Skip to content
FTLABBefore

Guide 01

Before accepting an investor

Full

The situation

Someone is offering capital, a warm introduction that is said to lead to capital, or a paid service attached to a raise. They may be a partner at a fund, an angel, a family office, a broker, an accelerator, a studio, or a strategic company. The conversation has become warm, and a document or a transfer is close.

The decision at stake

Whether to accept this counterparty: not only whether the money would help, but whether you know who they are, whether they can do what they describe, and whether their conduct and incentives fit a relationship you cannot easily leave.

Reported

A real company, and a person who was not that company

On 3 April 2016 the DFSA warned about an advance-fee approach that used the name of Al Jomaih Investments Ltd. The company was registered in the DIFC, number 0167. The DFSA said it was not licensed and did not provide financial services in or from the DIFC. People were offered loan facilities, asked to sign an “unconditional approval” letter, and then asked to pay about USD 13,000 to 18,000 to set up a special purpose vehicle before any funds. The pattern is the point, and it is old: a true register entry did not mean the person in the inbox represented the company. Check today’s alerts on dfsa.ae before you treat any name as current.

Regulatory3 April 2016

Al Jomaih Investments Ltd impersonated in a fraudulent advance-fee scam · Dubai Financial Services Authority

The DFSA described an advance-fee approach that used the name of a DIFC-registered company (registration no. 0167) which was not licensed by the DFSA. People were asked to pay about USD 13,000 to 18,000 before any loan. Check current DFSA alerts before you rely on this as a watchlist.

Illustration

A real angel, and a deal you may still refuse

An angel you can meet in person offers a small cheque. Their passport, their company, and two founders you found yourself all match. They also want a board observer seat, a side letter that their friend who made the introduction is paid a success fee by you, and a right to approve the next hire. Nothing here looks like impersonation. The open question is whether the control and the fee are a bad deal. Those are different questions from “is this person a fiction?”, and they can both be true.

Evidence used on this page

Each label is a kind of source, not a grade. Regulatory pages describe what an authority published. They are not a ruling on your facts.

  • Practitioner21 April 2026

    Reference check questions for founders · CRV

    A venture firm’s public note on checking the specific partner, including founders whose companies struggled, rather than relying on a curated list.

  • Regulatory3 April 2016

    Al Jomaih Investments Ltd impersonated in a fraudulent advance-fee scam · Dubai Financial Services Authority

    The DFSA described an advance-fee approach that used the name of a DIFC-registered company (registration no. 0167) which was not licensed by the DFSA. People were asked to pay about USD 13,000 to 18,000 before any loan. Check current DFSA alerts before you rely on this as a watchlist.

  • RegulatoryChecked 14 October 2026

    Public register of firms · Dubai Financial Services Authority

    The DFSA’s own register of firms it authorises. Open it from dfsa.ae. A listing, or the absence of one, still does not prove who sent you an email.

  • Regulatory11 February 2025

    DFSA cautions: public register cloned · Dubai Financial Services Authority

    The DFSA warned that cloned public-register pages exist. It says a register address whose domain does not start with dfsa.ae is not legitimate, and it points readers with concerns to the DFSA complaints function.

  • RegulatoryChecked 14 October 2026

    Dubai Financial Services Authority · DFSA

    Independent regulator of financial services in or from the DIFC. Use the site itself for alerts, the public register, and the complaints route.

  • CommunityQ1 2025

    Startup Struggle Survey 2025 · Slush

    Survey of 607 early-stage European founders in Q1 2025. Fundraising was a top concern for 58.1 percent, revenue growth for 52.8 percent (from 36.8 percent), and customer acquisition for about 50 percent. The same page says 18 percent thought it would be easy to raise if they wanted to, and 57 percent disagreed.

  • RegulatoryChecked 14 October 2026

    Registrar of Companies · Dubai International Financial Centre

    The DIFC registrar describes its role in incorporation and registration of DIFC entities. A certificate shows an entity was registered. It does not show that a named person may bind it today.

  • RegulatoryChecked 14 October 2026

    DIFC Courts · DIFC Courts

    The courts of the DIFC. Whether they can hear your dispute depends on the parties and the clause. Ask counsel before you treat a forum clause as settled.

  • RegulatoryChecked 14 October 2026

    Abu Dhabi Global Market · ADGM

    The official ADGM site, including the financial centre’s own materials on registration and regulation.

