Financial-Services Platform M&A in the GCC: Licences, Client Assets and Conduct Risk

1. Value the regulated operating system

A financial-services platform is a coordinated operating system rather than a free-standing collection of customers and software. The system includes the licensed entity, its permitted activities, controllers, board, approved individuals, compliance and risk functions, capital resources, client-money or custody arrangements, technology, outsourcing, complaints handling and regulatory reporting. Each component supports the target's ability to originate, service and retain revenue. A break in one component can impair the value of several others.

The transaction thesis should begin with the source of economic value. A buyer may seek distribution, deposits, payments volume, lending assets, recurring advisory fees, brokerage activity, customer data, a regulated entry point or a technology platform. The team should identify which legal entity earns each revenue stream, which permission authorises it, which people and systems operate it, and which customer or counterparty rights can affect continuity. That mapping prevents the buyer from attributing enterprise value to revenue that sits outside the acquired perimeter or depends on arrangements that cannot continue after control changes.

Regulatory approval is part of the value chain. The DFSA requires authorised firms to notify or seek approval for ownership or control changes and directs applicants to GEN 11.8 and its regulatory policy process.[1] Saudi payment regulations give SAMA authority to approve, reject or impose conditions on a controller application.[2] Saudi finance-company legislation also requires regulatory approval for specified ownership and merger events.[3] These rules make the buyer's identity, ownership, governance, financial resources and business plan relevant to completion certainty.

The investment case should therefore be expressed as a controlled sequence: establish the licence and legal perimeter; test which revenue transfers; reconcile client assets and liabilities; assess historic conduct; confirm prudential capacity; design approvals and conditions; allocate residual risk through price and documents; and build a Day One plan. This sequence turns regulation from a late legal checklist into a driver of value, timing and executable structure.

Each revenue stream should be traced through the licensed entity, permission, customer contract, accountable owner and critical operating dependency.

Table 1. Licence-perimeter diligence record

The record connects legal permissions to commercial value, responsible people and completion requirements.

2. Build the approval critical path before signing

Approval planning should begin during confirmatory diligence. The buyer needs a regulator-by-regulator map covering change of control, ownership thresholds, fit-and-proper information, source of funds, business plan, governance, capital, key individuals, competition clearance and any foreign-investment or data considerations. The map should distinguish formal legal deadlines from the practical time needed to prepare a complete filing, answer questions and satisfy conditions.

The DFSA ownership-control service expressly contemplates notification or approval and a staged enquiry, application, evaluation and approval process.[1] Saudi payment rules specify a formal controller process and allow SAMA to impose conditions.[2] A buyer should avoid treating these processes as administrative filings. Regulators may examine the acquirer's group structure, financial strength, reputation, governance, conflicts, proposed management and ability to support the target. A leveraged acquisition can create further questions around debt service, capital extraction and operational independence.

The regulatory workstream needs a single fact base. The ownership chart, funds flow, financing documents, valuation case, post-close business plan and governance model should tell a consistent story. Divergence between the commercial model and regulatory submission can delay approval or create obligations that undermine the investment case. Management projections should include the cost of compliance resources, capital buffers, remediation, technology resilience and reporting.

The sale agreement should match the approval strategy. Conditions precedent need objective drafting, cooperation obligations, information rights and a clear approach to conditions imposed by a regulator. The parties should determine who bears the risk of a capital injection, governance change, business restriction or customer remediation condition. A long-stop date should reflect the actual filing sequence and potential information requests. Reverse break fees or cost-sharing may be appropriate where the buyer controls approval risk, though their use depends on bargaining position and enforceability.

3. Convert reported revenue into transferable revenue

Reported revenue is an accounting outcome. Transferable revenue is the portion expected to remain legally permitted, contractually durable, operationally supported and commercially retained under the buyer's ownership. The bridge between the two should be visible to the investment committee and reflected in valuation.

Start with legal-entity attribution. Group reporting can combine regulated and unregulated entities, related-party arrangements or cross-border services. The buyer should reconcile revenue from audited accounts to the general ledger, product systems and customer contracts. Each stream should be mapped to the relevant permission and customer proposition. Revenue outside the acquired entities should be excluded unless a binding transfer or continuing service agreement exists.

