Chapter 2 sets out what the Securities and Commodities Authority expects of a firm, both when it applies for a licence and for as long as it holds one. It carries 14 of the 100 exam questions, and the material is precise: periods, limits and named duties that sit close together and are easy to confuse.
This chapter works through the parts of the SCA Rulebook, Chairman's Decision No. 13/RM of 2021, that apply to licensed bodies. It has three parts. The general provisions set the standing duties of every licensed firm: how it describes itself, where it operates, how it deals with the Authority, and what the Authority can do when a firm breaks the rules. The licensing part explains how financial activities are grouped into categories and what an applicant must show for initial approval. The last part lists the internal arrangements an applicant needs, from governance and pay to complaints, outsourcing and records. Read it as a picture of a well-run firm, then learn the numbers attached to each duty.
A licensed body must make its regulated status plain. Its documents, client agreements and emails included, should show that the Authority licenses and supervises it, with its licence number, category, activity and address, so that anyone harmed knows where to take a concern. A licence does not carry the right to use the Authority's logo; that needs written permission. An emergency means something beyond the firm's control that reasonable precautions could not prevent, such as a fire or a power cut. The firm tells the Authority at once, with the likely effects and the steps taken to limit losses. The head office must be a real, physical office in the UAE unless another location is approved; branches must be physical offices too, and each needs the Authority's approval first. Close ties must be notified and must never obstruct supervision.
Inspection lets the Authority check how far a licensed body complies with the legal and regulatory framework. It can open an investigation into a suspected violation, whether it comes to light during an inspection or through a complaint or report, with no need for a client loss first. The firm must cooperate: give accurate and complete information from paper and electronic records, answer enquiries by the deadline the Authority sets, and let employees the Authority names attend investigations or meetings. Submissions must arrive on time and be true, accurate, complete and well-founded. They normally go through the Authority's electronic systems; failing that, in writing to the right department, or to the chief executive's office when the department is unknown. Documents are in Arabic. English is accepted at the Authority's discretion, and the Arabic text prevails if the two conflict.
Article 17 gives the Authority four sanctions for a licensed body: a notice, a fine of up to AED 100,000, suspension of the firm's financial activity for at most one year, and cancellation of the licence or approval on a listed ground. For an approved employee, the suspension cap is two months. Cancellation grounds include failing a licence condition, a severe breach of duties, false or forged information, unpaid fees or fines, bankruptcy or a serious risk of it, a lawsuit that threatens the business, dissolution or liquidation, and not starting at least one licensed activity within six months. Cancellation is a power the Authority chooses to use. It is announced in two UAE dailies, at least one in Arabic, at the firm's cost. Client records, accounts and securities may be moved to another licensed body or market institution.
The Authority licenses 21 financial activities and groups them into five categories: dealing in securities, dealing in investment, keeping (custody), clearing and registration, credit rating agencies, and arrangement and advice, which the material also calls ranking and advice. A business starts from the work it plans to do. The activities decide the category, and the category then sets conditions such as paid-up capital and legal form. A firm may only carry on what its licence covers. Holding client assets is a third-category function, while deciding which investments to buy or sell on a client's behalf is portfolio management in the second category. A custodian that starts managing portfolios needs the right licence, and routing the orders through a licensed broker leaves the gap open.
Before initial approval, the Authority tests the applicant from several sides. Financial eligibility covers its record on commercial debts, loans and court-ordered payments, even without a bankruptcy declaration. Experience and efficiency asks whether those heading the activity have done this work and can manage its risks. Honesty and integrity looks at matters such as fraud findings. The compliance condition looks back five years for a crime or serious violation by the applicant, its partners or board members, inside or outside the UAE, and two years for a moderate one. Professional record covers past dismissal, sanction or licence cancellation by another supervisor. The company, board and senior management must satisfy the Authority's standards of efficiency and appropriateness, the work plan and feasibility study have to be realistic, and resources must match the risks.
An applicant documents how it will be run. The governance guide sets the board's duties, the commercial targets and strategies, and how progress is supervised. The administration guide names who is responsible for each job and keeps duties apart to avoid conflicts of interest. Senior management runs the daily business within the board's approved strategy, and one named senior officer answers for errors in allocating tasks and overseeing staff. An employee guide applies the Authority's standards to everyone who works for the firm, temporary and outsourced individuals included. A code of ethics bans financial crime and damaging rumours about the Authority or any market institution. Bonuses must reflect goals, risk, the role and its results, and long-term interests. Technical systems must be kept current, with cyber risk managed and breaches reported immediately to the Authority and the relevant cyber-security bodies.
These three control functions must each be documented, and each has a distinct job. Risk management identifies and measures the risks of the business. Compliance monitors, continuously, whether the firm is keeping to the law and the regulations that apply to it. Its guide covers monitoring programmes, independent resources and immediate reporting of violations, and the compliance officer needs unrestricted access to every record and to the board and senior management. Internal audit independently judges whether the firm's own rules, procedures and bylaws are suitable and effective. The internal auditor operates free of interference, holds no other job, compliance included, and can escalate to the board, the senior officer or a relevant committee of the board where needed. Neither board approval nor the size of the firm creates an exception.
Confidential information must be protected from leaks and improper disclosure. It may be released only on a recognised ground: a legal requirement, the client's consent, reasonable need in order to provide a particular service to that client, the information having ceased to be confidential, or a request from a UAE judicial or supervisory body. A whistleblowing policy encourages staff to report violations to senior management and the Authority, keeps their identity confidential while the matter is investigated and shields them from unfair prejudice. Breaches of rules and technical requirements are reportable, not only breaches of legislation. Complaints need a written procedure, given free to any client who asks. Each complaint is recorded on receipt, the employee complained about stays away from that service, and the complainant receives the final decision in a letter on the date of the decision.
