Regulatory Update July 2026 – ME Region

On 2 July, following the conclusion of the consultation period on several proposed legislative changes set out in Consultation Paper No. 171, “Miscellaneous Changes”, the Dubai Financial Services Authority (‘DFSA’) published amendments to the DFSA Rulebook, as summarised below:

• Prudential – Investment, Insurance Intermediation and Banking Business (‘PIB’) Module
  • the DFSA amended the calculation methodology for the K-ASA (Assets Safeguarded and Administered) and K-AUM (Assets Under Management) requirements under the ABCR framework
  • the amendment clarifies that firms should calculate average ASA and AUM based on the values recorded on the last business day of each of the previous six months, with the requirement calculated as the arithmetic mean of those monthly values
  • the applicable capital factors remain unchanged at 0.06% of average ASA and 0.02% of average AUM
• Conduct of Business (‘COB’) Module
  • removed the requirement to perform reconciliations on a trade settlement date basis.

You can read the DFSA’s amended legislation in full here.

On 7 July, the DFSA published Consultation Paper No. 173, “Proposals to Enhance the DFSA’s Collective Investment Funds Framework”, proposing significant reforms to the existing collective investment fund regime. The consultation represents the most substantial review of the framework since 2010 and builds upon the regime originally introduced in 2006.

The consultation seeks comment on multiple rulebooks, including:

• Collective Investment rulebook (‘CIR”)
• General rulebook (‘GEN’)
• Glossary rulebook (‘GLO’)
• Fees rulebook (‘FER’)
• Islamic Finance rulebook (‘IFR’)
• Marketing rulebook (‘MKT’).

In addition, the DFSA proposes an update to the Regulatory Law and to the Investment Trust Law.

Comments are invited until 7 September. The consultation paper is available here and feedback may be submitted here.

On 9 July, the DFSA published Consultation Paper No. 174, “Miscellaneous Changes”, seeking public comments on proposed amendments to the definitions of certain Investment Tokens and Crypto Tokens, requirements for Credit Rating Agencies, and certain regulatory reporting requirements.

Key proposed changes include:

• amendments to the definitions of Fiat Crypto Token, Privacy Device, Privacy Token, and Investment Token
• removal of the requirement to disclose fees and charges in every rating announcement
• retention of transparency requirements through existing annual report and website disclosure obligations
• removal of the disclosure requirement for Credit Rating Agencies (‘CRAs’) regarding Relevant Information
• removal of the requirement to disclose whether Relevant Information is publicly available or remains non-public
• elimination of disclosure obligations that provide limited value to users of credit ratings
• streamlining of disclosure requirements by focusing on information that is more relevant to assessing the quality, methodology, and robustness of credit ratings.

The changes will likely affect the following rulebooks:

• GEN rulebook
• Conduct of Business rulebook (‘COB’)
• Prudential – Investment, Insurance Intermediation and Banking rulebook (‘PIB’)
• Glossary rulebook (‘GLO’)
• CIR rulebook
• Authorised Market Institutions rulebook (‘AMI’).

You can read the consultation paper here, and comments are welcome until 24 August.

On 9 July, the DFSA published its 9th Audit Monitoring Report, “Setting the Standard in Audit Quality within Dubai International Financial Centre”, summarising findings from audit monitoring visits conducted across DIFC Registered Auditors during the period from 1 January 2024 to 31 December 2025.

The report highlights continued strengthening of audit quality across the DIFC, with the DFSA reporting a higher proportion of satisfactory audit engagements and fewer unsatisfactory findings compared to previous inspection cycles. The inspection programme covered 26 inspections across 93 audit engagement files, indicating ongoing supervisory scrutiny of audit firms operating within the DIFC.

A key development noted in the report is the publication of the first transparency reports by auditors of public listed companies under DFSA Rules, making the DFSA the first audit regulator in the UAE to mandate such disclosures. These reports provide information on firms’ governance arrangements, quality management systems, and organisational culture, representing a significant enhancement in audit transparency and accountability.

The report also reflects the continued growth and maturity of the DIFC audit market. Total audit fees increased by 74% to US$ 33.5 Mn, suggesting greater audit activity and providing firms with additional resources to invest in audit quality and technical capabilities. During the reporting period, Registered Auditors also recorded 10,802 Continuing Professional Development (‘CPD’) hours, representing a 17.7% increase over the previous cycle.

Audit activity remained robust, with Registered Auditors signing 1,267 financial statement auditor reports and 1,968 regulatory reports, underscoring the expanding scale and complexity of financial services activity within the DIFC.

In addition, the DFSA published its first thematic review on Audit Working Papers Archiving and Retention and entered into memoranda of understanding with the UAE Ministry of Economy and Tourism and the UAE Capital Market Authority to enhance regulatory cooperation and oversight.

For regulated firms and auditors, the report reinforces the DFSA’s increasing focus on audit quality, professional scepticism, robust quality management systems, and governance standards, while signalling that transparency and continuous improvement remain key supervisory priorities across the DIFC audit landscape.

You can read the DFSA’s audit monitoring report in full here.

On 21 July, the DFSA issued an email reminder, pursuant to its Dear SEO Letter dated 30 June, reminding Senior Executive Officers of Authorised Firms, Authorised Market Institutions, and Managing Partners and Main Contacts of Registered Auditors of the requirement to submit their Cyber Risk Self-Assessment 2026 responses by 24 July 2026.