Customer contracts may contain change-of-control, assignment, termination, consent, fee-review or data-transfer provisions. Institutional customers can have procurement and counterparty standards that trigger review. Retail customers may not require formal consent, but service changes, new terms or brand migration can drive attrition. The model should avoid assuming that historic retention automatically survives an ownership change.

Product economics also matter. Payment revenue depends on volume, take rate, scheme fees, safeguarding cost and fraud losses. Lending revenue depends on yield, funding, credit losses, collections and capital. Wealth revenue depends on assets, pricing, market levels, adviser retention and custody arrangements. Brokerage revenue may be transactional and sensitive to market activity. The buyer should model the economic driver beneath the top line and test its dependence on key people, channels, counterparties and regulatory permissions.

The illustrative bridge separates accounting revenue from revenue expected to survive legal, customer, operational and conduct adjustments.

Table 2. Revenue-transferability tests

Each adjustment needs evidence, a valuation treatment and a named post-close owner.

4. Test customer concentration and behaviour

Concentration should be measured across customers, products, channels, introducers, advisers, employers, merchants, banks and counterparties. A platform with thousands of end users can still depend on a small number of distribution relationships. A lender can appear diversified by borrower while relying on one funding provider or origination channel. A wealth platform can depend on a few advisers whose departure would move client assets.

The buyer should build monthly cohorts showing origination, activation, activity, retention, revenue, complaints, losses and unit economics. Cohorts formed through incentives or temporary pricing should be separated from organic acquisition. The analysis should test whether growth came from sustainable product value or from pricing, credit policy, aggressive distribution or regulatory arbitrage.

Customer behaviour around prior service changes can inform the transaction case. Repricing, platform migration, product withdrawal and adviser turnover provide evidence of sensitivity. The buyer should compare management's retention assumptions with actual outcomes from these events. It should also identify customers whose contracts, risk profile or economics may be unacceptable under the buyer's policies.

The most useful output is a probability-weighted retention case. Customers or segments can be grouped by contractual protection, relationship ownership, service dependency, switching cost, profitability and conduct risk. The resulting downside case should flow into consideration, financing headroom and integration priorities.

5. Reconcile client money and custody from end to end

Client assets require direct evidence because the platform may hold legal or operational responsibility for money and investments that do not belong to it. DFSA Principle 9 requires an authorised firm to arrange proper protection for client assets, and the DFSA Client Assets page points firms to detailed client-money and safe-custody requirements in its Conduct of Business module.[4] IOSCO recommends regular client statements, arrangements that safeguard client rights and careful selection and review of third parties holding client assets.[5]

Saudi payment rules require safeguarded funds to be held in a separate account, reconciled daily and protected from other use.[6] These requirements illustrate why a cash balance in a bank account is insufficient evidence. The buyer should trace the full chain from customer transaction to internal sub-ledger, pooled or segregated account, bank or custodian statement, reconciliation, exception log, customer statement and general ledger.

The review should establish legal ownership, trust or segregation status, account naming, permitted investments, access rights, signatories, liens, set-off risk, insolvency treatment and the role of agents or custodians. Third-party confirmations should cover balances and account status. Reconciliations should be reperformed for selected dates, including high-volume days and period ends. Old exceptions, manual journals, suspense accounts and negative client balances require explanation.

The transaction model should separate corporate cash from client money, restricted balances, regulatory capital and settlement funds. Cash described as surplus may be unavailable for debt service or distribution. A deficit or control weakness can require immediate funding, notification and remediation. Completion accounts and leakage definitions should prevent client money from being counted as acquired cash or used to fund consideration.

The evidence chain should reconcile customer obligations to external balances and preserve ownership, access and exception controls.

6. Distinguish safeguarding design from operating effectiveness

A policy can describe the intended control while daily practice diverges. Diligence should therefore test design and operation separately. Design testing asks whether the framework covers all products, currencies, settlement cycles, legal entities, banks, custodians and failure modes. Operating testing asks whether the control worked at the required frequency, exceptions were identified, owners acted and evidence was retained.

