only, then add the retail endorsement once operations are proven. If retail is your core market, plan for a longer review and build your website copy to retail disclosure standards from day one.

DIFC Entity and Ownership Structure

A DIFC broker licence is issued to a DIFC-incorporated entity, most commonly a private company limited by shares registered with the DIFC Registrar of Companies. You do not need the entity fully incorporated to start the application, but you do need the structure designed: shareholders, ultimate beneficial owners, and any holding companies.

The DFSA reviews controllers closely. Every person holding 10% or more must be disclosed and assessed as fit and proper, with source-of-wealth evidence to match. Complex offshore layers are not prohibited, but each layer adds review time and questions.

Here's where most applicants lose weeks: mismatched documents. The business plan says one shareholding split, the structure chart says another, and the application stalls while the regulator reconciles them. Lock the ownership structure before submission and keep every document consistent.

You will also need a physical presence commitment. DIFC offers options from flexi-desks to full offices, and the lease is usually finalised as an IPA condition rather than upfront.

Authorisation Enquiry and Regulator Meeting

The DFSA expects an authorisation enquiry before a formal application is submitted. This pre-application stage is not a formality; it is where the regulator decides whether your model is viable in the DIFC, and it shapes the rest of the DFSA authorisation process.

The sequence in practice:

1. Prepare a draft regulatory business plan: your services, target clients, revenue model, org chart, and three-year financial projections.

2. Meet the DIFC Business Development team and the DFSA Authorisation Enquiries team to walk through the model.

3. Incorporate the regulator's feedback. The DFSA either signals go-ahead for submission or asks for a rework of the draft.

4. Submit the formal application pack: business plan, financial model, policies and manuals, and fit-and-proper documentation for shareholders, directors, and senior management.

Straightforward applications can complete in 3 to 4 months; complex or retail-facing models typically run 6 to 12 months. Application fees vary by category, roughly USD 2,000 to USD 75,000.

What this means: the enquiry meeting is your one cheap iteration. Every change after formal submission costs weeks. Arrive with a business plan that already answers the obvious questions.

Governance and Authorised Individuals

The DFSA requires named, approved individuals in mandatory functions before authorisation is granted. For a brokerage, that means a Senior Executive Officer, a Finance Officer, a Compliance Officer, and a Money Laundering Reporting Officer (MLRO), each assessed individually as fit and proper under the DFSA's approval process.

Expectations that catch applicants out:

• The Senior Executive Officer, Compliance Officer, and MLRO are expected to be UAE-resident. Remote governance from another jurisdiction rarely passes.

• One person can hold Compliance Officer and MLRO roles in smaller firms, but the combined workload must be justified.

• Non-executive directors and controllers are also assessed, not just day-to-day management.

Recruit these people early. CVs, regulatory references, and interviews happen during review, and a late change of Senior Executive Officer effectively restarts the assessment of your governance. Clients preparing DFSA applications typically sign key hires on conditional contracts tied to authorisation.

Capital, Systems and Controls

Base capital requirements depend on licence category, but capital is only the entry ticket. The DFSA also assesses whether your systems and controls match the scale and risk of the business described in your plan.

The DFSA application requirements go further than capital: the pack must include working policies, not templates: compliance monitoring, AML/CTF aligned to the DFSA's AML module, risk management, conflicts of interest, business continuity, and remuneration. Reviewers read these against your business plan. A 20-page generic compliance manual attached to a matched-principal brokerage model is an immediate credibility gap.

Financial projections need to show capital adequacy under stress, not just at launch: typically three years, with the expenditure-based requirement often exceeding base capital once staff and platform costs are real. Budget for capital to sit untouched in the DIFC bank account, because deploying it into operating costs below the requirement is a breach.

The takeaway: write the policies for the firm you described, size the capital for the firm you will actually run.

Trading Platform and Outsourcing

Yes, an MT5 broker can operate from the DIFC, and MetaTrader 5 is a common platform choice for multi-asset brokers there. What the DFSA cares about is how the platform is delivered. A DFSA MT5 broker setup almost always involves outsourcing arrangements: hosting, bridge and liquidity connectivity, sometimes a white-label agreement with an established provider.

DFSA MT5 Broker Setup Under Outsourcing Rules

Under the DFSA's outsourcing requirements in the GEN module, you remain fully responsible for outsourced functions. Your application should document:

• Who hosts and operates the MT5 server infrastructure, and where.

• The written agreement covering service levels, data access, audit rights, and exit.

• How you supervise the provider: uptime monitoring, incident reporting, and business continuity.

• How client data and trade records remain accessible to you and the regulator.

In practice, the platform workstream runs in parallel with the application. Licence agreements with MetaQuotes or a white-label provider, server setup, and liquidity arrangements all take weeks to months. Signing them conditional on authorisation keeps the timeline moving without breaching the perimeter, because the platform can be built and tested privately before launch. What cannot happen is onboarding live clients before the licence is issued.