The Cyber Risk Self-Assessment forms part of the DFSA’s ongoing supervisory programme and was intended to assess firms’ cybersecurity governance arrangements, cyber risk management frameworks, and operational resilience capabilities.

On 21 July, the DFSA invited industry participants to attend a webinar on Consultation Paper No. 173 (‘CP173’), which sets out proposals to enhance the DFSA’s Collective Investment Fund framework.

The webinar is scheduled to take place on 11 August and will provide an overview of the proposed reforms, which aim to align regulatory requirements more closely with the risk profile of funds and their investors while maintaining a proportionate, risk-based approach to investor protection. The proposals also seek to further align the DFSA framework with international standards and regulatory best practices, improve regulatory clarity, and reduce unnecessary regulatory burdens.

Stakeholders are invited to submit written feedback on CP173 by 7 September, with the webinar serving as an opportunity to gain further insight into the proposals and raise questions with the DFSA ahead of the consultation deadline.

You can read the DFSA’s consultation paper in full here and submit your comments here.

On 21 July, the DFSA and the Hong Kong Monetary Authority (‘HKMA’) announced the HKMA-DFSA Joint Climate Finance Conference 2026, which will take place on 10 September in Hong Kong, with a livestream available for participants outside Hong Kong.

Held under the theme “Driving Transition in a Changing World”, the Conference forms part of Hong Kong Green Week 2026 and represents the second edition of the HKMA-DFSA flagship climate finance initiative. The event is designed to support the development of climate finance and facilitate greater collaboration between financial markets in Asia and the Middle East.

The Conference will bring together regulators, policymakers, investors and industry leaders to discuss the partnerships, capital mobilisation strategies and innovative financing solutions required to support a credible and effective transition to a lower-carbon economy amid an evolving global landscape. Discussions will also explore the role of Hong Kong and Dubai as strategic financial centres in advancing sustainable finance and transition finance initiatives.

You can read the DFSA’s announcement in full here.

On 30 July, in a Dear SEO Letter “2026 Artificial Intelligence Survey” delivered via email, the DFSA issued its 2026 Artificial Intelligence (‘AI’) Survey to Authorised Firms, requesting information on their current and planned use of AI, as well as the governance, risk management and oversight frameworks established to identify, manage and oversee AI-related risks.

The survey forms part of the DFSA’s ongoing efforts to monitor AI adoption and developments across the DIFC. Building on the findings of its 2024 and 2025 AI surveys, the DFSA noted that AI adoption among Authorised Firms increased significantly, with 52% of firms reporting the use of AI in 2025, compared to 33% in 2024. The 2025 survey also highlighted increased use of Generative AI, growing interest in expanding AI applications, and the continued evolution of governance and accountability arrangements.

The 2026 survey seeks to further assess:

• the types of AI being used by Authorised Firms and the extent of adoption
• the key drivers and barriers influencing AI adoption
• the governance frameworks and oversight arrangements implemented by firms in relation to AI use.

Authorised Firms are required to submit their responses by 27 August 2026 via the DFSA e-portal. The DFSA will use the survey results to enhance its understanding of emerging AI use cases, market trends and associated risks within the DIFC.

You can read the DFSA’s Artificial Intelligence Survey 2025 report here.

On 30 July, the DIFC Registrar of Companies (‘RoC’) held a stakeholder session to discuss forthcoming changes to the Prescribed Company (‘PC’) regime and the introduction of new functionalities under the Corporate Services Provider (‘CSP’) module. The session was attended by a number of DIFC CSPs and focused on amendments that came into effect on 2 August 2026.

Under the revised framework, the previous qualifying criteria have been removed, allowing any applicant to establish or continue a PC in the DIFC, provided that, where required, a DIFC-licensed CSP is appointed as the primary administrative and compliance interface with the RoC.

A key objective of the reforms is to broaden access to the DIFC’s special purpose vehicle framework while maintaining appropriate regulatory oversight. The changes are expected to make the regime more attractive for a wider range of ownership, holding and structuring arrangements.

The updated Regulations reaffirm that PCs must remain passive holding vehicles and may only be used for their permitted holding and structuring purposes. While a PC may be used in connection with financial services activities, compliance with applicable DFSA-administered legislation remains mandatory. PCs are also prohibited from employing staff, ensuring that they remain non-operational entities.

A notable feature of the revised regime is the introduction of a formal statutory role for CSPs. CSPs will act as the primary administrative, compliance and regulatory liaison between the PCs and the RoC, including responsibility for regulatory filings, record keeping and ongoing compliance obligations.

The reforms are expected to be of particular interest to:

• family offices and family wealth structures
• investment holding vehicles
• financing and transaction structures
• private ownership arrangements
• other corporate structuring solutions seeking a cost-effective DIFC vehicle.

You can read the DIFC’s announcement in full here.

In July, the DFSA issued several alerts regarding entities falsely claiming to be regulated by the DFSA, and a further alert regarding an entity impersonating the DFSA.

