DIFC Category 4 Licence: Activities, Capital and How to Apply

Direct answer. A DIFC Category 4 licence is the lightest of the five prudential categories operated by the Dubai Financial Services Authority (DFSA). It is granted to firms that advise on financial products, arrange deals in investments or credit, act as insurance intermediaries or insurance managers, administer funds, provide trust services, or rate credit — activities where the firm takes on no trading position of its own. The DFSA sets the base capital requirement for Category 4 at US$10,000, the lowest of any category, though in practice most firms are held to a higher expenditure-based figure. A Category 4 firm may not deal as principal, and it may not hold or control client assets unless the DFSA specifically endorses its licence to do so.

That last sentence is the one that catches people out. The licence is cheap to capitalise and expensive to run, because what you save on capital you spend on governance.

The distinction that decides your category

The DFSA does not sort firms by what they call themselves. It sorts them by the Financial Services they intend to carry on — each one defined in the General module of the DFSA Rulebook — and then by how much risk those services put on the firm's own balance sheet.

Five categories run from 1 to 5. Category 1 is the heaviest: accepting deposits and providing credit, with a capital requirement in the millions of dollars. Category 2 covers dealing in investments as principal, where the firm trades on its own book. Category 3 splits into sub-categories covering dealing as agent or matched principal, custody, asset and fund management, and money services. Category 5 is reserved for Islamic financial institutions that run their entire business in accordance with Shari'a. Category 4 is the residual tier at the bottom: firms whose collapse would not leave a counterparty holding an unpaid position, because the firm never takes one.

That is why the entry price is low. It is not why the scrutiny is low, because it isn't. Your balance-sheet risk is small; your conduct risk is not. A mis-sold insurance contract or a negligent corporate finance recommendation does real damage to a real client, and the DFSA's conduct rules bite on Category 4 firms exactly as they do on larger ones.

Which activities sit inside Category 4

The list published by the DFSA is the only one that governs, and it does move. As a working picture, Category 4 is the home of:

• Arranging deals in investments — introducing, structuring or bringing together a transaction you do not execute yourself.
• Advising on financial products — recommending a specific investment, insurance contract or credit facility to a specific client.
• Arranging credit and advising on credit — the same work, in the lending market.
• Insurance intermediation and insurance management — broking, placing and managing insurance and reinsurance business.
• Arranging custody — putting a client together with a custodian without holding the assets yourself.
• Providing fund administration — the back-office work behind a fund you do not manage.
• Providing trust services and acting as trustee in certain configurations.
• Operating a crowdfunding platform and providing credit rating services, in the forms the DFSA has defined for each.

If your business plan touches two or three of these, you stay in Category 4. If it touches one Category 2 or 3 activity — executing a trade on your own book, holding client money as a matter of course, managing a discretionary portfolio — the whole firm is pulled up into that higher category and the capital requirement follows it. There is no blended category.

What a Category 4 licence will not let you do

Three limits matter more than the rest.

You cannot deal as principal. If your revenue depends on a spread you take by standing between two sides of a trade, you are in Category 2, not 4.

You cannot hold or control client assets by default. The standard Category 4 licence is written on the assumption that money and securities never sit in your name. If your model genuinely requires it — some insurance intermediaries handle premium money, for instance — the DFSA can endorse the licence to allow it, and that endorsement changes your prudential obligations, your audit, and your client money rules. Plan for it at application stage, not after.

You cannot serve retail clients unless you are authorised for them. The DFSA distinguishes Retail Clients from Professional Clients, and a firm that wants retail business faces a heavier conduct and disclosure regime. Most new Category 4 applicants start Professional-only for this reason.

The capital you actually have to hold

Two numbers apply, and the higher one wins.

The first is base capital: US$10,000 for Category 4 under the DFSA's prudential module. It is a floor, not a budget.

The second is the expenditure-based capital minimum, calculated as a set number of weeks of your own annual audited expenditure. The week count depends on the category and on whether the firm holds or controls client assets or insurance money — a firm that does is held to a materially longer period than one that does not. Because the figure is derived from your own cost base, a firm with a large office, several licensed officers and an outsourced compliance provider can easily find its real capital requirement running to six figures in dollars while the headline number still reads US$10,000.

Get your financial model to the DFSA early. The expenditure figure is the single most common reason a founder's budget and the regulator's expectation diverge. The current rules and week counts are published in the Rulebook on the DFSA website — read the live version rather than any summary, including this one.

Professional indemnity insurance is a separate obligation, and the cover required scales with the nature and volume of the business rather than sitting at a flat figure.

