October 31, 2026 · Jurisdiction Briefing

DIFC: the DFSA’s USD 454,367 penalty on a company service provider that was never registered as a DNFBP

On 15 October 2026 the DFSA announced a financial penalty of USD 454,367.05 on Hayman-Woodward Global Mobility Services (DIFC) Ltd (HWW). The firm had carried on company service provider services in or from the DIFC without being registered as a Designated Non-Financial Business or Profession (DNFBP). The Decision Notice behind the announcement is dated 6 October 2026, and it says more than the headline about how the DFSA identified the business and how it built the number.

The only contravention the notice finds is of the DNFBP Prohibition in Article 71A(1) of the Regulatory Law 2004: the business was outside the supervisory perimeter when the DFSA says it should have been inside it. The notice also states that the DFSA does not allege that HWW engaged in money laundering.

The documents behind this briefing

The Decision Notice, dated 6 October 2026, given to HWW under paragraph 3(2) of Schedule 3 of the Regulatory Law 2004. The decision was made by a Settlement Decision Maker on behalf of the DFSA. The DFSA lists it in the Decision Notices section of its website, dated October 2026.
The DFSA’s media release of 15 October 2026.
The DFSA Rulebook AML module, version AML/VER30/04-26, for the current definitions and the DNFBP registration Rules. The rulebook site still lists it as the current module, and none of the DFSA’s May, July or October 2026 notices of amendments includes an AML module instrument. The consolidated module says on its cover that it has no legal effect and that the authentic versions are the rulemaking instruments on the DFSA website.

The notice is addressed to HWW alone. It says nothing in it is a determination that any other person breached a rule, and its findings are without prejudice to third parties.

The rule: register first, then carry on the business

The prohibition is short. Article 71A(1) of the Regulatory Law 2004, as quoted in the notice:

> “A person who is a DNFBP shall not carry on any activities in or from the > DIFC unless that person is registered by the DFSA as a DNFBP”.

The AML module’s Rule 3.2.1 defines who is a DNFBP: a listed class of persons whose business or profession is carried on in or from the DIFC. A company service provider is one of them. The module defines a company service provider as a person, not falling into the earlier limbs of the DNFBP definition, that by way of business provides any of four services to a customer:

acting as a formation agent of legal persons;
acting as (or arranging for another person to act as) a director or secretary of a company, a partner of a partnership, or a similar position for other legal persons;
providing a registered office, business address or accommodation, correspondence or administrative address for a company, a partnership or any other legal person or arrangement;
acting as (or arranging for another person to act as) a nominee shareholder for another person.

“Any of” matters: one service is enough. The DFSA found that HWW provided two of them, the first and the third, to 71 Clients.

What the DFSA relied on

HWW was incorporated on 28 August 2018 and is located in the DIFC. Its commercial licence lists Documents Clearing Services and Management Consultancies. The DFSA’s findings rest on what the business did:

Its own marketing. During the Relevant Period, 28 August 2018 to 27 February 2025, HWW promoted company set-up in Dubai and in UAE free zones. Its website advertised business set-up services including company registration, office registration and registered agent services.
Referral agreements with three free zones outside the DIFC. These were partnership agreements that included clauses on referring clients who wanted to incorporate companies. One listed products for HWW to promote, including company incorporation, branch registrations, trade licence issuance and renewals, visa services and leased office space.
Engagement letters and fee records. The notice gives three examples: licence renewal in a Dubai free zone for USD 5,000 (December 2024); a package of company documents, incorporation, a business plan, bank account opening and domiciliation for USD 8,500 (September 2024); and setting up a company in Dubai for USD 10,000 (January 2025).
Where the work was done. HWW carried on these activities through its DIFC-incorporated entity and from its offices in the DIFC.

The notice names the evidence base itself: a combination of website representations, referral agreements with free zones, engagement letters with clients and fee records.

The module’s own Guidance to Chapter 15 points the same way. In deciding whether a person carries on a DNFBP business in the DIFC, the DFSA says it will adopt a “substance over form” approach. It looks at what business is in fact being carried on, and not just what the person purports, or is licensed, to carry on. The notice does not cite that paragraph, but in our reading the case is an example of it: the licence said consultancy; the engagement letters said company formation.

The contract that counted against the firm

One detail deserves attention from anyone who signs partner agreements. In its agreement with the first free zone, HWW acknowledged that it was a DNFBP and a provider of corporate services under Federal Law No. 20 of 2018 and its implementing regulations, Cabinet Decision No. 10 of 2019.

The DFSA used that in its assessment of seriousness. It pointed to a lack of care and competence in failing, for a prolonged period, to recognise that HWW needed DFSA registration, despite being in the business of corporate services and entering into contracts on the basis that it was a DNFBP under federal law.

How the DFSA built USD 454,367.05

The notice walks through the five steps of the DFSA’s penalty policy in its Regulatory Policy and Process Sourcebook (RPP).