On 1 July, the DFSA warned that AmpliFi Capital was falsely presenting itself as a DFSA-regulated investment firm. The regulator confirmed that the entity has never been authorised by the DFSA, is not incorporated in the DIFC, and is not listed on the UAE National Economic Register. The DFSA also noted that the website contained misleading claims, including unrealistic return and guaranteed performance statements.

On 7 July, the DFSA issued a similar alert concerning TRADEMARKET FZCO, confirming that it has never been authorised to provide financial services, that no company named “TRADEMARK” is registered in the DIFC, and that no investment fund named “PERSONAL” is registered with the DFSA. The entity reportedly made false claims in investor contracts that its fund was subject to DFSA regulation.

On 21 July, the DFSA issued a public alert warning firms and individuals within the DIFC about fraudulent emails falsely purporting to originate from the regulator. According to the alert, the emails claimed to relate to regulatory and enforcement matters, including alleged regulatory breaches, code violations and requests for recipients to sign documents or acknowledge receipt of correspondence. The communications were designed to appear legitimate and included DFSA branding, employee names, job titles and contact information.

The DFSA advised that the fraudulent emails originated from email domains designed to closely resemble official DFSA email addresses and referred to urgent regulatory actions, enforcement proceedings or alleged breaches of Law No. 1 of 2004, requesting recipients to confirm receipt of documents, provide signatures or upload documents via embedded links.

The DFSA also reminded stakeholders that it

• does not have a compliance department
• does not send official correspondence from non-DFSA email domains
• does not request confidential information, document signatures or file uploads through unsolicited email links
• does not use third-party file-sharing links in unsolicited communications.

On 22 July, the DFSA issued a public warning regarding RETINARXIV BROKERS, an entity that was falsely claiming to be regulated by the DFSA. The DFSA confirmed that RETINARXIV BROKERS is not authorised, regulated or licensed by the DFSA and has never been permitted to provide Financial Services under the DFSA regulatory framework. The regulator further clarified that no company bearing the name “RETINARXIV” is registered within the DIFC.

According to the alert, RETINARXIV BROKERS claimed on its website to have obtained DFSA approval in 2019 and provided a link to a cloned version of the DFSA Public Register. The fraudulent register purported to show “Retinarxiv Limited” as a non-DIFC Company authorised to provide investment and contracts for difference (‘CFDs’) services. The DFSA strongly advised firms and members of the public not to respond to communications from the entity and warned against transferring funds or engaging in any transactions connected with RETINARXIV BROKERS.

You can read the DFSA’s alerts in full here.

On 9 July, the Financial Services Regulatory Authority (‘FSRA’) issued a regulatory alert regarding Veyron Markets Ltd, warning investors and the public of a suspected fraudulent scheme and false or misleading claims suggesting an association with the ADGM. The FSRA confirmed that Veyron Markets is not authorised or licensed by the FSRA, has never been granted permission to conduct regulated activities in or from the ADGM, and has never been incorporated or licensed in the ADGM.

The Regulator urged investors to exercise caution and verify a firm’s regulatory status through the FSRA Public Register before engaging in any financial services activities.

You can read the FSRA’s alert here.

On 8 July, the Registration Authority (‘RA’) issued a public alert warning that “Grummies ADGM Holding Company” is not incorporated, registered, or licensed in the ADGM, despite the circulation of a document purporting to be an ADGM commercial licence. The RA confirmed that the entity does not appear on the ADGM’s Public Register and has never applied for a commercial licence with the ADGM. The regulator cautioned that false claims regarding an entity’s ADGM status may mislead investors and the public, potentially exposing them to financial risk.

The RA advised individuals to independently verify any claimed association with the ADGM through its Public Register and document verification tools, and to exercise heightened caution when presented with investment opportunities, payment requests, or requests for personal or financial information.

You can read the ADGM’s alert here.

 On 13 July, the FSRA published its 2025 Annual Report, highlighting continued growth in the ADGM’s financial services sector and the regulator’s focus on innovation, financial crime prevention, and supervisory effectiveness.

Key points to note include:

• 95 Financial Services Permissions (‘FSPs’) and 120 In-Principle Approvals (‘IPAs’) were issued during 2025, representing increases of 22% and 32%, respectively, compared to 2024
• the FSRA continued to develop its policy and legislative framework to support innovation while maintaining high standards of market integrity, consumer protection, and financial stability
• the report highlighted ongoing efforts to strengthen supervisory oversight and combat financial crime across the regulated sector
• the FSRA expanded its use of regulatory and supervisory technologies to enable more efficient, data-driven oversight of firms and markets
• five new Memoranda of Understanding (‘MoU’) signed with international counterparts, further strengthening cross-border regulatory cooperation.

The report reflects the ADGM’s continuing growth as a financial centre, with increasing regulatory authorisations, greater technology-enabled supervision, and an ongoing emphasis on financial crime prevention and international regulatory collaboration.

You can read the FSRA’s Annual Report in full here.

On 20 July, the ADGM Panel’s Takeover Regulations (‘Takeover Code’) Rules 2026 (the ‘Rules’) came into force. The Rules establish the formal Takeover Code and provide a comprehensive framework governing takeover transactions, enforcement powers, jurisdictional matters, disclosure requirements and regulatory sanctions under the ADGM takeover regime.

