TRW & Co · Banking, Finance & Capital Markets
ADGM Financial Regulation
ADGM financial regulation governs banks, fund managers, brokers, custodians, fintech and virtual asset firms in Abu Dhabi's international financial centre. The FSRA authorises firms under the FSMR and its rulebooks, and 2026 brought new fund manager regimes, AML enhancements and a cyber framework. This guide covers licensing, ongoing duties and the onshore boundary.
Key pointAn FSRA permission authorises activity in and from ADGM, not onshore: firms that market to or serve onshore UAE clients may also need the Capital Market Authority (CMA, formerly the SCA) or the Central Bank, whose 2025 law widened the onshore perimeter.
At a glance
FSRA under the FSMR
The Financial Services Regulatory Authority authorises and supervises firms under the Financial Services and Markets Regulations 2015 and its GEN, COBS, PRU, FUNDS and AML rulebooks.
IPA then FSP
Applicants receive an In-Principle Approval with conditions, then incorporate, capitalise and staff the firm before the Financial Services Permission is granted.
2026 fund manager reforms
September 2026 rules created Sub-Threshold and Institutional Fund Manager regimes; existing foreign fund managers have until 31 March 2027 to comply.
24-hour cyber notices
The FSRA Cyber Risk Management Framework, effective 31 January 2026, requires material cyber incidents to be notified within 24 hours.
Common-law courts
English common law applies directly in ADGM, and disputes are heard by the ADGM Courts, separate from the onshore Abu Dhabi courts.
Swipe or scroll →
What ADGM financial regulation covers
ADGM financial regulation is the licensing, conduct, prudential and anti-money laundering regime that applies to financial services carried on in or from the Abu Dhabi Global Market, the international financial centre on Al Maryah and Al Reem Islands. It is administered by the Financial Services Regulatory Authority (FSRA) under the Financial Services and Markets Regulations 2015 (FSMR) and the FSRA's rulebooks, and it sits outside the UAE's federal financial regulation for most purposes.
The regime covers banks, asset and fund managers, brokers and dealers, custodians, insurers and intermediaries, market operators, payment and fintech firms, and virtual asset businesses. Its design follows international models, particularly the UK's, and disputes are heard by the ADGM Courts applying English common law. For founders and institutions, that combination of a recognisable rulebook and common-law courts is the main attraction.
The question becomes legal as soon as a business plans to carry on a regulated activity in ADGM, whether managing a fund, holding client assets, arranging deals or operating a trading venue. It continues through the life of the firm: supervision, change of control, new permissions, enforcement and, eventually, exit.
The legal framework for ADGM financial regulation
Constitutional basis
ADGM was established as a financial free zone under the federal framework for financial free zones, by Federal Decree No. 15 of 2013 and Abu Dhabi Law No. 4 of 2013. Within it, UAE federal civil and commercial laws are largely replaced by ADGM's own legislation, while federal criminal law, including anti-money laundering and sanctions law, continues to apply. Its jurisdiction was extended in 2023 to include Al Reem Island alongside Al Maryah Island.
ADGM has three independent authorities: the Registration Authority, which incorporates and licenses entities; the FSRA, which authorises and supervises regulated financial activity; and the ADGM Courts. English common law applies directly under ADGM's application of English law regulations, which is why contracts, security and trusts in ADGM work in a familiar way for international parties. The ADGM website publishes the legislation, rulebooks and guidance.
The FSMR and the rulebooks
The FSMR is the primary legislation. It sets the general prohibition on carrying on regulated activities without a Financial Services Permission, defines regulated activities and specified investments, establishes the regimes for approved persons, controllers, markets, offers of securities and market abuse, and gives the FSRA its supervisory and enforcement powers.
The detail sits in rulebooks: the General Rulebook (GEN) on governance, systems and controls; the Conduct of Business Rulebook (COBS) on client classification, disclosure, suitability, client money and custody; the prudential rulebooks (PRU for investment, insurance intermediation and banking, with separate insurance rules); the Fund Rules (FUNDS); the Market Rules (MKT); the Anti-Money Laundering and Sanctions Rules (AML); and the Islamic Finance Rules (IFR). A Guidance and Policies Manual explains how the FSRA exercises its powers.
