Senior Managers / Governance in United Arab Emirates

Key dates

2026-10-23

ADGM’s Registration Authority announced the enforcement action and the total USD 88,000 penalties against MCA Auditors and its registered Audit Principal.

Suggested considerations

• Registered audit firms should consider performing a documented file-by-file review of risk assessments, fraud-risk responses, group-audit instructions and evaluations, communications with those charged with governance, and sufficient appropriate audit evidence for material balances and disclosures.
• Registered Audit Principals should consider documenting substantive involvement at planning, risk assessment, supervision, review, consultation, resolution of significant matters and completion stages, rather than relying on evidence of a final sign-off alone.
• Firms should consider mapping each engagement to the applicable requirements in the Companies Regulations (Auditors) Rules 2023 and the relevant International Standards on Auditing, with evidence of review and clearance of identified deficiencies.
• Audit firms should consider maintaining a formal root-cause analysis, remediation plan, ownership allocation, target dates and effectiveness testing process so that remediation can be demonstrated during a subsequent RA inspection.
• Audit committees and other those charged with governance at ADGM-registered entities should consider challenging the auditor on fraud risks, group-audit scope, significant judgments, material evidence and the registered principal’s oversight before approving or relying on the audit.
• ADGM audit firms should consider preparing for continued RA monitoring and inspections, including ensuring that working papers and governance communications are complete, contemporaneous, retrievable and internally consistent.

What changed

This is an enforcement action rather than a new rule or amendment. It applies the Companies Regulations (Auditors) Rules 2023, including the obligations for Registered Auditors and Registered Audit Principals to conduct audit work in accordance with applicable technical and professional standards, including International Standards on Auditing, and to exercise due skill, care and diligence. The action signals that ADGM inspections will assess the complete audit evidence trail and the registered principal’s documented involvement across the engagement, not merely the final audit opinion.

Key dates

2026-10-28

ADGM published the Guidance on Crypto Mining Activities in and from ADGM under section 23 of the Commercial Licensing Regulations 2025.

Suggested considerations

• Firms considering establishment or continued operation in ADGM should perform the RA pre-application self-assessment and document why their activities fall within commercial mining rather than an FSRA-regulated financial service.
• Operators should assess whether they require or should apply for the dedicated commercial licence associated with activity code 7230 and should avoid representing the licence as an authorisation to conduct regulated financial services.
• Compliance teams may wish to prepare an up-to-date corporate structure and ultimate-beneficial-owner information for RA review, together with governance documentation proportionate to the scale and risk of the operation.
• Operators should identify all blockchain addresses used to receive mining rewards and establish controlled procedures for making the required confidential on-chain address disclosures to the RA.
• ADGM-headquartered groups should map global mining activities, reporting lines, outsourced infrastructure, jurisdictional controls and board oversight so that the ADGM entity can demonstrate reasonable supervision of overseas operations.
• Firms should review whether staking, validator, custody, brokerage, token issuance, investment management or other associated activities separately require FSRA permission or create an additional regulatory perimeter.
• Operators may wish to monitor the RA’s forthcoming consultation on the second-phase regulatory framework and preserve records supporting their current perimeter analysis, licensing basis, governance and operational-risk controls.
• Firms should consider the practical implications identified in independent commentary, including operational resilience, cybersecurity, infrastructure security, energy management, transparent service terms and any applicable UAE federal tax, accounting and AML/CFT requirements, without treating those commentary points as additional requirements expressly created by this publication.

What changed

Commercial crypto mining conducted in or from ADGM is associated with dedicated RA commercial activity code 7230 and requires the applicable commercial licensing pathway. The Guidance is technology-neutral and covers Proof-of-Work, Proof-of-Stake and future consensus mechanisms. It establishes a pre-application self-assessment to help applicants distinguish mining from FSRA-regulated financial activities, and highlights expectations concerning corporate structure, ultimate beneficial ownership, and confidential disclosure of on-chain addresses used for reward flows.

Key dates

2012-12-31

MISMEL was licensed by the DFSA as a credit rating agency.

2023-12-01

Beginning of the period during which MISMEL reported seven inadvertent data-disclosure incidents to the DFSA; the source specifies December 2023 but not an exact day.

2026-05-31

End of the incident period described by the DFSA; the source specifies May 2026 but not an exact day.

2026-10-28

The DFSA announced the enforcement action and USD 585,825 penalty against MISMEL.

