DFSA Category 3C licence: a comprehensive guide to requirements, obligations, and compliance

Important disclaimer. This article is a general overview of the DFSA framework for Category 3C. We could not read the current DFSA Rulebook text directly when we updated it, so figures and rule numbers that we could not confirm have been removed or flagged. All regulatory references, capital requirements, and compliance obligations are subject to change. Always consult the most current version of the DFSA Rulebook and seek professional advice before making any decisions regarding DFSA licensing or compliance matters.

The Dubai Financial Services Authority (DFSA) is the independent regulator of financial services conducted in or from the Dubai International Financial Centre (DIFC), employing a risk-based approach that categorises firms based on the nature and complexity of their activities.

Category 3C is a specific authorisation class within the DFSA's prudential framework, designed for firms providing certain financial services with risk profiles that warrant a distinct regulatory approach. This guide is written for MLROs and Compliance Officers who need to understand the regulatory requirements and compliance obligations associated with this licence category.

Regulatory framework

The DFSA's framework for Category 3C firms is established across four Rulebook modules. The General Module (GEN) defines financial service activities and the overall authorisation framework. The Prudential Investment, Insurance Intermediation and Banking Module (PIB) establishes prudential requirements including capital adequacy. The Conduct of Business Module (COB) sets standards of conduct for financial services activities. The AML Module specifies AML/CTF requirements.

Under Section 1.3 of PIB, an Authorised Firm is in Category 3C if its licence authorises one or more of: Managing Assets; Managing a Collective Investment Fund; Providing Custody (other than for a Fund and other than in relation to Crypto Assets); Managing a PSIA which is a PSIAr (a restricted Profit Sharing Investment Account); Providing Trust Services (where acting as trustee in respect of at least one express trust); or Providing Money Services (where it issues Stored Value); and it does not meet the criteria of Categories 1, 2, 3A, 3B, or 5.

Scope of activities

A Category 3C firm may carry out the six activities listed above. It may also be authorised to conduct Category 4 activities (such as Arranging Deals in Investments or Advising on Financial Products), but it cannot provide Financial Services in Categories 1, 2, 3A, or 3B. It is the authorisation for the Category 3C-specific activities, together with the absence of authorisation for 3A and 3B activities, that determines whether a firm belongs to Category 3C.

Capital requirements

Category 3C firms must hold Capital Resources that meet the Capital Requirement set in PIB. The requirement draws on the Base Capital Requirement (the amount of permanent share capital that must be maintained) and, for some firms, the Expenditure Based Capital Minimum (EBCM) (a calculation based on the firm's operating expenses). The DFSA changed the PIB capital and insurance rules with effect from 1 July 2025 and 1 July 2026, so we do not give figures here. Confirm the current figures and calculation methods against the current Rulebook.

Depending on the firm's category and activities, PIB may also require risk capital covering credit, market and operational risk, and liquidity resources to meet liabilities as they fall due. The revised PIB that applies from 1 July 2026 changed several of these requirements for the lower prudential categories, so check which ones apply to your licence in the current Rulebook.

Compliance obligations

AML/CTF requirements

Category 3C firms must comply with the requirements set out in the DFSA's AML Module, which cover: appointment of an MLRO; development and implementation of AML policies, procedures, systems, and controls; customer due diligence; enhanced due diligence for higher-risk customers; ongoing monitoring of customer relationships; suspicious activity reporting; AML training for employees; and record-keeping. The AML Module sets requirements for the MLRO on residence, seniority, independence and access to all business lines and support functions. Confirm the current text, including any residence requirement, before you appoint an MLRO.

Client classification

Under the COB Module, firms must classify clients as Retail Clients, Professional Clients (Service-based or Assessed), or Market Counterparties. This classification determines the level of regulatory protection and the corresponding obligations on the firm. Professional Client classification requires meeting specific net asset thresholds or knowledge and experience criteria as outlined in the COB Module, and must be reviewed regularly.

Record-keeping obligations

The GEN Module sets out detailed record-keeping requirements. Firms must maintain records for the period specified in the Rulebook, covering all business transactions, client identification and classification documentation, client agreements and instructions, financial instruments held for clients, compliance reviews and audits, staff training records, and communications with clients.

Reporting requirements

Category 3C firms must submit to the DFSA: prudential returns, an AML return, quarterly regulatory returns, notifications of material events, and annual financial statements.

