DFSA Conduct Supervisory Pulse: PAD Rules for DIFC Brokers
In June 2026, the DFSA published its first-ever Conduct Supervisory Pulse. It is a structured document based on real observations from deep-dive supervisory sessions with DIFC brokerage firms. The main objective is Personal Account Dealing (PAD) review – how your employees trade for themselves, and whether your firm has the controls to catch what goes wrong.
This is very important in the broader context of protecting investors and maintaining market integrity. This survey makes a lot more sense when we factor in the long term economic goals and supportive policies of the UAE government.
What Did the DFSA Just Do? The Pulse in Plain Language
The Supervisory Pulse is a new communication format basically, a direct channel from regulator to industry sharing what was found during live supervisory reviews, before enforcement begins.
During Q1 2026, the DFSA’s Conduct Supervision team ran Phase 1 of its Thematic Review on Brokerage – Oversight of the Trading Environment. They visited firms, asked questions and reviewed policies. They reviewed registers, and controls. After a careful analysis of the situation, they published this pulse stating the gaps they found and the good aspects they noticed.
Mark Steward leads the DFSA as Chief Executive. The DFSA itself is the independent regulator of all financial services conducted in or from the DIFC, the purpose-built financial free zone established in Dubai in 2004. It oversees asset managers, banks, insurers, fund managers, and most relevant here, brokerage firms.
The Pulse is not a warning notice. It is something more useful: a benchmark. It tells you exactly what a compliant firm looks like, and exactly what a non-compliant one looks like, across six defined areas. That kind of transparency is rare. It also means you have no excuse if the next review finds the same gaps.
What Is Personal Account Dealing (PAD)?
Personal Account Dealing – PAD – refers to transactions where an employee of a regulated firm trades investments for their own account.
It sounds simple but there is a deep market link here. A brokerage employee who works with client orders, market intelligence, and confidential information has something most retail investors do not: an informational edge. If that edge is used, even accidentally, for personal gain, the consequences range from conflicts of interest to market abuse.
The DFSA’s Glossary Module (GLO) formally defines a Personal Account Transaction as any investment or crypto token transaction by a firm’s employee, with narrow exclusions for government securities, life policies, and purely discretionary arrangements with no employee input.
The governing rule is COB Rule 6.2 – Personal Account Transactions in the DFSA Rulebook. Under COB Rule 6.2.1, firms are required to establish and maintain adequate policies and procedures to mitigate the risks arising from personal trading. This includes monitoring obligations, pre-clearance requirements, and record-keeping – and it extends to Suspicious Transaction and Order Report (STOR) obligations where market abuse indicators arise.
The practical risks PAD creates are direct:
- Front-running – trading ahead of a client order the employee knows is coming
- Trading on inside information – using confidential market or client data for personal positions
- Undisclosed conflicts – personal holdings that create bias in how client orders are handled
Poorly controlled PAD is, in the DFSA’s own words, a sign of weak culture, governance, and oversight. That kind of framing matters. It affects culture more than governance. Understanding the UAE’s AML/CFT framework provides important context for market conduct obligations in DIFC.
Why Now? The DIFC Brokerage Boom Behind the Review
In 2022, there were 49 authorised brokerage firms in DIFC. By March 2026, that number had reached 72 – this is an increase of 68%. Headcount across DIFC-located brokerage operations nearly doubled over the same period. And the sector’s combined profitability surged from USD 80 million in 2023 to USD 301 million in 2025 – a 276% increase in two years.
The brokerage review was formally launched through the DFSA “Dear SEO Letter” dated 28 November 2025, addressed to Senior Executive Officers of DIFC firms. That letter announced a 2026 programme of thematic reviews across three areas: Suitability, Fund Platforms, and Brokerage. The brokerage review itself runs in three sequential phases:
| Phase | Focus Area | Status |
| Phase 1 | Personal Account Dealing (PAD) | Completed — Pulse published June 2026 |
| Phase 2 | Best Execution | Upcoming |
| Phase 3 | Communication Channels & Record Keeping | Upcoming |
The PAD Pulse is Phase 1. Phases 2 and 3 follow in the same year. If your PAD framework is weak, your best execution and record-keeping frameworks are likely to be reviewed under the same critical lens.
DIFC is now home to 1,050 regulated entities – with 182 new firms added in the latest reporting period, a 16% increase. Dubai ranked 7th globally in the GFCI 39 rankings. Growth at this scale demands proportionate oversight. That is exactly what 2026’s thematic reviews represent.