Suggested considerations

• Credit rating agencies should consider mapping confidential-information flows, permitted uses, recipients and disclosure exceptions against DFSA COB 8.9.1 and COB 8.9.2.
• Compliance and technology teams may wish to test email, endpoint, access-control, data-loss-prevention and external-recipient controls using realistic scenarios involving inadvertent disclosures.
• Firms should consider documenting compensating controls and an approved replacement before disabling or materially changing any security tool, with formal risk acceptance where continuity cannot be achieved.
• Control owners may wish to review incident detection, escalation, investigation and regulatory-notification processes, including whether repeated near misses are aggregated and reported to senior management and the DFSA where applicable.
• Senior management and compliance teams should consider reviewing employee training, attestations, supervision and disciplinary arrangements so that confidentiality obligations are demonstrably enforced and not merely documented.
• Credit rating agencies may wish to retain sufficient records and audit trails to evidence the operation and testing of confidentiality controls, noting the DFSA Rulebook requirement to maintain relevant records for at least six years.
• Firms outside the credit-rating sector should consider the enforcement action as an indicator of DFSA expectations for proportionate data-confidentiality governance, although the cited COB 8.9 requirements specifically apply to credit rating agencies.

What changed

This is an enforcement action rather than a new rule or prospective regulatory amendment. The DFSA found that MISMEL failed to implement and maintain adequate systems and controls to safeguard confidential information and failed to ensure that employees did not disclose it. The relevant DFSA framework requires a credit rating agency to maintain policies, procedures and controls preventing use of confidential information for unauthorised purposes and disclosure to other persons, subject to limited exceptions such as prior written consent or a legal obligation; COB 8.9.1 also addresses pending...

Key dates

2026-10-09

ADGM's Registration Authority published the enforcement action and announced total penalties of USD 100,000 against PKF and its registered audit principal.

Suggested considerations

• Compliance teams at ADGM-registered audit firms should consider performing a documented review of current audit files against the applicable ISA requirements, with particular attention to fraud-risk assessment, audit evidence, audit documentation and the basis for audit conclusions.
• Registered audit principals should consider ensuring that their involvement, review work, judgments and approval of audit reports are clearly evidenced in the engagement file rather than relying on undocumented supervision.
• Audit firms should consider reviewing engagement acceptance, staffing, supervision, consultation, quality-control and file-completion processes to determine whether they support the required standard of due skill, care and diligence.
• Firms should consider conducting a targeted look-back across comparable ADGM engagements and retaining evidence of any remediation, especially where the same audit principal, methodology or documentation weaknesses may recur.
• ADGM entities and their boards or audit committees should consider confirming that their appointed auditor is appropriately registered and that significant audit judgments, fraud-risk procedures and evidence supporting the audit opinion are adequately documented.
• Senior management and professional-indemnity stakeholders should consider the possibility of separate financial and reputational consequences for the audit firm and the responsible registered audit principal.

What changed

This publication does not introduce a new rule or compliance deadline; it applies existing requirements under the Companies Regulations (Auditors) Rules 2023 to a specific audit engagement. The RA imposed USD 65,000 on PKF and USD 35,000 on its registered audit principal, demonstrating that enforcement exposure can attach separately to both the audit firm and the responsible individual.

Key dates

2026-10-01

ADGM published Consultation Paper No. 4 of 2026 proposing the Strata Regulations 2026.

2026-10-22 Deadline

Public consultation closes; comments should be submitted through the ADGM Registration Authority Consultation Portal by this date.

Suggested considerations

• Compliance and legal teams may wish to review the proposed Strata Regulations 2026 and Model Articles against existing strata governance, management agreements, building management statements and developer rights.
• Developers may wish to assess the proposed single Registrar approval process, required disclosure statement and strata management statement, staged-development arrangements, bank-guarantee exposure and six-month handover obligations.
• Existing strata developments may wish to map the likely automatic establishment of an Association when the Regulations commence, including legal-entity, contracting, banking, governance and record-keeping implications.
• Property-management businesses may wish to assess whether they hold, or can obtain, the required ADGM licence to act as an Association Manager and whether their service model supports competitive quotations and Registrar-approved budgets.
• Associations and developers may wish to model general-fund and reserve-fund requirements, including the three-year minimum reserve-fund study cycle, annual reserve forecast and restrictions on reserve-fund expenditure.
• Relevant stakeholders may wish to review defect-reporting, remediation, structural-integrity and Registrar-notification processes and identify evidence, escalation and document-retention controls.
• Developers, owners and advisers may wish to submit comments through the ADGM Registration Authority Consultation Portal by 22 October 2026; comments sent only to the consultation email address may not be considered.
• Firms should avoid treating the proposals as operative requirements because ADGM states that stakeholders should not act on them until the Regulations are enacted and published.

