This is written for boards and chief executives rather than compliance teams. Most DIFC firms outsource the Compliance Officer or MLRO function and trust that it is being handled, and usually it is. When it is not, the failure is quiet. Nothing breaks and no alarm sounds; the gap tends to show up during a regulator interaction, at which point the protection you were paying for turns out to have been thinner than you assumed.
The warning signs are usually visible long before that. Seven of them are worth knowing. One in isolation may be nothing. Several together are worth acting on.
1. You only hear from them at renewal
A function that surfaces once a year, around the annual return, is processing paperwork rather than managing risk. Compliance is continuous work, and if your only contact is an invoice and a signature request, you are paying for a title.
2. Every report says everything is fine
No firm goes a full year without a single issue, gap or judgement call. A report that never raises anything usually means nobody is looking hard enough to find it. The reports worth trusting are the ones that occasionally tell you something you would rather not have heard.
3. The policies could belong to anyone
Open the compliance manual and read a page at random. If nothing in it reflects your actual clients, products and risks, it is a template with your name on the cover. The DFSA expects a framework built around your firm, and generic documents are among the first things an experienced examiner notices.
4. They are absent from your governance
A Compliance Officer or MLRO needs a line of sight into how the firm is actually run: the board discussions, the significant decisions, the new business. Someone who never attends a governance meeting and only learns what happened afterwards can advise on nothing and react to everything. Reactive compliance is how firms end up explaining rather than preventing.
5. Regulatory change reaches you from somewhere else
Horizon scanning is part of the job, which means knowing what is coming before it lands. If you consistently hear about DFSA rule changes, deadlines or thematic reviews from a peer, a newsletter or your auditor before your own Compliance Officer mentions them, one of the function's core tasks is not being done.
6. There is no evidence trail
Compliance that cannot be evidenced barely counts. Ask for the record of the monitoring done, the reviews performed and the decisions taken, and it should come back quickly and in order. If it is vague, or assembled only after you ask, it will not hold in an examination, where the trail is exactly what gets tested.
7. It all rests on one person you can rarely reach
A function that depends on a single individual who is hard to reach, with no visible team behind them and no cover if they step away, carries a concentration risk that was probably never priced in. The value of outsourcing is meant to be resilience: depth, cover and availability. A lone, distant point of contact is the opposite of that.
What good looks like, and what to do now
A compliance function that is working feels different. You hear from it between renewals. The policies read as though they were written for your firm. Someone competent is in the room when decisions are made, warning you about what is coming rather than explaining what already happened, and the evidence is there when you ask for it. That is the baseline the DFSA assumes you already have, not a premium.
If any of this landed uncomfortably, one request settles most of it: ask for the evidence trail from the last six months and watch how quickly and cleanly it arrives. ECOVIS JRB provides outsourced compliance and MLRO support for DIFC firms and reviews existing arrangements where a board wants an independent read. That read is far better had now than during an examination.
Salman Rafique is Founding Partner for Assurance & Compliance at ECOVIS JRB, part of the ECOVIS International network. He works with companies across ADGM, DIFC and the UAE mainland on statutory audit, regulatory compliance and outsourced compliance functions.