Governance requirements

The DFSA expects an Authorised Firm to have a governing body with appropriate expertise and to fill key roles, usually a Senior Executive Officer (SEO) responsible for day-to-day operations, a Finance Officer (FO) responsible for financial affairs, a Compliance Officer (CO) responsible for compliance matters and a Money Laundering Reporting Officer (MLRO) responsible for AML/CTF compliance. Someone must also be responsible for risk management. The exact list of Licensed Functions and required roles depends on the firm, so confirm it in the GEN Module. Some functions may be outsourced under the DFSA's outsourcing requirements, but the firm remains responsible for compliance.

The GEN Module sets requirements for a Compliance Function to monitor compliance with applicable laws and for systems and controls that identify, monitor and control risks. A firm should also consider whether it needs an Internal Audit Function to examine the adequacy and effectiveness of those controls, given its size and activities. Control functions should be independent of operational functions and have sufficient authority, resources, and access to the Board. Confirm the exact requirements against GEN.

All individuals performing Licensed Functions must satisfy the DFSA's fit-and-proper criteria: integrity, competence and capability, and financial soundness.

Application process

The application involves several stages. An Initial Assessment confirms that Category 3C is the appropriate licence class for the intended activities, followed by a Pre-application meeting with the DFSA to discuss the application. Documentation preparation covers a Regulatory Business Plan, financial model and projections, policies and procedures, and application forms. Following Formal Application Submission, the DFSA reviews the application and conducts interviews with proposed senior management. If satisfied, the DFSA grants In-principle Approval. The firm then establishes a physical presence in the DIFC and implements systems and controls. Final Approval and licence grant follows confirmation of operational readiness and capital deposit.

Required documentation typically includes: Regulatory Business Plan; financial projections; AML/CTF policies and procedures; compliance manual; risk management framework; personal questionnaires for Controllers and proposed Authorised Individuals; corporate structure diagrams; and evidence of capital.

Ongoing obligations

Firms must submit regular reports to the DFSA (prudential returns, annual audited financials, annual AML return, reports on material changes) and notify the DFSA of specified events under the GEN Module, including changes to Controllers or Authorised Individuals, breaches of Rules, significant business changes, and matters that could materially affect the firm's reputation or financial position. Annual fees are payable as specified in the Fees Module (FER), based on authorised activities. Firms must conduct regular compliance reviews including review of AML systems and controls, periodic review of conduct of business rules compliance, independent audit of financial statements, and periodic capital adequacy assessment.

Comparison with other licence categories

Category 3C vs. Category 3B: Category 3B focuses on Providing Custody for a Fund or of Crypto Assets, acting as Trustee of a Fund, and operating or administering an Employee Money Purchase Scheme. Category 3C focuses on asset management, fund management, non-crypto/non-fund custody, restricted PSIAs, express trust services, and stored-value money services.

Category 3C vs. Category 3A: Category 3A focuses on Dealing in Investments as Principal (matched principal only) or as Agent. Category 3C has no dealing authorisation but focuses on asset management, custody, and trust services as described above.

Category 3C vs. Category 4: Category 4 is limited to arranging and advisory activities: Arranging Deals in Investments, Advising on Financial Products, Arranging Custody, Insurance Intermediation, Insurance Management, and similar. Category 3C involves more direct management of assets and provision of services carrying greater responsibility for client assets.

Common compliance pitfalls

• Misunderstanding permissions. Confusion about what activities are permitted under Category 3C versus other categories, particularly the boundary with 3B (crypto/fund custody) and 3A (dealing).
• Inadequate capital planning. Not accounting for future business growth in capital projections or failing to monitor continuously against the Capital Requirement.
• Inadequate client asset segregation. Failure to properly segregate client assets from firm assets. The DFSA expects client assets to be protected, so test segregation regularly.
• Insufficient documentation. Particularly around client classification and suitability assessments, and around the commercial rationale for complex ownership or fund structures.
• Inadequate governance arrangements. Especially around control function independence: audit, compliance, and risk functions must be demonstrably independent from operational lines.
• Delayed notifications. Failing to notify the DFSA of material events, controller changes, or breaches in a timely manner is a standalone compliance failure.

Best practice for MLROs. Implement a risk-based approach to AML/CTF that reflects the specific risks of Category 3C activities, since asset managers, custodians, and trust service providers have distinct exposure profiles. Conduct regular independent testing of your AML/CTF framework and keep up with DFSA notices and AML updates. Maintain a regulatory calendar, monitor capital regularly, and review client-classification procedures periodically.

When you prepare a Category 3C application, get custody arrangements, client asset protection and governance right first. ComplyFactor provides AML advisory, outsourced MLRO services, and independent AML review for regulated entities across multiple jurisdictions, including UAE-authorised firms.