  • RegulatoryChecked 14 October 2026

    Financial Services Regulatory Authority · ADGM

    The FSRA regulates financial services in ADGM. Ask whether the activity you are being offered is inside that perimeter.

  • RegulatoryChecked 14 October 2026

    FSRA public register · ADGM

    The FSRA describes this register as its official public record of firms, individuals, and other bodies it has approved. The same page says it cannot guarantee accuracy and does not accept liability for errors or missing information.

  • RegulatoryChecked 14 October 2026

    ADGM Courts · ADGM

    ADGM’s courts. A clause that names them still needs a lawyer’s view of whether it fits the dispute you might actually have.

  • RegulatoryChecked 14 October 2026

    Capital Market Authority · UAE Capital Market Authority

    The current federal capital-markets authority site. Confirm with counsel whether an onshore offer, promotion, or platform sits inside its perimeter.

  • Regulatory10 April 2025

    Regulatory alert: awareness regarding impersonation of authorised persons · ADGM Financial Services Regulatory Authority

    The FSRA warned that fraudsters misuse names and logos of FSRA-licensed firms. Only firms authorised by the FSRA may undertake regulated activities in ADGM. Check the ADGM Registration Authority public register for incorporation, and the FSRA public register for a Financial Services Permission. One register does not answer the other.

  • Practitioner21 August 2019

    Aaron Harris on fundraising and meeting with investors · Y Combinator

    Harris writes that most founders do not get to choose whose money they take. He discusses AngelList syndicates and special purpose vehicles that raise from outside limited partners, and says those forms are not bad in themselves. Concealment of who someone is, and of whose money is being invested, is a reason to be suspicious. He does not publish a four-way taxonomy of capital sources.

  • Regulatory6 October 2009

    Guide to broker-dealer registration · U.S. Securities and Exchange Commission

    A US guide. The page shows April 2008 in the heading and 6 October 2009 as a date. It discusses when finders, business brokers, and people whose compensation depends on the outcome or size of a securities transaction may need to register. It is not UAE law and it is not a list of acceptable fees.

  • Regulatory21 September 2026

    DFSA impersonated in an advance-fee scam · Dubai Financial Services Authority

    The DFSA says scammers impersonate it, claim it holds a box of money and gold, demand 11.1 percent so the package can leave the country, pose as a fictitious Compliance Department officer, send AI-generated images, and pressure a deadline. It says do not respond and do not send money, report correspondence through the DFSA complaints function, and if you have already sent money, contact your bank and the relevant police authority immediately. The page does not say to freeze every payment.

  • RegulatoryChecked 14 October 2026

    Advance fee fraud · U.S. Securities and Exchange Commission, Investor.gov

    The page describes frauds that ask for a fee up front to receive proceeds, such as a fee, a tax, a commission, a validation fee, or repayment of a margin loan. It also describes a reload scam: prior victims, sometimes approached by someone impersonating a government regulator, are asked to pay more to recover or unlock funds. It is a US page, not a ruling on UAE facts.

  • RegulatoryChecked 14 October 2026

    Commissioner of Data Protection: FAQs and glossary · DIFC

    On personal data breaches, the FAQ points to Articles 41 and 42 of DIFC Data Protection Law 2020. Notify the Commissioner as soon as practicable in the circumstances if the breach compromises confidentiality, security, or privacy. Communicate to the individual as soon as practicable if the risk is high, and promptly if there is an immediate risk of damage. This is not a blanket 72-hour rule. The FAQ says it is not legal advice and the Commissioner does not warrant accuracy for a particular firm. A direct request was rate-limited; a second fetch returned the FAQ text.

  • RegulatoryChecked 14 October 2026

    Data breach notifications · ADGM Office of Data Protection

    Under Article 32 of the ADGM Data Protection Regulations 2021, a Data Controller must notify the Office of Data Protection without undue delay and, where feasible, not later than 72 hours after becoming aware. The page describes a Data Controller as an ADGM registered entity that determines the purposes and means of processing. It does not set a 72-hour clock for every UAE startup.

  • RegulatoryChecked 14 October 2026

    AML, CTF and sanctions compliance: summary · Dubai Financial Services Authority

    The supervisory regime applies to Authorised Firms other than a Credit Rating Agency, Authorised Market Institutions, DNFBPs, and Registered Auditors, collectively Relevant Persons. Raising equity does not by itself make a startup a Relevant Person.