Step 1: disgorgement. HWW admitted that, of the fees it received from the 71 Clients, USD 242,800 can be attributed to the DNFBP services. The DFSA took that back as economic benefit from the contravention. It also disgorged the registration fees HWW would have paid had it been registered during the Relevant Period: USD 6,000 a year under Rules 3.7 and 3.8 of the Fees module, USD 48,000 in total, plus simple interest of USD 5,647.05. The notice’s annex records that the fees module version it quotes, FER/VER33/07-25, was in effect until December 2025.

Step 2: seriousness. The DFSA set the figure at USD 225,600, calculated on HWW’s total revenue from the 71 Clients who received company service provider services in the period. It gave three reasons the contraventions were serious:

HWW was not supervised by the DFSA against the AML module and other DFSA-administered legislation, which the DFSA says created serious risks of money laundering; the notice adds that the DFSA does not allege HWW engaged in money laundering;
HWW failed to recognise the need to register for a prolonged period, repeating the contravention across 71 Clients;
the lack of care and competence described above.

The DFSA also found nothing to suggest the contraventions were intentional, and said they were serious notwithstanding that.

Steps 3 and 4: no adjustment. The DFSA found none of the mitigating or aggravating factors relevant, and considered USD 225,600 sufficient for deterrence.

Step 5: settlement. HWW agreed to settle, and the DFSA applied a 30% discount to the fine only, not to the disgorgement. The fine became USD 157,920.

The total is USD 242,800 + USD 48,000 + USD 5,647.05 + USD 157,920 = USD 454,367.05. Without the settlement discount it would have been USD 522,047.05. The notice adds USD 5.46 (AED 20) of Knowledge and Innovation Dirham fees, required by Dubai law. The penalty is due within 28 days of the notice being given. By settling, HWW agreed not to refer the matter to the Financial Markets Tribunal.

In our reading the structure is the lesson. About 65% of the total (USD 296,447.05 of USD 454,367.05) is disgorgement and interest, which the settlement discount does not touch: the fees earned while unregistered, and the registration fees the firm never paid.

What registration would have required

Chapter 15 of the current AML module sets out what a DNFBP takes on when it registers:

Apply through the DFSA electronic portal (Rule 15.1.1).
Meet the criteria (Rule 15.1.2): show the DFSA it is fit and proper to perform anti-money laundering functions, and that it has adequate resources and systems and controls, including policies and procedures, to comply with Federal AML legislation, the Regulatory Law and the Rules. The DFSA may look at the applicant’s senior management, beneficial owners, group entities and others it has a relationship with. Guidance adds that the DFSA will need to be satisfied the applicant will comply with Article 21, on internal supervision, of Cabinet Resolution No. 134 of 2025.
File an annual information return for each calendar year by 31 January of the following year (Rule 15.1.3).
Notify changes in name, legal status, address, MLRO, senior management, beneficial ownership or main activities, before the change takes effect or promptly after if that is not possible (Rule 15.1.4).
Give 14 days’ written notice before ceasing DNFBP business in or from the DIFC, with a request to cancel the registration (Rule 15.2.1).
Not misrepresent its regulatory status with the DFSA, expressly or by implication (Rule 15.3.1).
Have written whistleblowing policies and procedures (section 15.3A).

The notice’s first reason for seriousness makes the link: because HWW was not registered, it was not supervised by the DFSA against the requirements of the AML module and other DFSA-administered legislation.

One check on the notice’s annex

Annex A of the notice reproduces the DNFBP definition. That text lists a Single Family Office, shows item (c) as deleted, and describes real estate businesses as carrying out transactions “with a customer”. The current module, AML/VER30/04-26, reads differently: item (c) covers issuers of, and service providers for, Non-Fungible Tokens and Utility Tokens (with exclusions), the real estate limb reads “for or on behalf of a customer”, and the list ends at item (f), a company service provider. If you are building a perimeter checklist, take the definition from the current module, not from the annex.

What to do with this

These are our suggestions, not DFSA requirements.

Test the perimeter by activity, not by licence. List every service the DIFC entity offers, including anything bundled into “business set-up” or “relocation” packages, and map each against the four company service provider limbs and the other DNFBP limbs. Record the conclusion and who reached it.
Read your own contracts and website. If a partner agreement says you are a DNFBP, or your website advertises registered agent or office services, a regulator can use that. Make sure your registration status matches what your documents say you do.
If you onboard or refer to DIFC corporate service businesses, ask for evidence of their DFSA registration as part of due diligence, and keep it on file.
If you are registered, calendar the obligations. The 31 January annual information return, the change notifications under Rule 15.1.4 (including main activities) and the 14-day notice before ceasing business.
Brief senior management on the arithmetic. In this case most of the penalty was disgorgement and interest, which settlement did not reduce.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates united-arab-emirates-dubai-difc