DIFC vs ADGM (UAE financial free zones)

In plain words

Picture one country with two islands inside it. The islands follow the country’s criminal law and fly its flag, but each has its own business law, its own courts and its own financial regulator. A bank or fintech on an island is licensed by the island’s regulator, not the national one. That is roughly how the UAE works for financial services.

The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) are the UAE’s two financial free zones. Each is a defined area of its city with its own civil and commercial law, based on English common law, its own English-language courts, and a single regulator for all financial firms inside it: the Dubai Financial Services Authority (DFSA) in DIFC and the Financial Services Regulatory Authority (FSRA) in ADGM. ^{1 2}

Everything outside the free zones is the “mainland”, or onshore UAE. There, the Central Bank of the UAE (CBUAE) licenses banks, wallets and payment firms, and the federal Capital Market Authority regulates securities. So a fintech entering the UAE is really choosing between three different regulatory worlds, and the choice shapes everything from who its customers can be to which court settles its disputes.

Illustration

Three regulatory worlds in one country

Swipe sideways to see the whole diagram.

How it works

How a firm gets licensed in a free zone

The path is similar in DIFC and ADGM. The names of the registries and forms differ.

1. 1

   Pick the zone and the activities

   Map exactly what you will do, such as payments, custody or advice, and for which clients. That decides the permissions you need.

2. 2

   Talk to the regulator early

   Both the DFSA and the FSRA expect pre-application meetings, where you present the business model before filing anything.

3. 3

   Apply with a full regulatory business plan

   Business plan, financial forecasts, policies, risk and AML frameworks, and the people who will run them. The regulator tests whether the firm can operate safely from day one.

4. 4

   In-principle approval, then go live

   You set up the company with the zone’s registry, lease an office, hire key staff and inject capital. The final licence follows once the conditions are met.

CompanyZone registry

LicenceDFSA or FSRA

DIFC and the DFSA

The DIFC was set up as Dubai’s international financial centre and is the older and larger of the two zones by number of financial firms. It has its own body of civil and commercial laws, written by the DIFC and modelled on common-law principles, covering companies, contracts, employment, insolvency and data protection. Disputes go to the DIFC Courts, which sit in English and follow common-law procedure. ³

The DFSA is the single regulator for financial services in and from the DIFC. It covers banking, payments and money services, investment business, insurance, funds, crypto tokens and market infrastructure, and it supervises its firms for AML compliance. ¹

What a DFSA licence is

A firm that carries on financial services in the DIFC is an Authorised Firm. Its DFSA licence lists the exact financial services it may carry on, such as dealing in investments, arranging custody, advising, or providing money services. The DFSA places each firm in a prudential category, based on how risky its activities are, and that category sets how much capital it must hold and what it reports. Taking deposits sits at the heavy end; arranging or advising sits at the light end.

Alongside the firm, the DFSA approves individuals in key roles. Expect it to want a senior executive officer, a finance officer, a compliance officer and an MLRO who are suitable, experienced and based in the UAE. The regulator looks for real substance: decisions made in the DIFC by people who understand the business, not a brass plate.

Example. A wealth platform wants to offer portfolio advice and arrange custody for clients across the Gulf. In the DIFC it would seek permissions for advising and arranging, partner with a custodian, and fall into one of the lighter prudential categories, because it does not hold client money itself.

ADGM and the FSRA

ADGM is Abu Dhabi’s international financial centre. Its distinctive feature is that English common law, including the rules made by English judges over centuries, applies directly in the zone, alongside ADGM’s own regulations. For lawyers and investors used to English contracts, that is a familiar starting point. Disputes go to the ADGM Courts, which also sit in English. ²

The FSRA regulates all financial services in ADGM, from banking and asset management to payments and virtual assets. ADGM was one of the first places anywhere to publish a dedicated rulebook for crypto businesses, and it remains a common choice for institutional crypto firms.

What an FSP is

A firm carrying on regulated activities in ADGM needs a Financial Services Permission (FSP) from the FSRA. Like a DFSA licence, it lists each regulated activity the firm may carry on and any conditions or restrictions, for example that it may deal only with professional clients. The company itself is registered with ADGM’s Registration Authority; the FSP is the separate regulatory permission on top.

