Three packages, depending on the stage a firm is at. Scope and price are agreed after a short call
For companies preparing for a DFSA licence
For licensed firms not sure everything is under control
For firms that need independent proof the controls work
The same five steps for every package, so you always know what happens next
20–30 minutes on regulator, package and timeline
A short look at the infrastructure and processes
We agree the depth of the work
Scoping, statement of work, work plan
Evidence repository set up, work starts
Out of scope unless separately agreed: implementation and administration of controls, procurement, legal policy drafting, and remediation work itself
Every engagement is led by our Head of Compliance — she reads the DFSA rulebook so you don't have to, and publishes plain-language breakdowns of every rule change.
The DFSA rulebook (GEN 5.5) requires a documented cyber risk framework: managed risks, tested controls and incident reporting. "We have an IT guy" does not satisfy it.
The DFSA cyber self-assessment questionnaire is scored. Incomplete or inconsistent answers are a red flag — and a common path to a full thematic audit of your firm.
An audit finding means remediation on the regulator’s clock, follow-up reviews and, for repeat issues, fines. Year-round evidence is far cheaper than a scramble.
Persistent IT compliance failures put the licence itself at risk — and clients, banks and partners increasingly ask for proof of your security posture.
Download the DFSA IT compliance checklist — the same one we use in our assessments. We'll email it to you.
The DFSA keeps tightening IT rules because attacks on UAE firms keep growing. We map your systems to what the regulator publishes, so there is no guesswork about what "good" looks like.
Sources: UAE Cyber Security Council; UAE cyber reports, 2024
We audit your IT against DFSA rules and show exactly where you stand.
IT policies, risk registers and procedures written to DFSA expectations.
Access control, encryption, backup and endpoint protection — implemented, not just described.
Security awareness training for your people — phishing, data handling, incident response — with audit-ready completion records.
Evidence collected year-round and an expert beside you when the auditor arrives.
A named security officer who owns your compliance calendar and reports to your board.
“Her ability to explain complex technical issues in simple terms was greatly appreciated by our team, who are not all IT-savvy… Their responsiveness, attention to detail, and the seamless way they handle IT issues makes them a reliable and trustworthy partner for any business.”
Practical guides on DFSA and ADGM rules, audits and evidence
What the regulator actually checks in the questionnaire, and how to have the answers documented before it lands.
Read moreThe controls and evidence a licensed firm is expected to have in place, in plain language.
Read moreSix months after the deadline: who owns the cyber risk framework, what gets tested, and what still goes unreported.
Read moreYes — we also run FSRA (ADGM) compliance and UAE-wide requirements such as PDPL. This page covers our DFSA service; ask us about the rest.
Depends on the gaps. A typical firm goes from assessment to audit-ready in 8–12 weeks. The assessment itself takes about two weeks.
Yes. We can run compliance alongside your current provider, or co-manage. Many clients start this way.
We prepare the evidence pack, join the sessions where you want us, and answer the technical questions. You are never alone in the room.
A fixed monthly fee scoped to your licence type and headcount, agreed after the free assessment. No surprise invoices.
We work to ISO 27001-aligned processes: least-privilege access, encrypted backups, full audit logging. NDA before we see anything sensitive.
Leave your details and a compliance expert calls you back within one business day. Or call us now.
Contact us now – our team is ready to assist you!
