Compliance Audit Guide in UAE Federal: Implementation Checklist

What a compliance audit is for

A compliance audit is a comparison between two things: what the public record and your own documents say about the company, and what the company actually does. Almost every finding worth having comes from a gap between the two — a licence listing activities the business stopped doing years ago, a register of shareholders that predates a transfer, a policy that names a compliance officer who left, a filing obligation nobody was made responsible for.

The federal framework changed substantially over the last few years, and much of what businesses hold in their files was written for the previous version of it. The point of the exercise below is not to produce a document. It is to end up with a short list of things that are wrong, a named person for each, and a date.

Start with the entity record

Pull the trade licence and read the licensed activities against what the business actually sells. Operating outside the licensed activity is one of the more common findings and one of the easier to fix. Then check that the licence, the establishment card, the lease registration and the entity's registered address are all current and consistent.

Move to the corporate registers: shareholders, directors or managers, and ultimate beneficial owners. Every transfer, appointment and resignation should be reflected in the register, in the constitutional documents where relevant, and in the filings made with the authority. Beneficial ownership information must trace up through corporate shareholders to the natural persons who ultimately own or control the entity, and it must be kept current rather than filed once.

Legacy ownership arrangements deserve particular attention. Federal Decree-Law No. 26 of 2020, effective 1 June 2021, removed the requirement for 51% UAE-national ownership of mainland limited liability companies, and 100% foreign ownership is now permitted for most mainland activities, subject to a list of activities of strategic impact. Many companies restructured; some did not, and side agreements written under the old regime are still sitting in files where they no longer reflect the shareholding on the register. A local service agent for the branch of a foreign company is a different and still lawful arrangement — do not confuse the two when reviewing.

Governance under the Commercial Companies Law

Mainland companies are governed by Federal Decree-Law No. 32 of 2021, which replaced Federal Law No. 2 of 2015. Articles of association drafted under the old law are often still in force and often still contain provisions that no longer match the statute. The audit should check that the constitutional documents reflect the current law, that general meetings are held and minuted, that the manager's or board's authority is documented and that the authority actually exercised falls inside it, and that accounts are prepared and audited where required.

Related-party transactions and conflicts are worth a separate look: who approved them, on what authority, and whether the approval was recorded.

Tax

Corporate tax under Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023. Taxable income up to AED 375,000 is taxed at 0% and income above that at 9%. Registration and return filing are obligations in their own right — an entity that owes no tax still has to be registered and still has to file. Confirm that the registration exists, that the financial year used for tax matches the accounting period, and that transfer pricing documentation exists where the group's dealings require it.

Value added tax at 5% applies under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022. Check the registration position against actual turnover, confirm that invoices meet the required content, and check the treatment applied to exports, intra-group charges and any exempt or zero-rated supplies. Reclaimed input tax should be supported by documents that exist.

Economic substance: check the period, not the rule

Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 by Cabinet Decision No. 98 of 2024. Obligations remain only for the financial years from 2019 to 2022. This is a frequent source of wasted effort in both directions: some businesses still run annual substance assessments that no longer apply, while others assume the cancellation is retrospective and leave unfiled notifications or reports, or unresolved penalties, for those earlier years. The audit question is therefore about the historic periods, not the current one.

Anti-money laundering and sanctions

If the business carries on an activity covered by the anti-money-laundering regime, the audit should confirm that a compliance officer is appointed and known to the staff, that a written risk assessment exists and has been revisited, that customer due diligence is performed and evidenced before onboarding rather than reconstructed afterwards, that screening against sanctions lists is actually run, that records are retained for the required period, and that staff have been trained. Registration on the applicable reporting platforms and the mechanism for filing suspicious transaction reports should be tested rather than assumed.

Employment

Employment relationships are governed by Federal Decree-Law No. 33 of 2021, which replaced Federal Law No. 8 of 1980. Check that contracts are on the current basis and registered with the authority, that the registered contract matches what the employee was offered, that wages are paid through the Wage Protection System on time, that health insurance is in place, and that personnel files hold the permits, visas, policy acknowledgements and leave records that an inspection would ask for. Handbooks that still quote the 1980 law should be rewritten, not annotated.

Data protection

Federal Decree-Law No. 45 of 2021 governs personal data on the mainland, while DIFC and ADGM operate their own regimes. Map what personal data the business holds, why, where it is stored and who it is shared with — including group companies and service providers abroad. Then check that privacy notices exist, that a lawful basis is identified for each processing activity, that a retention position has been decided, and that there is a workable procedure for responding to a data subject request or a breach before one happens.

How to run it so it produces change

• Work from evidence, not assurances: ask for the document, and record what was produced.
• Give every finding a named owner and a date, and rank by exposure rather than by ease of fixing.
• Separate what is unlawful now from what is untidy, and say which is which.
• Keep the remediation log — proof of a considered response matters when a regulator asks.
• Re-run the entity record, tax and register checks on a fixed cadence, and after every corporate change.

Where an audit surfaces something serious — an unregistered position, a filing never made, a shareholding that does not match the register — the sequence in which it is corrected matters, and legal advice is worth taking before a voluntary disclosure or a corrective filing is made. Our corporate legal services team runs compliance reviews for mainland and free zone entities and handles the remediation, while our commercial dispute resolution practice deals with the enforcement and penalty proceedings that follow when nothing was done.

To arrange a compliance review, contact the Nour Attorneys team.

Schedule Your Consultation

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Related Resources

Explore more of our insights on related topics:

• Company Formation Checklist for UAE Investors
• Compliance Audit Guide for Financial Entities
• Contract Drafting Protocol Guidelines
• Employee Onboarding Legal Requirements