Regulatory Compliance Updates September 2024 – ME Region

On 12 September, the DIFC announced the success of the Dubai AI & Web3 festival.

• the Dubai AI & Web3 Festival was opened by Hamdan bin Mohammed and attracted over 6,800 participants from more than 100 countries
• an announcement was made by the DIFC concerning Dubai AI Licence and AI as a Service solution
• AI and Web3 finalists shall compete in the inaugural Future Tech World Cup.

The event emphasized Dubai’s commitment to becoming a global leader in AI and Web3 technologies, featuring key talks and the launch of initiatives such as the Dubai AI Licence and ‘AI as a Service’ solutions. The second edition is set to take place in November next year, and by 2027, the Dubai AI & Web3 Festival is set to become among the world’s biggest AI events.

You can read the DIFC article in full here.

On 9 September, the DIFC announced initiatives supporting Wealth and Asset Management in the DIFC, highlights included:

• over 400 wealth and asset management firms now operating in the DIFC, showing significant growth from 350 firms at the end of 2023
• the DIFC is launching a pioneering ‘DIFC Funds Centre’ in Q1 2025 to support hedge fund spinouts and boutique asset management firms
• the sector includes 60 pure-play hedge funds, with 44 classified as ‘billion-dollar club’ funds.

You can read the DIFC article in full here.

On 29 August the DIFC announced that Google Cloud is collaborating with the Dubai AI Campus to provide mentorship and resources for selected startups. Initiatives include establishing Google Cloud’s Gen AI Startup School, aimed to bolster innovation in AI. This partnership strives to enhance Dubai’s reputation as a hub for technology-focused companies and to attract top talent and investors to the region.

You can read the DIFC article in full here.

On 16 September, the DIFC announced details of the hybrid conference, which took place in Hong Kong and brought together more than 240 participants from financial institutions, industry associations, and international organisations across both regions. The DFSA and the Hong Kong Monetary Authority (‘HKMA’) also signed a Memorandum of Understanding (MoU) to further deepen their strategic partnership on sustainable finance, reflecting a broader push for responsible financial development in the region.

The DFSA and the HKMA will continue working closely to promote sustainable finance, including transition finance. The enhanced partnership will enable both regions to explore opportunities for mobilising capital in order to champion a broader range of sustainable and green initiatives within their respective markets and wider economies.

You can read the DIFC article in full here.

In September, the DIFC Data Protection Commissioner published the ‘Accreditation and Certification Framework for Autonomous and Semi-Autonomous Systems’, following the release of Regulation 10 on Personal Data Processed Through Autonomous and Semi-Autonomous Systems which was issued and published by the DIFC Commissioner of Data Protection in September 2023.

The framework is aimed at firms who use, operate, provide, offer or otherwise make available for commercial use ‘Systems’ for ‘High Risk Processing’.

The new framework sets out:

• Part 1: the application process that governs an application for becoming an Accredited Certification Body, including the specific accreditation application criteria that the Commissioner shall review when assessing such organisations
• Part 2: certification for how an Accredited Certification Body certifies a Certification Applicant’s System used in or for High Risk Processing Activities.

The Guidance and FAQs have also been updated, and can be found under the ‘Lawful Processing’ section of the DIFC website here.

The Framework is available here and Regulation 10 can be found here.

On 9 September, it was announced that the Registration Authority (‘RA’) of the Abu Dhabi Global Market (‘ADGM’) had issued Consultation Paper No.8 of 2024 concerning the Proposal for a Commercial Permits Framework. The paper seeks public feedback and comments on the proposed Commercial Permits Regulations 2024 and subordinate rules.

The Commercial Permits Regulations 2024 and subordinate rules aim to establish a framework for obtaining, renewing, and maintaining commercial permits in relation to certain activities in ADGM.

The key features of the RA’s proposals are as follows:

• introducing a requirement to obtain a commercial permit from the RA with respect to certain activities
• establishing specific conditions applicable to Alcohol or Shisha Permits
• providing the fees payable to the RA in connection with the issuance and renewal of annual or temporary Alcohol and Shisha Permits.

The consultation period will close on 29 September 2024. You can read the consultation paper here.

On 11 September, it was announced that the RA of the ADGM has issued an advisory reminding all ADGM-registered entities to comply with the ADGM Employment Regulations 2019 and the Temporary Work Permit Rules 2024.