What has changed recently
ADGM financial regulation has moved quickly in 2025 and 2026. The FSRA's Cyber Risk Management Framework took effect on 31 January 2026, requiring a written cyber framework, board accountability and notification of material cyber incidents within 24 hours. In April 2026 the FSRA consulted on enhancements to its AML framework, including virtual asset and fiat-referenced token transfers and unhosted wallets; the changes were finalised in May 2026.
In September 2026 the FSRA amended its fund management rules to create lighter regimes for Sub-Threshold Fund Managers (closed-ended, non-retail funds with committed capital up to USD 200 million), Institutional Fund Managers (institutional funds with a minimum subscription of USD 5 million and no natural-person investors) and venture capital fund managers.
The reforms also added an employee investment vehicle framework and tighter rules for foreign fund managers, who have until 31 March 2027 to comply. In July 2026 the FSRA also consulted on reducing the requirement for court approval of business transfer schemes.
Regulated activities, categories and capital
The FSRA authorises firms activity by activity. Each Financial Service on the permission, from accepting deposits to advising on investments, carries its own requirements, and the combination places the firm in a prudential category under PRU. The category drives base capital, liquidity, reporting and, in practice, the size of the team the FSRA expects to see.
| Category | Typical activities | Prudential intensity |
|---|---|---|
| Category 1 | Accepting deposits; banking | Highest: full banking capital and liquidity framework |
| Category 2 | Dealing as principal (unmatched); providing credit | High: significant base capital and risk-based capital |
| Category 3A | Dealing as matched principal or as agent | Moderate, higher for retail leveraged products |
| Categories 3B and 3C | Custody, fund and asset management, and similar activities | Moderate: base capital and expenditure-based minimum |
| Category 4 | Advising, arranging, insurance intermediation, operating MTFs or private financing platforms, representative offices | Lowest: modest base capital, expenditure-based minimum where applicable |
The precise figures are set by PRU and the fees rules and change from time to time, so check the current rulebook before modelling. The 2026 fund manager reforms show the direction of travel: lighter capital and governance for managers that only serve institutional or sophisticated investors, and stricter requirements where retail clients or "host" arrangements are involved.
Specialist frameworks sit alongside the core regime. The FSRA has regulated virtual asset activities since 2018, and has added rules for fiat-referenced tokens; our page on virtual asset regulation compares ADGM with VARA, the CMA and the DIFC. Fund structures are covered in our page on investment funds.
Key decisions: ADGM, DIFC or onshore?
Choosing ADGM is a strategic decision that should follow the business model, client base and banking plan. ADGM and the DIFC offer similar common-law environments; the differences lie in rule detail, supervisory approach, cost, ecosystem and proximity to Abu Dhabi's sovereign and institutional investors. Our page on DIFC financial regulation sets out the Dubai alternative.
Serving onshore clients
An FSRA permission authorises activity in and from ADGM, not regulated activity onshore. Marketing to or dealing with onshore UAE clients can engage the Capital Market Authority (CMA), which replaced the Securities and Commodities Authority from 1 January 2026, or the Central Bank, whose 2025 law, Federal Decree-Law No. 6 of 2025, widened the onshore perimeter. Map onshore touchpoints before launch; our page on financial promotions covers marketing rules.
Branch or subsidiary
Foreign groups can enter through a branch or a locally incorporated subsidiary. A branch is quicker and relies on the parent's capital and home regulation, but the FSRA will look closely at the home regulator and group supervision. A subsidiary costs more but ring-fences liabilities and suits groups planning a regional platform.
Full permission or testing first
Fintech businesses can consider the FSRA's Regulatory Laboratory, a controlled environment for testing innovative services before full authorisation. It suits genuinely novel models; firms with conventional activities usually do better applying for a full permission straight away.
