In this episode of The Riffle, we examine the growing global threat of cyber-enabled fraud and its impact on financial crime risk in an increasingly digitalised financial system.

The discussion explores how technologies such as artificial intelligence, digital platforms, and instant payment channels enable large-scale fraud schemes, as well as the increasing use of virtual assets to move and obscure illicit proceeds.

We also outline the FATF’s strategic response, including payment transparency measures, strengthened asset recovery frameworks, VASP regulation, and the use of advanced technologies to detect suspicious financial activity.

A concise regulatory briefing for boards, senior management, MLROs, compliance, risk, and legal teams seeking clarity on the evolving risks associated with cyber-enabled fraud.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the Dubai Financial Services Authority (DFSA) framework governing Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF), and Countering Proliferation Financing (CPF)within the Dubai International Financial Centre (DIFC).

We explore the regulatory architecture underpinning AML compliance, including the DFSA’s risk-based approach, customer due diligence (CDD) and enhanced due diligence (ECDD) requirements, senior management oversight, and verification standards for individuals and legal persons.

The discussion also covers governance expectations for digital onboarding and automated monitoring systems, accountability for outsourced AML functions, internal audit requirements, and regulatory obligations related to sanctions screening and reporting.

A concise regulatory briefing for boards, senior management, MLROs, compliance, risk, and legal teams seeking clarity on DFSA AML supervisory expectations and compliance standards in the DIFC.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the UAE Travel Rule framework applicable to Virtual Asset Service Providers (VASPs) operating across the UAE.

We explore the regulatory architecture underpinning Travel Rule compliance, including mandatory collection, verification, and transmission of originator and beneficiary information, universal cross-border application, verification thresholds, and enhanced controls for higher-risk transfers.

The discussion covers the respective obligations of originator, beneficiary, and intermediary VASPs, supervisory expectations in relation to unhosted wallets, prohibited virtual assets, STR/SAR reporting requirements, and the Travel Rule’s function as a core AML and CTF safeguard within the UAE’s virtual asset ecosystem.

A concise regulatory briefing for boards, senior management, MLROs, compliance, risk, and legal teams seeking clarity on Travel Rule implementation and supervisory standards in the UAE.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the Dubai Financial Services Authority’s supervisory communication issued on 1 March 2026 in response to evolving regional geopolitical developments and the resulting expectations for Authorised Firms within the DIFC.

The discussion outlines the DFSA’s confirmation of operational continuity, financial system resilience supported by capital and liquidity buffers, and recent stress-test outcomes.

We review the four supervisory priorities — business continuity, governance oversight, heightened risk vigilance, and proactive regulatory communication — alongside enhanced monitoring indicators, capital and funding sensitivities, and sector-specific vulnerabilities.

Particular focus is given to mandatory escalation triggers requiring prompt notification via the DFSA ePortal where risks become systemic or threaten orderly operations.

A concise overview for boards, SEOs, risk, compliance, and legal teams seeking clarity on current supervisory expectations within the DIFC.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the 2026 amendments to the Dubai Financial Services Authority’s Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (AML), enacted under Rule-Making Instrument No. 435 of 2026.

The discussion explores the alignment of the DIFC regulatory framework with Federal Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, effective 2 March 2026, and the resulting expansion of supervisory expectations for Authorised Firms and DNFBPs.

We analyse the formal integration of proliferation financing into the AML regime, enhanced customer due diligence requirements for natural and legal persons, the risk-based approach to beneficial ownership without fixed thresholds, and strengthened governance responsibilities for senior management and MLROs.

Particular attention is given to the explicit application of Federal AML obligations to Virtual Asset Service Providers (VASPs), enhanced sanctions screening requirements, SAR reporting obligations to the Financial Intelligence Unit, and the DFSA’s reinforced administrative penalty powers within the DIFC.

A concise overview for boards, senior management, MLROs, compliance officers, legal teams, VASPs, and regulated entities seeking clarity on the heightened AML and financial crime compliance expectations under the revised framework.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine Dubai’s Real Estate Tokenisation Pilot and the regulatory oversight framework governing its controlled implementation under the Virtual Assets Regulatory Authority (VARA).