The key highlights include:

• formalisation of the Takeover Code
  • the Rules formally incorporate the Schedule as the Takeover Code, which together with the Takeover Regulations 2015 and any related directions issued by the Panel, constitute the ADGM Takeover Regime
• introduction of Core Takeover Principles
  • equal treatment of shareholders holding securities of the same class
  • protection of minority shareholders where control of a company is acquired
  • ensuring shareholders have sufficient information and time to make informed decisions on takeover proposals
  • requiring offeree company boards to act in the interests of the company as a whole and not frustrate shareholder decision-making
  • preventing false or distorted markets in the securities of companies involved in a takeover
  • requiring offerors to ensure they have adequate resources to satisfy any cash consideration before announcing an offer
  • limiting disruption to the business affairs of an offeree company during a takeover process
• dual jurisdiction framework
  • the Rules introduce express provisions for transactions subject to both the ADGM oversight and another regulatory authority
  • parties are required to consult the Panel as soon as practicable where dual jurisdiction exists
  • the Panel may determine how conflicts between regulatory frameworks should be addressed and clarify which aspects of a transaction fall within the scope of the Takeover Regime
• the Panel is granted broad powers to address actual or anticipated breaches of the Takeover Regime, including the ability to
  • issue directions to prevent or restrain non-compliant conduct
  • require actions necessary to secure compliance with the Rules
  • consider complaints relating to breaches, provided they are submitted promptly
• offer and response document requirements
  • the Rules designate specific provisions of the Takeover Code as offer document rules and response document rules for the purposes of section 18 of the Takeover Regulations 2015
  • these provisions govern the disclosure content required in offer documents, offeree board circulars and any subsequent revisions or updates issued during the course of a takeover transaction
• fees and charges
  • the Rules confirm that document charges and other fees payable under the Takeover Code remain applicable
  • the Panel may also charge for additional goods and services, including applications for and maintenance of exempt principal trader, exempt fund manager and recognised intermediary status, with fees published on the ADGM website.

Companies, offerors, advisers and market participants involved in takeover transactions within the ADGM should review the new requirements carefully to ensure compliance with the updated Takeover Regime.

You can read the ADGM’s Takeover Code in full here.

On 14 July, the Financial & Cyber Crime Prevention Department (‘FCCP’) issued Notice No. FSRA/FCCP/117/2026 reminding Relevant Persons of their obligations under the FSRA Anti-Money Laundering and Sanctions Rules and applicable UAE AML/CFT legislation. The notice emphasises the requirement for firms to promptly identify, investigate, and report suspicious activities and transactions that may be linked to money laundering, terrorist financing, proliferation financing, or other criminal activity.

The FCCP highlighted several key compliance expectations:

• maintaining effective AML/CFT policies, procedures, systems and controls
• conducting annual risk assessments
• providing tailored staff training
• maintaining appropriate governance and escalation frameworks
• ensuring that suspicious activities are adequately documented, reviewed, and escalated to the Money Laundering Reporting Officer (‘MLRO’)
• maintaining records for the required retention period of 6 years.

The notice further reiterated the requirement for all Relevant Persons and relevant users to be registered on the UAE Financial Intelligence Unit’s goAML platform through the prescribed registration process. In addition, the FSRA reminded firms of the various report types that may need to be submitted through goAML, including Suspicious Transaction Reports (‘STRs’), Suspicious Activity Reports (‘SARs’), sanctions-related reports, High-Risk Country Reports (‘HRC’), and Postponement of Suspicious Transaction Reports (‘PSTRs’), each of which is subject to specific reporting requirements and deadlines.

Importantly, the FSRA also reiterated that firms must submit STRs and SARs to the FIU without delay and notify the FCCP of such submissions via email.

The Regulator also noted that it may take appropriate supervisory or enforcement action where firms fail to comply with applicable AML/CFT legislation, national directives, or the FSRA AML Rulebook.

You can read the FSRA’s notice in full here.

 On 23 July, the ADGM RA announced updates to its Commercial Permits framework through the introduction of new regulations and comprehensive guidance governing sales and promotional activities conducted within the ADGM. The changes are intended to enhance legal certainty, improve operational efficiency and strengthen consumer protection across a broad range of commercial activities.

The updated framework establishes a dedicated regulatory regime for businesses, professionals and other eligible entities undertaking specified sales and promotional activities within the ADGM. It introduces clearer requirements, streamlined application processes and consistent standards applicable across a range of sectors.

To support implementation, the ADGM also issued a comprehensive Guidance on Commercial Permits for Sales and Promotions, providing practical information on permit requirements, regulatory expectations and application procedures. The guidance outlines the categories of activities requiring permits and explains the end-to-end application process through the ADGM portal.

The revised framework covers various promotional activities, including:

• temporary sales and discount campaigns
• clearance sales
• instant prize promotions
• prize draws and competitions
• product launches
• promotional stands and marketing activities.

In addition, the new measures seek to strengthen consumer protection by encouraging transparency, accountability and responsible promotional practices. The framework also provides the ADGM Registration Authority with clear supervisory and enforcement powers to monitor compliance, investigate potential misconduct and take appropriate regulatory action where necessary.

You can read the ADGM RA’s updated commercial permits guidance in full here.

