November 14, 2026 · Jurisdiction Briefing · 7 min read

DIFC: the DFSA’s USD 109,200 fine on an ADGM-licensed adviser that met and onboarded clients in a DIFC office

On 1 October 2026 the DFSA announced a fine of USD 109,200 (AED 401,000) on Vault Wealth Limited (VWL). VWL is incorporated in the Abu Dhabi Global Market (ADGM) and licensed by its Financial Services Regulatory Authority (FSRA). The DFSA found that it carried on financial services in or from the DIFC without DFSA authorisation, in breach of the Financial Services Prohibition in Article 41(1) of the Regulatory Law 2004. The two services were Advising on Financial Products and Arranging Deals in Investments.

VWL agreed to settle, and the DFSA reduced the fine by 30% from USD 156,000. The DFSA’s Managing Director of Enforcement, Alan Linning, put the point of the case in one line of the media release:

> “Authorisation by another regulator does not permit a firm to conduct > financial services in or from DIFC.”

The Decision Notice behind the release, dated 21 September 2026, shows how a firm licensed one emirate away ended up there, and what part its own compliance officer played.

The documents behind this briefing

The Decision Notice to VWL, dated 21 September 2026, given under paragraph 5 of Schedule 3 of the Regulatory Law. The decision was made by a Settlement Decision Maker on behalf of the DFSA. The DFSA lists it in the Decision Notices section of its website, dated September 2026.
The DFSA’s media release of 1 October 2026.

The notice is addressed to VWL alone. It says nothing in it is a determination that any other person breached a rule, and its findings are without prejudice to third parties.

Three companies, one name

The notice describes a small group:

Vault Wealth Holdings (VWH), incorporated in the ADGM on 5 December 2022 as a non-operational holding company. It owns the other two.
Vault Wealth Limited (VWL), incorporated in the ADGM on 9 March 2023 and licensed by the FSRA on 13 June 2023 for Advising on Investments or Credit and Arranging Deals in Investments in or from the ADGM. It has never been authorised by the DFSA.
Vault Technology Limited (VTL), a DIFC entity incorporated on 8 November 2023 and wholly owned by VWH. It has never been regulated by the DFSA. The DIFC public register designates it a “Non-Financial Company”, with technology, research and development as its activities.

The DIFC office carried no branding that set VTL apart from “Vault Wealth”; it simply displayed “Vault”. VTL did not appear on the Vault Wealth website or on its LinkedIn accounts.

An approach to the DFSA that went quiet

In August 2023, VWL’s then Compliance Officer and MLRO submitted a General Enquiry form through the DFSA website. It said VWL wanted to set up a DIFC entity and start the authorisation process, and that the founders wanted to move VWL’s regulated activity to the DIFC. On or about 7 August 2023, one founder and the CO/MLRO met the DFSA’s Authorisations Team.

After that meeting the DFSA heard nothing further from the firm or either founder. On 24 October 2023 the Authorisations Team changed the status to “Pre Application – Dormant”. VWL never submitted an application, and neither did VTL, which was incorporated in the DIFC three months after the meeting.

What happened in the DIFC office

The DFSA’s account comes from an interview with the former CO/MLRO, an inspection of the DIFC office, emails and WhatsApp messages, and an interview with a VWL financial adviser (the notice calls him the Vault Wealth Advisor, or VWA).

Where staff worked. The former CO/MLRO, interviewed on 25 April 2024, said the Abu Dhabi office was used for about two meetings a month and that, after December 2023, VWL employees worked from the VTL office in the DIFC.
Who the clients were. She said about 150 retail clients were being serviced by VWL employees, predominantly former clients of the two founders at their previous employer, a large multinational bank. VWL had four client-facing staff, including both founders, who lived in Dubai and worked from the DIFC office.
What a founder said at the inspection. DFSA officers inspected the DIFC office on 16 May 2024. One founder described VTL as a “tech firm” helping the wealth business operate, said it operated in a “grey area” because it was “front end facing”, and said roughly 90% of VWL’s customers were retail customers and that a VWL financial adviser was based in the DIFC office.
What the emails said. Between February and April 2024 the adviser invited prospective clients to meet “in person at DIFC” for discovery and financial planning sessions, used an email signature with a DIFC office address, and told one prospect: “Our location is DIFC, Dubai.” On the day of the inspection he moved a client meeting, writing that “The dfsa is still in our offices”.
What the adviser said in interview. On 22 October 2024 he said clients come to the firm because they want financial advice, and that “It is not a robo-advisory”. He confirmed meeting a client in person in the DIFC after a remote financial planning session.

