On Monday 29 June 2026 the DFSA published its first Conduct Supervisory Pulse, and it chose personal account dealing as the subject. The Pulse is a new format: a direct read-out from live supervisory work, shared with the industry before any enforcement follows. The headline is uncomfortable for a sector that has grown quickly. Brokerage numbers in the DIFC have risen to 72 from 49 since 2022, and the review found that the controls around how employees trade for their own account have not kept pace, with a share of firms holding no employee-trading policy at all.
The finding that matters for anyone responsible for systems is more specific than "firms need policies". The DFSA pointed to three shortfalls in particular: over-reliance on employee declarations, thin post-trade monitoring, and weak record keeping. None of those is a policy problem. They are all problems with the machinery behind the policy. A personal account dealing regime can read perfectly on paper and still fail every one of them, because the paper does not check a trade against a restricted list, reconcile a declaration to a broker statement, or keep the record a supervisor will ask for.
The point worth holding on to
Personal account dealing is not a new obligation. COB 6.2 of the DFSA Rulebook has governed personal account transactions since 2004. The Pulse does not create a rule, it signals that supervision is now testing how firms actually run the rule that already exists. The work is not writing a policy, it is making the controls real in the systems.
The Pulse describes what good and weak personal account dealing controls look like across a set of defined areas. The grid below takes the standard control areas, sets out what COB 6.2 expects of each, the gap the Pulse commonly found, and where a system carries the control rather than leaving it to a declaration. Tap any control for the detail.
Six personal account dealing controls, and where the gap sits
Tap any control for what the rule expects, what the Pulse found, and where the system carries it
Read across the six and a pattern emerges. The controls the Pulse flagged as weak are the ones that cannot be done by a person signing a form. Pre-trade approval, holdings reconciliation, post-trade monitoring and record keeping are all jobs a system does continuously and evidences automatically, or a firm does intermittently and reconstructs under pressure. The declaration-based model is not wrong in principle, it is just only as good as the declaration, and the Pulse is the moment that limit becomes visible to a supervisor.
The reason personal account dealing came first is worth sitting with. Supervisors treat it as a read on culture: if the controls around how staff trade for themselves are weak, the broader trading environment is usually weaker too. The DFSA is now led by a former enforcement chief, and the approach echoes the conduct regimes in more established markets, where staff dealing and surveillance have long underpinned market-abuse enforcement. Phases two and three of the review are coming. Firms that fix the personal account dealing machinery now enter those phases with the foundations in place. Firms that leave it as a policy and a promise enter them under scrutiny.
What a personal account dealing system actually does
Strip away the framing and the requirement resolves into a small number of jobs that a system does well and a manual process does badly. The point is not technology for its own sake. It is that each of these jobs produces evidence as a by-product, and evidence is exactly what the Pulse found firms could not produce. This is what a fitted personal account dealing software build operationalises for a DIFC firm.
Pre-trade approval as a workflow
An employee requests, the request is checked against the current restricted and watch lists, an approver decides, and the whole chain is timestamped and kept, so approval is a process rather than a verbal nod.
Holdings and broker reconciliation
Broker statements or feeds are reconciled to declarations and approvals, flagging trades that were not approved or not declared, so the firm sees the account rather than only the attestation.
Post-trade monitoring
Approved and reconciled trades are monitored for exceptions, conflicts and timing around client activity, raising cases for compliance rather than leaving detection to spot checks.
Record keeping and MI
The full record is kept by design, with the management information a board and a supervisor expect and a defined escalation path, so producing evidence is a query, not a reconstruction.
None of this is exotic. Global compliance and surveillance suites do versions of it, and for some firms one of those is the right answer. The work that recurs in the DIFC is the fit: the restricted list that reflects this firm\u2019s client orders and research, the broker feeds that exist in this market, the approval routing that matches this firm\u2019s actual sign-off chain, and the management information shaped to what a DFSA supervisor asks for. That fit is where an off-the-shelf surveillance product meets the limits of its configuration and a firm has to decide between bending its process to the tool or building the control around its process. The same pattern shows up across UAE compliance work, where global AML platforms keep needing custom work to meet the local regulatory reality.
| Control | Declaration-reliant approach | Systematic approach |
|---|---|---|
| Pre-trade approval | Email or verbal, not checked against a live list | Workflow checked against the current restricted list, timestamped |
| Holdings visibility | What the employee chose to declare | Declarations reconciled to broker statements |
| Monitoring | Occasional spot checks | Continuous exception monitoring with cases |
| Record keeping | Scattered across email and spreadsheets | One record by design, versioned and queryable |
| Supervisor evidence | Reconstructed under deadline | Produced as management information on request |
A personal account dealing control that lives in a declaration is a promise. A control that lives in a system that checks, reconciles, monitors and records is a process. The Pulse is the moment the difference between the two becomes visible to a supervisor.
