IT for DMCC Companies in JLT: A Practical Guide from Flexi-Desk to 50 Staff
What IT a DMCC-licensed trading or advisory company in JLT really needs, from a flexi-desk to a leased office of 50.
Most DMCC companies in JLT need less IT than they expect, but it has to be set up properly. A flexi-desk or very small office can run on Microsoft 365, managed laptops, MFA and a separate backup. Once you lease an office with its own network, add business-grade Wi-Fi, a firewall, a second internet line with failover, documentation and regular support.
Key takeaways
- Flexi-desk and very small offices should stay cloud-first: Microsoft 365, managed laptops, MFA on every account and a separate backup.
- Travelling directors should reach company systems through cloud apps protected by MFA, never through remote desktop exposed to the internet.
- Trading companies should confirm any change to supplier bank details by calling a number already on file, never by replying to the email.
- Offices that trade across time zones need a second internet line from a different provider, with automatic failover on the firewall.
- Older JLT fit-outs often keep usable cabling but need new switches, firewalls and access points, so test before deciding.
- The domain, Microsoft 365 tenant and admin credentials must be registered to the company, not to one partner or a former IT contact.
What IT do DMCC companies in JLT need at each office size?
What a DMCC company in JLT needs depends less on headcount than on whether you control a network. A flexi-desk company lives almost entirely in the cloud; a leased office with its own cabling, Wi-Fi and internet lines needs the network looked after as well.
Many JLT tenants are trading and professional-services companies that start on a flexi-desk or in a small serviced unit, then take a fitted office as the team grows. The mistake is carrying flexi-desk habits into a 30-person office: personal email accounts for suppliers and files on a partner's laptop. The table below is a sensible baseline. Our IT support page for JLT and DMCC covers how we look after these offices. Free zone requirements and renewals are published by DMCC.
| Office size or setup | What IT it needs |
|---|---|
| Flexi-desk or virtual office | Company domain, Microsoft 365 with MFA, managed laptops with disk encryption, cloud backup of mailboxes and files |
| Small serviced office on the building network | All of the above, plus a clear rule that company data never sits only on a laptop, and a shared printer set up securely |
| Leased office with its own network | Business firewall, managed switches and access points, separate guest Wi-Fi, a second internet line with failover, a small UPS |
| Growing office of 20 to 50 staff | All of the above, plus standard laptop builds, onboarding and offboarding checklists, documentation and monitored support |
How should travelling directors access company systems securely?
Start with cloud apps and MFA, not a VPN. If email, files and accounting systems live in Microsoft 365 and cloud platforms, a director in a hotel only needs a managed laptop or phone and a strong sign-in.
Turn on MFA for every account, preferably with an authenticator app rather than SMS codes, and block legacy sign-in methods that bypass it. Microsoft 365 Business Premium adds Conditional Access and Intune, which let you require a managed, encrypted device before anyone opens company data. Our guide to MFA for small businesses explains the rollout.
When a VPN still makes sense
A VPN is still useful when a system genuinely lives in the office: a NAS holding archived contracts, an on-premises accounting server or a line-of-business application that cannot move to the cloud. Run it on the firewall, require MFA for every connection and give each person their own account so access can be removed when they leave.
Avoid exposed remote desktop
Opening remote desktop (RDP, normally port 3389) straight to the internet so a partner can reach an office PC is one of the most common ways small offices are breached. Automated scanners find these ports constantly and try passwords around the clock. If someone needs a desktop in the office, put it behind the VPN or use a managed remote access tool with MFA.
How can trading companies stop invoice and payment-diversion fraud?
Combine email security with a payment procedure that does not rely on email at all. Attackers who compromise a mailbox, or register a lookalike domain, can send a genuine-looking message asking you to pay a supplier's new bank account.
Trading companies are attractive targets because they pay large invoices to overseas suppliers, often under time pressure and across time zones. Technology reduces the risk; the procedure is what catches the attempt that gets through. Microsoft documents the controls that catch most of these attempts in anti-phishing protection, and suspected fraud can be reported to Dubai Police.
- Confirm every change of bank details by calling the supplier on a number already held on file, never one given in the email.
- Require a second person to approve new beneficiaries and changes to existing ones.
- Enforce MFA on every mailbox, including shared mailboxes and accounts belonging to partners who rarely log in.
- Publish SPF, DKIM and DMARC records for your domain so others can reject messages forging it.
- Tag external emails and alert on new mailbox forwarding rules, a common sign that an account has been taken over.
Does a JLT office need a second internet line and failover?
If the business trades across time zones, yes. A single line means one fault stops calls, email and trading platforms, often at the hours when Asian or American counterparties are most active.
The practical setup is a second line from a different provider, for example one from du and one from e&, where the building supports both, connected to a firewall that switches over automatically. A mobile 5G or 4G router can serve as the backup where a second fixed line is not available. Put the firewall, switch and access points on a UPS, and test failover by unplugging the main line rather than assuming it works. Our network and Wi-Fi service covers dual-line design and configuration.
How can you tell an older JLT fit-out needs new cabling or network kit?
Look for unlabelled cabling, consumer-grade equipment and nobody able to explain how the network is built. Many JLT offices have been refitted and re-let several times, and each tenant leaves something behind.
- A patch panel with no labels and no port map, so every fault starts with tracing cables.
- A router supplied with the internet line doing the work of a firewall.
- Switches or access points that no longer receive firmware updates from the vendor.
- Wi-Fi that drops in meeting rooms or at desks furthest from the access point.
- A comms cupboard without ventilation that runs hot through the summer.
- Cable runs added over the years through ceilings with no record of where they go.
Refresh or replace?
