Our summary
Published by the Dubai Financial Services Authority on 10 April 2026, this thematic review looks at how well compliance functions work in fintech Authorised Firms in the Dubai International Financial Centre (DIFC), including crowdfunding and money services firms of different sizes. The DFSA used firm submissions, supervisory contact and internal documents to see how firms set up, staff and run their compliance work.
The DFSA found that 53% of firms have three or fewer compliance staff, with some depending on one person, and that about 58% outsource compliance, which can weaken local oversight. Other issues were Compliance Officers with conflicting roles, limited Board oversight, a “tick-box” approach in some firms, uneven use of compliance technology (used by about 90% of firms, but at very different levels), and late notifications to the regulator. The DFSA expects proportionate resources, stronger governance, a proactive compliance culture, better use of technology, and open and timely contact with the regulator. It asks firms to compare their own arrangements with the findings.
How auditors use it: Use the findings as a benchmark when auditing the compliance function, not only in fintech firms. Check key-person risk, oversight of outsourced compliance, independence of the Compliance Officer, Board reporting, and how quickly the firm notifies and responds to its regulator.