UAE broker warning list

Scope

This list covers financial brokers and investment firms regulated (or falsely claiming to be regulated) by the three UAE financial authorities:

• DFSA: Dubai Financial Services Authority (DIFC).
• FSRA: Financial Services Regulatory Authority (ADGM, Abu Dhabi).
• CMA: Capital Market Authority (onshore UAE; formerly the SCA).

How these scams work

Reading the regulators' alerts, five patterns dominate. Recognising them matters more than memorising names, because the specific entities change constantly.

Unauthorised firms. A firm operates in or from the UAE, often with a slick website and a Dubai address, without any licence to conduct financial services. The regulator states plainly that it is not authorised.

False claims of a licence. A firm actively claims on its site or to clients that it is DFSA, FSRA or CMA regulated when it is not. This is the most common DFSA alert type.

Clone and impersonation scams. The most dangerous kind: scammers impersonate a genuinely licensed firm, copying its name, branding and even its real licence number, then route you to a lookalike site or "account manager". The licence checks out, but you are not dealing with the licensed firm. Always reach a broker through the contact details on the regulator's register, never the ones a caller or website gives you.

Regulator impersonation. Fake emails, letters, "notices", Telegram channels, forged official seals and even cloned public registers, impersonating the DFSA or its executives, frequently to demand advance "release fees", "taxes" or "certificates" before releasing funds that do not exist.

Advance-fee scams. You are told a large sum is "frozen" and can be released once you pay a fee, tax or certificate charge. Paying never releases anything; it invites further demands. No legitimate broker or regulator ever charges you to release your own money.

The warning list

Most recent first. Type tags the pattern above. Source links the regulator's own alert.

A date marked "(reported)" is the date a news outlet reported the warning, not the date the regulator published it, because we could not read the regulator's own notice to confirm it. Those rows link the report and say so in the Source column. Treat them as a lead to verify on the regulator's register, not as a confirmed notice.

Crypto and virtual-asset platforms (VARA)

Crypto and virtual-asset activity in Dubai (outside the DIFC) is regulated by a separate authority, VARA (the Virtual Assets Regulatory Authority), not the DFSA, FSRA or CMA. VARA issues its own consumer and marketplace alerts about unlicensed virtual-asset firms, as well as enforcement fines against licensed exchanges. Because that is a different regulator and a different product from the trading brokers above, we do not fold it into the main list.

If you are checking a crypto exchange or token platform, verify it and read VARA's notices directly on VARA's own site. Recent VARA consumer alerts have concerned unlicensed platforms operating in or from Dubai; VARA has also taken enforcement action against firms including well-known exchanges. Always confirm a crypto platform's status with VARA before depositing.

What to do if you think you've been scammed

Act fast, and don't send another dirham.

• Stop paying immediately. Never pay a "release fee", "tax" or "verification deposit" to unlock a withdrawal. It never works.
• Contact your bank or card issuer now to stop, recall or dispute the payments and block further transactions. Speed matters for any chance of recovery.
• Preserve everything: screenshots, chat logs, account names, wallet addresses, transfer receipts, phone numbers, URLs.
• Report cybercrime or online fraud to Dubai Police eCrime at ecrime.ae, via the Dubai Police app, or on 901. In Abu Dhabi, use the confidential Aman service. Call 999 if you feel physically threatened.
• If a CBUAE-licensed bank or financial institution is involved, complain to the institution in writing first, then escalate to the CBUAE Consumer Protection Call Center on 800 22823, and if unresolved to the independent ombudsman, Sanadak (sanadak.gov.ae).
• If the firm claimed DIFC or ADGM regulation, report it to the DFSA or the ADGM FSRA through their complaint channels. This also helps them flag clone and impersonation scams.
• Keep every case reference number.
• Watch for the recovery scam that often follows: anyone promising to get your money back for an upfront fee is a second fraud.

Data sources and provenance

Entity names and domains change, so this is a point-in-time compilation and not a substitute for the regulators' own registers. If you believe an entry is out of date or incorrect, contact us.

• DFSA entries are compiled from the DFSA's public alerts page; each row links the specific alert.
• FSRA entries are compiled from the ADGM/FSRA regulatory alerts page; each row links the specific alert.
• CMA entries are compiled from the CMA's open-data warnings page. That page builds its table in the browser, so on some days it cannot be read and returns nothing.
• Where a regulator's own page could not be read, a row cites the press report instead, and both the date and the Source column are marked to show it. We replace those citations with the regulator's own notice once we can reach it.