The KYC detail

The part of the notice most relevant to onboarding teams is how the DFSA treated know-your-customer documents.

The adviser emailed one prospect the documents needed to open an account with the broker dealer VWL used for its clients: Emirates ID (front and back), passport copy, and proof of UAE address. In interview he described pre-filling a client’s application, uploading the documents for him, and sending a link for the client to e-sign.

The DFSA quoted the Guidance to GEN Rule 2.9.1: activities that constitute Arranging include assisting potential buyers of Investments by completing applications or other processes relevant to the transaction. It then found that, from February to May 2024, prospective clients gave KYC documentation to the adviser for the purpose of arranging the creation of their investment accounts. Together with the advice given from the DIFC office, that led to the finding that VWL carried on Advising and Arranging by way of business in or from the DIFC, including by holding itself out as willing and able to do so (GEN Rule 2.3.1(b)).

In our reading, the lesson is that collecting and uploading a client’s identity documents for a third-party account is not a neutral back-office task. The DFSA treated it as part of a regulated activity, and the place where it happens matters.

The compliance officer who raised it

The former CO/MLRO told the DFSA she had raised concerns with one of the founders about Vault’s presence in the DIFC and the continuing lack of a DFSA licence, and that they were not addressed during the rest of her tenure (June 2023 to March 2024).

The DFSA treated that as an aggravating factor. VWL’s senior management knew about the DFSA authorisation requirement and chose not to obtain it, and failed to act on the concerns raised by the then Compliance Officer.

How the DFSA built USD 109,200

The notice follows the five steps of the penalty policy in Chapter 6 of the DFSA’s Regulatory Policy and Process Sourcebook (RPP).

Step 1: disgorgement. None. The DFSA saw no evidence that VWL made a profit or avoided a loss as a direct result of the contraventions and, given the nature of the client agreements, did not consider it relevant.

Step 2: seriousness. USD 130,000. The DFSA gave four reasons the contraventions were serious:

they involved providing financial services in or from the DIFC without DFSA authorisation;
they avoided the regulatory scrutiny and protections that help protect users and potential users of financial services in the DIFC;
VWL’s senior management was aware of the contravention;
the lack of signage and communication showing that the DIFC entity was separate from the ADGM-authorised entity could lead prospective clients meeting in the DIFC to believe VWL was authorised to provide financial services there.

Step 3: aggravation. Plus 20%, for the senior-management factors above. The figure became USD 156,000.

Step 4: deterrence. No adjustment. The DFSA considered USD 156,000 sufficient to deter VWL and others.

Step 5: settlement. VWL and the DFSA agreed the relevant facts and the amount of the fine, and the DFSA applied a 30% discount. The fine became USD 109,200.

The notice adds USD 5.46 (AED 20) of Knowledge and Innovation Dirham fees, required by Dubai law and payable with the fine. The DFSA’s release thanks the FSRA for its close assistance and cooperation in the investigation.

What to do with this

These are our suggestions, not DFSA requirements.

Map where regulated activity actually happens. For a firm licensed in one centre, list where advisers sit, where clients are met and where account applications are completed. VWL’s FSRA licence was for services in or from the ADGM, and the DFSA’s release is explicit that another regulator’s authorisation does not permit financial services in or from the DIFC.
Look hard at the unregulated sister company. If a group entity with a technology or support description shares staff, premises or a brand with a regulated firm, document what each entity does, and make sure office signage, email signatures and websites say which entity a client is dealing with.
Escalate perimeter concerns in writing and keep the trail. Here the compliance officer’s unanswered concern became an aggravating factor against the firm. A perimeter question raised by compliance deserves a recorded answer from senior management or the board.
If an authorisation enquiry stalls, decide formally. Either apply, or record why the planned activity will not take place in the new centre, and check that it does not.
If you are the broker or platform, ask introducing advisers where they are authorised and where they meet and onboard your clients, and record the answer in your introducer due diligence.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates united-arab-emirates-dubai-difc