Website and Financial Promotions Before Authorisation

Under Article 41A of the DIFC Regulatory Law 2004, only Authorised Persons may make financial promotions in or from the DIFC. The financial promotions prohibition, detailed in chapter 3 of the DFSA's GEN Rulebook, covers any communication that invites or induces someone to engage in financial services, and your website is exactly that kind of communication.

This is the workstream most licensing guides ignore, and it is where a brokerage can accidentally create a regulatory problem before it even holds a licence.

What Must Stay Inactive or Carefully Worded

The practical rule: build everything, publish selectively. Design, development, and content production can run at full speed during the application; what goes live must be limited until authorisation.

Regulators check applicants' websites during review. A live sign-up form or a premature "regulated broker" claim invites exactly the wrong kind of attention, and misleading regulatory status claims can jeopardise the application itself.

WSA's experience building broker sites reflects this sequencing: the full site, including the account funnel and platform pages, is designed and staged during the application window, while only a compliant holding version is public. On authorisation day, the switch is a deployment, not a rebuild. A conversion-focused forex broker website structure can be fully tested behind the curtain before a single client sees it, and planning the brokerage website cost alongside the licence budget keeps the launch plan realistic.

In-Principle Approval Conditions and Launch

In-principle approval is a conditional green light, not a licence. The IPA letter states that the DFSA intends to grant authorisation once specified conditions are met, and it typically gives you a window of around three months to complete them.

Standard IPA conditions for a brokerage:

1. Incorporate the entity with the DIFC Registrar of Companies.

2. Finalise the office lease.

3. Open the corporate bank account and deposit the base capital.

4. Confirm authorised individuals in post and any remaining documentation.

Only when the DFSA verifies these conditions does it issue the licence, and only then may you conduct financial services and market them. Launching anything client-facing during the IPA window, including a live website funnel, is still premature.

Sequence the final month deliberately: platform in final testing, website staged and reviewed against a broker website checklist, compliance sign-off on every public page, bank account funded. Firms that treat the IPA window as a countdown checklist go live within days of the licence; firms that start building at IPA add months after approval.

Conclusion

A DFSA licence application rewards firms that treat it as a programme, not a form: scope defined first, ownership locked, governance recruited early, capital sized honestly, and the platform and website built in parallel under the constraints that apply before authorisation. The brokers that reach revenue fastest are the ones whose website and MT5 stack are staged, tested, and compliance-checked while the regulator completes its review.

This checklist is practical guidance, not legal advice; confirm specifics with the DFSA or a licensing adviser. And when you are ready to make the website workstream launch-proof, WSA designs brokerage sites that satisfy the wording constraints today and convert traders tomorrow.

FAQ

Does the DFSA require an enquiry before application?

Yes. The DFSA expects prospective applicants to go through its authorisation enquiry stage before submitting a formal application. You share a draft regulatory business plan and meet the DFSA's Authorisation Enquiries team (usually alongside the DIFC Business Development team) to test whether the model fits the DIFC framework. The DFSA then signals whether to proceed to formal submission or rework the plan. Skipping meaningful pre-application engagement usually backfires: issues that could have been resolved in one meeting surface during formal review instead, where every clarification round adds weeks.

Can an MT5 broker operate from DIFC?

Yes. MetaTrader 5 brokers operate from the DIFC under DFSA licences, typically with dealing permissions in Category 2 or 3A. The platform itself is not the regulatory issue; the delivery model is. MT5 hosting, bridge connectivity, and white-label arrangements count as outsourcing under the DFSA's GEN module, so the application must document provider agreements, supervision arrangements, data access, and continuity planning. You remain fully responsible for outsourced functions. Platform contracts are usually signed conditional on authorisation and the stack is built and tested privately before launch.

Can the website launch before authorisation?

A limited version can; a functioning broker website cannot. Under the DIFC financial promotions prohibition (Article 41A of the Regulatory Law 2004), only Authorised Persons may promote financial services in or from the DIFC. Before authorisation, a site may present company identity, factual status ("authorisation pending"), careers, and neutral educational content, but it must not invite trading, display account opening or deposit flows, promote trading conditions, or claim regulated status. The practical approach is to build and stage the complete site during the application and keep a carefully worded holding version public until the licence is issued.

What happens after in-principle approval?

You complete the IPA conditions, then receive the licence. The approval means the DFSA intends to authorise you once you incorporate the DIFC entity, sign the office lease, open a corporate bank account, deposit the base capital, and confirm authorised individuals in post. The window is typically around three months. Once the DFSA verifies the conditions, it issues the licence and you may begin conducting and promoting financial services. IPA itself grants no permissions: onboarding clients or activating a live website funnel during the window is still a breach.

How long does a DFSA licence application take?

Typically 6 to 12 months from first enquiry to licence. Straightforward professional-client models with clean ownership structures can complete in around 3 to 4 months of formal review; retail endorsements, complex shareholding, or novel business models push toward the longer end. The main variables you control are document quality and consistency, early recruitment of key role-holders, and responsiveness during review rounds. The IPA conditions phase adds a further few weeks depending on how quickly the entity, bank account, and capital deposit are completed.