A licensed body may outsource tasks but never its responsibility, and it must keep essential tasks of its own. A copy of each written contract goes to the Authority immediately after signing. A provider whose contract another licensed body ended for breach within the past year cannot be used, and a provider serving more than one licensed body needs the Authority's approval. Work may go abroad only where expressly permitted and local conditions there do not stop the provider performing. A cloud provider keeps its servers inside the UAE, does not review the data, supplies an annual external audit report and protects the data, with back-ups, for ten years; the firm also needs an exit strategy. Records, paper or electronic, are kept safely for at least ten years with back-ups and must be retrievable within three business days.
A short revision checklist written by Bourse Prep from the syllabus and from our verified question bank. Use it to check yourself after studying the chapter. It does not replace the official workbook. Unfamiliar term? See the UAE FRR glossary.
The figures in this chapter that the exam material states, each with the rule it belongs to. Learn the figure and its owner together. Test yourself on them in Rules Lab.
| What | Figure | Context |
|---|---|---|
| Maximum fine on a licensed body under Article 17 | AED 100,000 | a ceiling for this provision, not for every offence |
| Maximum suspension of a licensed body's financial activity | One year | imposed by the Authority under Article 17 |
| Maximum suspension of an approved employee | Two months | applies to the individual, not the firm |
| Time to start at least one licensed activity | Six months from obtaining the licence | otherwise a ground on which the Authority may cancel |
| Publication of a cancellation decision | Two UAE daily newspapers, at least one in Arabic | at the licensed body's expense |
| Licensed financial activities and licence categories | 21 activities in five categories | the activities decide the category |
| Look-back for crimes and serious violations | Five years | before the application, inside or outside the UAE |
| Look-back for moderate violations | Two years | part of the same compliance condition |
| Retention of employee records | Ten years from the last update | kept under the employee rules guide |
| Complainant's reply to a proposed referral | Ten business days | refusal or silence means no referral |
| Look-back on a provider's terminated contracts | One year | no breach-related termination by another licensed body in that time |
| Cloud data protection and back-ups | Ten years | with zero data loss over the period |
| Cloud data security report | Every year | from an external auditor, copied to the Authority |
| Retention of a licensed body's records and back-ups | At least ten years | covers electronic and paper records |
| Retrieval of any record from the archive | Three business days | a separate test from retention |
Places where the syllabus draws a line between two rules that sound alike. They are not predictions about any exam.
Article 17 caps the suspension of a licensed body's financial activity at one year. The cap for suspending an approved employee is two months. Before recalling a number, decide who is being suspended. A suspension longer than two months is beyond the employee limit but may still be within the firm's.
The Authority licenses 21 financial activities, but there are only five licence categories. The first figure counts activities, the second counts the groups they fall into. The category follows from the activities a firm will carry on, not from the size of its capital or its legal form.
The compliance condition for initial approval uses two look-back periods: five years for a crime or serious violation and two years for a moderate one. Violations committed abroad count. A serious violation older than two years but within five still counts against the applicant, because the shorter moderate period does not apply to it.
Retention and retrieval are separate tests. Records and back-ups are kept for at least ten years, and any record must be recoverable from the archive within three business days. Long storage does not excuse slow retrieval. Employee records have their own ten-year rule, counted from the last update.
Close ties have to be notified to the Authority, but notice alone does not satisfy the rule. The tie must also leave supervision unimpeded, and the other party has to satisfy the Authority's efficiency and appropriateness standards. If supervision is obstructed, the Authority can insist that the tie be ended or changed.
Article 17 lists cancellation grounds, such as failing to start a licensed activity within six months or leaving a fine unpaid. Each ground gives the Authority a power to act. None of them cancels the licence automatically, and a minor breach already put right is not a listed ground.
Study tools for the rules in this chapter: side-by-side comparisons, decision paths and procedures. More are collected in Rules Lab.
| Compliance | Internal audit | |
|---|---|---|
| Main job | Continuous monitoring of whether the firm keeps to the law and regulations | Independent review of whether the firm's own rules, procedures and bylaws are suitable and effective |
| Access | Every record, plus the board and senior management, without restriction | The relevant records, plus the board, senior officer or board committee where needed |
| Independence | Independent resources set out in the compliance guide | Works independently and free of interference |
| Combining roles | Must stay separate from the internal audit job | Holds no other job, whatever the firm's size or the board's view |
| Escalation | Violations reported immediately under the compliance guide | Findings can go to the board, not only to the unit being audited |
A licensed body wants to hand a task to an outside provider.
In every case the contract is in writing, a copy goes to the Authority immediately after signing, and the licensed body stays fully responsible for the work.
The learning objectives for this element, as the CISI UAE Financial Rules and Regulations syllabus, Version 4.2, effective 10 September 2023 lists them. Every question in our bank is mapped to one of them.
Chapter 2 rewards exact recall more than interpretation. Filter practice to this chapter and take the 89 questions in two passes: the general provisions and Article 17 first, then the applicant requirements. When you miss one, read the explanation and name the rule you confused, because the alternatives are often a neighbouring number or a neighbouring duty. Keep the numbers table beside you until pairs such as ten years and three business days come without effort.
15 questions from all eight chapters. The answer is only revealed once you have committed to one.
Start the free UAE FRR demo