The activities you list on the application determine your category, capital and staffing. Applying for permissions "just in case" can push a firm into a higher prudential category and delay authorisation. Apply for what you will do in the first two years and vary the permission later.
The authorisation process step by step
No regulator guarantees a timetable, and incomplete applications are the main cause of delay. A well-prepared application for ADGM financial regulation typically follows this path.
- Define the business and activities. Break the model into regulated activities and specified investments, identify client types, and confirm whether any onshore or overseas licences are also needed.
- Hold pre-application discussions. Present the proposal to the FSRA authorisation team. Early feedback on the business plan, structure and key individuals saves time later.
- Prepare the application pack. Regulatory business plan, financial projections and capital analysis, governance and organisational chart, compliance and AML manuals, risk, outsourcing and cyber frameworks, and approved person applications.
- Submit and respond to questions. File the application with fees. Expect detailed questions and interviews of proposed senior executives and control function holders.
- Receive In-Principle Approval. The FSRA issues an IPA listing conditions to satisfy before final approval, usually including incorporation, capital, premises, staff and systems.
- Incorporate and satisfy conditions. Register the entity with the Registration Authority, inject capital, secure an office, hire the team and complete systems.
- Obtain the Financial Services Permission. Once the conditions are met, the FSRA grants the FSP and the firm can begin regulated business, subject to ongoing supervision.
Ongoing obligations after authorisation
Authorisation is the start of the relationship. ADGM financial regulation imposes continuing duties that the FSRA tests through returns, risk assessments, thematic reviews and visits.
Governance and people. Approved persons, including the Senior Executive Officer, Compliance Officer and Money Laundering Reporting Officer, must remain fit and proper and be replaced promptly when they leave. Changes of controller need prior approval.
Conduct and clients. Client classification, suitability, disclosure, client money and custody rules must be applied and evidenced, with complaints handling and record-keeping.
Prudential and reporting. Capital and liquidity must be maintained at all times, with regular prudential returns and audited accounts. Breaches must be notified.
Financial crime. Firms must run risk-based AML, sanctions and counter-proliferation financing controls, register and report through goAML, and apply the travel rule to virtual asset transfers. Our page on AML compliance covers the federal overlay.
Technology and data. The cyber framework, outsourcing controls and data protection duties under the ADGM Data Protection Regulations 2021 apply together; see our pages on cybersecurity law and ADGM data protection.
Supervision, enforcement and the courts
The FSRA supervises on a risk basis. Higher-impact firms, such as banks, market operators and retail-facing businesses, can expect closer engagement, while smaller institutional firms are supervised mainly through returns, thematic reviews and periodic visits. Supervisory findings usually come with a remediation plan and deadlines, and the FSRA expects the board to own that plan.
Where supervision identifies serious failings, the FSMR gives the FSRA investigation and enforcement powers, including requiring documents and interviews, imposing financial penalties, issuing public censures, restricting or withdrawing permissions and prohibiting individuals. Firms have routes to challenge decisions, with the ADGM Courts as the final forum. Because the FSRA publishes many enforcement outcomes, the reputational cost can exceed the financial penalty.
The ADGM Courts also matter commercially. Disputes over fund documents, investment management agreements, security and insolvency of ADGM entities are decided by judges applying English common law, and ADGM Courts judgments can be enforced onshore in Abu Dhabi under the arrangements between the ADGM Courts and the Abu Dhabi Judicial Department. Our page on ADGM Courts proceedings explains how litigation there works.
Markets activity has its own layer. Offers of securities, listings on ADGM venues, market abuse and, since 2026, takeovers under updated takeover rules are all regulated within ADGM. Issuers and sponsors should treat disclosure, prospectus and market conduct duties as continuing obligations, not one-off approvals.
The FSRA judges a firm less by its application than by whether the people, systems and records described in it still exist two years later.