As per these regulations, effective from 1 September 2024, all entities registered with the ADGM must obtain and maintain valid work permits and temporary work permits for every individual working within ADGM jurisdiction.

You can read the ADGM article in full here.

On 20 September, the Financial Services Regulatory Authority (‘FSRA’) of the ADGM alerted the financial services community and members of the public about misleading claims made by New Financial Technology Ltd (‘NFT’) concerning a purported investment fund named the ‘NFT Fund’.

The FSRA confirmed to the public that NFT is not and has never been:

• authorised by the FSRA to carry on any form of Regulated Activity in or from ADGM, nor has it applied to the FSRA for such authorisation
• incorporated in the ADGM or licensed to undertake any form of commercial activities in the ADGM
• established as an investment fund in the ADGM.

The FSRA advises the financial services community and members of the public to exercise caution when contacted by any entity that purports to be licensed to undertake Regulated Activities in ADGM, unless and until the entity’s regulated status can be confirmed by checking the FSRA’s Public Register.

You can read the ADGM article in full here.

On 24 September, it was announced that speakers for Abu Dhabi Finance Week (‘ADFW’) 2024 include a cast of senior leaders from global banking institutions such as UBS, State Street, BNY, Santander, Standard Chartered, First Abu Dhabi Bank, Emirates NBD, Abu Dhabi Islamic Bank, Starling Bank and Oak North Bank.

• ADFW will be held on 9 – 12 December 2024.
• ADFW 2024 will feature over 300 speakers, including top leaders from global banking institutions and investment firms, solidifying Abu Dhabi’s position in the global financial landscape.
• High-profile speakers confirmed include Ray Dalio of Bridgewater, Bill Ford of General Atlantic, and David Hunt of PGIM, highlighting the event’s significance for financial dialogue and innovation.
• ADFW, backed by Abu Dhabi’s leadership, aims to enhance collaboration and investment opportunities in the region’s finance sector.

ADFW will be open for registration in the coming weeks. For more information please visit: www.adfw.com

You can read the article in full here.

On 9 September 2024, it was announced that the Securities and Commodities Authority (‘SCA’) signed a cooperation agreement on 5 September with Dubai’s Virtual Assets Regulatory Authority (‘VARA’).

The move bolsters the UAE’s position as a leading global hub for virtual assets, in alignment with the government’s visionary aspirations to build the world’s best and most dynamic economy.

With regards to the licensing of Virtual Asset Service Providers (‘VASPs’) the two parties agreed that VASPs operating in/from Dubai or wishing to service the emirate of Dubai are required to obtain a license from VARA, and can be registered by default with the SCA to service the wider UAE. VASPs wishing to operate out of any other Emirate, must be licensed by the SCA to do so. The agreement covers the mechanism for mutual supervision of VASPs, penalty and fine imposition, the exchange of information and statistics, as well as cooperation in employee training and qualification.

You can view the full article here.

On 16 September 2024, it was announced that the Central Bank of the UAE (‘CBUAE’) imposed a financial sanction on a bank operating in the UAE. The sanctions are pursuant to articles 89 and 137 of the Federal Decree Law No. (14) of 2018 regarding the Central Bank & Organisation of Financial Institutions and Activities and its amendments, and article 14 of the Federal Decree Law No. (20) of 2018 on Anti-money Laundering and Combating the Financing of Terrorism and Illegal Organisations.

The bank was fined AED 5 million and directed to present the Central Bank’s action to the board of directors of the overseas headquarters.

You can read the full statement here.

On 18 September, it was announced that the CBUAE has decided to cut the Base Rate applicable to the Overnight Deposit Facility (‘ODF’) by 50 basis points, from 5.40% to 4.90%, effective from 19 September.

This decision was taken following the US Federal Reserve’s announcement to reduce the Interest Rate on Reserve Balances (‘IORB’) by 50 basis points. The CBUAE has also decided to maintain the interest rate applicable to borrowing short-term liquidity from the CBUAE at 50 basis points above the Base Rate for all standing credit facilities.

The Base Rate, which is anchored to the US Federal Reserve’s IORB, signals the general stance of monetary policy and provides an effective floor for overnight money market interest rates in the UAE

You can read the full statement here.