  • RegulatoryUpdated 11 August 2026

    UAE law on bankruptcy · UAE government portal, u.ae

    The portal describes Federal Decree-Law No. 51 of 2023. Article 3, as returned by a second fetch of the legislation portal after a direct request was blocked, applies to companies subject to the Commercial Companies Law, a natural person with the capacity of a trader, and a licensed civil company of a professional nature. It does not apply to government companies whose own documents set special rules, free-zone companies that follow special rules, Central Bank licensed banks, financial institutions and insurers under separate laws, or personal, family, and consumption debts including a home. The same u.ae page also says the law does not apply to natural individuals, which is broader than the trader limb. Follow Article 3 and ask counsel. This site does not recommend a jurisdiction.

The record

Name the decision in your own words before you collect comfort from theirs. Fundraising was the concern most often cited by the 607 early-stage European founders in the Slush survey of early 2025 (58.1 percent). That pressure is a reason to write this down, not a reason to skip it.

  5. 5.Have you already accepted, signed, paid, or given this person access?

    If yes, complete the final section as well. The earlier questions still matter.

Identity

Who is the person, which legal entity is supposed to act, and have you authenticated the contact details and the claimed relationship without using only the materials they sent? A certificate of incorporation, a DIFC registration, or a website that names a real firm answers a narrower question than founders often think. The DFSA’s 2016 alert is a plain example: the company existed on a register, and the approach was still an impersonation.

  1. 1.Have you matched the person to an identity that does not depend on the email they sent?

    A video call is a start. A passport check, a known mutual who will confirm the face, or a register of individuals at the regulator is stronger.

  3. 3.Do the email domain, phone, and address match the entity’s own published details?

    Open the entity’s site yourself. Do not rely on a link in the message.

  4. 4.Have you confirmed, from outside their message, that this person works at or represents that entity?

    A staff page they control is weak. A regulator’s individual register, a call to a published number, or a founder who knows them is stronger.

Organisation, permission, and the person

A real organisation, an authorised activity, and an authentic representative are three checks. On 10 April 2025 the ADGM FSRA warned that fraudsters misuse the names and logos of firms it licenses. Only firms authorised by the FSRA may undertake regulated activities in ADGM. The alert says to check the ADGM Registration Authority public register for a firm that claims to be incorporated or registered in ADGM, and to search the FSRA public register for a Financial Services Permission. A company on one register is not a permission on the other, and neither register proves that the person emailing you works there.

  1. 1.Have you opened the company register yourself, from the registrar’s own site?
  2. 2.If they claim a regulated activity, have you opened the regulator’s register of permissions, not only the company register?

Document, message, and payment instruction

Authenticate the document, the message, and the payment instruction separately. A genuine file can be attached to a fake thread. A genuine thread can carry a changed account number. Use a number or address you found yourself, and read back the amount, the account name, and the document date.

  1. 1.Have you confirmed the document, including its date and parties, on a channel you found yourself?
  2. 2.Have you confirmed the message came from the person, on a channel that was not inside the message?
  3. 3.Have you confirmed the payment instruction, including the account name and number, before any transfer?

Whose money is it

Aaron Harris, writing for Y Combinator on 21 August 2019, says most founders do not get to choose whose money they take. He discusses AngelList syndicates and special purpose vehicles that raise from outside limited partners, and says those forms are not bad in themselves. He says concealment of who someone is, and of whose money is being invested, is a reason to be suspicious. The four categories below are this site’s questions. They are not his taxonomy.

  1. 1.As described to you, whose money is this?

    If they will not say, choose unsure and write the refusal.

What kind of fee

A fee is not one thing. Separate the investment itself from a broker’s engagement, the company’s own legal expenses, paid advisory work, a build or services contract, and a charge said to unlock, release, or validate funds. For each, ask who is paid, for what, and on what conditions, including if the round never funds. Not every upfront payment is a fraud finding. A charge described as unlocking funds is still a reason to stop and verify the sender. The US Securities and Exchange Commission’s Guide to Broker-Dealer Registration shows April 2008 in the heading and 6 October 2009 as a date. It discusses when finders, business brokers, and people whose compensation depends on the outcome or size of a securities transaction may need to register in the United States. It is not UAE law, and it is not a menu of fees.

  1. 1.Which kind of payment is in front of you?