The sample should include ordinary days, peaks, weekends, public holidays, month ends, system releases and known incidents. Reviewers should inspect reconciliation timestamps, preparer and approver identities, source-file integrity, adjustments, aged differences and closure evidence. Manual spreadsheet controls deserve particular attention because formulas, file versions and access can change without a clear audit trail.

The buyer should examine whether client money or assets have been pledged, swept, netted or exposed to bank set-off. It should test whether the account title and acknowledgement reflect the intended legal status. For custody, the chain of sub-custodians, omnibus accounts, asset registration, corporate actions, reconciliations and statements needs review. Crypto-assets and tokenised instruments can add wallet control, private-key, on-chain reconciliation and insolvency questions.

Any gap should be converted into a quantified remediation plan. The plan needs an interim control, system change, evidence standard, owner, cost and deadline. Material uncertainty can support a completion condition or specific escrow. A buyer that accepts a weak control at signing should understand whether it can legally operate the business before remediation is complete.

7. Treat conduct risk as a future cash-flow claim

Conduct risk arises where product design, distribution, advice, disclosure, pricing, servicing, collections or complaints produce an unfair or non-compliant customer outcome. Its financial effect can extend beyond fines. Remediation may include refunds, fee reversals, interest adjustments, compensation, customer communications, system correction, legal costs, external assurance, additional staff and lost revenue.

The CBUAE Consumer Protection Regulation establishes standards for licensed financial institutions, including controls around consumer assets and data.[7] The related Consumer Protection Standards give detailed expectations for products, disclosure, market conduct, complaints and protection.[8] ADGM has also enhanced aspects of client classification and conduct within its regulatory framework.[9] The buyer should apply the rules relevant to the target and period, including any regulator guidance or supervisory correspondence.

Testing should move from policies to customer outcomes. Review product approval files, target-market definitions, marketing, fee schedules, suitability or affordability records, call samples, complaints, cancellations, arrears, collections and vulnerable-customer handling. Employee and distributor incentives can reveal pressure points. Exception rates should be analysed by product, channel, adviser, branch, cohort and period.

Historic growth needs a conduct overlay. A high-converting channel may have weak disclosure or unsuitable targeting. A profitable product may contain fees that face refund risk. A low complaint rate may reflect poor complaint capture. The buyer should estimate affected populations, breach periods, redress method, response rates, operational cost and revenue changes. Each assumption should have an evidence range rather than a single unsupported point estimate.

The matrix combines customer impact and evidence of control failure to determine transaction treatment.

Table 3. Conduct-risk diligence and quantification

The buyer should connect each customer outcome to population, cash exposure, control cause and deal response.

8. Build a defensible remediation model

A remediation model should be capable of review by finance, legal, compliance and the board. It begins with the affected population and period. The team should identify all relevant accounts, transactions or customers and document data limitations. Sampling can inform the estimate, but the methodology should address selection bias, missing records and differences across channels or products.

The cash calculation may include principal, fees, interest, compensation, tax, statutory or contractual interest, tracing cost, customer communication and administration. The base case should show gross exposure, expected contact rate, validation rate, payment rate and timing. A prudent case should allow for regulator expectations, reopened periods, broader populations and execution delays.

Accounting provisions do not set the transaction exposure automatically. A provision reflects a particular accounting judgement and information date. The buyer may have a different risk appetite, remediation approach or legal view. The diligence team should reconcile the provision to underlying cases, test subsequent experience and identify exposures that are unprovided, disclosed as contingent or absent from the financial statements.

Data and systems determine execution cost. A target with complete customer history, reproducible calculations and valid contact details can remediate more efficiently than one relying on manual files. The buyer should assess whether the target can identify affected customers, recalculate outcomes, prevent recurrence, issue payments and prove closure. The model should include these capabilities in cost and timing.

9. Test AML, sanctions and beneficial-ownership controls

Financial-services M&A transfers a portfolio of customer and transaction risk. FATF Recommendation 10 requires customer identification, beneficial-owner verification, understanding of the relationship's purpose and ongoing monitoring.[10] The FATF Recommendations also address politically exposed persons, correspondent relationships, reliance, recordkeeping, suspicious transaction reporting, targeted financial sanctions and higher-risk jurisdictions.[10]

The buyer should compare the target's risk appetite with its own. A portfolio accepted under one model may require refresh, restriction or exit under another. Diligence should analyse customer risk ratings, overdue reviews, missing beneficial ownership, PEP and sanctions alerts, source-of-funds evidence, transaction-monitoring scenarios, alert backlogs, suspicious reports, law-enforcement requests and regulator findings.