On 27 September, it was announced His Excellency Khaled Mohamed Balama, Governor of the CBUAE, hosted a high-level roundtable with the Chairman and representatives of the Foreign Exchange and Remittance Group, to discuss developments in the exchange business in the UAE. Participants highlighted the critical contribution of exchange houses to the national financial services landscape with more than 1000 exchange house branches operating across the UAE. CBUAE discussed its main priorities in prudential supervision, market conduct, anti-money laundering, combatting the financing of terrorism, and regulatory developments pertaining to exchange businesses.

You can read the full publication here.

On 20 September, it was announced His Excellency Talal Al Teneiji, Director of the Executive Office for Control and Non-Proliferation (‘EOCN’), met with His Excellency Waleed Al Awadhi, Chief Operating Officer, and Ms Kawthar Kazem, Director of Human Resources at the DFSA.

During the meeting, they attended a presentation by Ms Afra Al-Falasi, a specialist at the DFSA, outlining the outcomes of her secondment at the EOCN in the foundational training program, which focused on implementing Targeted Financial Sanctions and combating sanctions evasion.

This initiative is part of the EOCN and DFSA vision to open new opportunities for cooperation, knowledge exchange, and building competencies at both technical and operational levels, as well as to learn about best practices to strengthen the framework for combating terrorism financing, proliferation financing and sanctions evasion. This program aims to enhance capacity building and knowledge in government authorities, including supervisory bodies in the financial and non-financial sectors, to identify the requirements of Targeted Financial Sanctions and aims to strengthen and improve the national cooperation procedures and exchange of information to combat sanctions evasion.

You can read the full article here.

On 24 September, a press release from the Bank of International Settlements highlighted the Basel Committee approval of the annual assessment exercise for global systemically important banks. The Basel Committee has also finalised an analytical report on liquidity risk insights from the 2023 banking turmoil. The progress report will be submitted to G20 Finance Ministers and Central Bank Governors and published next month.

The Committee also continues to review the comments received on its consultation proposing a Pillar 3 disclosure framework for climate-related financial risks.

You can read the full article here.

The United Nations Security Committee (‘UNSC’) amended one entry on its sanction list on 17 September in light of the global political landscape. As a member of the UN, the UAE is committed to implementing the UNSC resolutions, and all firms must report on their involvement with sanctioned entities.

Further details can be found here.

On 26 September, the DFSA announced that it had accepted an Enforceable Undertaking (‘EU’) from Baker Tilly MKM Chartered Accountants (‘Baker Tilly’). Baker Tilly failed to assemble complete and final sets of audit documentations for several audit files in a timely manner. The violation continued over a three-year period.

This violates the International Standard on Auditing 230, Audit Documentation, and the International Standard of Quality Management 1. Audit documentation demonstrates the integrity of the audit process and acts as a written record that provides support for the auditor’s opinion.

The DFSA acknowledges Baker Tilly’s cooperation in dealing with this matter.

A copy of the EU setting out full details of this matter can be found in the Decision Notices & Regulatory Actions section of the DFSA website. You can read the DFSA article in full here.

On 27 September, the Irish Data Protection Commission (‘DPC’) announced its final decision following an inquiry into Meta Platforms Ireland Limited (‘MPIL’). This inquiry was launched in April 2019, after MPIL notified the DPC that it had inadvertently stored certain passwords of social media users in ‘plaintext’ on its internal systems (i.e. without cryptographic protection or encryption).

The DPC submitted a draft decision to the other concerned supervisory authorities across the EU/EEA in June 2024, as required under Article 60 of the General Data Protection Regulations (‘GDPR’). No objections to the draft decision were raised by the other authorities.

The decision, which was made by the Commissioners for Data Protection and notified to MPIL, includes a reprimand and a fine of €91million.

The DPC’s decision records the following findings of infringement of the GDPR:

• Article 33(1): MPIL failed to notify the DPC of a personal data breach concerning storage of user passwords in plaintext;
• Article 33(5): MPIL failed to document personal data breaches concerning the storage of user passwords in plaintext;
• Article 5(1)(f): MPIL did not use appropriate technical or organisational measures to ensure appropriate security of users’ passwords against unauthorised processing; and
• Article 32(1): MPIL did not implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the ability to ensure the ongoing confidentiality of user passwords.

The DPC will publish the full Decision and further related information in due course.

You can read the article in full here.