The latest ADGM cyber threat updates highlight a growing convergence of AI-related threats, credential theft, phishing campaigns, ransomware activity, and critical vulnerabilities affecting remote access and AI platforms.

Overall, financial institutions should remain particularly alert to the following developments:

• rise in AI-themed cyber threats
  • threat actors are increasingly exploiting the popularity of AI tools and platforms through fake AI applications and browser extensions delivering infostealers and malware
  • AI brand impersonation campaigns targeting users with malicious downloads
• Microsoft 365 and OAuth token theft
  • several campaigns focused on obtaining access tokens rather than usernames and passwords
  • ARToken is using device-code phishing to compromise Microsoft 365 accounts and bypass traditional MFA protections
  • ToddyCat has been observed abusing OAuth authorisation workflows to gain access to corporate email accounts without directly stealing credentials
• increased ransomware risk through remote access tools
  • ransomware operators continue to leverage legitimate administration tools and exposed remote-access infrastructure
  • Anubis ransomware affiliates are exploiting Citrix vulnerabilities and stolen VPN credentials while using tools such as ScreenConnect, Zoho Assist and MeshAgent to maintain access
  • supply-chain compromises and credential theft are increasingly being used as a precursor to ransomware deployment
• critical vulnerabilities requiring immediate attention
  • financial institutions should prioritise patching
  • Citrix NetScaler high-severity vulnerabilities affecting remote access infrastructure
  • Langflow OSS vulnerabilities that could enable full compromise of AI platforms
  • SimpleHelp authentication bypass vulnerability (actively exploited)
  • Adobe Campaign Classic critical remote code execution vulnerability
  • Apache Tomcat authentication bypass vulnerability
• browser and extension-based threats
  • researchers identified multiple campaigns abusing browser functionality
  • malicious extensions hijacking cryptocurrency transactions
  • AI-themed extensions intercepting and collecting search activity
  • large-scale software impersonation campaigns distributing AsyncRAT and remote-access malware.

For financial services firms, the most immediate priorities are strengthening phishing and credential security controls, monitoring OAuth and Microsoft 365 activity, reviewing the use of AI tools and agents, restricting unauthorised browser extensions, and urgently patching exposed Citrix, Langflow, SimpleHelp, Adobe Campaign Classic, and Apache Tomcat systems.

You can read the ADGM’s cyber threats newsletter in full here.

On 23 July, the ADGM announced the return of Abu Dhabi Finance Week (‘ADFW’) 2026, which will be held from 7 to 10 December 2026 under the theme “The Capital Community, Powered by Partnerships”.

The event will bring together investors, financial institutions, policymakers and business leaders from around the world to discuss the future of finance, capital allocation and economic growth. The event is expected to host more than 35,000 participants, over 800 speakers, and in excess of 70 events across four thematic days.

Key discussion themes will include:

• tokenisation and digital assets
• private markets and alternative investments
• artificial intelligence (‘AI’)
• trade and energy
• real estate
• infrastructure investment.

The programme will focus on how collaboration between sovereign investors, global financial institutions, policymakers and innovators can help mobilise capital, accelerate economic transformation and support sustainable growth.

You can read the ADGM’s announcement in full here.

On 27 July, the FSRA published Consultation Paper No. 2, “Proposed Enhancements to Transfer Schemes”, setting out several proposed changes aimed at making the Transfer Scheme regime more efficient and proportionate, while continuing to maintain appropriate safeguards for client protection.

Part 7 of the Financial Services and Markets Regulations (‘FSMR’) provides a legal framework for transferring all or part of the business of an ADGM Authorised Person or Recognised Body to another entity through a Transfer Scheme. Currently, all such transfers (except transfers of Domestic Funds) require Court approval before they can take effect. This process allows business transfers to occur without obtaining consent from every affected client or third party, while ensuring that their interests remain protected.

However, the mandatory Court approval requirement can result in significant costs and delays, particularly for smaller and less complex transfers. As many ADGM firms carry out transfers of this nature, the current framework may impose a regulatory burden that is disproportionate to the associated risks.

You can read the FSRA’s Consultation Paper here, and comments are welcome until 21 September.

On 10 July, the UAE Financial Intelligence Unit (‘UAE FIU’) participated in the 32nd Egmont Group Plenary, held in Baku, Azerbaijan. The annual gathering brought together Financial Intelligence Units (‘FIUs’) from across the Egmont Group network to strengthen international cooperation in the fight against money laundering, terrorist financing and other financial crimes.

During the Plenary, the UAE FIU co-led two projects within the Egmont Working Groups focused on enhancing the strategic intelligence capabilities of FIUs and improving the tools and resources available to member FIUs across the global network. The UAE FIU also held a series of bilateral meetings with counterpart FIUs to discuss ongoing cooperation and progress on both operational and strategic initiatives.

A key theme of this year’s Plenary was the growing importance of public-private partnerships (‘PPPs’) in combating financial crime, a priority that was also highlighted by the Financial Action Task Force (‘FATF’) in its recent report “Information Sharing to Combat Illicit Finance: Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements” (see Section 4). The discussions emphasised how enhanced collaboration between public authorities, financial institutions and other stakeholders can strengthen the detection, prevention and disruption of illicit financial activity.

You can read the Egmont Group’s announcement in full here.

