The short answer: whether you are launching under VARA, setting up in the DIFC or ADGM, or operating in another free zone, regulators expect clearly accountable people in distinct roles: a Compliance Officer, a Money Laundering Reporting Officer and, for virtual asset firms, a head of risk. Interim regulatory professionals can build your framework and cover specialist roles while you recruit, but the regulated seats still have to meet each regulator's own rules on employment, residency and approval.
Most Dubai business owners discover this too late: you cannot just hire "a compliance person" any more. Finding approved people for those seats takes longer than most founders plan for.
The three roles Dubai regulators expect
Compliance is not one job. Dubai's financial regulation splits it into distinct responsibilities.
The compliance officer (CO)
The Compliance Officer (CO) owns your compliance framework. They build the systems, write the policies and train your staff. They make sure business processes align with the DFSA or VARA rulebooks.
For VARA-regulated firms, the rulebook's starting position is that the CO needs at least five years of relevant experience in a compliance function, must be a UAE resident or passport holder and a full-time employee, must be approved by VARA as fit and proper, and reports directly to the Board. The DFSA requires the Compliance Officer to be one of the mandatory appointments held by Authorised Individuals. Our guide to VARA licence compliance appointments covers the full appointment process.
In practice, VARA decides case by case. It is open to the CO also heading the risk function, and each of the CO, MLRO and risk roles can be outsourced in consultation with VARA, depending on the firm's business plan, permissions and activities. A solid proposal with the right roles embedded matters.
The DFSA considered moving Compliance Officers, Finance Officers and Senior Managers to a firm-assessed "designated function" model in its CP165 consultation. It decided against it: they continue to need DFSA approval. What did change: from 1 July 2026, the DFSA's conduct principles extend to relevant employees, and firms must verify at least annually that authorised individuals remain fit and proper.
The money laundering reporting officer (MLRO)
The MLRO helps prevent your company from being used for financial crime. They monitor transactions, investigate suspicious activity and file reports with the UAE Financial Intelligence Unit. Under VARA's rules, reports are made on the goAML platform. The MLRO must report immediately on suspicion.
This is not a part-time add-on to someone's existing role. VARA requires the MLRO to have at least two years of experience handling AML/CFT matters and to be a fit and proper person reviewed annually. The MLRO must also report to the Board at least quarterly on the effectiveness of AML/CFT controls. The DFSA's AML rules require the MLRO to be resident in the UAE and to have appropriate seniority and independence, and require Authorised Firms other than Representative Offices to appoint a deputy MLRO for contingency cover. The DFSA does not approve the deputy, who in a small firm is typically an internal staff member.
Why the scrutiny? Because getting AML wrong damages businesses. The new federal AML law, Federal Decree-Law No. 10 of 2025, repealed the 2018 law, took effect on 14 October 2025 and expressly covers virtual asset service providers. Legal commentators note that it also places greater responsibility on companies and senior managers.
In ADGM, the FSRA requires an MLRO and a Compliance Officer as Approved Persons performing Controlled Functions. Its AML rules require the MLRO to be resident in the UAE, and require every Relevant Person other than a Representative Office to appoint a deputy MLRO. The FSRA does not approve the deputy, whose role is contingency cover: often an internal staff member in a small firm, though it can be a standalone full-time role.
The MLRO also needs technical knowledge of your sector: blockchain and crypto patterns for VASPs, correspondent banking risks for payment companies.
The chief risk officer (head of risk)
The head of risk, often called the Chief Risk Officer, identifies, assesses and manages risk across market, operational, technology and regulatory exposures. VARA's rulebook calls this role the head of the risk function. The head of risk needs appropriate qualifications and authority to oversee the VASP's overall risk exposures and reports directly to the Board, unless they are also the CO.
Why you need these functions covered properly
One person can sometimes hold more than one of these seats. VARA's rulebook allows the CO to also be the head of the risk function. It allows the MLRO to hold more than one non-client-facing role, provided the roles do not create conflicting duties. The DFSA's mandatory appointments are the Senior Executive Officer, Finance Officer, Compliance Officer and MLRO, and credit rating agencies must keep the Senior Executive Officer and Compliance Officer separate.
But these are demanding jobs. A proper CO builds policies, trains staff, prepares regulatory reports and manages compliance technology. An MLRO monitors transactions, investigates alerts and maintains AML systems. The head of risk coordinates across business functions, maintains risk registers and reports to the Board.
As activity grows, combining them stops being practical. Regulators weigh whether a combination undermines the person's capacity or independence.
The point is clear separation of duties and clear ownership. Similar to how successful businesses need different types of executive leadership, regulatory roles reward specialisation.
The recruitment reality
Finding qualified regulatory professionals in Dubai takes many months, and there is no published benchmark to plan against. You need people with technical knowledge of the DFSA or VARA rulebooks, sector expertise, UAE regulatory experience, recognised qualifications such as CAMS, and strong references from regulated firms.
They need to be UAE residents or passport holders where the rules require it. They need to start inside your licensing timeline. Notice periods, visas and the regulator's own approval of each individual add to the lead time.
Meanwhile you are stuck. You cannot get licensed without these appointments. You cannot operate without a licence. You cannot generate revenue while waiting. That is the regulatory catch-22 facing Dubai's financial services sector.