Test the cabling before deciding. If existing runs pass certification and reach the desks you need, keep them and replace the active kit: firewall, switches and access points. Replace the cabling when runs fail testing, the layout is changing, or you need outlets where none exist. Cabling works in towers normally need building management approval, so allow time for it.
Moving between JLT clusters or to a bigger office
Order internet lines for the new office early, survey the space before the fit-out is finished and have the network live before moving day. Our office IT relocation checklist sets out the order of work.
How do you keep the domain, tenant and data owned by the company?
Register everything to the company and hold the master credentials centrally. In partner-led firms, the domain is often bought on one partner's personal card and the Microsoft 365 tenant was set up by a freelancer who has since moved on.
Transfer the domain to a registrar account in the company's name, keep at least two global administrator accounts for Microsoft 365 with one emergency account stored securely, and give your IT provider delegated rather than exclusive access. Use shared mailboxes for addresses such as accounts and trading desks, so they survive staff changes. When someone leaves, block sign-in, convert their mailbox to shared if needed and move their OneDrive files to a manager.
Backing up Microsoft 365 and shared files
Microsoft keeps the service running, but its retention of deleted items is limited and it is not a backup you control. A separate Microsoft 365 backup covering mail, OneDrive, SharePoint and Teams protects against accidental deletion, a malicious leaver and ransomware syncing encrypted files to the cloud. If the office also has a NAS, back it up off site and test restores regularly. Our Microsoft 365 and cloud service includes tenant setup, ownership and backup.
Is a remote support plan enough, or do you need full managed support?
A remote plan with on-call visits suits a small, cloud-first office. Full managed support makes sense once you run your own network, firewall, second line or NAS, or when an outage would stop trading.
A five-person advisory firm on a flexi-desk mainly needs account administration, laptop management, MFA, backup checks and someone to call. A 40-person trading office with its own network needs monitoring, patching, failover testing, documentation and engineers who can be on site when a switch fails. Many JLT companies move from the first to the second as they grow. Our comparison of managed IT and break-fix support explains the trade-offs.
How should a DMCC company handle audit, KYC and document requests?
Trading companies in DMCC spend a surprising amount of time sending documents to people who are entitled to ask for them: the free zone portal at renewal, banks running periodic KYC reviews, auditors at year end, and counterparties who want a licence copy before they will sign. The usual method is an email with six attachments, which is slow, insecure and impossible to retrieve six months later when the same bank asks again.
The better pattern is a single, well-organised set of company documents in SharePoint, with the licence, lease, memorandum, share register, bank letters and signatory IDs kept current in one library that only the directors and the person handling compliance can edit. When a request arrives, share a link to exactly the documents needed, set it to expire, and let the recipient view without downloading where that is enough. The link can be revoked the day the audit closes, and the library's version history shows which copy of the licence was in force on any given date.
Add an electronic signature tool for the documents that need signing, so a director travelling can sign a board resolution from a phone rather than printing, signing and scanning in a hotel business centre. And keep a simple log of what was sent to whom and when, because the second request from the same bank is nearly always for the same pack, and the log turns a two-hour scramble into a two-minute resend.
- One current company-documents library, editable only by directors and the compliance owner.
- Expiring, view-only sharing links instead of email attachments.
- Version history so you can prove which document was in force when.
- Electronic signature for resolutions and agreements signed on the move.
- A log of what was sent to which bank, auditor or counterparty.
How Listonics helps DMCC companies in JLT
Listonics engineers work on site across the UAE, including JLT, with remote support UAE-wide. For a flexi-desk or small office we set up Microsoft 365, MFA, managed laptops and backup. For leased offices we design the network, firewall and second-line failover, and refresh cabling in older fit-outs. Managed IT support is a fixed monthly fee per user or per device, with 24/7 monitoring under a managed plan and a network diagram, asset register, account list and port map handed over. Start with a free office IT assessment and talk to Listonics about the right level of support.
Frequently asked questions
A flexi-desk company needs a domain registered to the company, Microsoft 365 with MFA on every account, laptops that are managed and encrypted, and a separate backup of mailboxes and files. It does not usually need its own firewall or server. The priority is making sure company data and accounts belong to the business rather than to individuals.
Not always. If email, files and business applications are in Microsoft 365 and other cloud platforms, MFA and managed devices give secure access without a VPN. A VPN is still useful when a system only exists in the office, such as a NAS or on-premises accounting server. In that case, require MFA and individual accounts for every user.
Call the supplier on a phone number you already hold, not one in the email or attached invoice, and confirm the change with someone you know. Require a second person to approve any new or changed beneficiary. Treat urgency and requests for secrecy as warning signs, even when the email appears to come from a known address.
Yes, where the building supports both providers. The usual approach is a business firewall with two internet connections, set to fail over automatically if the main line drops. Some firewalls can also spread traffic across both lines. Test failover regularly and put the firewall and switches on a UPS so a brief power cut does not interrupt calls.
Not necessarily. Have the existing cabling tested first. If runs pass and outlets are where you need them, keeping the cabling and replacing the switches, firewall and access points is often the sensible option. Replace cabling when runs fail, the layout changes or outlets are missing, and allow time for building management approval.
The company should hold at least two global administrator accounts, with one emergency account stored securely, and your IT provider should have delegated admin access. Avoid a setup where only one partner or an outside contractor holds the master credentials, because leaving staff or a disputed contract could lock the business out of its own email and files.
Keep them in one SharePoint library, share an expiring link to just the documents requested rather than emailing attachments, and set it to view-only where the recipient does not need a copy. Revoke the link when the review closes. It is faster than email and leaves a record of exactly what was shared.
Written by Srinivasan Ramachandran, Founder, Listonics · Published Sep 13, 2026 · Last reviewed October 22, 2026 · 2225 words
