Firms operating across both DIFC and ADGM face overlapping but distinct cybersecurity requirements. This article compares the DFSA and ADGM FSRA approaches to help firms build efficient compliance programs that satisfy both regulators.
Several financial services groups operating in the UAE maintain licensed entities in both the Dubai International Financial Centre and Abu Dhabi Global Market. While the DFSA and ADGM FSRA share common foundations rooted in international regulatory standards, there are meaningful differences in how they approach cybersecurity and technology risk that firms must understand.
Both regulators take a principles-based approach, expecting firms to implement controls proportionate to their risk profile. However, the DFSA tends to be more prescriptive in certain areas, particularly around outsourcing and business continuity, while ADGM FSRA provides more detailed guidance on specific topics like cloud computing and digital assets.
Both regulators require board-level oversight of technology risk and a designated senior individual responsible for cybersecurity. The core governance expectations are largely aligned: approve strategy, allocate resources, receive reporting, and ensure accountability. Where they differ is in the granularity of reporting expectations and the frequency of governance reviews.
Both require comprehensive technology risk assessments conducted at least annually. ADGM FSRA tends to emphasize alignment with recognized frameworks such as NIST and ISO 27001, while DFSA focuses more on the firm's ability to demonstrate proportionate risk management without mandating specific frameworks.
This is where the most notable differences emerge. ADGM has published specific cloud computing guidance with detailed expectations for due diligence, data sovereignty, and exit planning. The DFSA addresses cloud through its broader outsourcing framework, which covers technology outsourcing including cloud services but without separate cloud-specific guidance.
Both require notification of material technology incidents, but the specific triggers, timeframes, and reporting formats differ. Firms operating under both regulators must maintain incident response procedures that can satisfy both sets of requirements simultaneously.
Both regulators expect regular security testing. The expectations for scope, frequency, and remediation timeframes are broadly similar, but firms should confirm specific requirements with each regulator as expectations may evolve.
For firms operating under both DFSA and ADGM FSRA, the most efficient approach is to build a single cybersecurity program that meets the higher standard across both frameworks. This avoids duplication, reduces compliance costs, and ensures consistent security across the organization. ITSEC helps multi-regulated firms design unified cybersecurity programs that satisfy both DFSA and ADGM requirements. Contact us for a dual-framework compliance assessment.
Get a comprehensive security assessment from our expert team. Protecting businesses since 2011.