Compliance Audit Guide in Abu Dhabi Mainland: Documentation Requirements
An ADGM entity in the same group is audited against an entirely different standard.
An inspection, a bank review, a buyer's due diligence request and a tax query all ask an Abu Dhabi mainland company the same thing: can you produce the document that proves what you say you did? This guide goes file by file through what a DED-licensed entity should be able to hand over — the licence and the approvals behind it, corporate records under Federal Decree-Law No. 32 of 2021, employment files under Federal Decree-Law No. 33 of 2021, corporate tax and VAT records, the historic economic substance years, personal data under Federal Decree-Law No. 45 of 2021, and anti-money-laundering checks — naming the gaps that usually turn up and who inside the business owns each file.
What a compliance audit is actually for
An inspection, a bank review, a buyer's due diligence request and a tax query all ask the same underlying question of an Abu Dhabi mainland company: can you produce the document that proves what you say you did? A compliance audit is the exercise of asking that question of yourself first, file by file, while there is still time to fix what is missing.
This guide sets out the files an Abu Dhabi mainland entity should be able to produce, who inside the business owns each one, and the gaps that most often turn up when nobody has looked in a while. It deals with mainland entities licensed by the Department of Economic Development. ADGM is a separate common-law jurisdiction with its own regulator and its own rules, so an ADGM entity in the same group is audited against a different standard.
The licence file
Start with the licence itself, because everything else is measured against it. Check that the activities recorded on the licence still describe what the business does. Businesses drift: a trading company starts providing installation services, a consultancy starts reselling software. Where the activity has moved, the licence needs amending, and where the new activity is regulated, an approval from the relevant sector authority is needed before the amendment.
Then check the supporting documents behind the licence: the registered tenancy, the manager's appointment, the signatories on record, and any external approvals attached to the activity. A tenancy that lapsed, or a manager who left two years ago but is still the recorded manager, will surface at renewal at the worst possible moment.
Corporate records
Company records sit under Federal Decree-Law No. 32 of 2021, which replaced Federal Law No. 2 of 2015 as the Commercial Companies Law. The audit should confirm that the company holds a current, signed memorandum of association reflecting the actual shareholding, together with every notarised amendment; a register of shareholders that matches the memorandum; minutes of general assembly and management decisions, including approval of the accounts; and the register of ultimate beneficial owners, updated for any change in the ownership chain.
Two mismatches are common. Shares were transferred commercially but the memorandum was never amended, so the register and the reality diverge. And decisions that the law or the memorandum reserves to the shareholders were taken by a manager without a resolution. Both are fixable while everyone is still on speaking terms and expensive to fix afterwards.
The employment file
Employment is governed by Federal Decree-Law No. 33 of 2021, which replaced Federal Law No. 8 of 1980. For every employee the company should hold a signed contract matching the terms registered with the authority, the work permit and residence visa, the passport and Emirates ID copies, evidence of salary payment through the wage protection arrangements, and records of leave taken.
Check that job titles on the permits match the work actually performed, that end-of-service calculations follow the current law rather than the one it replaced, and that any policy documents handed to staff — handbooks, bonus schemes, restrictive covenants — are consistent with the contracts and with the law. Where the company uses contractors or secondees, confirm which entity sponsors them and who carries the employer obligations.
Tax records
Corporate tax is imposed by Federal Decree-Law No. 47 of 2022 and applies to financial years starting on or after 1 June 2023. Taxable income up to AED 375,000 is charged at 0% and income above that at 9%. The audit should confirm registration, confirm that the accounting records support the taxable income reported, and confirm that transactions with related parties and connected persons are documented on terms the company could defend.
VAT is charged at 5% under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022. Check that registration status still matches turnover, that tax invoices carry the required particulars, that input tax claimed is supported by valid invoices, and that returns reconcile to the ledgers.
The Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 by Cabinet Decision No. 98 of 2024. Obligations remain only for the financial years 2019 to 2022, so the audit should confirm those historic filings were made and that nothing is left open, rather than continuing to run a current-year process that no longer applies.
Data, records and financial crime
Personal data handled in the UAE is governed by Federal Decree-Law No. 45 of 2021. The audit should identify what personal data the business holds about customers, employees and suppliers, on what basis, where it is stored, who it is shared with, and how long it is kept. Contracts with service providers who process data on the company's behalf need terms that reflect that role. DIFC and ADGM operate their own data regimes, so a group with entities there cannot rely on a single policy.
Where the activity brings the business within the anti-money-laundering framework — as it does for several categories of designated non-financial businesses and professions — the file should show a customer due diligence process that is actually followed, records of the checks performed, a nominated officer, and staff training.
Audit map
| Area | Documents to produce | Usual owner |
|---|---|---|
| Licence | Trade licence, activity list, registered tenancy, sector approvals, signatory records | Administration |
| Corporate | Memorandum and amendments, share register, resolutions and minutes, beneficial ownership register | Company secretary or general counsel |
| Employment | Contracts, permits and visas, wage payment records, leave and end-of-service calculations, policies | Human resources |
| Tax | Corporate tax registration and returns, VAT registration, tax invoices, related-party documentation | Finance |
| Historic substance | Filings for the financial years 2019 to 2022 and correspondence closing them out | Finance |
| Data and financial crime | Data inventory, processing terms, retention rules, customer due diligence records, training log | Compliance |
Running the audit so it produces something
Give each area a named owner and a fixed date. Ask for the document, not for confirmation that the document exists — the gap between the two is where the findings are. Record each finding with the fix, the person responsible and a date, and re-test the ones that were missing. An audit that ends in a memorandum nobody actions is worse than no audit, because it creates a written record that the company knew.
Set a repeat interval and tie it to real triggers as well: a change of shareholder, a new regulated activity, a first hire in a new emirate, a financing round, or a buyer asking for a data room.
Where this leads
Most enforcement and most failed transactions in Abu Dhabi trace back to records, not to conduct. The business did the right thing and cannot prove it, or did something reasonable that nobody documented. An audit closes that distance while it is still cheap.
Our corporate legal services team runs compliance reviews for Abu Dhabi mainland entities, rebuilds corporate records that have fallen behind, and prepares companies for due diligence. Where a review turns up a dispute with a counterparty, a shareholder or an employee, our commercial dispute resolution team acts on it.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
- Company Formation Checklist for UAE Investors
- Compliance Audit Guide for Financial Entities
- Contract Drafting Protocol Guidelines
- Employee Onboarding Legal Requirements
