Regulatory & Compliance Advisory
Your licence, from strategy to sign-off.
The core of what we do — choosing the right regulator and activity, building the application and policy pack, and defending it through review across VARA, DFSA, ADGM, CMA, GCGRA and CBUAE.
What it covers
One partner across every UAE regulator.
Regulatory and compliance advisory is the backbone of a successful licence — the strategy that decides which framework fits and the evidence that proves you belong in it.
We handle the full arc: perimeter analysis, activity selection, the regulatory business plan, AML/CFT and governance policies, responsible-individual documentation, and the back-and-forth with the regulator until you are approved — then we stay on to keep you compliant.
How we help
Strategy, application, assurance.
Licence strategy
We confirm the right regulator and activity for your model and map the fastest credible route to approval.
Application & policies
We prepare the business plan, AML/CFT policy pack and forms, and manage the regulator review end to end.
Ongoing compliance
We keep your obligations met after approval — monitoring, reporting and governance as an ongoing partner.
FAQ
Advisory questions.
Which regulators do you cover?
VARA, DFSA, ADGM (FSRA), CMA, GCGRA and CBUAE — the full UAE regulatory map. We help you choose the right one first.
Do you write the policies too?
Yes. We produce the AML/CFT, governance and risk policy pack each regulator expects, tailored to your activity — not templates.
Can you take over an application already in progress?
Often, yes. We review where it stands, fix the gaps and steer it through the remaining review stages.
What happens after approval?
Your compliance obligations begin. Our pre- & post-licence support keeps them met without disruption.
Where a model sits inside a regulated activity, governance questions follow the sector rather than the technology. See AI governance in UAE regulated activities for how that plays out in practice.
What regulatory advisory actually involves
The phrase covers everything from a one-page opinion to running an authorisation end to end. Here is what we mean by it, and what a firm entering the UAE should expect to be asked.
Perimeter first: what are you actually doing?
Regulators assess substance, not description. A firm that calls itself a technology provider may be arranging deals. A non-custodial platform may still control client assets. A token may be a payment instrument under one framework and a security under another. Before anything is filed we map your activity, money flows and control points against the UAE frameworks — VARA, the CMA, the DFSA, ADGM's FSRA, the CBUAE and the GCGRA — and establish which regime you fall into and why.
Then structure, then submission
The right regime determines the entity, the substance requirements and the people you need in controlled roles. We structure the UAE entity, define the governance, identify who must be assessed for fitness and propriety, and build the policy suite the authority expects — AML and sanctions, risk, compliance monitoring, conflicts, outsourcing, client assets, business continuity — written for your business rather than adapted from a template.
Where applications lose time
- Describing the business in terms that do not match how the authority classifies activity
- Policy suites that contradict the operating model, or each other
- Controlled-role candidates who cannot evidence relevant experience, or who are not genuinely available to the firm
- Substance arrangements that look like a mailbox rather than an operation
- Technology and security commitments written to impress rather than to be delivered
- Answering a regulator's follow-up questions inconsistently across workstreams
One team across the whole obligation
Advisory alone leaves you to source the technology and the security separately, which is where most of the contradictions above come from. KOLL keeps them together: the same team that writes the monitoring policy specifies the RegTech that implements it, and the security commitments are designed by the cybersecurity practice that will help you operate them. We then stay on through post-licence support.
Requirements differ by authority and by activity, and they change. We confirm the current position against the official framework for your case before anything is relied on. Start with the UAE regulatory ecosystem if you are not yet sure which authority applies.
Advised end to end
Start with a strategy conversation.
Tell us your goals. In one confidential call we'll confirm the right regulator, the activities you need, a realistic timeline and the exact next steps.