Risks and common mistakes
Starting regulated activity before the FSP is granted
An In-Principle Approval is not a permission. Firms that onboard clients, take mandates or market products after receiving an IPA but before the FSP is granted risk breaching the general prohibition in the FSMR. The same applies to new activities added before a variation of permission is approved. Use the IPA period to build systems and hire, and keep all client-facing activity on hold until the permission is in hand. Marketing materials should also be checked so they do not imply that the firm is already authorised.
Treating key individuals as box-ticking
The FSRA interviews and assesses proposed senior executives, compliance officers and MLROs. Candidates who are part-time, based abroad without a credible plan, or lacking relevant experience slow applications and can lead to refusal. After authorisation, gaps in these roles are a recurring supervisory concern. Budget for experienced people, plan succession and notify changes on time.
Assuming ADGM licensing covers onshore business
An FSRA permission does not authorise regulated activity onshore. Firms that solicit onshore UAE clients, hold onshore client money or run onshore marketing campaigns can fall within the CMA's or the Central Bank's perimeter. The 2025 Central Bank law states that technology or business model alone does not take an activity outside the perimeter. Map every onshore touchpoint and take advice before relying on reverse solicitation or group arrangements.
Outsourcing without oversight
Groups often centralise compliance, IT and operations outside ADGM. That is permitted, but the ADGM firm remains responsible. The FSRA expects outsourcing policies, due diligence, written agreements with audit and access rights, and exit plans, and its cyber framework requires third-party contracts to be reviewed for incident reporting. Our page on financial services outsourcing explains the requirements.
Mishandling a regulatory investigation
FSRA enquiries can escalate into formal investigations with powers to compel documents and interviews, and outcomes such as fines, public censure and restrictions on individuals. Early mistakes, such as incomplete document production, inconsistent explanations or internal reviews without privilege, are hard to repair. Take advice at the first sign of enforcement interest; our page on regulatory investigations explains the process.
Cross-border angle
ADGM's rulebook is modelled closely on UK regulation, which makes it accessible to UK-regulated groups, but the detail differs and UK permissions do not passport into ADGM. The FSRA has cooperation arrangements with many foreign regulators, which matter for branch applications and group supervision.
For Saudi and wider GCC investors, ADGM is a common hub for funds and asset management, but marketing into Saudi Arabia requires compliance with Capital Market Authority rules. Indian groups use ADGM for funds and treasury, and need to consider Indian outbound investment and exchange control rules. Chinese and Singaporean institutions often establish ADGM platforms for Middle East distribution; their home regulators' outsourcing and group supervision rules apply in parallel.
For Bangladeshi groups and investors, ADGM entities can hold regional investments, but Bangladesh's foreign exchange regulations on outward investment must be satisfied first. TRW & Co's offices in Dhaka, Singapore and London help coordinate these home-country requirements with the ADGM application.
How TRW & Co helps with ADGM financial regulation
Structuring and perimeter analysis
We map the business model to FSRA regulated activities and categories, compare ADGM with the DIFC and onshore options, and identify any onshore licensing needs.
Authorisation applications
We prepare and review regulatory business plans, manuals and approved person applications, manage FSRA questions and track IPA conditions through to the FSP.
Funds and asset management
We advise on fund manager categories after the 2026 reforms, fund structuring, foreign fund manager transitions and employee investment vehicles.
Compliance frameworks
We draft AML, sanctions, conduct, outsourcing and cyber frameworks aligned with the FSRA rulebooks and federal law, and run gap reviews after rule changes.
Transactions and change of control
We advise on acquisitions of regulated firms, controller approvals, business transfers and group reorganisations involving ADGM entities.
Supervision and enforcement
We support firms through thematic reviews, breach notifications and investigations. Where proceedings before the ADGM Courts are needed, we work alongside registered practitioners.
See our practices for related work, or contact us to discuss an ADGM application or review.
Checklist for decision-makers
- Have we mapped every activity to an FSRA regulated activity and confirmed the resulting prudential category?
- Have we compared ADGM with the DIFC and onshore regulators for our clients, banking and investors?
- Do we have credible, available candidates for the Senior Executive Officer, Compliance Officer and MLRO roles?
