Running a business in the UAE today is very different from a decade ago. The country has aligned itself with global standards set by bodies such as the Financial Action Task Force and the Organisation for Economic Co-operation and Development, which means companies are expected to be more transparent, better governed, and properly documented.
For many business owners, compliance still feels like paperwork that only lawyers worry about. In reality, maintaining the right documents is what keeps your licence active, protects you from fines, and builds trust with banks, investors, and regulators.
Ultimate Beneficial Owner (UBO) Records: Knowing Who Really Controls the Company
One of the biggest compliance changes in the UAE is the focus on Ultimate Beneficial Ownership. Simply put, authorities want to know the real people behind a company, not just the names of corporate shareholders. This change was made by Cabinet Decision No. 58 of 2020
What is a UBO?
A UBO is the natural person who:
- Owns or controls 25% or more of the company, directly or indirectly, or
- Exercises control through other means (for example, appointing most directors), or
- If no one fits the above, the senior manager is treated as the UBO by default
Mandatory UBO Registers
Under Cabinet Decision No. 58 of 2020 Most UAE companies must maintain 3 types of internal records:
- Register of Ultimate Beneficial Owners – Details each UBO’s full name, nationality, identification details, address, and basis of control.
- Register of Shareholders/Partners – Includes share classes, voting rights, and nominee relationships.
- Register of Nominee Directors or Managers – Lists names of individuals acting under another person’s instructions.
These must be:
- Kept at the company’s registered office
- Updated whenever there is a change
- Filed with the relevant authority within the prescribed timelines
The complexity of identifying UBOs often increases when natural persons reside in different countries or when ownership chains involve multiple layers of corporate entities.
If a shareholder is a company or a legal person, ownership must be traced up through the chain until the natural individuals who ultimately control the entity are identified. This requires recording the legal entity’s name, license number, headquarters address, and authorized representative at each level of the chain.
Compliance requires not only the maintenance of internal records but also the proactive filing of UBO declarations with the relevant Registrar. Article 14 of Cabinet Decision No. 58 of 2020 says that this is typically done via the Department of Economic Development (DED) portal or the Ministry of Economy’s centralized platform. A critical requirement is the 15-day update rule: any change in the UBO data or the management structure must be reported to the authority within 15 days of the change occurring.
Other Licensing and Operational Documents: Proof That You Are Allowed to Operate
A valid licence is not just a certificate on the wall—it is supported by several key documents.
Trade Licence
According to Federal Decree-Law No. 50 of 2022 and Federal Decree-Law No. 32 of 2021. Every business must maintain a valid trade licence issued by the relevant authority. The type of license and the associated compliance documentation depend heavily on whether the entity is in the mainland or a free zone.This licence must be renewed annually. An expired licence can lead to fines, blacklisting, and business disruption.
Office Lease and Address Documents
According to Article 13 of Federal Decree-Law No. 32 of 2021 businesses must maintain proof of a registered office address, such as:
- Ejari or Tawtheeq in Dubai (for mainland entities)
- Registered office confirmation (for free zones)
Why it Matters
Authorities use this to confirm that the company has a real presence and is not just a paper entity.
Establishment Card and Labour Records
Companies employing staff must maintain:
- Establishment card – It serves as a key identifier for businesses, much like a bank card does for individuals. It contains essential business details such as the company’s name, a unique card number, and its expiry date. This essential piece of identification enables businesses to access a wide range of government services, from sponsoring employee visas to managing payroll and engaging with regulatory bodies. Without it, businesses cannot legally hire foreign employees or complete essential administrative tasks.
- Wage Protection System (WPS) compliance – UAE Labour Laws mandate Use of Wage WPS when hiring employees.It is a mandatory electronic salary transfer system by the Ministry of Human Resources & Emiratisation (MoHRE) and the Central Bank to ensure private sector employees get paid on time and in full, enhancing transparency, reducing disputes, and safeguarding workers’ rights through bank/exchange house transfers
Why it matters
Non-compliance affects visa renewals and can trigger labour penalties.
AML Compliance Documents: Not Just for Banks
Many business owners assume Anti-Money Laundering (AML) rules apply only to financial institutions. In reality, several businesses—such as real estate companies, auditors, dealers, and corporate service providers—are directly covered. In ADGM they have a Anti-Money Laundering and Sanctions Rulebook.