The FSRA also approves people in controlled roles, applies capital requirements based on the firm’s activities, and supervises AML. As in the DIFC, it expects the firm’s management and control to be genuinely in the zone.

Example. A crypto custody firm serving funds and family offices applies to the FSRA for permissions to provide custody of virtual assets. The FSRA reviews its key management, segregation of client assets, cyber security and the tokens it plans to support before granting the FSP.

DIFC vs ADGM vs mainland

Who you can serve from a free zone

This is the question founders most often get wrong. A DFSA licence or an FSP covers financial services carried on in or from that zone. It is not a licence for the whole UAE retail market.

In general, a free zone firm can serve clients outside the UAE, other free zone businesses and, within its permissions and conditions, certain clients in the UAE. Offering regulated financial products to retail customers on the mainland, holding their dirham balances or running their everyday payments is onshore business, which the CBUAE or the CMA regulates. ⁴ The exact boundary depends on the activity, the type of client and how you market, so take advice before you promise anything to mainland customers.

The same logic applies to payments. Both free zones have a money services activity for things like payment accounts, money transmission and e-money, but these come with limits around mainland customers and dirham payments. A wallet aimed at UAE consumers, paid in dirhams through local rails, usually ends up with a CBUAE licence or a CBUAE-licensed partner, not a free zone permission. Read UAE payment licences explained for fintech founders for the onshore side.

Crypto in each zone

The UAE has more than one crypto regulator, and which one applies depends on where you sit:

• DIFC. The DFSA regulates crypto tokens inside the DIFC. Firms may only offer services in tokens the DFSA has recognised, and they need a licence for each activity, such as dealing, custody or running a trading venue.
• ADGM. The FSRA’s virtual asset framework covers exchanges, brokers and custodians, with a strong focus on institutional clients, custody standards and market conduct.
• Dubai outside DIFC. VARA licenses virtual asset activities across Dubai, including Dubai’s other free zones, but not inside the DIFC.
• Payments in stablecoins onshore. The CBUAE regulates payment tokens, meaning stablecoins used to pay for goods and services onshore. See why stablecoin use changes the UAE launch route.

Firms coming from Europe sometimes expect a MiCA licence to help here. It does not passport into the UAE; each Emirati regime needs its own licence, though a strong European compliance setup makes the application easier.

Sandboxes: DFSA Innovation Testing Licence and ADGM RegLab

Both zones run a regulatory sandbox for products that do not fit neatly into existing rules, or for founders who want to test with real customers before a full application.

A sandbox is not a shortcut to a full licence. You still need a credible team, controls and capital for the test. Its real value is evidence: live data showing the product works and the risks are managed, which strengthens the full application.

What it takes in practice

Timelines depend heavily on preparation. A well-prepared application for a simple activity can move in a few months; holding client money, novel products or crypto usually take longer. Build the product while the application runs, so both are ready together.

Choosing: mainland, DIFC or ADGM

Decision guide

Where should your fintech sit?

Swipe sideways to see the whole diagram.

Three scenarios show how this plays out:

• A crypto custody firm serving funds and family offices compares the FSRA in ADGM, the DFSA in DIFC and VARA in Dubai. It weighs which regulator’s custody rules fit its technology, whether the tokens it supports are accepted, and where its institutional clients already have accounts.
• A wealth app for expatriate professionals plans advice and portfolio tools. For clients across the Gulf, a DIFC or ADGM permission fits. To market investment products to UAE retail customers onshore, it would also need the CMA’s permission or an onshore partner.
• A UAE consumer wallet with dirham balances and local card payments goes straight to the CBUAE for an SVF licence, or launches with an SVF-licensed partner. A free zone adds little for this model.

When DIFC and ADGM both fit, the deciding factors are practical: how each regulator treats your exact activity today, how long applications are taking, office and staff costs, which zone your banks, custodians and clients already use, and whether your team prefers Dubai or Abu Dhabi. For the wider comparison with a UK launch, read UK vs UAE fintech launch routes.

Example: a UK EMI picks its Gulf base

Common misconceptions

FAQ