The people you have to appoint

A DIFC financial services firm is a staffed entity, not a mailbox. The DFSA requires named individuals to be approved for specific licensed functions, and the core set for a Category 4 firm is:

• Senior Executive Officer (SEO) — the person actually running the firm, who must be resident in the UAE.
• Compliance Officer — resident in the UAE, with real authority and real access to the board.
• Money Laundering Reporting Officer (MLRO) — resident in the UAE, and the named contact for suspicious activity reporting.
• Finance Officer — responsible for the firm's financial reporting and prudential returns.

Some of these roles can be combined and some can be outsourced, within limits the DFSA sets, but the SEO cannot be a figurehead. The regulator interviews individuals proposed for licensed functions and will refuse a candidate whose experience does not match the business plan. If your SEO has never worked in the product you are licensing, expect questions.

Employment terms for these hires sit under DIFC's own employment law, not the federal labour law that applies onshore — a difference that catches employers out on notice, end-of-service and leave. We set out the contrast in DIFC employment law compared with onshore UAE.

Premises, systems and the compliance stack

You need physical premises inside the DIFC. A registered address at a service provider can work for the smallest firms, but the DFSA expects the space to match the headcount and the activity, and it does visit.

Beyond the lease, an application is judged on the documents behind it: a regulatory business plan that survives cross-examination, a financial model with three years of projections, a compliance manual and monitoring programme written for your business rather than lifted from a template, an anti-money-laundering manual and client risk assessment methodology, a risk register, business continuity arrangements, and outsourcing agreements for anything you do not do in-house.

The anti-money-laundering piece deserves its own budget line. The DFSA's AML module applies on top of the UAE's federal anti-money-laundering framework, and a generic manual that does not describe your actual client base, jurisdictions and product set is one of the fastest ways to draw a long list of follow-up questions.

How the application runs

The sequence is broadly consistent, even if the timing is not:

1. Scope the activities. Decide precisely which Financial Services you are applying for. Everything downstream — category, capital, officers, manuals — flows from this.
2. Pre-application contact with the DFSA. A short paper setting out the proposition, ownership and management. Used well, this stage removes most surprises.
3. Submit the authorisation application. The core form plus supplementary forms for each licensed function, with the business plan, financial model and manuals attached.
4. Review and questions. Expect rounds of written questions and interviews with the proposed SEO, Compliance Officer and MLRO.
5. In-principle approval. The DFSA indicates it will license you subject to conditions — typically incorporating the entity, paying in capital, signing the lease, arranging insurance, and finalising systems.
6. Incorporate with the DIFC Registrar of Companies and satisfy the conditions.
7. Licence granted and the firm can begin the licensed activity.

Anyone quoting you a fixed number of weeks is guessing. The elapsed time turns on how complete the first submission is and how quickly you answer. A clean, well-evidenced file moves; a thin one stalls in questions.

Category 4 against the alternatives

A Representative Office is a separate, lighter DFSA category for a firm that only markets the products of an overseas group company and does no advising or arranging in its own right. If you genuinely just need a marketing presence, it is a smaller commitment than Category 4.

The Innovation Testing Licence lets a firm test a financial innovation on restricted terms before applying for a full licence. It is a route, not a shortcut.

[ADGM](/dictionary/adgm) in Abu Dhabi operates its own regulator and its own category structure, published on adgm.com, and is worth pricing in parallel if you have no reason to be in Dubai specifically.

A mainland or non-financial free zone company is the right answer for a business that does not carry on a regulated Financial Service at all. Plenty of consultancies pay for a DFSA licence they never needed. The trade-offs between those structures are set out in mainland versus free zone company setup in the UAE, and the corporate tax position of a free zone entity in free zone qualifying income and corporate tax.

Where applications usually stall

• A business plan that describes ambition rather than mechanics. The DFSA wants to know who the clients are, where they are, how you reach them, who is paid what, and what happens when it goes wrong.
• An SEO whose background does not match the licence. This is not fixable with paperwork.
• A capital figure built on the US$10,000 headline without modelling the expenditure-based minimum.
• Template manuals. A compliance or AML manual naming the wrong regulator or the wrong product set signals that nobody has thought about the firm's actual risks.
• Unclear ownership. Beneficial ownership has to be traceable to natural persons, with source of wealth evidenced.

Before you start

Read the current Rulebook on the DFSA website and the setup material published by the DIFC at difc.ae. Federal-level guidance on doing business in the UAE sits on the official portal at u.ae. Terms used across those documents are defined in our legal dictionary, and UAE federal instruments are indexed in the legislation library.

Then get advice before you file, not after the questions arrive. You can find a corporate and commercial lawyer in the UAE and compare experience, languages and practice areas directly, or ask a legal question if you are still working out whether your model is a regulated Financial Service at all. Clients engage and pay lawyers directly; LEXAI is a directory, not a party to that engagement.

If a dispute later arises between shareholders in a free zone entity, the forum and the governing law are not always where you expect — see free zone shareholder disputes in the UAE.