Key AML Documents to Maintain
- Enterprise-Wide Risk Assessment (EWRA): A business must identify risks associated with their businesses and perform an enterprise wide ML/FT risk assessment on a regular basis. It must develop a risk assessment in order to understand how and to what extent it is vulnerable to ML/FT(Money Laundering/Financial Terrorism), and help determine the nature and extent of AML resources necessary to mitigate and manage that risk. It helps in Identifies money laundering risks linked to customers, countries, and services
- AML Policies and Procedures Manual: Explains how the company verifies customers, monitors transactions, and reports suspicious activity. Every entity must have procedures, controls, policies, and systems to detect suspicious activities and report them immediately to the Financial Intelligence Unit (FIU) by filing SAR/STR on the goAML portal. Key components mandated by the Ministry of Economy and the CBUAE include:
- Customer Due Diligence (CDD): Procedures for identifying and verifying customers and beneficial owners using reliable, independent source documents.
- Enhanced Due Diligence (EDD): Stricter measures for high-risk customers, such as Politically Exposed Persons (PEPs) or those from high-risk jurisdictions.
- Ongoing Monitoring: Protocols for scrutinizing transactions to ensure they are consistent with the customer’s known business and risk profile.
- Sanctions Screening: Mandatory screening of all customers and transactions against local (UAE Terrorist List) and international (UN Consolidated List) sanctions lists.
- Appointment Letter for Compliance Officer / MLRO – These are professionals who spend their days analyzing transaction data and deciding what needs to be reported to government agencies. Generally, you need an MLRO when:
- You hit regulatory thresholds: Most countries require one once you process a certain amount of money or have enough customers (the exact numbers vary by location)
- You’re getting a financial license: Banks, investment firms, and money transfer businesses must have an MLRO from day one.
- You’re expanding internationally: Different countries have different rules, and you need someone who understands them all.
- Suspicious activity is increasing: If you’re seeing more unusual transactions, you need someone trained to handle them properly.
- Auditors are asking questions: When regulators or auditors start pointing out gaps in your compliance, it’s time to act.
- Training Records: Proof that staff are trained on AML obligations
Why it Matters
Regulators expect these documents to exist even if no suspicious activity has occurred. Missing paperwork alone can trigger penalties.
Economic Substance and Corporate Tax Records: Showing Real Activity
A major shift in the regulatory landscape occurred with the issuance of Cabinet Decision No. 98 of 2024. This decision announced the cancellation of economic substance reporting requirements for financial years ending after December 31, 2022. Although formal Economic Substance filings have been discontinued for recent years, record-keeping obligations remain important, especially with the introduction of corporate tax.
Documents You Should Retain
- Board meeting minutes
- Proof of employees working in the UAE
- Lease agreements for office space
- Financial statements and invoices
Free zone entities claiming tax benefits must also demonstrate that:
- Key activities are carried out in the UAE
- Adequate staff and assets exist locally
Why it Matters
Tax authorities and auditors now review substance as part of routine checks.
Accounting, Audit, and Internal Control Records
Since Corporate governance standards in the UAE have been elevated through legislative reforms focused on transparency and risk management. The requirement for internal audit functions and formal compliance frameworks is dictated by the legal form of the entity and its regulatory status.
For mainland companies, Federal Decree-Law No. 32 of 2021 specifies that Public Joint Stock Companies (PJSCs) must establish a robust internal control environment.
Core Financial Documents
- Accounting records and ledgers
- Audited financial statements (where required)
- Bank statements and reconciliations
Larger companies and regulated entities may also need:
- Internal audit reports
- Risk management and internal control documentation
Within the ADGM, the FSRA mandates that all licensed entities establish and maintain an effective internal audit function. This is done through the General Rulebook specifically Version 7. The rulebook says that this function must be independent of day-to-day operations and report directly to the Board of Directors or the Audit Committee. The audit must cover significant operational areas, risk management, and financial controls.
For firms involved in banking, investment, or insurance intermediation, the PRU Rulebook requires regular internal audits with comprehensive reports submitted to senior management and the Board for formal review.
Why it matters
These records support tax filings, bank reviews, and investor due diligence.
Final Thoughts: Compliance as a Business Asset
Compliance in the UAE is no longer about ticking boxes. Authorities expect companies to understand their obligations, maintain proper records, and update them regularly.
From MOAs and UBO registers to AML manuals and financial records, these documents:
- Protect your business from fines and disruption
- Make banking and financing easier
- Build credibility with partners and investors
For business owners, the key is simple: keep your core documents accurate, updated, and accessible. With the right guidance, compliance becomes a strength—not a burden.
If you would like help reviewing or organising your corporate compliance documents, professional legal advice can save time, cost, and future risk.