On 13 July, the UAE Capital Market Authority (‘CMA’) issued a warning concerning DeVere Acuma Insurance Brokers L.L.C., Dubai, advising investors not to conduct business with the entity.

The CMA stated that DeVere Acuma Insurance Brokers L.L.C. is not licensed or authorised to carry out regulated financial activities or provide financial services that fall within the CMA’s regulatory remit. The CMA further emphasised that it accepts no responsibility or liability for any transactions, investments or dealings conducted with the entity.

You can read the CMA’s alert in full here.

On 22 July, the CMA issued a resolution amending Article (1) of the Resolution of the Chairman of the Authority’s Board of Directors No. (32/Chairman) of 2018 Concerning Technical Services Fees Payable to the Authority.

The amendment updates the legal basis for the CMA’s technical services fee framework and aligns the applicable fees with the UAE’s new capital markets regulatory regime.

New fees introduced include:

• approval of a public offering prospectus for shares of local public joint-stock companies, entities incorporated outside the State, and entities incorporated in free zones or financial free zones within the State
• approval of amendments to a public offering prospectus for entities incorporated outside the State or in free zones/financial free zones (post-approval)
• approval of an extension to a public offering period for a public joint-stock company, entities incorporated outside the State, and entities incorporated in free zones or financial free zones
• registration of capital increase shares for entities incorporated outside the State and entities incorporated in free zones or financial free zones for listing purposes
• approval of listing tradeable product contracts (approval and cancellation)
• amendment of specifications for listed tradeable product contracts
• licensing credit rating activity
• registration of an in-kind assets’ valuer for funds
• request for temporary suspension of a licence, approval, or registration.

Repealed fees include:

• fee for approval for a licensed company to change its address, head office, or branch location
• fee for approval for a licensed company to launch promotional advertising campaigns for its services
• fee for reviewing a proposed new investment fund
• cancellation fee for the licence of a local investment fund (standalone fund and protected cell fund)
• cancellation fee for the registration of a foreign fund for promotion purposes
• cancellation fee for the registration of Global Depositary Receipts (‘GDRs’) for listing purposes
• cancellation fee for the issuance of covered warrants
• fees for deciding on grievances
• fee for approval to retrieve a bank guarantee letter deposited with the Market
• fee for approval to retrieve a bank guarantee letter deposited with the CMA
• fee for approval to combine permissible positions
• fee for approval for a licensed entity to outsource the Risk Management Officer position
• fee for approval for a credit rating agency to outsource the Credit Rating Analyst position to its parent company where the licensed entity is a branch of a foreign company
• fee for approval for a credit rating agency to outsource the Credit Rating Analysis Lead position to its parent company where the licensed entity is a branch of a foreign company
• cancellation fee for the registration of a financial product for promotion within the State.

The amended fee schedule will be published in the Official Gazette and will come into force ten business days after the date of publication.

You can read the CMA’s new fee schedule in full here.

In July, the CMA launched a public consultation on a draft Resolution on Private Placements by Free Zone Companies in the UAE’s financial markets. The proposed resolution seeks

to enhance the efficiency and regulation of private placement activities, while strengthening investor protection and supporting the development of UAE capital markets. The proposal would provide free zone companies with a regulated mechanism to raise capital through private placements conducted via licensed UAE markets.

The consultation forms part of the CMA’s broader efforts to expand access to capital markets, improve fundraising opportunities for companies operating within free zones, and establish clear regulatory requirements for issuers and market participants involved in private placement transactions.

Stakeholders are invited to submit comments and feedback to the CMA by 17 August 2026.

You can read the CMA’s consultation in full here.

In July, the CMA launched a public consultation on a proposed framework governing private placements by private joint-stock companies (‘PrJSCs’) through UAE licensed securities markets.

The consultation represents a significant step in the development of the UAE’s private capital markets by creating a formal regulatory pathway for private companies to raise capital without undertaking a public offering.

Key proposals include:

• a dedicated regulatory regime for private placements by UAE PrJSCs
• financial eligibility requirements, including solvency and minimum shareholder equity thresholds
• three-stage approval process involving the Ministry of Economy and Tourism, the relevant securities market, and the CMA
• mandatory appointment of a CMA-licensed Financial Adviser (Issuance Manager) and a Receiving Entity
• detailed disclosure and prospectus requirements covering governance, financial performance, shareholder structure, material contracts, litigation and risk factors
• recognition of electronic private placement platforms and enhanced cybersecurity obligations for markets
• investor protection measures, including risk acknowledgements, complaint handling requirements and director accountability for disclosures
• clear supervisory and enforcement powers for the CMA, including the ability to suspend offerings, cancel subscriptions and revoke approvals.

The proposed framework would introduce greater transparency, regulatory certainty and investor protections while providing private companies with a structured avenue to access capital through UAE financial markets.

You can read the CMA’s consultation in full here, and responses are welcome until 17 August 2026.

In July, the United Nations Security Council (‘UNSC’) made several updates to its sanction lists.

On 9 July, the UNSC established pursuant to Resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning ISIL (‘Da’esh’) and Al-Qaida amended one (1) entry on its sanctions list. The amendment updated information relating to an existing designated individual or entity and did not constitute a new designation.