- Is our capital plan based on the current PRU and fees rules, with a buffer?
- Have we identified any onshore UAE or home-country licensing needs?
- Are our AML, cyber and outsourcing frameworks aligned with the 2026 FSRA changes?
- For fund managers: does the 2026 Sub-Threshold, Institutional or venture capital regime fit, and do existing foreign fund manager arrangements need to change by 31 March 2027?
- Do we have a plan for supervision, breach reporting and responding to FSRA enquiries?
ADGM financial regulation rewards preparation: a clear perimeter analysis, realistic staffing and a credible compliance framework shorten the path to authorisation and make supervision smoother.
Frequently asked questions
01Who regulates financial services in ADGM?
The Financial Services Regulatory Authority (FSRA) authorises and supervises financial services firms, markets and related activities in ADGM under the Financial Services and Markets Regulations 2015 and its rulebooks. The ADGM Registration Authority incorporates and licenses entities, and the ADGM Courts hear disputes. Federal criminal law, including anti-money laundering and sanctions law, still applies in ADGM.
02How long does FSRA authorisation take?
There is no guaranteed timetable. The process runs from pre-application discussions through a formal application, an In-Principle Approval with conditions, then incorporation, capital, staffing and systems before the Financial Services Permission is granted. Timing depends mainly on the completeness of the application, the complexity of the activities and the availability of suitable key individuals. A well-prepared application for a straightforward model moves much faster than a novel or incomplete one.
03Can an ADGM firm serve clients in Dubai or onshore Abu Dhabi?
An FSRA permission covers activity in and from ADGM. Marketing to or dealing with onshore UAE clients can engage the Capital Market Authority (formerly the SCA) or the Central Bank, and Federal Decree-Law No. 6 of 2025 widened the Central Bank's perimeter. Some cross-border models are possible, but they need careful structuring and advice on the specific activity, client type and marketing approach.
04What changed for fund managers in 2026?
In September 2026 the FSRA introduced lighter regimes for Sub-Threshold Fund Managers managing closed-ended, non-retail funds with committed capital up to USD 200 million, and for Institutional Fund Managers serving only institutional funds with a USD 5 million minimum subscription and no natural-person investors. Venture capital managers became a sub-category, an employee investment vehicle framework was added, and foreign fund managers face tighter rules with a transition to 31 March 2027.
05What key individuals does the FSRA require?
Most firms need approved individuals in senior and control functions, typically including a Senior Executive Officer, a Compliance Officer and a Money Laundering Reporting Officer, and often a Finance Officer. The FSRA assesses their fitness and propriety, experience and availability, and may interview them. Some streamlined fund manager regimes introduced in 2026 relax certain requirements, such as the Finance Officer role.
06Does ADGM regulate virtual assets?
Yes. The FSRA has regulated virtual asset activities since 2018 under the FSMR and its rules, and has added provisions for fiat-referenced tokens. Its 2026 AML enhancements address virtual asset transfers, the travel rule and unhosted wallets. Firms choosing between ADGM, the DIFC, VARA and the CMA (formerly the SCA) should compare the activity scope, token rules and banking implications of each.
07What happens if the FSRA takes enforcement action?
The FSRA can investigate, compel documents and interviews, and impose outcomes including financial penalties, public censure, restrictions on permissions and prohibitions on individuals. Firms have routes to challenge decisions, ultimately before the ADGM Courts. Early, careful handling of document production and explanations is critical, and legal privilege should be considered before internal reviews begin.
Sources and official materials
- Abu Dhabi Global Market — ADGM legislation, FSRA rulebooks and guidance
- FSRA consultation on AML enhancements (April 2026) — Consultation Paper No. 1 of 2026
- Federal Decree-Law No. 6 of 2025 (UAE Legislation) — New Central Bank law and onshore perimeter
- Capital Market Authority (formerly SCA) — Federal securities regulator for onshore activity
- Central Bank of the UAE — Onshore banking, payments and insurance regulator
- ADGM Office of Data Protection — Data protection duties for ADGM firms
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