    You can note more than one in the next answer if several apply.

  3. 3.If any charge is described as unlocking or releasing funds, have you stopped and verified the sender before paying?

Authority

Can this person approve, sign, and fund, or are they a messenger? A real firm may still need an investment committee, a second signatory, or a client who has not yet said yes. Ask who else must agree, and what happens if that person says no after you have stopped talking to others.

  1. 1.Can the person you are speaking to sign the documents and send the money, in their own name or under a documented mandate?
  3. 3.Have you seen evidence of that authority that they did not draft for this conversation?

    A mandate, a partnership agreement extract, or a prior close they can point to. A slide is not authority.

Capacity

What evidence sits behind the promised investment, introduction, or service, and which conditions are still open? Warmth is not capacity. A fund that is nearly fully deployed, an angel whose money is “arriving next month”, and a broker whose investors are unnamed are three different gaps. Write the gap as a condition, not as a mood.

  1. 1.Have you seen evidence that the money exists and is theirs to invest: a fund announcement you can verify, a prior close, or a bank process your lawyer understands?

    Do not ask a stranger to send a bank statement to your personal inbox as proof. That request is itself a pattern to slow down.

  4. 4.Is anyone asking you to pay a fee, a deposit, or a “setup cost” before the investment is funded?

    An advance fee, especially to unlock a vehicle or a government approval, belongs in the misrepresentation section below. The DFSA alert described fees of about USD 13,000 to 18,000 before a loan that was not real.

Conduct

What happened when a previous company struggled or disagreed? CRV’s public note of 21 April 2026 makes a practical point: the founders an investor chooses as references are a biased sample, and the higher-signal calls are with people whose companies did not go well, found outside that list. Ask about the partner, not the logo of the firm. Five to seven conversations is their suggested target, including at least one difficult company. Treat that as a practitioner’s rule of thumb, not a law.

  1. 1.Have you spoken with at least one founder you found yourself, not from the investor’s list?
  2. 2.Have you spoken with a founder whose company struggled, was bridged, or failed while this partner was involved?

    CRV suggests asking the investor for those names directly. A refusal is information.

  4. 4.Are you checking the specific person who would hold the relationship, rather than the firm’s reputation?

Alignment

Incentives, fees, conflicts, time horizon, and what they expect on control and exit. A smaller valuation from a careful partner can be a better life than a larger one from a partner who needs a quick exit you do not want. Write the expectation while it is still a conversation, because it is harder to recover once it is a signature.

  3. 3.Have you said, in writing, the time horizon and the kind of exit you will not pursue?
  5. 5.If the references are thin and you badly want the money, can you still decline?

    This is a question about you, not about them.

Intermediaries

Brokers, advisors, accelerators, studios, and strategic partners often sit between you and the money. The questions are representation, success fees, exclusivity, and obligations that continue after the introduction. A strategic partner who wants a right of first refusal on your product is not “just an investor”.

  1. 1.Is anyone other than the named investor being paid, in cash or in equity, if this closes?
  3. 3.Are you being asked for exclusivity: not to speak to other investors, customers, or acquirers for a period?
  5. 5.Have they stated, in a way you can keep, whether they represent you, the investor, or themselves?

    An advisor who is paid by both sides has a conflict to write down, even when it is allowed.

A bad deal, or a misrepresented counterparty

Keep these apart, because the response is different. A bad deal is a real person and a real entity, with economics, control, or behaviour you should not accept. A possible fraud or misrepresentation is a doubt about identity, authority, or whether the investment exists. Both can be present. A warning sign is a reason to verify. It is not, by itself, a finding of fraud. Paying to “unlock” an investment is a reason to stop and verify, not a reason to negotiate the fee down. The DFSA has also warned that copies of its public register appear on other domains: open dfsa.ae yourself.

  1. 1.Which description fits, as of today?

    You can change this as you learn more.

  4. 4.Have you stopped sending money, documents, or access until the identity question is settled?

UAE and GCC: questions for an advisor

This is not a map of the law, and it does not recommend a jurisdiction. The inserts state an entity, an activity, a source date, and the fact that would change the answer. Where DIFC data protection law applies, breach notification to the Commissioner is as soon as practicable, not a blanket 72 hours. An ADGM Data Controller notifies without undue delay and, where feasible, within 72 hours. The DFSA AML module applies to defined Relevant Persons, not to every startup that raises equity. UAE federal bankruptcy has exclusions. Ask which rules apply in mainland UAE, the DIFC, and ADGM, and, if a person or asset sits elsewhere in the GCC, which country’s rules apply. The Capital Market Authority’s own page says that from 1 January 2026 the Securities and Commodities Authority was renamed under Federal Decree-Laws No. 32 and No. 33 of 2025.