On 17 July, the UNSC established pursuant to Resolution 1533 (2004) concerning the Democratic Republic of the Congo added six individuals and two entities to its sanctions list. The new designations target individuals and organisations associated with activities that undermine peace, security and stability in the Democratic Republic of the Congo and are subject to applicable UN sanctions measures.

On 24 July, the UNSC concerning Libya approved the addition of the vessel AVAX (IMO 9058713) to its sanctions list. The vessel was designated in connection with activities relating to the illicit export of petroleum from Libya and is subject to restrictions on specified dealings and related financial transactions.

On 31 July, the UNSC established pursuant to Resolution 1988 (2011) amended five (5) entries on the Taliban sanctions list. The updates revised identifying and other details relating to existing designated individuals who remain subject to the applicable UN sanctions measures.

Firms are reminded to monitor sanctions developments and ensure that updates are reflected in their sanctions screening systems and internal controls. Firms using EOCN should ensure they are registered to receive live sanctions updates.

You can read the UNSC’s sanctions updates here, here, here, and here.

On 14 July, the Middle East and North Africa Financial Action Task Force (‘MENAFATF’), in cooperation with the Financial Action Task Force (‘FATF’) Training Institute and the Tunisian Financial Analysis Committee, launched a training programme on “FATF International Standards for the Middle East and North Africa Region”. The five-day programme was designed to strengthen participants’ understanding of international standards relating to anti- AML, CFT and counter-proliferation financing (‘CPF’), and to enhance their capacity to implement these standards effectively. The initiative also aims to support member jurisdictions in preparing for the third round of FATF mutual evaluations and improving the effectiveness of their national AML/CFT/CPF frameworks.

The training programme covers a range of key topics, including:

• the FATF Recommendations and international AML/CFT/CPF standards
• technical compliance and effectiveness assessment methodologies
• the components of an effective AML/CFT/CPF framework
• emerging financial crime risks and regulatory challenges.

The course brought together approximately 40 participants from MENAFATF member countries and was delivered by a panel of international and regional experts.

You can read the MENAFATF’s announcement here.

On 17 July, the CBUAE announced the conclusion of a visit by an International Monetary Fund (‘IMF’) staff team, which took place between 7 and 16 July 2026.

During the visit, IMF representatives held discussions with relevant UAE authorities on recent economic and financial sector developments, the country’s macroeconomic outlook, and key policy priorities. The discussions also formed part of the preparations for the IMF’s forthcoming 2026 Article IV Consultation, the IMF’s regular assessment of a member country’s economic conditions, policies and financial stability framework.

The engagement provided an opportunity for the IMF and UAE authorities to exchange views on the country’s economic performance, emerging challenges and opportunities, and policy measures aimed at supporting sustainable economic growth and financial sector resilience.

As part of the programme, the IMF staff team visited the UAE’s Cybersecurity Operations Centre, where it received a briefing on the CBUAE’s cybersecurity framework and supervisory approach. The delegation was also presented with the CBUAE’s use of AI technologies to enhance operational efficiency, strengthen risk management capabilities and support institutional development.

You can read the CBUAE’s announcement in full here.

On 8 July, the Financial Action Task Force (‘FATF’) published a report entitled “Information Sharing to Combat Illicit Finance: Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements”, highlighting the growing importance of information sharing and collaboration between public authorities and the private sector in combating ML, TF and PF.

The report examines how public-private partnerships (‘PPPs’) and other information-sharing mechanisms can improve the detection, analysis and disruption of financial crime, particularly in an environment characterised by rapid digitalisation and increasingly complex cross-border financial transactions.

According to the report, at least 84 PPPs have been established globally, with 52 surveyed jurisdictions reporting at least one domestic PPP and 18 reporting multiple arrangements. FATF noted that well-designed PPPs can serve as effective and permanent tools for combating financial crime when supported by an appropriate legal framework, clear governance arrangements and technological innovation.

The report also encourages greater cooperation between authorities, financial institutions, virtual asset service providers, DNFBPs, and other non-traditional stakeholders. FATF emphasised that broader collaboration is becoming increasingly important considering the significant growth in fraud and technology-enabled financial crime.

Among the key findings:

• more than 75% of surveyed jurisdictions use PPPs to share strategic information, including financial crime typologies, red flags and emerging risk trends
• between 55% and 66% of jurisdictions have mechanisms for sharing operational information, such as case intelligence, suspicious transaction report indicators and customer due diligence information
• increasing use is being made of secure technologies, including encrypted communication channels and information-sharing platforms, to facilitate collaboration between stakeholders.

The report further highlights several successful international initiatives, including Singapore’s Project FRONTIER+, a cross-border anti-scam alliance involving 13 jurisdictions that resulted in more than 2,100 arrests, the freezing of over 36,000 bank accounts and the seizure of approximately SG$ 28.2 Mn. The report also references a South African public-private initiative that contributed to the disruption of a pyramid scheme and the freezing of more than US$ 450,000 in related funds.

You can read the FATF’s report in full here.

On 16 July, the FATF published a targeted update on the implementation of Recommendation 15 (virtual assets and virtual asset service providers), assessing global progress in the regulation and supervision of virtual assets (‘VAs’) and virtual asset service providers (‘VASPs’) since the FATF extended its AML/CFT standards to the sector.

