We recently wrote about how Dubai is experiencing massive growth in fund management and is establishing itself as the third-largest global hub for hedge funds after New York and London. There are several reasons for this, including its strategic location, business-friendly environment (including tax breaks) and high quality of life for residents.
The numerous hedge funds setting up in Dubai are within the Dubai International Financial Centre (DIFC). This is a “free zone” physically located in Dubai, where there are fewer restrictions for financial firms; however, they are still required to comply with the rules and regulations of the Dubai Financial Services Authority (DFSA). So, if you’re a UK-regulated firm expanding into Dubai, what are the key things you need to know about their approach to cyber security?
First, check their Rule Book
Unsurprisingly, like other leading regulators, the DFSA has made cyber resilience a cornerstone of its regulatory agenda. Whether you're a hedge fund or another financial firm, you’ll be expected to demonstrate a robust cyber security framework from day one.
Similar to the Financial Conduct Authority (FCA), all DFSA authorised firms must comply with the Rule Book. Specifically, this includes the Cyber Risk Management rules outlined in the General (GEN) Module. These rules require firms to:
- Implement a cyber security framework tailored to their size, complexity, and risk profile.
- Identify, assess, and mitigate cyber risks.
- Detect, respond to, and recover from cyber incidents.
- Ensure board-level oversight and accountability for cyber risk.
Similar to the FCA, the DFSA does not mandate the use of a specific cyber security standard. Instead, it encourages firms to adopt internationally recognised frameworks such as NIST, ISO 27001, with a particular emphasis on the G7 Fundamental Elements of Cybersecurity.
Understanding the G7 Fundamental Elements of Cyber Security
These are a set of eight high-level principles developed by the G7 nations to guide financial sector entities in building and maintaining effective cyber security. The principles are as follows:
- Cyber security strategy - Develop a risk-based strategy aligned with industry standards.
- Governance - Define roles, ensure accountability, and allocate resources and authority for oversight.
- Risk & controls - Identify critical operations and third-party risks and implement appropriate controls.
- Monitoring - Continuously monitor systems and test controls to detect and address threats.
- Response - Respond swiftly to incidents, contain impacts, notify stakeholders, and coordinate actions.
- Recovery - Restore operations securely, address vulnerabilities, and communicate progress.
- Information sharing - Share timely, actionable cyber intelligence with relevant stakeholders.
- Continuous learning - Regularly review and enhance the cyber security framework based on evolving risks and lessons learned.
Participate in the Threat Intelligence Platform
One of the more innovative requirements and tools from the DFSA is the Threat Intelligence Platform (TIP). This is the first regulator-led cyber threat intelligence platform in the region.
TIP enables firms to:
- Share and receive real-time threat intelligence.
- Participate in cyber simulations.
- Benchmark their cyber maturity against peers.
Using the TIP is a strong way to demonstrate alignment with the DFSA and that you’re actively working to protect your business.
Focus on cyber security when heading to Dubai
Dubai is expanding rapidly and is quickly catching up to New York and London for hedge fund management. Financial services firms who choose to expand or set up there, benefit from a very supportive regulatory environment, with a particularly strong focus on cyber security. Firms looking to align their cyber security practices should focus on the G7 Fundamental Elements of Cybersecurity and take part in the DFSA’s Treat Intelligence Platform. Good luck!
