DFSA

DFSA Money Services and Payment Firms Explained

2026-06-04 · 7 min read · By Aureus Worldwide

DFSA money services and payment firms operate under the Providing Money Services permission, the regulated activity that allows a firm to run payment accounts, move money and issue stored value in or from the Dubai International Financial Centre (DIFC). As payments, e-money and fintech have grown, the Dubai Financial Services Authority (DFSA) has built out a dedicated regime so that a DFSA money services business is properly capitalised, safeguards its users' funds and treats them fairly. This guide explains what the permission covers, the prudential category that applies, the safeguarding rules and how the regime connects to digital assets.

What "Providing Money Services" covers

Providing Money Services is one of the Financial Services listed in the DFSA's General (GEN) module, and it is deliberately broad. In practice it captures the building blocks of a modern payments business, including:

• Operating a payment account, an account held for a user to place, hold and move funds.
• Executing payment transactions, transfers, direct debits, standing orders and card-based payments.
• Issuing payment instruments, cards or other means a user relies on to initiate payments.
• Acquiring payment transactions, enabling merchants to accept and be paid for transactions.
• Money remittance, sending and receiving money without a payment account in the traditional sense.
• Issuing stored value, issuing electronic money or a prepaid balance a user can spend.

Because these activities are on the regulated list, carrying them on by way of business in or from the DIFC requires a licence. As with every regulated activity, the boundary matters: our guide to regulated financial services activities explains how the "by way of business" test and the exclusions work, and getting the classification right is the first step before applying for DFSA authorisation.

Payment services versus stored value

It helps to separate two ideas that often sit inside a single firm. Payment services are about moving money on behalf of users, initiating and executing transactions between payers and payees. Stored value (electronic money) is about holding value that a user has pre-funded, which they can later spend or redeem. Many firms do both: they issue an e-money balance and provide the payment rails to spend it.

The distinction matters because holding pre-funded balances increases the firm's responsibility for user funds. A firm that merely routes a transaction touches the money briefly; a firm that issues stored value holds it, sometimes for extended periods, and the safeguarding and prudential regime responds accordingly.

The prudential category and capital

Providing Money Services generally falls into prudential Category 3D under the DFSA's Prudential, Investment, Insurance Intermediation and Banking (PIB) module. Category 3D was introduced to accommodate payment and stored-value businesses, and it sits within the same overall framework explained in our guide to DFSA prudential categories.

Two capital ideas apply, and a firm must hold the higher of them:

1. A base capital requirement for the category, set in the PIB module.
2. An expenditure-based capital minimum, a set fraction of the firm's annual expenditure, so the firm always holds enough to wind down in an orderly way.

For a young payments firm the expenditure-based minimum often bites hardest, because operating costs run ahead of the fixed base. Because the DFSA updates its Rulebook, the sensible course is to model both measures against your business plan and confirm the current figures rather than relying on a fixed number. Continuous capital monitoring, not a quarter-end snapshot, is expected, with prompt notification to the DFSA if the requirement is at risk.

Safeguarding: protecting users' money

The single most important conduct feature of the money services regime is safeguarding. Money that a firm receives from users in connection with payment services or stored value is not the firm's own money, and it must be protected so that users are not exposed if the firm fails. In broad terms, safeguarding is achieved by:

• Segregating user funds from the firm's own funds, typically in a designated safeguarding account with a bank; or
• Covering the funds with an equivalent protection, such as an insurance policy or a guarantee that pays out to users if the firm cannot.

Alongside segregation, firms are expected to reconcile safeguarded balances regularly, keep clear records of how much is owed to each user, and have controls that prevent user money being mixed with, or used as, working capital. This discipline is where reliable, audit-ready accounting stops being a back-office nicety and becomes a core regulatory control, the safeguarding calculation is only as trustworthy as the ledger behind it.

Conduct and disclosure to payment users

Payment firms deal with users who need clarity and protection, so the regime layers conduct obligations on top of prudential ones. A DFSA money services business is generally expected to:

• Give users clear information about the service, charges, exchange rates and timeframes before and after a transaction.
• Execute transactions within expected timeframes and handle errors and unauthorised transactions fairly.
• Handle complaints properly and maintain adequate systems and controls for the volume and type of payments processed.
• Guard against fraud and operational failure, given how central reliable systems are to a payments business.

These duties flex with the firm's client base. A firm serving consumers or smaller businesses will face more protective expectations than one dealing only with sophisticated counterparties, a theme explored in our guide to professional versus retail client classification.

Where money services meets crypto

Payments and digital assets increasingly overlap, and the DFSA's regimes are designed to meet at the edges. A Fiat Crypto Token, a token that references a single fiat currency and aims to hold a stable value, in other words a fiat-backed stablecoin, is regulated under the DFSA crypto token regime. But where such a token is used as a means of payment, the money services regime can apply as well.

The practical consequence is that a payment-focused token business often needs more than one permission: a crypto-related activity permission plus a Providing Money Services permission, with the safeguarding and conduct duties attached. Firms building stablecoin or tokenised-payment products should map their model against both regimes from the start, rather than assuming a single licence covers the whole business.

AML: a heightened obligation for payments

Payment and remittance businesses handle exactly the kind of fast, cross-border flows that financial-crime controls are designed to catch, so anti-money-laundering compliance is not an add-on, it is central. A money services firm must run a risk-based programme with customer due diligence, transaction monitoring, sanctions screening and suspicious-activity reporting, as set out in our guide to DFSA AML and CTF obligations. The speed and volume of payments make strong transaction monitoring and a capable Money Laundering Reporting Officer especially important; regulators pay close attention to this sector precisely because of its exposure.

A readiness checklist for payment firms

Before applying, a prospective DFSA money services business should be able to show:

• A clear map of which money services activities it will carry on, and confirmation that no others creep in.
• A capital plan modelling both the base and expenditure-based requirements, with headroom.
• A safeguarding design, where user money will sit, how it will be segregated and reconciled, and who controls it.
• A systems and controls framework proportionate to payment volumes, including fraud and operational-resilience measures.
• A risk-based AML programme with a resident MLRO and goAML readiness.
• Robust, audit-ready accounting so that capital and safeguarding calculations are defensible at any time.

How Aureus Worldwide can help

Aureus Worldwide is a Dubai-based accounting, tax, CFO and compliance-advisory firm. We are not DFSA-authorised, we do not provide regulated money or payment services, and we do not act as your DFSA-approved functions, those roles sit within your licensed firm. What we provide is the financial backbone a payment firm needs: audit-ready accounting and safeguarding reconciliations, the capital and expenditure models behind your prudential planning, outsourced CFO support, and AML documentation help through our AML consulting team, all coordinated with your appointed auditor and your DIFC and ADGM advisers. To build the finance and safeguarding foundation for a DIFC payments business, contact our team.

Talk to our chartered accountants →