Outcomes - Six Areas, Strengths and Gaps
The DFSA reviewed firms across six defined areas of their PAD control frameworks. What follows is what they actually found, both what works and what does not.
| Area | Positive Indicators Observed | Indicators Requiring Enhancement |
| 1. Policies & Procedures | Tailored policies; role-specific obligations; annual governance reviews; active pre-clearance processes | Narrow definitions of PAD; no regular policy updates; retrospective approvals permitted; restricted lists referenced but not maintained |
| 2. Governance, MI & Oversight | Board oversight of PAD; MI reported to Committees; escalation channels in place | Senior management receiving only declaration-signing status — no visibility on wider PAD risks |
| 3. Monitoring & Surveillance | Automated pre-trade screening; cross-checking of employee trades against client activity; independent verification via trade feeds | Over-reliance on employee declarations; no post-trade monitoring; monitoring conducted only annually |
| 4. Compliance Oversight | PAD included in Compliance Monitoring Programmes (CMPs); internal audit coverage; Group-level bank account sampling | PAD not in CMP scope; approvals handled only by line management; no internal audit coverage of PAD |
| 5. Training & Awareness | Role-specific induction training; annual refreshers; completion rates tracked; effectiveness assessed | No formal PAD training; only acknowledgement of policy — no understanding verified; training content misaligned with actual P&Ps |
| 6. Record Keeping | Complete electronic PAD registers; six-year retention; records of compliance testing with outputs available | Incomplete registers; inaccurate records; one firm recorded zero breaches when breaches had occurred |
A few findings deserve specific attention.
The DFSA found significant divergence in how firms approach PAD. Some had sophisticated, risk-based frameworks with automated pre-trade screening, approved broker lists with automated transaction feeds, and Board-level MI. Others relied almost entirely on employee self-declarations – with no independent check, no post-trade review, and no evidence that policies had been updated since the firm launched. This is a lack of self assurance systems on part of those firms.
The DFSA also disclosed something important from its recent enforcement work: it has already identified discrepancies between firms’ own PAD reporting and independent enquiries conducted by the DFSA for a number of employees. That is not an abstract concern. That is a live enforcement signal.
The proportionality principle runs through everything. The DFSA is not requiring every brokerage firm to build the same framework. It explicitly recognises that frameworks should match the nature, scale, and complexity of the business, its products, employee roles, and risk profile. A 10-person specialist broker does not need the same system as a 200-person multi-asset dealer. But both need a system and both need to be able to demonstrate it works.
What Should DIFC Brokerage Firms Do Now?
The DFSA has been transparent about what it expects to see in future engagements, meaning this Pulse functions as a checklist. Here is what your Compliance Officer or SEO should do immediately.
- Self-assess against the six areas and COB 6.2. Map your current PAD framework against each of the six areas the DFSA reviewed. Where do you have documented evidence? Where are the gaps?
- Reduce reliance on employee declarations. If your PAD monitoring depends primarily on employees self-reporting their personal trades, that is the first gap to close. Add independent verification: trade confirmations, account statements, approved broker feeds. Declarations alone are insufficient.
- Implement post-trade monitoring. Many firms reviewed had pre-trade clearance but no post-trade surveillance. That is half a framework. Cross-check employee transactions against client activity and market events. Build this into your Compliance Monitoring Programme.
- Fix your record keeping. Six-year retention is the minimum. A complete PAD register covering attestations, approvals, confirmed trades, breaches, and compliance testing outputs is not optional.
- Brief your Board and senior management. PAD MI should flow upward. Your Board should know how many PAD requests were submitted, how many were declined, what breaches occurred, and what action was taken. Compliance status on declarations alone is not Board-level governance.
- Prepare for Phases 2 and 3. Best execution and communication channels/record keeping are next. The same supervisory methodology applies. If your trading oversight framework has gaps in PAD, the same systemic weaknesses are likely to surface in the phases that follow.
How ADEPTS Can Help
DIFC brokerage firms are now operating under a live, phased supervisory review – PAD first, best execution and record keeping to follow.
ADEPTS Advisory is DIFC-approved and DFSA-familiar. Here is where we work alongside your compliance and leadership teams:
- DIFC compliance and PAD framework review – gap assessment against COB 6.2 and the six areas in this Pulse → AML & Compliance Services
- Independent monitoring and controls testing – building or testing your compliance monitoring programme for PAD → Internal Audit Services / Risk Advisory
- Board oversight, MI design, and governance – making sure PAD reporting reaches the right level → Corporate Governance Services / ICFR Advisory
- PAD policy drafting and record-keeping documentation – bringing your P&Ps in line with DFSA expectations → Legal Documentation & Policies
- New DIFC entrants — setting up the right compliance architecture from day one → DIFC Free Zone Business Setup
ADEPTS explains the change and helps you act before the next review phase lands.
The Bottom Line
The DFSA Conduct Supervisory Pulse on Personal Account Dealing is very importing for maintaining market integrity. It is about whether the employees inside DIFC’s fastest-growing sector are trading in ways that protect rather than exploit the clients and markets they serve.
PAD is Phase 1 for a reason. If the culture, governance, and oversight around personal trading are weak, the firm’s broader trading environment is almost certainly weaker than it should be. The DFSA knows this. That is why they started here.
Firms that address PAD now will enter phase 2 and 3 without fear of repercussions. Firms that do not will face those phases under increased scrutiny. The Pulse is published. The clock has started. Talk to ADEPTS for a DIFC PAD compliance review.
References
- DFSA Conduct Supervisory Pulse – Brokerage Thematic Review: Personal Account Dealing (June 2026):
dfsa.ae - DFSA Rulebook – COB 6.2 Personal Account Transactions: dfsaen.thomsonreuters.com
- DFSA Annual Report 2025 (published 25 June 2026): dfsa.ae/news
- DFSA “Dear SEO Letter” – 2026 Thematic Reviews (28 November 2025): available via DFSA communications- https://www.dfsa.ae/your-resources/publications-reports/seo-letters-1