Model validation matters where rules or machine-learning systems prioritise alerts. The buyer should understand coverage, thresholds, tuning, data inputs, false positives, false negatives, overrides and governance. A low alert count can indicate effective controls or weak detection. Case samples should trace source transactions through alert generation, investigation, escalation and closure.

The transaction model should include the cost and customer impact of remediation. Large backlogs can consume compliance capacity and delay integration. Customers that cannot be verified may need restrictions or exit, reducing revenue. Representations, covenants and indemnities should be tied to defined facts and periods. The buyer should retain freedom to meet legal obligations and respond to regulators, even where that action affects earn-out performance.

10. Confirm prudential capital, liquidity and funding

Regulated cash is not automatically distributable cash. The buyer should separate client money, restricted reserves, settlement balances, minimum capital, liquidity buffers and operating cash. Regulatory returns should be reconciled to audited accounts and management information. The methodology for risk-weighted assets, exposures, liquidity and concentration should be reviewed where applicable.

The post-close capital plan needs to include transaction effects. Acquisition financing, goodwill, intangible assets, group exposures, dividends, integration costs, remediation and business growth can change capital capacity. A highly leveraged holding company may depend on distributions from a regulated subsidiary, while the regulator may expect the subsidiary to remain independently resilient.

Funding durability is equally important. Deposit or wallet balances can be operationally stable yet legally repayable. Warehouse lines, bank facilities, sukuk, securitisations and related-party funding can contain change-of-control clauses, financial covenants and eligibility tests. The buyer should model renewal, margin and collateral under a downside case.

The sale agreement should define permitted distributions and leakage with reference to regulated constraints. Completion accounts should avoid treating restricted or client balances as ordinary cash. A capital injection required for approval needs a clear funding source and should be reflected in the buyer's total investment cost.

Table 4. Prudential and cash-capacity bridge

The bridge prevents regulated, restricted or client balances from being treated as acquisition cash.

11. Examine technology, data and outsourcing as regulated infrastructure

Technology diligence should connect system architecture to regulated obligations and customer outcomes. The team should map origination, onboarding, identity verification, screening, transaction processing, decisioning, ledger, reconciliation, reporting, complaints and data retention. Interfaces and manual workarounds can be more consequential than the headline technology stack.

Outsourcing does not transfer accountability. Critical providers can include cloud infrastructure, core banking, payment processors, card schemes, sponsor banks, custodians, KYC vendors, credit bureaus, call centres and analytics providers. Contracts should be tested for assignment, change of control, audit access, regulator access, subcontracting, data location, resilience, incident support, exit and transition.

Cyber diligence should examine identity and access management, privileged accounts, patching, vulnerability management, security monitoring, incident response, backups, recovery testing and material incidents. The buyer should test whether the target can restore regulated services and reconcile transactions after disruption. Historical uptime alone is insufficient evidence of recovery capability.

Data rights affect both value and compliance. The buyer should confirm the legal basis and contractual rights for customer data, analytics and model training. Cross-border transfers, retention, consent and deletion should be mapped. A proposed migration or integration can change data flows and control responsibilities, so the target-state architecture should be reviewed before the regulatory business plan is finalised.

12. Review models, pricing and automated decisions

Financial platforms increasingly use models for credit, fraud, pricing, suitability, customer risk, transaction monitoring and collections. A buyer should maintain a model inventory showing purpose, owner, data, methodology, validation, approval, monitoring, overrides and change history. Vendor models require enough transparency to govern outcomes and manage failure.

The diligence team should test performance across time and customer segments. Aggregate accuracy can conceal poor outcomes for important groups. Credit models need vintage performance, calibration, stability and override analysis. Fraud models need loss capture and customer-friction assessment. Pricing models require approval, disclosure and outcome review. Suitability tools should be assessed against the actual advice or sales process.

