The Strategic Guide to Business Compliance Advisory in the UAE
Which authority can ask you for something, what it can ask for, and who inside the business should have the answer ready.
UAE compliance duties depend on where a company is licensed: mainland, a free zone, or DIFC and ADGM, which run their own company law, courts and regulators. This guide sets out who regulates what, which federal obligations apply wherever you sit, and how to keep them from falling between departments.
Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant
Most compliance trouble in the UAE starts somewhere unremarkable. A shareholder register is never updated after a transfer. A change of beneficial owner is agreed in a board minute and nobody tells the registrar. A company assumes its accountant handled tax registration; the accountant assumed the licence agent did. The obligations themselves are published and, for the most part, plainly worded. What fails is ownership of them.
Compliance advisory, done properly, is less about writing policies than about answering three questions for a specific company: which authorities can ask it for something, what each of them can ask for, and who inside the business is responsible for having the answer ready.
Related: See our company formation work for how the licensing decision shapes everything that follows.
Your licence decides your regulator
A mainland company licensed by an emirate's economic department sits under federal law: the Commercial Companies Law, Federal Decree-Law No. 32 of 2021, which replaced Federal Law No. 2 of 2015, governs its constitution, its share capital, its board and its shareholder meetings. It answers to the licensing authority, the Ministry of Economy for certain filings, and to the Federal Tax Authority for tax.
A company registered in the Dubai International Financial Centre or Abu Dhabi Global Market sits somewhere different. Both are common-law jurisdictions with their own companies legislation, their own courts, and their own financial regulators: the Dubai Financial Services Authority in the DIFC and the Financial Services Regulatory Authority in ADGM. Both also have their own data protection regimes, separate from the federal one. A DIFC entity does not comply with the Commercial Companies Law; it complies with DIFC company law, and the two are not interchangeable.
The other free zones sit in between. Each has a registrar with its own filing requirements and its own licence conditions, but federal law continues to apply to the areas the zone does not cover — tax and criminal liability among them. The first useful thing an adviser does is draw this line clearly for the client, because a policy written for the wrong regime is worse than no policy: it creates a paper record of doing the wrong thing carefully.
Related: Our mergers and acquisitions team sees these gaps surface fastest in due diligence.
What applies regardless of where you are licensed
Some obligations follow the business rather than the licence, and these are where most companies are exposed.
Corporate tax. Federal Decree-Law No. 47 of 2022 applies to financial years starting on or after 1 June 2023. The rate is 0% on taxable income up to AED 375,000 and 9% above that. A free zone licence does not answer the question by itself, and the old assumption that it means no tax at all is simply wrong. It is still repeated in marketing material, and still relied on by companies that have never asked anyone to put the position in writing.
VAT. Federal Decree-Law No. 8 of 2017, amended by Federal Decree-Law No. 18 of 2022, imposes VAT at 5%. Registration turns on turnover thresholds, not on where the company is licensed, and the recurring problems are mechanical: invoices that do not carry the required particulars, input tax reclaimed on blocked items, and records that cannot be produced when the authority asks.
Beneficial ownership and anti-money laundering. Companies must maintain registers of shareholders and of ultimate beneficial owners and keep the registrar informed of changes. Businesses in designated non-financial sectors — real estate brokers, dealers in precious metals and stones, corporate service providers, auditors — carry customer due diligence and suspicious transaction reporting duties of their own. These are the obligations regulators have been most visibly willing to fine.
Related: Our corporate governance advisory practice builds and maintains these registers.
Personal data. Federal Decree-Law No. 45 of 2021 sets the federal data protection framework. DIFC and ADGM entities apply their own data protection laws instead. A group operating across both needs to know which entity holds which data, not merely to publish a single privacy notice on a shared website.
Employment. Federal Decree-Law No. 33 of 2021 replaced the 1980 labour law. Free zone employers largely follow it, with DIFC and ADGM again running their own employment regimes. Contract templates drafted under the old law are still in circulation and are a common finding.
Economic Substance. Worth stating plainly, because advisers still bill for it: the Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 under Cabinet Decision No. 98 of 2024. Obligations remain only for the FY2019 to FY2022 period, which matters if there are unfiled notifications or reports sitting in that window.
Turning the list into something a company can run
A compliance framework that lives in a PDF does nothing. What works is duller: a single register of obligations, each one with a named owner inside the business, a source document, and a recurring date. Licence renewal, tax filings, register updates, audit, insurance, visa and labour quota matters — one list, reviewed at board level rather than left with whoever happens to handle administration.
Related: Read our tax consultancy page for how the tax entries on that list are handled.
Two habits do most of the work. The first is treating corporate records as live documents: minutes signed and filed at the time, resolutions matched to the transactions they authorise, registers amended the same week a transfer completes. The second is putting compliance terms in contracts where they belong — data processing terms with vendors, AML representations with intermediaries, audit and record-keeping clauses with distributors — so that a third party's failure does not become the company's problem without recourse.
Training is worth doing only if it is specific. A general session on ethics changes nothing; a session that shows the finance team what an invoice must contain, or shows sales staff which client questions must be escalated, changes behaviour.
When to bring someone in
External advice earns its cost at particular moments rather than continuously: when the business adds a jurisdiction or a licensed activity, when ownership changes, when a regulator or auditor raises a question, and when the group's structure has drifted from what the corporate documents describe. A review at those points is narrow and answerable. A standing retainer to be told the business is compliant, without anyone testing the records, is not.
Related Services: Explore our business compliance advisory and corporate business lawyer services for practical support in this area.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