A clear word on what we are and are not. We build software. We are not a compliance consultancy, a regulated firm, or a legal advisor, and we do not tell a firm what its personal account dealing obligations are or whether it meets them. Those judgements belong to the firm\u2019s compliance function and its qualified advisors. What we do is build the system that operationalises and evidences the controls the firm and its advisors have decided it needs, fitted to the DFSA\u2019s expectations and the firm\u2019s actual systems. The advisory and regulatory relationship stays where it belongs; the build is ours.
It also does not always need a custom build. A small firm with a handful of staff and a simple book can run a tight personal account dealing process on a disciplined manual basis or a standard tool, and we will say so. The systems case strengthens with personal account dealing volume, the number of broker feeds to reconcile, the need to evidence approvals against a moving restricted list, and the wish to own the data and the management information rather than rent them. This is the same shift from one-off checking to continuous, evidenced oversight that runs through conduct supervision generally, which we look at in the move from investigation to ongoing monitoring.
Questions firms are asking
The DFSA\u2019s first Conduct Supervisory Pulse, published on 29 June 2026, reported on personal account dealing across DIFC brokerage firms and found that controls had not kept pace with the sector\u2019s growth. It noted that a share of firms had no employee-trading policy, and pointed to over-reliance on employee declarations, thin post-trade monitoring and weak record keeping as the common shortfalls. It is the opening phase of a wider 2026 review of how brokers oversee their trading environment. The authoritative text is the Pulse itself, published by the DFSA.
No. Personal account transactions have been governed by COB 6.2 of the DFSA Rulebook since 2004. The Pulse does not introduce a new rule. It signals that supervision is now testing how firms run the existing rule in practice, which is why the focus is on systems and evidence rather than on whether a policy exists on paper.
No. We are an independent software engineering company. We are not a compliance consultancy, a regulated or licensed firm, or a legal advisor, and we are not affiliated with or endorsed by the DFSA or the DIFC. We do not advise a firm on its personal account dealing obligations or whether it meets them. We build the software that operationalises and evidences the controls a firm and its qualified advisors have decided it needs. For the obligations themselves, firms should rely on the DFSA Rulebook and obtain qualified legal and compliance advice for their specific circumstances.
No. A personal account dealing system supports the compliance function, it does not replace it. The judgement on approvals, exceptions and escalations stays with compliance; the system carries the workflow, the reconciliation, the monitoring and the record. Where a firm already runs a surveillance or compliance platform that works, the question is integration and fit rather than replacement, and that is scoped before any build.
No, and we will say so. A small firm with a simple book can run a disciplined manual process or a standard off-the-shelf tool. The case for a fitted system strengthens with dealing volume, the number of broker feeds to reconcile, the need to evidence approvals against a moving restricted list, and the wish to own the data and management information. The honest answer for some firms is off-the-shelf; for others it is a build, and discovery is where that is decided.
Personal account dealing is Phase 1 of the DFSA\u2019s 2026 review of the trading environment, with further phases to follow. The same control discipline, approve, reconcile, monitor, record and escalate, extends to best execution, market conduct and broader surveillance. Firms that build the personal account dealing machinery well establish the foundations, the data feeds, the case workflow, the record, that the later phases draw on. It connects to the wider operational platform work behind a UAE financial services business, set out on our banking and fintech software page.
The DFSA has done something useful by publishing what good and weak personal account dealing controls look like before enforcement, not after. It has also made the gap legible: the firms that struggle are not the ones without a policy, they are the ones whose controls live in declarations and spreadsheets rather than in a system that checks, reconciles, monitors and records. That gap is closable, and the work to close it is ordinary software work done against a specific regulatory expectation. The clock the Pulse started is not a deadline with a fine attached, it is the window before Phase 2, and the firms that use it to make their controls real rather than rewrite their policy are the ones that will find the next review uneventful.
References to the DFSA, the DIFC, COB 6.2 of the DFSA Rulebook, and the DFSA Conduct Supervisory Pulse on Personal Account Dealing (29 June 2026) are descriptive of publicly available frameworks and publications as published at the time of writing. Figures cited (72 DIFC brokerage firms, up from 49 in 2022; the finding that a share of firms held no employee-trading policy; the identification of over-reliance on declarations, thin post-trade monitoring and weak record keeping; and personal account dealing as Phase 1 of a wider 2026 review) are drawn from publicly available summaries of the DFSA Pulse and related reporting as published, are point-in-time, and represent no specific firm. The control areas illustrated are a structural reading of the regime, not a compliance assessment of any firm. BY BANKS is an independent software engineering company; we design and build software and hand it over. We are not a compliance consultancy, a regulated or licensed firm, a legal advisor, or an accredited vendor under any DFSA or DIFC scheme, and we are not affiliated with or endorsed by the DFSA, the DIFC, or any authority, firm or organisation referenced in this article. On any engagement, the firm owns its compliance, regulatory, technology selection and personal account dealing decisions and responsibility for their implications. This article is not regulatory, compliance, or legal advice; readers should obtain qualified advice for their specific circumstances and rely on the DFSA Rulebook and the DFSA\u2019s published material for current authoritative requirements. Public sources used in this piece are listed on our Sources and Data page.
Ready to Build Something?
If this resonated, let's talk about how we can apply these ideas to your business.
Start a Conversation