Artificial intelligence can accelerate document review, anomaly detection and customer service, but it also creates data, explainability, governance and third-party dependencies. The buyer should distinguish experimental tools from production decision systems. Material outputs need accountable owners, review thresholds, incident management and a controlled path for model changes.

Valuation should reflect the cost of bringing models and data into the buyer's governance standard. A proprietary model can be an asset when its rights, data lineage and performance are defensible. It can become a liability when inputs are unlawful, outputs cannot be explained, validation is absent or a critical vendor can terminate access.

13. Secure key functions and accountable governance

Regulated businesses depend on directors, senior managers, compliance officers, money-laundering reporting officers, risk leaders, finance personnel, internal audit, technology owners and product specialists. The buyer should identify which roles require regulatory approval, which people hold multiple responsibilities and which functions lack credible succession.

Retention analysis should consider more than compensation. Individuals may be concerned about independence, reporting lines, regulatory accountability, strategy and culture. The buyer should define the target operating model early enough to discuss roles, while respecting confidentiality and employment law. Where a key departure can affect approval or operational continuity, the transaction needs an alternative candidate and handover plan.

Governance after completion should preserve challenge. A buyer seeking rapid commercial integration can unintentionally weaken compliance, risk or audit independence. Board and committee terms should define reserved matters, information rights, escalation and conflicts. Group policies should be adapted to local rules and the target's activity rather than imposed without a gap analysis.

The conditional period needs controls over key-person departures, remuneration changes, regulatory appointments, outsourcing, product launches, system releases and material customer actions. These controls should protect the business without preventing compliance with law or regulator directions.

14. Integrate competition analysis with the commercial thesis

Competition clearance should be assessed from the first market-definition discussion. UAE Cabinet Decision No. 3 of 2025 sets notification thresholds based on AED 300 million of total annual sales in the relevant UAE market or an aggregate market share exceeding 40 per cent.[11] The underlying UAE competition law and Ministry process govern economic concentrations and should be applied to the transaction facts.[12][13]

Financial markets can be narrower than broad labels suggest. Payment acquiring, wallets, remittances, consumer finance, brokerage, custody and wealth services may have distinct customer groups, channels and competitive constraints. Data, distribution, licences and access to infrastructure can affect the analysis. The buyer's internal market materials should remain consistent with its commercial case and regulatory submissions.

Saudi transactions may also require review under the applicable competition regime, in addition to sector-regulator approval. Other GCC jurisdictions have their own rules and thresholds. The critical path should capture filing sequence, information requirements, remedies and long-stop implications.

Potential remedies can change value. A commitment to maintain access, limit tying, divest a business, preserve data separation or alter commercial terms may reduce synergies. The valuation model should include remedy scenarios before the buyer makes an unconditional price commitment.

15. Translate diligence into valuation

The valuation model should start with transferable revenue and risk-adjusted cash flow. It should then incorporate required capital, restricted cash, remediation, integration, technology investment, customer attrition and approval timing. This approach creates a bridge from diligence evidence to enterprise value and equity value.

Revenue multiples can remain useful as market references, but the buyer should avoid applying them to heterogeneous revenue. Recurring custody or administration fees, transaction fees, lending spread, interchange, subscription revenue and one-off implementation income have different durability, capital and risk. Segment valuation and cohort economics provide a more defensible basis.

The model should show a base case and named downside cases. Examples include delayed approval, loss of a sponsor bank, adviser departures, lower customer retention, expanded remediation, funding repricing, higher regulatory capital and delayed integration. Each case should identify the fact that would move the outcome and the action available to management.

Consideration structure can share uncertain value. An earn-out can align payment with retained revenue, though it creates disputes if the buyer changes pricing, systems or strategy. Holdbacks and escrows are more suitable for defined claims. Completion accounts can address cash, debt and working capital, while locked-box structures require rigorous leakage and balance definitions. The mechanism should match the risk rather than substitute for understanding it.

16. Build a price-protection waterfall

Transaction protection works best as a layered system. The first layer is scope and valuation: exclude value that cannot be evidenced. The second is a completion condition for matters that must be resolved before the buyer can safely own or operate the business. The third is a purchase-price adjustment for measurable balance-sheet or cash items. The fourth is a holdback or escrow for a defined exposure with uncertain outcome. The fifth is a specific indemnity for identified historic risk. General warranties and limitations sit behind these targeted tools.