Jurisdiction inserts

Each insert names an entity, an activity, a source date, and the facts that change the answer. None of them recommends a jurisdiction, a court, or a filing.

DIFC Commissioner of Data Protection

A personal data breach under Articles 41 and 42 of DIFC Data Protection Law 2020, where the breach compromises confidentiality, security, or privacy.

Notify the Commissioner as soon as practicable in the circumstances. Communicate to the individual as soon as practicable if the risk is high, and promptly if there is an immediate risk of damage. The FAQ says it is not legal advice and does not warrant accuracy for a particular firm.

What would change the answer. Whether DIFC data protection law applies to this entity and this processing, and whether the breach compromises confidentiality, security, or privacy. This is not a blanket 72-hour rule.

Regulatory Commissioner of Data Protection: FAQs and glossary FAQ checked 14 October 2026. A direct request was rate-limited. A second fetch returned the FAQ text.

ADGM Office of Data Protection

A personal data breach by a Data Controller under Article 32 of the ADGM Data Protection Regulations 2021. The page describes a Data Controller as an ADGM registered entity that determines the purposes and means of processing.

Notify without undue delay and, where feasible, not later than 72 hours after becoming aware.

What would change the answer. Whether the entity is an ADGM Data Controller, and whether notice within 72 hours is feasible. The 72 hours are not a clock for every UAE startup.

Regulatory Data breach notifications Page checked 14 October 2026.

Dubai Financial Services Authority

Anti-money laundering, counter-terrorist financing, and sanctions compliance.

The supervisory regime applies to Authorised Firms other than a Credit Rating Agency, Authorised Market Institutions, DNFBPs, and Registered Auditors. The page calls these Relevant Persons.

What would change the answer. Whether this entity is a Relevant Person. Raising equity does not by itself put a startup inside the AML module.

Regulatory AML, CTF and sanctions compliance: summary Summary page checked 14 October 2026.

UAE federal bankruptcy, Federal Decree-Law No. 51 of 2023, Article 3

A possible inability to pay debts, and whether a federal process is even in scope.

Article 3 applies to companies subject to the Commercial Companies Law, a natural person with the capacity of a trader, and a licensed civil company of a professional nature. It does not apply to government companies whose own laws or documents set special settlement or bankruptcy rules, free-zone companies and businesses that follow their own special rules, banks, financial institutions and insurance companies licensed by the Central Bank and governed by separate laws, or personal, family, and consumption debts, including a home for personal or family residence. The u.ae page also says the law does not apply to natural individuals. That sentence is broader than the trader limb in Article 3. Ask counsel which sentence governs, and follow Article 3.

What would change the answer. The legal form, whether a free zone has its own rules, whether a person has the capacity of a trader, and whether the debt is personal, family, or consumption. Nothing here recommends a jurisdiction or a process.

Regulatory UAE law on bankruptcy u.ae page updated 11 August 2026 and checked 14 October 2026. The legislation portal blocked a direct request. A second fetch returned Article 3.

  2. 2.If anyone claims a financial service in or from the DIFC, have you checked the firm and the individual on the DFSA public register, opened from dfsa.ae?
  3. 3.If the activity is in ADGM, have you checked the FSRA public register on adgm.com?
  4. 4.If the raise, the promotion, or the platform touches onshore UAE securities, have you asked counsel whether the Capital Market Authority’s perimeter applies?

Already acted?

If you have signed, paid, or lost access, use the separate page “I have already signed, paid or lost access”. It keeps suspected payment fraud, a compromised account, a contract that is not being performed, a dispute over ownership or control, and a possible inability to pay debts apart, and more than one can apply. This section does not tell you to freeze every payment, to copy systems, or to publish an accusation. A lawyer in the relevant place has to say what you can still do.

I have already signed, paid or lost access

  4. 4.Have you listed what you already hold in your own mail, your own files, and your own bank statements?

    Ask counsel before you copy a mailbox, a system, or a device that is not yours.

Saved on this device.

Open your record