What changed

The proposed regime would replace the existing two-step strata-plan approval process with a single process administered by the Registrar. Developers would submit a proposed strata plan, disclosure statement and strata management statement; the Registrar could approve, condition, defer, request amendments to, or reject the application, and could defer registration until construction completion and required folios or subdivisions were established.

Key dates

2026-11-30 Deadline

Consultation period for ADGM FSRA Consultation Paper No. 5 of 2026 closes; comments may be submitted to [email protected].

Suggested considerations

• Compliance teams may wish to review the proposed Guidance and submit written comments to [email protected] by 2026-11-30, particularly on operational feasibility, proportionality and the treatment of permissionless protocols.
• Firms should consider inventorying current and planned DeFi activity, including protocol use, liquidity provision, staking, lending, borrowing, decentralised exchange activity, smart-contract interaction and client-facing exposure.
• Firms should consider mapping each DeFi activity to existing ADGM permissions and identifying activities that may require a variation of permission, additional controls or discontinuation.
• Risk and compliance functions may wish to assess whether existing governance arrangements clearly assign senior accountability for DeFi, approve protocols and counterparties, set exposure limits and address conflicts of interest.
• Firms should consider enhancing due diligence for protocol code, governance structures, upgrade and administrative privileges, oracle dependencies, bridge and composability risks, concentration, liquidity, sanctions exposure and the availability of legal recourse.
• AML and financial-crime teams may wish to assess transaction-monitoring, wallet-screening, sanctions-screening, blockchain analytics, travel-rule and suspicious-activity escalation controls for DeFi-related activity, taking account of limited visibility into beneficial ownership and counterparties.
• Operations and technology teams should consider whether incident-management procedures cover smart-contract exploits, oracle failures, governance attacks, de-pegging, bridge compromise, protocol insolvency, loss of access and material service disruption.
• Client-asset teams should review segregation, custody, ownership, valuation, reconciliation and disclosure arrangements where client assets interact with DeFi protocols or are exposed to protocol failure.

What changed

The proposed Guidance sets supervisory expectations for identifying, assessing, monitoring and managing risks arising from engagement with DeFi protocols and venues. It covers governance and accountability, risk assessments, due diligence, exposure and control measures, ongoing monitoring, financial-crime controls, incident escalation, recordkeeping, auditability, competence and client-asset safeguards. The proposal is guidance under consultation and does not itself introduce binding new rules at this stage.

Key dates

2026-10-02

The prudential reporting amendments, including the redesigned Form B110 framework, came into force.

2027-01-01

The amended credit rating agency requirements come into force.

Suggested considerations

• Credit rating agencies should map existing conflicts-of-interest policies, relationship assessments and escalation controls against the new principles-based requirements before 2027-01-01.
• Credit rating agencies should review rating-announcement templates, annual disclosures and website disclosures to identify content that can be removed or consolidated, while retaining enough information for users to understand how each rating was determined.
• Credit rating agencies should document how they will identify relationships that may reasonably be perceived as conflicts, not only relationships that create an actual conflict.
• All authorised firms should review the redesigned Form B110 and its applicable data items, reporting frequency and submission instructions, including data previously maintained for Forms B180 and B120.
• Compliance and regulatory-reporting teams should reconcile the first B110 submission against prior B120 and B180 returns and update reporting ownership, source-system mappings, validation controls and governance records.
• Firms should confirm whether any firm-specific DFSA direction or prudential-category exception affects the B110 data items they must submit.
• Firms should retain evidence of implementation, including amended procedures, reporting mappings, control testing and approvals, in case the DFSA reviews the transition.

What changed

For credit rating agencies, the DFSA will assess relationships that may cause, or may reasonably be perceived as causing, a conflict of interest under a more principles-based framework rather than through unnecessarily prescriptive requirements. The amendments remove duplicative or overly detailed disclosure obligations while retaining the overarching requirement to provide sufficient information for users to understand how a credit rating was determined.