The report, developed under the FATF Virtual Assets Contact Group (‘VACG’) Roadmap, reviews measures adopted across the FATF Global Network, including jurisdictions with significant virtual asset activity, to regulate and oversee VASPs and address financial crime risks associated with virtual assets.

The FATF noted that jurisdictions have continued to make progress in several key areas, including:

• conducting risk assessments relating to VAs and VASPs
• developing regulatory and supervisory frameworks
• establishing licensing and registration regimes for VASPs
• implementing the FATF Travel Rule (Recommendation 16)
• enhancing supervisory and enforcement activities.

Despite these developments, the report identified several persistent challenges. In particular, the FATF highlighted deficiencies in translating risk assessments into effective mitigation measures, operationalising licensing and registration frameworks, identifying entities conducting VASP activities, and ensuring effective risk-based supervision and enforcement.

The report also draws attention to several emerging and growing risks within the VAs sector, including:

• the increasing use of VAs in large-scale fraud schemes operated by organised criminal groups
• the misuse of stablecoins
• risks associated with peer-to-peer transactions involving unhosted wallets
• offshore VASPs operating outside effective regulatory oversight
• ongoing supervisory and compliance challenges associated with decentralised finance (‘DeFi’) arrangements.

To address these risks, the FATF sets out recommendations aimed at strengthening implementation of Recommendation 15, improving risk mitigation measures, and enhancing domestic, international and public-private sector cooperation.

You can read the FATF’s report in full here.

On 21 July, the FATF published a report examining the evolving risks associated with DeFi and the application of FATF standards to the sector.

The report updates and supplements the FATF’s previous analysis contained in its 2021 Updated Guidance for a risk-based approach to VAs and VASPs, reflecting the significant growth and development of the DeFi ecosystem in recent years.

While DeFi continues to represent a relatively small portion of the overall virtual asset market, FATF noted that increasing participation by institutional investors, VASPs and other regulated entities has increased its importance within the global financial system and heightened its potential exposure to money laundering, terrorist financing and proliferation financing risks.

The report emphasises that the effective implementation of FATF standards in the context of DeFi requires a functional and risk-based approach, focusing on the activities being performed and the degree of control exercised rather than solely on technological structures or decentralisation claims.

Among its key findings, FATF highlights:

• the continued expansion and increasing sophistication of DeFi arrangements
• the growing interaction between traditional financial institutions, VASPs and DeFi platforms
• ongoing challenges in identifying accountable persons and entities exercising control over DeFi arrangements
• the need for jurisdictions to adopt effective supervisory and regulatory frameworks capable of addressing emerging DeFi-related risks
• the importance of mitigating the risk of criminal misuse of DeFi products and services.

The report also includes several recommendations for regulators, supervisors and market participants, including measures to assist jurisdictions in determining whether sufficient control exists within a DeFi arrangement to trigger regulatory obligations under the FATF standards. Additionally, FATF outlines risk mitigation expectations for DeFi arrangements and for financial institutions and VASPs that interact with them.

You can read the FATF’s report in full here.

On 31 July, the FATF published an updated consolidated ratings table. The table summarises jurisdictions’ progress against the 40 FATF recommendations. The recommendations assess each jurisdiction’s level of compliance with AML, CTF and proliferation financing standards.

You can read the consolidated FATF’s ratings in full here.

On 6 July, the Central Bank of the UAE (‘CBUAE’) imposed a financial sanction of AED 1.82 Mn on a branch of a foreign bank operating in the UAE. The penalty followed CBUAE examinations that identified the bank’s failure to issue a liability letter within the required seven-day timeframe, in breach of the CBUAE’s Market Conduct and Consumer Protection Regulations and Standards.

The enforcement action was taken pursuant to the Federal Decree-Law No. (6) of 2025 regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. The CBUAE reiterated its commitment to ensuring that licensed financial institutions comply with applicable laws, regulations, and standards to uphold consumer protection, transparency, and the integrity of the UAE financial system.

You can read the CBUAE’s enforcement action in full here.

On 24 July, the Dubai Virtual Assets Regulatory Authority (‘VARA’) announced enforcement action against Shelbit General Trading L.L.C., operating as Shelbit or Shelbit Exchange, for continuing to conduct virtual asset activities in Dubai without the required regulatory authorisation.

The action follows a cease-and-desist notice and enforcement action issued on 2 January 2025, after which VARA identified, through its ongoing market monitoring activities, that the entity allegedly continued to:

• provide virtual asset services to customers in and from Dubai without holding a valid VARA licence
• onboard customers without conducting mandatory Know-Your-Customer (‘KYC’) checks as required under UAE law
• market virtual asset services within Dubai without the necessary regulatory approval.

VARA stated that the identified activities raised concerns extending beyond consumer protection and included cross-border transaction activity with the potential to impact the integrity of the UAE financial system.

According to the regulator, the conduct constituted breaches of the UAE AML/CFT framework, including Federal Decree-Law No. (10) of 2025 Regarding Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation Financing, Cabinet Resolution No. (111) of 2022 Regulating Virtual Assets and Virtual Asset Service Providers, Dubai Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, as well as applicable VARA Regulations and Rulebooks.

You can read the VARA’s enforcement action in full here.