The Dubai Financial Services Authority (DFSA) fined Hayman-Woodward Dh1.67m on 15 October 2026 for six years of company service provider (CSP) activity carried on in and from the DIFC without the mandatory DNFBP registration. For UAE businesses the signal is clear: the licence must match actual activity, and any gap can be enforced retrospectively.
What happened
Hayman-Woodward Global Mobility Services (DIFC) Ltd. — HWW DIFC — served 71 clients between August 2018 and February 2025 by acting as a formation agent of legal persons and providing a registered office, business address, correspondence and administrative address. This is the classic CSP package, which in the DIFC sits inside the Designated Non-Financial Business or Profession (DNFBP) category and requires separate registration with the DFSA.
At the same time HWW DIFC's authorised activity in the DIFC was limited to management consultancy and document clearing. Alongside, the firm signed agreements with three free zones outside the DIFC covering company set-up support and customer service provision — which the DFSA treated as part of the unlawful CSP work uncovered during the investigation.
Penalty and settlement discount
The DFSA initially set a combined financial penalty of USD 522,047.05 (AED 1,917,217.79, around Dh1.92m) — fine plus disgorgement of unlawful profits. HWW DIFC agreed to settle, and the fine component was reduced by 30%. The resulting payment is USD 454,367.05 (AED 1,668,662.99, Dh1.67m).
What exactly was breached
Article 71A(1) of the Regulatory Law 2004 — the so-called DNFBP Prohibition. In plain terms, carrying on CSP services and other DNFBP activity in or from the DIFC without prior registration with the DFSA is forbidden. Registration lets the regulator monitor these activities and apply the full AML/CTF toolkit.
"Registration as a DNFBP enables the DFSA to monitor these activities and ensure that appropriate safeguards are in place," Alan Linning, the DFSA's managing director of enforcement, is quoted as saying. He also notes that CSP work falls into the elevated financial-crime-risk category and gets dedicated regulator attention.
What this means for business in the DIFC and beyond
The core lesson: the licence has to cover what the firm actually does. If on paper you are a management consultancy, but in practice you set up companies for clients and provide them with an office address in the DIFC, that is already a CSP service and triggers mandatory DNFBP registration. The DFSA reads any mismatch strictly and enforces retrospectively — HWW DIFC was made to pay for 6+ years of activity.
The second practical point: agreements with free zones outside the DIFC do not take CSP work out of DFSA scope if the entity itself is DIFC-registered and clients are served from the DIFC. Before expanding to the mainland or another free zone, review both your internal processes and your licence portfolio. If you are still at the planning stage, walk through the proper sequence of setting up a UAE company and choosing the right licence before you register — fixing it later is always more expensive.
How to lower the risk right now
- run an internal audit: match the licence code in DIFC/DMCC/ADGM/mainland against the services actually provided to clients;
- if you set up companies, provide addresses or act as a nominee, check whether DNFBP registration is required in the jurisdiction of activity (DFSA in DIFC, FSRA in ADGM, Ministry of Economy on the mainland);
- document AML/CTF procedures: client KYC, UAE FIU reporting, MLRO appointment — the full package the regulator expects from a DNFBP;
- weigh the risk perimeter when signing agency agreements with free zones and consultants — the liability stays with the legally obliged entity, not the intermediary.
The HWW DIFC case fits a broader trend. The DFSA, ADGM FSRA and the UAE Ministry of Economy are steadily tightening oversight of intermediaries working on client immigration, corporate and financial infrastructure. We mapped the 2026 reform landscape in our dedicated piece on UAE business regulation in 2026 — including AML/CTF expectations and the role of DNFBPs in the supervisory system.
This article is informational and does not constitute legal advice. When planning structure and licensing, cross-check the position with a qualified adviser and the DFSA's own publications.
