UAE AML and KYC obligations for company owners
Just researching? Get the free setup planner → · Specific situation? Talk to us →
What are UAE AML and KYC obligations, exactly?
Anti-money laundering (AML) and know-your-customer (KYC) are two sides of the same compliance framework. KYC is the process, identifying and verifying who owns and controls a company. AML is the broader obligation, ensuring that businesses and financial institutions are not used to move, conceal or legitimise criminal proceeds.
In the UAE, these obligations flow from federal law (primarily Federal Decree-Law No. 20 of 2018 on AML and its implementing regulations), from the Central Bank of the UAE for financial institutions, and from individual freezone and mainland registrars.
The UAE is a member of FATF and has spent the last several years tightening its compliance infrastructure. International founders setting up here should treat these rules as serious and routine, not exceptional. They sit alongside your other recurring compliance obligations, such as corporate tax registration and annual filing.
Who has to comply, and with what?
The obligations divide roughly into two tiers.
All UAE companies, regardless of emirate, structure or activity, must:
- Maintain accurate records of Ultimate Beneficial Owners (UBOs) and file them with the relevant registrar.
- Keep a register of shareholders and officers, updated when changes occur.
- Respond to KYC requests from banks, freezone authorities and other regulated counterparties.
- Cooperate with any requests from the UAE’s Financial Intelligence Unit (UAEFIU) or relevant supervisory authority.
Companies conducting Designated Non-Financial Business or Profession (DNFBP) activities face additional obligations. The DNFBP category covers: real estate brokers and developers, dealers in precious metals and stones, auditors and accountants, corporate service providers and trust and company service providers, and lawyers when conducting certain activities.
If your UAE entity falls into this category, you are required to implement a full internal AML programme, written policies and procedures, a named Compliance Officer, staff training, a risk-based client due-diligence process, and suspicious transaction reporting obligations.
What does UBO registration actually involve?
| Obligation | Who it applies to | Where it is filed |
|---|---|---|
| UBO register (25%+ ownership or effective control) | All mainland and freezone companies | Registrar of the licensing authority |
| Shareholder register | All companies | Maintained internally, filed on request |
| Beneficial ownership declaration | All companies | Registrar / freezone authority |
| DNFBP registration with supervisory authority | DNFBP-classified entities only | Relevant supervisory body (e.g. CBUAE, RERA, DMCC) |
The UBO threshold is 25% direct or indirect ownership, or the ability to exercise effective control by other means. Where a corporate chain sits above the UAE entity, you trace through to the natural person at the top. Shell-on-shell structures do not obscure the obligation.
How does bank KYC work in practice?
Every UAE bank, Emirates NBD, FAB, Mashreq, Wio, Liv Business and the rest, runs periodic KYC reviews on business accounts. At opening they will require: incorporation documents, a valid trade licence, passport copies and visa pages for all signatories and beneficial owners, a description of business activities and expected transaction volumes, and sometimes source-of-funds evidence.
Periodic reviews happen throughout the life of the account. A common mistake is treating the opening KYC as a one-off event. When the bank sends a renewal request, and they will, respond within the stated window. Delays cause account restrictions; non-response causes closures.
If your company’s activities or ownership have changed since you opened the account, disclose this proactively rather than waiting for a review. Inconsistency between declared purpose and actual transactions is one of the most common triggers for enhanced due diligence.
What are the most common AML compliance mistakes?
Founders, especially those running lean, remote operations, tend to fall into the same traps:
Treating UBO filing as optional. It is not. Freezone authorities including DMCC, RAKEZ and ADGM have their own filing portals and deadlines. Missing them can block licence renewals.
Letting corporate documents expire. Expired trade licences, lapsed Emirates IDs or out-of-date memoranda of association create KYC gaps that banks will flag immediately.
Not updating records after ownership changes. If a co-founder exits or new investors come in, the UBO register and shareholder records must be updated with the registrar, not just internally.
Running DNFBP activities without registering. Corporate service providers and consultants who handle client structures or transactions may fall into the DNFBP category without realising it. The supervisory registration and programme obligations then apply.
Does it matter which emirate or freezone I’m in?
The federal AML framework applies everywhere in the UAE. ADGM and DIFC operate under their own legislation (aligned with but separate from federal law) and have their own supervisory bodies, the FSRA and DFSA respectively. Both apply FATF standards rigorously and run their own firm-registration and AML-oversight processes.
For companies in RAK (RAKEZ, RAK ICC), Sharjah (SHAMS), or Dubai mainland (DED), the federal framework and the relevant freezone authority’s rules apply directly. The practical compliance burden is similar across all of them, the difference is in which portal you file through and which authority you report to.
Already left the UAE with a company, visa or accounts still open? Our UAE Wind-Down tells you what’s still live in your name, and closes it down properly, from here.