The parties should avoid double counting. A conduct exposure deducted from enterprise value should not automatically generate a second recovery for the same amount. The documents need rules for insurance, provisions, tax effects, recoveries, mitigation and overlapping claims. Regulatory confidentiality and customer privacy can affect evidence and claims procedures.

Earn-outs should exclude outcomes distorted by remediation or buyer-controlled changes, or clearly specify their treatment. Seller covenants during the earn-out period should be balanced with the buyer's obligation to comply with regulation and manage risk. A regulator direction must take priority over an economic metric.

The investment committee should receive a single schedule linking each material diligence finding to valuation, condition, covenant, warranty, indemnity, escrow, insurance or accepted residual risk. The schedule prevents important findings from disappearing between advisers and transaction documents.

Risk should first be removed from value, then assigned to the most specific executable protection.

Table 5. Finding-to-protection decision matrix

The selected mechanism should be measurable, enforceable and consistent with regulatory obligations.

17. Govern signing to close and Day One

The period between signing and completion can be long enough for customers, staff, regulators and counterparties to react. The buyer needs information rights and protection against value leakage, while the target must remain independently governed and comply with law. The sale agreement should define ordinary-course operations and reserved actions without giving the buyer premature control.

A joint readiness office can track approvals, conditions, people, customer communications, financial close, client assets, technology, cyber security, outsourcing, data, regulatory reporting and Day One decisions. Each item needs an owner, evidence, dependency and escalation route. Regulatory communications should be coordinated and accurate.

Day One priorities are continuity and control. Customer funds and transactions should remain safe; licences and governance should remain valid; regulatory reporting and complaint channels should operate; access rights and signatories should reflect approved authority; and staff should know escalation routes. Large system migrations or product changes are usually better sequenced after control stability unless a regulator or critical risk requires immediate action.

The first hundred days should convert diligence findings into a board-approved remediation and value plan. The plan should preserve the evidence trail, assign accountable executives, set milestones and establish independent assurance for high-risk items. Commercial synergies should be paced against compliance capacity and customer outcomes.

18. Use an investment-committee decision standard

The investment committee should see one integrated decision record. It should identify the strategic rationale, acquired perimeter, required approvals, transferable revenue, client-asset conclusion, conduct exposure, capital need, technology dependencies, valuation, protections, downside cases and Day One plan. Each conclusion should link to evidence and a responsible workstream.

The committee should distinguish resolved findings, matters addressed through documents, post-close obligations and accepted residual risks. Approval conditions should be specific. Examples include satisfactory regulator approval, cure of a reconciliation deficit, retention of named functions, execution of a sponsor-bank consent, funding of a remediation escrow and approval of the Day One control plan.

The board of the acquired regulated entity will retain its own duties after completion. Group approval does not replace local governance or regulatory accountability. The buyer should therefore align the transaction decision with the operating board's ability to govern the business.

A reproducible decision pack should also preserve the information date. Regulatory correspondence, customer balances, complaints, capital and approval assumptions can change between committee approval and completion. The transaction team should define which changes require renewed diligence, valuation review or escalation. A material adverse change framework alone may be too broad for regulated operating risks. Specific bring-down evidence, including updated client-asset reconciliations, capital returns, complaints data, cyber incidents, key-person status and regulator communications, can provide a more useful completion control.

Accountability should continue after ownership transfers. Each accepted risk needs a board or executive owner, a due date, a funding source, a reporting metric and closure evidence. Escrow release, earn-out certification and indemnity claims should draw from the same controlled record where appropriate. This continuity reduces the risk that a finding is financially protected in the acquisition documents but operationally neglected after completion.

The committee secretary should retain the final evidence schedule, minutes, conditions and approved downside case. Subsequent deviations should be recorded with their rationale and approving authority, creating a durable link between acquisition governance and post-close supervision.

A disciplined standard improves both value and execution. It makes clear which revenue the buyer is paying for, which obligations accompany that revenue, how client assets remain protected, how historic conduct is funded and how regulatory control will operate from completion. The result is a transaction thesis that can survive scrutiny after the deal team has moved on.

