GCC investor acquisition: reaching UAE and Saudi investors compliantly

The short answer

Reaching GCC investors compliantly means satisfying three regimes at the same time: the UK rules on where your promotion is directed, the securities law of the country the investor is in, and that country's data protection law. In practice that points to one route. Lead with non-promotional content, build a permissioned audience, and make any actual offer through a partner licensed in the investor's jurisdiction.

The most common mistake is assuming the UK exemption for overseas promotions is a licence to market overseas. It is not. It takes the UK regulator out of the picture and leaves the local one fully in it.

The 2026 context

Any honest guide to the Gulf written this year has to start with the war. The conflict that began on 28 February 2026 closed Dubai's airspace in March. The Foreign Office was reported to have 76,000 British nationals registered in affected areas as it drew up evacuation plans, and around 30,000 British residents left the UAE at the height of the conflict, many of them temporarily.

The economic picture is now quantified. The World Bank's October 2026 update, as reported by The National, forecasts a 4.3% average contraction across the GCC in 2026, with the UAE contracting 1.6% before growing 8% in 2027 and Saudi Arabia contracting 2% before growing 6.1%. The forecast assumes the Strait of Hormuz gradually reopens from the end of December. Nobody knows whether that assumption holds.

Our position is that this is a reason to change the message, not to stop. Capital in the region has not disappeared. Investors are reassessing where they hold assets, where they bank and where they will live, and some are looking at the UK again. Campaigns that sold Gulf property on the strength of uninterrupted growth will not land. Campaigns about diversification, jurisdiction and resilience will, if they are made through the right channels.

Layer one: the UK side

Article 12 of the Financial Promotion Order exempts promotions made to, or directed only at, persons outside the UK. The FCA's guidance in PERG 8.12 explains how to show that a promotion is directed only overseas. For a promotion made from within the UK, conclusive proof needs a clear statement that it is directed only at persons outside the UK and must not be acted on by persons in the UK, plus proper systems to stop UK recipients who could not lawfully receive it from engaging. Unsolicited real-time promotions, such as cold calls, only qualify if made from outside the UK for a business carried on entirely outside the UK.

Two practical points follow. First, the FCA regards a website registered with a UK search engine as an indication of UK targeting, so a GCC landing page sitting on your main UK site is weak evidence of overseas direction. Second, investors move. An expatriate on home leave in Guildford is a UK recipient when they open your email there.

Layer two: securities law in the UAE

The UAE's federal regulator changed this year. Federal Decree-Laws No. 32 and No. 33 of 2025 took effect on 1 January 2026 and renamed the Securities and Commodities Authority as the Capital Market Authority. According to Dechert's analysis, promotion is listed among the regulated financial activities, Article 2(1)(d) of Decree-Law No. 33 reaches any person targeting clients within the UAE even from outside the country, and penalties for unlicensed activity include imprisonment of at least one year and fines of up to AED 250 million. The same analysis notes that CMA guidance on cross-border activity was still awaited in February 2026.

The rules that shaped practice before the change are still the best guide to what the CMA expects. Under the former SCA's Promotion and Introduction Regulations of 2017, promoting financial products required an SCA licence with an onshore presence, foreign funds had to be promoted through a locally licensed promoter, and the qualified investor exemption excluded natural persons, including high net worth individuals. Reverse solicitation was available but narrow, and needed to be evidenced.

For classifying individuals, the SCA rulebook's professional investor test for a natural person turns on net assets of at least AED 4 million, excluding the main residence, or relevant professional experience. The DIFC and ADGM are separate financial free zones with their own regulators, the DFSA and the FSRA, and their own rules, which the federal laws do not displace.

The working conclusion: a UK firm should not run its own promotional campaign into the UAE. It should build awareness and an audience, and route any offer through a licensed local partner or an authorised firm in the relevant free zone.

Layer two: securities law in Saudi Arabia

In Saudi Arabia, offers of securities are governed by the Capital Market Authority's Rules on the Offer of Securities and Continuing Obligations. A private placement must be restricted to sophisticated investors or structured as a limited offer, made through an authorised person licensed for arranging, and notified to the CMA at least ten days before the offer date. A limited offer is capped at 100 offerees, excluding sophisticated investors, with a minimum of SAR 1 million each, as summarised by Mondaq.

A natural person can qualify as a sophisticated investor through any of several routes, including net assets of at least SAR 5 million; securities transactions totalling at least SAR 40 million over the previous twelve months with at least ten a quarter; at least three years in a professional role in the financial sector requiring investment knowledge; or a recognised professional qualification. Check the current consolidated text before relying on any threshold, because the CMA amends these rules regularly.

Layer three: data protection

UAE

Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, took effect on 2 January 2022 and makes specific, clear consent the default basis for processing, subject to exceptions. The DIFC and ADGM have their own data protection laws and sit outside it. The federal law's implementing regulations had still not been issued by June 2026, when the UAE created a Federal Authority for Artificial Intelligence and Data that the market expects to take on its enforcement. The absence of regulations is not an absence of law. Build to the consent standard now.

Saudi Arabia

The Saudi Personal Data Protection Law took effect on 14 September 2023, with full enforcement from 14 September 2024. It requires consent to process personal data for direct marketing and an easy, simple way for people to stop receiving it. Transfers out of the Kingdom need an approved basis and, in some cases, a risk assessment, which matters as soon as a UK agency holds Saudi investor data on UK systems.

Who you are actually trying to reach

The GCC is several audiences, not one.

The UK's commercial ties shape the expatriate segments. UK defence export orders reached £13.2 billion in 2024, and the Middle East was on average the largest market from 2017 until Europe overtook it that year. That trade sustains a long-standing British professional community in Saudi Arabia and the wider Gulf. Our separate guide to marketing to UK expats in oil, gas and defence covers that audience in detail.

A route to market that holds up

1. Separate the content from the offer. Research and commentary build the audience. Offers go through the licensed route.
2. Build a permissioned GCC audience. Consent captured under the standard of the investor's jurisdiction, with records.
3. Host the GCC programme separately. Its own pages, clear jurisdiction statements, and screening for UK and other ineligible enquirers.
4. Partner locally before launch. A licensed promoter onshore, or an authorised firm in the DIFC or ADGM, named in the plan from day one.
5. Respect the calendar. The UAE works a Saturday and Sunday weekend; Saudi Arabia a Friday and Saturday one. Ramadan moves about eleven days earlier each year and changes response patterns for a month.
6. Record everything. Reverse solicitation, if you ever rely on it, is only as good as the evidence that the investor approached you.

What a GCC qualification call has to establish

Qualification for a Gulf investor is longer than for a UK one, because jurisdiction comes before suitability. Before anything about a product is discussed, the call needs to settle the following, on the recording.

The last question is not small talk. Since February, many expatriate investors in the region have had reason to revisit where they live, bank or hold property. Their answer tells the receiving team more about the right proposition than any data field does.

What we do, and where we stop

Our investor data covers the UAE, Saudi Arabia, Qatar, Kuwait, Bahrain and Oman, and we run multi-channel outreach across the region from the UK. We build the audience, the content and the qualification. We do not hold a UAE or Saudi licence, and we will not run a promotional campaign into either country without the client's licensed route in place. If a brief needs one and does not have it, we will say so at scoping.

Common questions

Where to go next

The B2B data and multi-channel outbound service page covers how we build and work international audiences. For the UK data rules that sit alongside the local ones, read sophisticated investor data: sourcing, consent and lawful use.