What training and competence rules does the DFSA apply?

The DIFC is a financial free zone with its own regulator, so firms licensed there follow the DFSA Rulebook rather than the rules of onshore UAE financial regulators. The DFSA describes itself as the independent regulator of financial services conducted in or from the DIFC, "a purpose-built financial free zone in Dubai, UAE".

For international readers, the UAE has two broad layers. Onshore, federal laws and federal regulators apply across the seven emirates. Financial free zones, chiefly the DIFC in Dubai and Abu Dhabi Global Market (ADGM), have their own financial services regulators and rulebooks. Federal criminal law still reaches into the free zones: the DFSA states that Federal Anti-Money Laundering Legislation applies directly in the DIFC under Articles 70 and 71 of the Regulatory Law, and that the DFSA is the competent authority administering it for DIFC firms.

In practice a DIFC firm maps three sources into its training program: the DFSA Rulebook, federal AML legislation (see UAE AML/CFT training requirements), and DIFC laws administered by other DIFC bodies, such as the data protection regime covered in DIFC Data Protection Law training.

The rules are spread across the General Module and the AML module; the current list of Rulebook modules contains no separate training and competence module. The table sets out the provisions that matter most for training design, as at September 2026.

GEN Rule 5.3.19 requires an Authorized Firm to ensure, as far as reasonably practical, that its Relevant Employees are fit and proper, competent and capable of performing their assigned functions, and "trained in the requirements of the legislation applicable in the DIFC". The firm must maintain systems and controls to achieve this and "must be able to demonstrate that it has complied with these requirements through appropriate measures, including the maintenance of relevant records" (GEN 5.3.19).

The version in force from July 1, 2026 refers to Relevant Employees; the earlier version referred to all Employees. A Relevant Employee is an Employee other than an Authorized Individual who meets the criteria in GEN Rule 4.3.1(2): involvement in Financial Services business, activities connected with it, or managing the firm. DFSA guidance on GEN 4.3.1 gives front office sales and trading and back office compliance and accounting as examples, and says drivers, personal assistants and similar roles would not ordinarily be covered.

The word "demonstrate" is the practical center of the rule. A completion log alone shows attendance, not competence. Firms should hold a role based competency framework, assessment results, and dated evidence that content reflected the legislation in force at the time.

The Senior Executive Officer, Compliance Officer and Money Laundering Reporting Officer must each complete at least 15 hours of continuing professional development (CPD) in each calendar year under GEN Rule 5.3.19A. The firm, not only the individual, is responsible for ensuring this happens.

• Relevance: CPD must relate to the person's current role, any anticipated change in that role, and their professional skill and knowledge.
• Structure: it must consist of structured activities, defined as courses, seminars, lectures, conferences, workshops, web based seminars or e-learning requiring a commitment of thirty minutes or more.
• Records: the Employee must keep adequate records of CPD activities to demonstrate that the requirement has been met.

Reading and informal learning under thirty minutes does not count toward the 15 hours. A CPD log should therefore capture the activity, its duration, its provider, and a short note on its relevance to the role.

From July 1, 2026, the firm carries the first line assessment of competence: it must not apply for Authorized Individual status unless it is satisfied the individual is fit and proper, assessed against GEN App7 (GEN 7.6.1). The changes came through GEN Rule-making Instrument No. 430 of 2025, made after Consultation Paper No. 165 and in force on July 1, 2026, according to the DFSA's December 2025 Notice of Amendments to Legislation.

GEN A7.1.1 requires the firm to consider integrity, competence and capability, financial soundness and proposed role. For competence, the firm must obtain details of the individual's knowledge and skills against those the role requires, verify the information, determine relevant qualifications and experience, and determine the individual's knowledge of the firm's relevant systems and procedures.

The ongoing duty is in GEN 7.7.1: the firm must be satisfied that each Authorized Individual remains fit and proper, continues to be competent, has kept abreast of relevant market, product, technology, legislative and regulatory developments, and is able to apply that knowledge. The assessment must be reviewed at least annually, and GEN 7.7.3 requires records of each assessment to be kept for at least six years and made available to the DFSA on request.

AML Rule 12.1.1 requires a Relevant Person to provide AML training to all relevant Employees at appropriate and regular intervals, and GEN Rule 5.5.14 requires cybersecurity training for relevant Employees at least annually. Both rules specify content, not just frequency.

Under AML 12.1.1, training must enable Employees to understand relevant money laundering legislation (including Federal AML legislation), the firm's policies and controls and changes to them, how to recognize and deal with suspicious transactions, how to notify the Money Laundering Reporting Officer (MLRO), current money laundering techniques and trends relevant to the business, their own roles including the identity of the MLRO, and relevant sanctions and international findings. Training must be tailored to the firm's products, services, customers, channels and transaction complexity, and indicate different levels of risk. AML 14.4.5 requires the firm to be able to demonstrate compliance, including through training records.

GEN 5.5.14 states that an Authorized Person "must establish and maintain a comprehensive cybersecurity training programme and adequate awareness arrangements". All relevant Employees must receive training on the firm's cybersecurity policies and standards at least annually, develop awareness and competencies for detecting and reporting Cyber Incidents, and understand their individual responsibilities.

Each DFSA obligation can be translated into a testable learning outcome and a specific evidence record that a supervisor could inspect. The mapping below is illustrative and should be adapted to the firm's own risk assessment.

This is the gap between completion tracking and competency verification. The DFSA's rules ask firms to show competence and currency, so records should link each person to the obligation, the outcome, the assessment and the content version. The guide on preparing training records for an audit covers how to structure that evidence, and verification of competency explains how to confirm people can apply what they learned.

Weak training and competence controls expose both the firm and its individuals to DFSA supervisory and disciplinary action. DFSA guidance on GEN 4.3.1 states that breaching a Conduct Principle makes an individual liable to disciplinary action and may indicate the individual is no longer fit and proper, in which case the DFSA may consider suspending or withdrawing Authorized Individual status or imposing restrictions under Articles 58 and 59 of the Regulatory Law.

For the firm, GEN 5.3.19, GEN 7.7.3 and AML 14.4.5 all turn on demonstrable records. Missing CPD logs, undated content, or annual reviews that were never documented are the gaps a supervisory visit is most likely to find.

Knowledge Foundry models DFSA obligations, the roles they apply to, and the learning outcomes and assessment points that evidence them before any content is written. Each record then links a person to the rule version, content version and assessment result, so annual reviews and CPD evidence can be produced for a supervisor from one governed source.