The interim solution
Many companies work out that they do not need permanent employees for every regulatory seat on day one. They need the functions, the expertise and the accountability to regulators. Interim regulatory appointments address this. Instead of waiting for recruitment to finish, you bring in experienced professionals who know the rulebooks and can start within weeks. Fractional risk and compliance officers are built for this gap.
Our engagements typically run 30 to 60% less than a full-time hire. They help you build compliance infrastructure, train your team and prepare for the regulator's questions. Then they hand over to permanent staff when you are ready. Pre-profit startups avoid carrying three full-time regulatory salaries before licensing revenue arrives.
One caution, so you plan honestly: some rulebooks start from a full-time employee approved by the regulator (VARA's does for the Compliance Officer and Responsible Individuals). VARA may agree a different structure, including outsourcing a role, when your business plan, permissions and activities support it, so agree the structure with VARA early. The DFSA is more flexible in places. Its AML rules allow the MLRO role to be outsourced to a suitable individual with the firm remaining responsible, and it may waive the UAE residency requirement for a Compliance Officer or MLRO in appropriate circumstances. Agree the structure with your regulator before you commit.
Interim does not mean inferior. You are getting professionals who specialise in regulatory set-up. The comparison between fractional executives and traditional consultants shows why this model works well.
What a well-run interim handover looks like
- Weeks one to two: a gap analysis against the relevant rulebooks, and a decision on who holds each regulated seat.
- Build phase: policies, the compliance management system, the AML monitoring approach and the risk framework are drafted and tested.
- Parallel recruitment: the permanent CO, MLRO or head of risk is recruited and put forward for approval while the interim team keeps the function running.
- Handover: the interim professional trains the permanent hire, then steps back on one month's notice.
Each firm's timetable differs, so plan against your regulator's current guidance rather than a template.
When you need these roles
You need these roles if you are:
- Applying for a VARA licence (the rulebooks apply to every VASP)
- Operating in the DIFC under DFSA supervision
- Operating in ADGM under FSRA supervision
- Running payment services or holding client assets
- Providing investment services
You probably do not need them immediately if you are a pure technology provider with no regulated activities, or an early-stage business not yet touching regulated services.
The moment you touch regulated activities, you need them straight away. "Straight away" means either having interim professionals ready to engage or accepting delays.
What happens when companies get this wrong
VARA's enforcement record shows what weak compliance functions cost:
- August 2025: VARA published enforcement action against Morpheus Software Technology (Fuze) for failures in its AML programme, governance, compliance and internal systems and controls, plus unlicensed activity in breach of its licence conditions and failure to disclose material facts. The firm accepted the findings. A Skilled Person was to be appointed to oversee remediation. VARA did not state the penalty amount. Khaleej Times reported the action on the day it was announced.
- October 2025: VARA penalised 19 unlicensed firms with fines of AED 100,000 to AED 600,000 and issued a public warning.
- June 2026: VARA issued a notice of fines to licensed firm CoinMENA over AML programme compliance failures in its internal systems and controls. The case shows that scrutiny continues after the licence is granted.
VARA's Rulebook 2.0, in force from 19 June 2025, also flagged that MLROs and senior management may face enforcement action for non-compliance. The UAE left the FATF grey list in February 2024, and its fifth-round FATF/MENAFATF mutual evaluation was scheduled for June 2026, so authorities have strong reason to show that controls work in practice.
Why SMEs cannot ignore this
Regulators care about your activities, not your size. A small VASP faces the same MLRO requirements as a large exchange. If you run a smaller financial services business, you might think this only applies to big players. It does not.
That creates a problem for SMEs. You may not be able to afford several full-time regulatory professionals, yet you cannot operate without the functions. Fractional and interim arrangements give you senior expertise without the full-time cost, where the regulator accepts that structure. Whether you need financial leadership, operational expertise or technology guidance, the same model applies to regulatory functions: senior experience for the hours you need, with structure and governance around it.
The bottom line
Building a regulatory team in Dubai is a prerequisite for operating in financial services, not an option.
You have two broad choices:
- Recruit permanent staff for every seat first, accepting a long lead time before you can apply.
- Engage interim regulatory professionals who start within weeks, build the framework, and transition to permanent hires as they are approved.
Many companies find the second route lets them get licensed faster, operate compliantly from day one and recruit permanent staff without desperation.
Regulation is not getting simpler. Requirements are rising and scrutiny is intensifying after VARA's 2025 and 2026 enforcement actions, the new federal AML law and the DFSA's July 2026 conduct changes. Companies that succeed treat compliance as strategic advantage, not burden. That starts with the right people in the right roles, permanent or interim.
Not sure which regulatory roles you need for your business model? Take our regulatory compliance readiness assessment or executive readiness assessment to identify gaps in your current structure.
Related guides: Risk and Compliance hub, MLRO, Deputy MLRO, Compliance Officer, Head of Compliance, Chief Risk Officer, Head of Financial Crime.
Ready to build your regulatory team without a long wait? The Fractional Dubai team includes experienced compliance professionals who support financial services companies through DFSA, FSRA and VARA requirements. We can often have interim support in place within weeks. Contact us to discuss your regulatory staffing needs.
