The short version
Four things cause DFSA applications to overrun: a Compliance Officer who has not been identified, a Regulatory Business Plan written as a pitch rather than an operating description, inconsistency between the application documents, and a business model that changes during review. All four are within the applicant's control.
One: the compliance hire
This is the biggest single cause and it is entirely predictable. The DFSA has to approve the Compliance Officer by name. That person needs relevant experience, has to satisfy the fitness and propriety assessment, and frequently has to relocate to the UAE and obtain a residence visa.
Founders who start the search after in-principle approval add three to four months to the timeline. Founders who start it alongside the Regulatory Business Plan do not. There is no clever way around this: the market for approvable compliance officers in Dubai is tight and it takes time.
Two: an RBP that reads like an investor deck
The Regulatory Business Plan is not a document about why the business will succeed. It is a document about how the business operates and what stops it going wrong. Reviewers want to know who signs the mandate, where client money sits, who can instruct a transaction, who checks it and what happens when that person is away.
Plans full of market sizing and strategy generate a query round asking for the operational detail. That round costs four to six weeks, and it is avoidable by writing the right document the first time.
Three: documents that contradict each other
The DFSA reads the RBP, the compliance manual, the AML policy and the financial model together. When the plan describes discretionary management and the manual only addresses advisory, that is a question. When the expenditure based capital calculation uses a cost base that differs from the projections, that is a bigger one.
This happens most often when different documents are produced by different people or lifted from different sources. The fix is a single review pass across the whole pack before submission, checking that every number and every description agrees.
Four: changing the model mid-application
Sometimes unavoidable, usually expensive. A change to the activity set can change the prudential category, which changes the capital requirement, which changes the financial model, which changes the expenditure test. The review effectively restarts.
Where the change comes from the DFSA pushing back, accept it early. Defending a position the regulator has already rejected is the most expensive route to the same destination.
What a three month application looks like
Pre-application meeting held. Category confirmed before drafting started. Compliance Officer identified and available. RBP written operationally with a financial model that ties to it. Compliance and AML manuals drafted against the actual model rather than downloaded. One or two query rounds, answered specifically and with evidence.
That is not an unusually well-resourced application. It is an application where the sequencing was right.
Questions
Can we apply to the DFSA before hiring a Compliance Officer?
You can file, but the individual has to be approved before the Licence is granted, and the approval process runs on its own timetable. Applications that reach in-principle approval without a candidate identified stall there.
How many rounds of DFSA questions should we expect?
Two to three is normal. More than that usually signals a problem with the application pack rather than with the business, most often a plan that has not described the operating model in enough detail.