DIFC Prescribed Company: Open to All, 85 Days Left

Last week, a family adviser in Dubai sent us a structure chart and a confident note: "This one sits under the Foundation, so it should be exempt." The chart showed a DIFC Foundation at the top and a Prescribed Company underneath it, holding a portfolio of investments. The adviser had read the headline correctly. DIFC had opened its Prescribed Company regime to everyone. What he had not read was the definition underneath the headline. For the new exemption, a Foundation does not count as a Registered Person. The structure he was most sure about was, on the published accounts, the one most likely to need a Corporate Service Provider. That is the whole story of the 2026 changes in one chart. DIFC deleted the entrance exam and replaced it with a chaperone. And the companies that most assume they do not need one are the ones the definition was written to catch.

This post sets out what actually changed on 24 July 2026, who is genuinely exempt, who is not, and what an existing Prescribed Company needs to do in the 85 days left before Sunday 24 January 2027. It does not declare any named company exempt or non-exempt. That test depends on who controls your company and when it was incorporated, and it has to be run structure by structure. What we can do here is give you the test exactly as the published accounts state it, so you can see whether your own assumption survives it.

DIFC Prescribed Company: What Was Removed on 24 July

Start with the opening, because it is real. The DIFC Prescribed Company Regulations 2026, Consolidated Version No. 5, were enacted and came into force on 24 July 2026. On the accounts published by firms that have worked through the enacted text, the previous qualifying purpose, applicant and nexus-based eligibility requirements have been removed as entry requirements. Regulation 4.2 also removes the requirement to conduct principal business activity in the DIFC. In plain terms, an international investor with no regional footprint no longer has to manufacture a local link to hold through DIFC.

That is a genuine change in direction. The old regime asked who you were and why you wanted the vehicle before it let you in. The new regime lets a much broader range of applicants in and puts its energy somewhere else: into who administers the vehicle once it exists. If you only read the first half of that sentence, you will price a DIFC holding company wrong. Open access is not light-touch access. The gate moved. It did not disappear.

One boundary did not move at all, and it matters for anyone tempted to use the new openness creatively. A Prescribed Company stays a passive vehicle. Its licence is restricted to holding activity. It cannot maintain a workforce, and it cannot conduct regulated financial services or establish a fund without DFSA authorisation. We see the same pattern in other UAE structuring choices, where the vehicle that is cheapest to open is the one with the narrowest permitted use, a point we made when we looked at moving a company without closing it down. A holding company that starts trading, hiring or advising is not being entrepreneurial. It is drifting outside the licence it was given.

The New Price of Admission: A Corporate Service Provider

Here is the exchange DIFC made. Every non-exempt Prescribed Company must appoint a Corporate Service Provider. In the Regulations, that means a company services provider registered with the DFSA as a Designated Non-Financial Business or Profession. The CSP is not a mailing address you rent once a year. On the published accounts, the CSP acts as the company's registered office, its filing hand and its records keeper, and as the main administrative link with the DIFC Registrar of Companies.

Read that job description slowly, because it explains the fine ladder later in this post. If the CSP is the registered office, the filing hand and the records keeper, then the quality of your books is no longer a private matter inside your own office. The records the CSP must keep updated, accessible and producible are the company's books: statutory records, ownership information and filings. A company whose records live in three inboxes and a spreadsheet last touched in March does not have a CSP problem in January. It has a bookkeeping problem that January will expose. That is why we keep returning to the same discipline we set out in our post on record keeping in the UAE: the file has to be producible on the day someone asks, not assembled after they ask.

Exempt means four controllers, not a feeling

Exemption is narrow, and it is defined by the Controller, not by how established, respectable or well-advised the structure feels. On the published accounts, a Prescribed Company is exempt only where its Controller is one of four things: a Registered Person, an Authorised Firm, a Government Entity or a Publicly Listed Entity.

Four categories. Not five. Not "a serious DIFC entity". If your Controller does not fit one of those four, as those terms are defined, you should work on the basis that a CSP appointment is required unless another exemption applies on your specific facts. And even inside the first category, the definition does quiet, decisive work.

DIFC Prescribed Company: Why Foundation Structures Get Caught

This is the trap, and it deserves its own section because so many family structures sit exactly here. "Registered Person" expressly excludes a Variable Capital Company, a Non-Profit Incorporated Organisation, a Foundation and another Prescribed Company. Say that back in ordinary language. If your Prescribed Company is controlled by a DIFC Foundation, it does not become exempt through the Registered Person route, because a Foundation is not a Registered Person for this purpose. Foundation-controlled Prescribed Companies are therefore generally not exempt, unless another exemption applies through a different Controller category.

Think about who that catches. The classic family-office pattern in DIFC is a Foundation at the top, holding companies underneath it, each one holding a different asset or investment. It is a sensible pattern. It is also, now, a pattern where the layer everyone assumed was the strongest DIFC credential, the Foundation itself, is the very thing that removes the exemption underneath it. The adviser in our opening story was not careless. He applied the old instinct: DIFC entity on top, DIFC vehicle underneath, surely that is as inside-the-system as it gets. Under the 2026 definition, inside the system is not the test. The four named categories are the test.

The same caution applies to the other exclusions. A structure controlled by a Variable Capital Company, a non-profit vehicle or another Prescribed Company should not assume the Registered Person route is open to it either. Each of those has to be tested, not waved through. And no adviser, including us, should tell you your company is exempt from a structure chart alone without checking the Controller against the defined terms. If someone gives you that answer in one line, ask them which of the four categories your Controller falls into, and watch whether the answer names a category or just repeats the confidence.