References

1. Dubai Financial Services Authority, “Request for Amendment to Ownership and Control Structure,” including GEN 11.8 and RPP 2.2.13 prerequisites, 2026. https://services.dfsa.ae/authorised-person/authorised-firm-request-for-amendment-to-ownership-or-control-structure-authorized-persons-supervise/
2. Saudi Central Bank, “Implementing Regulations of Payments and Payment Services Law,” controller approval provisions, current rulebook. https://www.rulebook.sama.gov.sa/en/implementing-regulations-payments-and-payment-services-law
3. Saudi Central Bank, “Finance Companies Control Law,” including regulatory approval for merger and acquisition matters. https://rulebook.sama.gov.sa/en/finance-companies-control-law
4. Dubai Financial Services Authority, “Client Assets,” Principle 9 and Conduct of Business client-money and safe-custody framework. https://www.dfsa.ae/what-we-do/client-assets
5. International Organization of Securities Commissions, “Recommendations Regarding the Protection of Client Assets,” 2014. https://www.iosco.org/library/pubdocs/pdf/IOSCOPD401.pdf
6. Saudi Central Bank, “Article 93” and safeguarding requirements for safeguarded funds. https://rulebook.sama.gov.sa/en/article-93-2
7. Central Bank of the UAE, “Consumer Protection Regulation,” current rulebook. https://rulebook.centralbank.ae/en/rulebook/consumer-protection-regulation
8. Central Bank of the UAE, “Consumer Protection Standards,” current rulebook. https://rulebook.centralbank.ae/en/rulebook/consumer-protection-standards
9. Abu Dhabi Global Market Financial Services Regulatory Authority, “ADGM FSRA Enhances Financial Regulatory Framework for Client Classification,” 2024. https://www.adgm.com/media/announcements/adgm-fsra-enhances-financial-regulatory-framework-for-client-classification
10. Financial Action Task Force, “The FATF Recommendations,” updated 2026. https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/FATF%20Standards%20-%2040%20Recommendations%20rc.pdf
11. UAE Cabinet, “Cabinet Decision No. 3 of 2025 on Thresholds Related to the Implementation of Federal Decree-Law No. 36 of 2023,” available from the Ministry of Economy and Tourism competition-legislation register. https://www.moet.gov.ae/en/web/guest/regulation-of-competition-legislations
12. UAE Government, “Federal Decree-Law No. 36 of 2023 Regulating Competition,” available from the Ministry of Economy and Tourism legislation register. https://www.moet.gov.ae/en/laws
13. UAE Ministry of Economy and Tourism, “Economic Concentration,” filing process and guidance. https://www.moet.gov.ae/en/web/guest/economic-concentration
14. Saudi Capital Market Authority, “Merger and Acquisition Regulations,” current consolidated regulations. https://cma.org.sa/en/RulesRegulations/Regulations/Documents/Merger%20and%20Acquisition%20Regulations.pdf
15. Saudi Central Bank, “Implementing Regulation of the Finance Companies Control Law.” https://www.sama.gov.sa/en-US/LawsRegulations/FinanceRules/Implementing_Regulation_of_the_Finance_Companies_Control_Law--EN.pdf
16. Saudi Central Bank, “Safeguarding of Safeguarded Funds,” current rulebook circular. https://rulebook.sama.gov.sa/en/safeguarding-safeguarded-funds
17. Dubai Financial Services Authority, “Conduct of Business Module,” current DFSA Rulebook. https://dfsaen.thomsonreuters.com/rulebook/conduct-business-module-cob
18. Abu Dhabi Global Market Financial Services Regulatory Authority, “FSRA Rulebook,” General Rulebook and Conduct of Business framework. https://www.adgm.com/operating-in-adgm/financial-services/regulatory-framework/fsra-rulebook
19. IFRS Foundation, “IFRS 3 Business Combinations,” acquisition-method and identifiable-asset requirements. https://www.ifrs.org/issued-standards/list-of-standards/ifrs-3-business-combinations/
20. Basel Committee on Banking Supervision, “Principles for Operational Resilience,” 2021. https://www.bis.org/bcbs/publ/d516.htm