The discussion explores the pilot’s phased progression from initial technological and regulatory validation to its current evaluation stage, including the assessment of secondary-market mechanisms and the conditions required for future scalability.

We also consider the legal architecture underpinning the initiative, including Dubai Law No. 4 of 2022, Cabinet Resolution No. 111 of 2022, and the applicable VARA Rulebooks, alongside jurisdictional scope across Dubai Mainland and Free Zones, with the DIFC excluded.

Particular attention is given to VARA’s formal marketplace alert addressing unauthorized promotional claims, the mandatory licensing requirement for virtual asset activities, verification through the VARA Public Register, and reporting of unlicensed conduct.

A concise overview for boards, senior management, compliance officers, legal teams, digital asset operators, and market participants seeking to understand the supervisory parameters governing tokenised real estate activity within Dubai’s regulated virtual asset ecosystem.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the VARA Connect Portal — the official digital interface of the Virtual Assets Regulatory Authority (VARA) for managing regulatory applications and supervisory engagement within Dubai’s virtual asset ecosystem.

The discussion explores the operational architecture of the portal, including entity onboarding, the Initial Disclosure Questionnaire (IDQ) process, activity-based dynamic disclosures, and the structured governance model underpinning application submissions.

We also consider key procedural elements such as access controls and multi-factor authentication, the single-editor rule, consultant authorisations, RFI batch management, payment verification workflows, and the staged communication framework applicable pre- and post-submission.

A concise overview for boards, senior management, compliance officers, legal teams, consultants, and virtual asset firms seeking to navigate VARA’s digital application environment efficiently and in line with supervisory expectations.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the Financial Services Regulatory Authority’s Cyber Risk Survey Findings and Recommendations, as set out in FSRA Notice No. 15 of 2026, and their implications for firms operating in the Abu Dhabi Global Market (ADGM).

The discussion explores the results of the FSRA’s Q3 2025 supervisory cyber risk survey, assessing the maturity of cyber risk management frameworks across Authorised Persons and Recognised Bodies, and identifying recurring governance and control weaknesses observed by the regulator.

We also consider key findings relating to board and senior management accountability, ICT asset identification, third-party risk management, adversarial testing, monitoring capabilities, and incident response preparedness, alongside the regulatory expectations underpinning the Cyber Risk Management Rules effective from 31 January 2026.

A concise overview for boards, senior management, CISOs, IT, risk, compliance and legal teams, and ADGM firms seeking to align their cyber risk frameworks with FSRA supervisory expectations and upcoming regulatory requirements.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the UAE Travel Rule framework and its implications for Virtual Asset Service Providers (VASPs operating within the UAE).

The discussion explores regulatory expectations around the collection, verification, and transmission of originator and beneficiary information, scope and universal application across jurisdictions, verification thresholds, and role-specific obligations for originator, beneficiary, and intermediary VASPs.

We also consider enhanced due diligence for unhosted wallets, prohibited assets such as privacy tokens, risk-based decisioning, and STR/SAR reporting obligations to the UAE Financial Intelligence Unit.

A concise overview for boards, senior management, compliance and legal teams, risk and AML functions, and VASPs seeking to align their controls and operating models with UAE regulatory expectations.

🎙️ Presented by 10 Leaves

In this episode of The Riffle, we examine the Financial Services Regulatory Authority’s revised IT and cyber incident reporting framework and its implications for Authorised Persons operating in the ADGM.

The discussion explores the FSRA’s expectations around timely incident identification and escalation, immediate notification obligations, the 24-hour reporting backstop, and the use of structured reporting templates across the incident lifecycle.

We also consider incident classification, impact and severity assessments, progressive reporting, supervisory engagement, and interaction with broader regulatory and legal reporting obligations.

A concise overview for boards, senior management, compliance and legal teams, IT and risk functions, and ADGM firms seeking to align their incident reporting and cyber risk frameworks with FSRA regulatory expectations.

🎙️ Presented by 10 Leaves