DFSA

DFSA Client Money and Safe Custody Rules Explained

2026-05-05 · 7 min read · By Aureus Worldwide

DFSA client money and safe custody rules govern how an Authorised Firm must protect the money and assets it holds for clients, so that those assets are identifiable and returnable if the firm fails. Set out in the Dubai Financial Services Authority's Conduct of Business (COB) module, the DFSA client money and safe custody rules are among the most operationally demanding obligations a DIFC firm can take on, and among the most closely supervised. This guide explains what counts as client money and client assets, the core protections of segregation and reconciliation, and why many firms deliberately structure themselves to avoid holding client assets at all.

What the rules protect, and why

The purpose of the client asset regime is simple and serious: if a firm becomes insolvent, its clients' money and securities should not be caught up with the firm's own estate. Clients should get their assets back, quickly and in full. Everything in the rulebook, segregation, trust status, reconciliation, record-keeping and the specialist audit, serves that single aim.

The regime splits into two related sets of provisions:

• Client Money, the COB client money provisions (detailed in the module's client money appendix) covering cash a firm holds or controls for clients.
• Safe Custody Assets, the safe custody provisions (in the corresponding appendix) covering client investments such as securities, fund units and derivatives held on clients' behalf.

Both engage the same philosophy of segregation, reconciliation and independent verification, adapted to cash and to securities respectively.

Segregation and the client account

The foundational rule for client money is segregation. A firm that holds client money must place it in a designated client account, a bank account clearly titled to identify it as holding client money (for example, "[Firm] DIFC Limited, Client Account"). The firm's own funds must never be commingled with client money, except in narrow permitted circumstances such as covering bank charges or a minimum-balance requirement.

The client account must be held with an approved bank, a deposit-taking institution regulated in the DIFC, the wider UAE, or a jurisdiction offering equivalent protection. Crucially, the client money is held on trust for clients, which is what keeps it outside the firm's estate on insolvency. To make that trust status effective, firms obtain acknowledgement letters from the bank confirming that it will not treat the client money as the firm's own or exercise any right of set-off against it. The equivalent applies to securities: safe custody assets must be held in accounts clearly designated as client accounts and never mixed with the firm's own investments.

Reconciliation: the discipline that proves it

Segregation is only credible if the firm can prove, at any time, that the money and assets recorded in its books actually exist and match the bank and custodian records. That proof comes from reconciliation, performed on two levels:

• Internal reconciliation, carried out frequently (in practice daily for active firms), comparing the firm's internal record of total client money with the sum of individual client ledgers, and investigating any discrepancy at once.
• External reconciliation, carried out periodically (typically monthly), comparing the firm's internal client money records against the actual bank and custodian statements.

Both must be documented in writing, signed off by a suitably senior responsible individual, commonly the Compliance Officer or a senior manager, and retained for the DFSA to inspect (record-keeping periods for client-asset records are long, typically several years). Any discrepancy must be investigated and resolved promptly, within a short window rather than left to accumulate. The same monthly reconciliation and sign-off discipline applies to safe custody assets, matched against custodian records. This reconciliation rhythm is not back-office housekeeping, it is a primary compliance obligation, and a supervisor examining a firm will ask to see the signed reconciliations first.

Disclosure, consent and permitted uses

Holding client assets also brings transparency duties. A firm must generally:

• Disclose to clients how their money and assets are held, including the use of any third-party bank or custodian and the associated risks.
• Obtain consent where required, for example, before using a title-transfer collateral arrangement, under which a client transfers full ownership of assets to the firm as security and thereby steps outside the client money protections.
• Apply proper due diligence when selecting and monitoring banks and sub-custodians, and disclose where assets are held with a sub-custodian, potentially in another jurisdiction.

Clients are entitled to understand whether their assets sit within the protective client-money framework or, through arrangements like title transfer, outside it.

The distribution rules on insolvency

The regime's ultimate test is a firm failure. The COB provisions include client money distribution rules that govern what happens if the firm becomes insolvent: the segregated client money pool is distributed to clients ahead of the firm's general creditors, in proportion to their entitlements. This is precisely why segregation, accurate ledgers and up-to-date reconciliations matter so much, the returnability of client money in a failure depends entirely on the records being clean and the pool being properly ring-fenced beforehand. A firm that let its reconciliations lapse leaves clients exposed at the very moment the protections are supposed to work.

The client-asset auditor's report

Client asset compliance is independently verified. In addition to the ordinary audit of the firm's accounts, a firm that holds client money or safe custody assets must obtain a specific auditor's report on its client assets, a report by its DFSA-registered auditor on whether the firm has maintained systems adequate to comply with the client money and safe custody rules throughout the period, filed with the DFSA. A qualified or adverse client-asset report is a serious red flag to the regulator. Because this report tests systems and records across the whole year, firms that keep clean, reconciled records month by month sail through it, while those that scramble at year-end rarely do. It connects directly to the firm's broader audit and financial reporting obligations.

The strategic choice: hold client assets, or not?

Here is the decision many DIFC firms miss until late. Holding client money and assets triggers:

• A higher prudential category and a larger expenditure-based capital minimum, the prudential categories regime deliberately loads more capital onto firms that hold client assets.
• The full client-asset compliance machine, segregation, daily and monthly reconciliation, acknowledgement letters, disclosure and the client-asset audit.

Firms that can achieve their commercial goals without holding client assets, by arranging or advising only, or by routing all custody through a third-party custodian, sit in a lower category (often Category 4) and escape most of this burden. For an asset or fund manager, using an eligible external custodian rather than self-custody is frequently the decisive structuring choice. Whether to hold client assets should therefore be a deliberate decision taken at authorisation, weighed against its capital and operational cost, not a default that creeps in later.

A practical client-asset checklist

If your model does involve holding client assets, the essentials are:

1. Open designated client accounts at approved banks, correctly titled and on trust.
2. Obtain acknowledgement letters confirming trust status and no set-off.
3. Run daily internal and periodic external reconciliations, documented and signed.
4. Resolve discrepancies promptly and escalate anything material.
5. Disclose custody arrangements and obtain any required client consents.
6. Retain records for the required period, ready for DFSA inspection.
7. Support the client-asset auditor's report with clean, complete evidence.

How Aureus Worldwide can help

Aureus Worldwide is a Dubai-based accounting and CFO-outsourcing firm. We are not DFSA-authorised, we do not hold client money or assets, and we do not provide regulated financial services or sign the DFSA client-asset auditor's report, but we build the record-keeping and reconciliation discipline that makes client-asset compliance defensible. That includes maintaining clean client-money ledgers, running and documenting internal reconciliations to a consistent standard, and preparing the underlying records to an audit-ready state for your appointed DFSA-registered auditor's client-asset report, all through our accounting and outsourced CFO services and coordinated with your compliance officers. To strengthen the bookkeeping behind your client-asset obligations, contact our team.

Talk to our chartered accountants →