What exempt companies get, and what they still carry

An exempt company is not an unregulated company. Exemption here has a specific, limited meaning: it is exemption from the mandatory CSP appointment, because its Controller falls into one of the four categories. It does not remove the passive-activity limits, the filing duties or the need to keep proper records. Treating "exempt" as "nothing to do" would be the second mistake, right after assuming you are exempt in the first place. The first question is always the narrow one: exempt from the CSP requirement, on which category, evidenced how?

The Deadline and the Asymmetric Fine Ladder

Now the clock. Existing non-exempt Prescribed Companies incorporated before 24 July 2026 must appoint a CSP by Sunday 24 January 2027, unless the Registrar grants a longer period on application. From today, Saturday 31 October 2026, that is 85 days. Not a year. Not "some time next year". Eighty-five days, across the year-end close, the audit season and the January filing rush, in a market where every other non-exempt company incorporated before July is working to the same date.

We have watched this film before in a different part of the calendar. In Dubai's bookkeeping panic, the businesses that suffered were not the ones with the hardest position. They were the ones that discovered the work in the final window and had to buy speed instead of planning. CSP onboarding has the same shape. A proper appointment involves checks on the ownership chain, documents, and the records the CSP will be responsible for. Starting that conversation in January, when the provider's desk is full of everyone else who also waited, is a choice, even if it does not feel like one in October.

USD 20,000 for not hiring one. USD 100,000 for starving one.

The fine ladder, as the published accounts state it from the enacted Regulations, is deliberately asymmetric, and the asymmetry tells you what DIFC actually cares about. Failing to appoint a CSP carries a fine of up to USD 20,000. Failing to give the appointed CSP the documents and information it needs carries a fine of up to USD 100,000. Starving your own gatekeeper costs five times not hiring one.

Sit with that ratio for a moment. A regime that only wanted a name on a form would fine the missing name most heavily. This regime fines the missing cooperation most heavily. The message is that the appointment is the start of a working relationship in which the company feeds its CSP accurate records and information, on time, so filings and registers stay true. A company that appoints a CSP in December and then ignores its requests for ownership documents, accounts and updates has not bought safety. It has bought the larger fine bracket.

Two careful points belong with those figures. First, both are stated as "up to" maximums in the sources. They are not fixed tariffs, and this post does not tell any company what fine it would receive. Second, the money is not the only consequence. On the published accounts, the Registrar may also revoke Prescribed Company status, stripping the exemptions and concessions that come with it. Losing the status you structured around is a bigger commercial problem than a fine you can pay and forget. The status is the asset. The fine is just the invoice for putting it at risk.

What to Do in the Next 85 Days

If you hold, control or advise a DIFC Prescribed Company, run this sequence now, while 85 days is still a plan and not a panic.

• Test the Controller first, in writing. Name the Controller. Test it against the four categories: Registered Person, Authorised Firm, Government Entity, Publicly Listed Entity. Apply the exclusions inside Registered Person honestly, including Foundation, Variable Capital Company, Non-Profit Incorporated Organisation and another Prescribed Company. Record the conclusion and the category relied on. If no category fits, work as a non-exempt company.
• Check the incorporation date. The 24 January 2027 transition date in the published accounts applies to non-exempt companies incorporated before 24 July 2026. Newer companies and new incorporations need their own position confirmed, not a borrowed deadline.
• Start CSP onboarding before year-end. Choose a DFSA-registered provider, agree what it will hold as registered office, what it will file, and what records it expects from you and how often. Put the appointment date in the same diary as your tax registrations, the discipline we recommend for corporate tax registration in the UAE: one calendar, no orphan deadlines.
• Feed the gatekeeper before you appoint it. Gather statutory records, ownership information, accounts and filings into one producible file. Monthly bookkeeping is what makes this a copy-and-send exercise instead of a reconstruction project. If the file cannot be produced this week, that gap is your real January risk, larger than the appointment form itself.
• Test the intended use against the passive limit. Before any new Prescribed Company is sold to you on "open to everyone", confirm the activity is genuinely holding activity, with no workforce and no regulated activity without authorisation. Open entry does not widen what the vehicle may do.

None of that needs a restructure. It needs an honest status check, done early. The most expensive sentence in UAE structuring this year will be some version of "we assumed we were exempt", said in late January by a structure that never ran the four-category test.

An honesty note on sources

Everything material in this post is stated as its source states it. The enactment date of 24 July 2026, Consolidated Version No. 5, the removal of the qualifying purpose, applicant and nexus tests, the CSP requirement for non-exempt companies, the four exemption categories, the exclusion of Foundations and the other named vehicles from Registered Person, the 24 January 2027 transition date for companies incorporated before enactment, and the fines of up to USD 20,000 and up to USD 100,000 are taken from published accounts of the enacted Regulations, including Creation Business Consultants' account of the regime changes and Trowers & Hamlins' account of the amendments. Those accounts describe the Regulations; they are not the Regulations themselves, and the complete legal text governs. We have not declared any named company exempt or non-exempt, quoted any company a formation price, or promised any appointment outcome or timeline. Confirm your own Controller, incorporation date and CSP position against the full text and with DIFC before acting.

The practical point is safe to act on today. Run the test. If a CSP is needed, start the appointment while you still have 85 days of choice about who provides it and how calmly the records move across. Escrow can help with the two parts that sit underneath the legal appointment: the exempt-status assessment file, structure by structure, under our company formation support, and the monthly bookkeeping that keeps the records your CSP must hold ready to produce at any point. Start with a free accounting system health check at escrowconsultinggroup.com, and bring your structure chart. We will test the Controller before we admire the chart.