DFSA

DFSA Controllers and Changes in Control Explained

2026-03-18 · 6 min read · By Aureus Worldwide

DFSA controllers and changes in control rules determine who is allowed to own and influence an Authorised Firm in the Dubai International Financial Centre (DIFC), and when the regulator's approval is needed before ownership changes. The Dubai Financial Services Authority (DFSA) treats the people behind a firm as seriously as the firm itself, because unsuitable owners can undermine even a well-run business. This guide explains who counts as a controller, the thresholds that trigger the regime, and the approval and notification duties that apply when control changes.

What the DFSA means by a "Controller"

A Controller is not simply the largest shareholder. Under the DFSA's General (GEN) module, a person is generally a Controller of an Authorised Firm if, alone or acting with associates, they:

• hold 10 per cent or more of the shares in the firm or its holding company; or
• are entitled to exercise, or control the exercise of, 10 per cent or more of the voting rights; or
• are able to exercise significant influence over the management of the firm through their shareholding or voting power.

Two points often surprise applicants. First, the test captures indirect control: a person who controls a parent company that owns the Authorised Firm is a controller of the firm too, however many layers sit in between. Second, the concept of associates means holdings are aggregated, family members, connected companies and parties acting in concert are counted together, so control cannot be diluted simply by splitting a stake across related names.

Control thresholds and bands

The regime is built around graduated thresholds rather than a single line. The 10 per cent level is where a person first becomes a Controller and comes within the regime. Beyond that, the DFSA expects to be told as control rises or falls through further bands, commonly framed around 20, 30 and 50 per cent, because a person moving from a minority stake to a controlling or majority position changes the firm's risk profile. Passing the 50 per cent mark, for instance, gives outright control and attracts the closest scrutiny.

Because the exact bands and the precise triggers for approval versus notification are set out in the Rulebook and can be updated, firms and prospective investors should confirm the current thresholds in the GEN module rather than relying on memory. The principle, however, is stable: the more control you acquire, the more the DFSA wants to know and approve.

Approval before the change, not after

The defining feature of the regime is timing. A person who proposes to become a Controller, or to increase their control across a relevant threshold, must generally obtain the DFSA's prior approval or non-objection before the transaction takes effect. This is not a formality to be completed after signing, it is a condition of the change being permitted at all.

In practice this means a share sale, a new investor coming onto the register, or an internal group reorganisation that shifts ownership must be planned around the DFSA's assessment window. The firm and the proposed controller both provide information, and the deal timetable has to accommodate the regulator's review. Founders raising capital, private-equity buyers and groups restructuring their holdings all need to build this approval step into the deal from the outset, because completing first and asking later is a breach.

The mirror image also matters: a Controller reducing or ceasing control, or the firm acquiring a new controller through any route, are events the DFSA expects to be notified about.

The fit-and-proper test for controllers

When it assesses a proposed controller, the DFSA applies the same underlying question it applies to a firm and its Authorised Individuals: are these people fit and proper to be connected with a regulated firm? The assessment typically weighs:

• Integrity and reputation, the controller's honesty, regulatory history and any adverse findings.
• Financial soundness, whether the controller is financially stable and the source of the funds being invested is legitimate and transparent.
• Influence on the firm, how the controller intends to exercise its influence, and whether that supports sound and prudent management.
• Group structure and transparency, whether the wider ownership chain, including ultimate beneficial owners, is clear and lawful.

The source-of-funds and beneficial-ownership dimension links closely to the firm's AML and CTF programme: the regulator wants to know that money entering a regulated firm is clean and that the ultimate owners are identifiable. Opaque structures designed to hide who is really in control are a red flag rather than a neutral fact.

What the firm must do: notifications and record-keeping

The obligations do not fall on incoming investors alone. The Authorised Firm itself must:

1. Notify the DFSA of changes in its controllers, in line with the Rulebook's triggers and timeframes.
2. Maintain accurate records of its ownership and control, so it can identify its controllers and their holdings at any time.
3. Confirm its controllers as part of ongoing reporting, keeping the regulator's picture current.
4. Cooperate with the assessment of any proposed controller, providing the information the DFSA needs.

Keeping a single, reliable view of ownership is not just a controllers-regime task, it feeds beneficial-ownership records, AML due diligence and the firm's wider senior-management and governance arrangements. Firms that track ownership continuously find these notifications straightforward; those that reconstruct it under pressure often discover gaps.

Indirect control, groups and beneficial ownership

Group-owned firms deserve particular care. Because control is assessed up the chain, a change several levels above the Authorised Firm, a shareholder selling out of the ultimate parent, or a fund reaching the end of its life and transferring its stake, can be a change in control of the DIFC firm even though nothing changes at the firm's own register. Multinational groups reorganising their holdings sometimes overlook this and trigger an unapproved change without intending to.

The safest approach is to treat the DFSA's definition of control as reaching all the way to the ultimate beneficial owners, and to test any corporate action anywhere in the chain against it. Where the group structure is complex, mapping it clearly, and keeping that map current, is the foundation for getting controllers notifications right and for satisfying the parallel beneficial-ownership rules that apply to UAE entities.

Consequences of getting it wrong

Acquiring or increasing control without the required approval is a contravention, not a paperwork slip. The DFSA has a range of powers to respond, including:

• Objecting to a person being or becoming a controller.
• Imposing conditions on the way control may be exercised.
• Requiring the disposal of shares, or restricting the voting rights attached to them, so that improperly acquired control cannot be exercised.
• Taking enforcement action against the firm or the individuals involved.

Beyond the formal sanctions, an unapproved change in control can stall a transaction, unsettle banking relationships and damage the firm's standing with its regulator. Building the approval step into any ownership change, and taking regulatory advice early, is far cheaper than unwinding a completed deal.

How Aureus Worldwide can help

Aureus Worldwide is a Dubai-based accounting, tax and compliance-advisory firm. We are not DFSA-authorised and we do not submit controllers applications or give legal advice on a change in control, those are matters for your DFSA regulatory and legal advisers. Where we help is the supporting substance: mapping and documenting group ownership and ultimate beneficial owners through our UBO consulting service, preparing the financial information that underpins a source-of-funds review, and providing audit-ready accounting and compliance officer support, coordinated with your DIFC and ADGM advisers. To get your ownership records and financial reporting ready for a change in control, contact our team.

Talk to our chartered accountants →