UAE AML and KYC obligations for company owners
What are UAE AML and KYC obligations, exactly?
Anti-money laundering (AML) and know-your-customer (KYC) are two sides of the same compliance framework. KYC is the process, identifying and verifying who owns and controls a company. AML is the broader obligation, ensuring that businesses and financial institutions are not used to move, conceal or legitimise criminal proceeds.
In the UAE, these obligations flow from federal law (primarily Federal Decree-Law No. 10 of 2025 on AML, which replaced Federal Decree-Law No. 20 of 2018 and took effect on 14 October 2025, and its implementing regulations), from the Central Bank of the UAE for financial institutions, and from individual freezone and mainland registrars.
The UAE is a member of MENAFATF, the regional body that follows FATF standards, and has spent the last several years tightening its compliance infrastructure. International founders setting up here should treat these rules as serious and routine, not exceptional. They sit alongside your other recurring compliance obligations, such as corporate tax registration and annual filing.
Who has to comply, and with what?
The obligations divide roughly into two tiers.
All UAE companies, regardless of emirate, structure or activity, must:
- Maintain accurate records of Ultimate Beneficial Owners (UBOs) and file them with the relevant registrar.
- Keep a register of shareholders and officers, updated when changes occur.
- Respond to KYC requests from banks, freezone authorities and other regulated counterparties.
- Cooperate with any requests from the UAE’s Financial Intelligence Unit (UAEFIU) or relevant supervisory authority.
Companies conducting Designated Non-Financial Business or Profession (DNFBP) activities face additional obligations. The DNFBP category covers: real estate brokers and developers, dealers in precious metals and stones, auditors and accountants, corporate service providers and trust and company service providers, and lawyers when conducting certain activities.
If your UAE entity falls into this category, you are required to implement a full internal AML programme, written policies and procedures, a named Compliance Officer, staff training, a risk-based client due-diligence process, and suspicious transaction reporting obligations.
What does UBO registration actually involve?
| Obligation | Who it applies to | Where it is filed |
|---|---|---|
| UBO register (25%+ ownership or effective control) | All mainland and freezone companies | Registrar of the licensing authority |
| Shareholder register | All companies | Registrar of the licensing authority |
| Beneficial ownership declaration | All companies | Registrar / freezone authority |
| DNFBP registration with supervisory authority | DNFBP-classified entities only | Relevant supervisory authority for the sector |
Under Cabinet Decision No. 109 of 2023, the UBO threshold is 25% or more of the capital or voting rights, held directly or indirectly, or the ability to exercise control by other means. A new company must file its UBO and shareholder registers with the registrar within 60 days of licensing. Where a corporate chain sits above the UAE entity, you trace through to the natural person at the top. Shell-on-shell structures do not obscure the obligation.
How does bank KYC work in practice?
Every UAE bank, Emirates NBD, FAB, Mashreq, Wio, Liv Business and the rest, runs periodic KYC reviews on business accounts. At opening they will require: incorporation documents, a valid trade licence, passport copies and visa pages for all signatories and beneficial owners, a description of business activities and expected transaction volumes, and sometimes source-of-funds evidence.
Periodic reviews happen throughout the life of the account. A common mistake is treating the opening KYC as a one-off event. When the bank sends a renewal request, and they will, respond within the stated window. Delays cause account restrictions; non-response causes closures.
If your company’s activities or ownership have changed since you opened the account, disclose this proactively rather than waiting for a review. Inconsistency between declared purpose and actual transactions is one of the most common triggers for enhanced due diligence.
What are the most common AML compliance mistakes?
Founders, especially those running lean, remote operations, tend to fall into the same traps:
Treating UBO filing as optional. It is not. Freezone authorities including DMCC, RAKEZ and ADGM have their own filing portals and deadlines. Missing them can block licence renewals.
Letting corporate documents expire. Expired trade licences, lapsed Emirates IDs or out-of-date memoranda of association create KYC gaps that banks will flag immediately.
Not updating records after ownership changes. If a co-founder exits or new investors come in, the UBO register and shareholder records must be updated with the registrar, not just internally.
Running DNFBP activities without registering. Corporate service providers and consultants who handle client structures or transactions may fall into the DNFBP category without realising it. The supervisory registration and programme obligations then apply.
Does it matter which emirate or freezone I’m in?
The federal AML framework applies everywhere in the UAE. ADGM and DIFC operate under their own legislation (aligned with but separate from federal law) and have their own supervisory bodies, the FSRA and DFSA respectively. Both apply FATF standards rigorously and run their own firm-registration and AML-oversight processes.
For companies in RAK (RAKEZ, RAK ICC), Sharjah (SHAMS), or Dubai mainland (DED), the federal framework and the relevant freezone authority’s rules apply directly. The practical compliance burden is similar across all of them, the difference is in which portal you file through and which authority you report to.
Already left the UAE with a company, visa or accounts still open? Our UAE Wind-Down tells you what’s still live in your name, and closes it down properly, from here.
Questions people ask
What is a UBO and why does my UAE company need to register one?
A Ultimate Beneficial Owner is any natural person who ultimately owns or controls 25% or more of a company, or who exercises effective control through other means. UAE regulations require companies to identify, verify and file UBO information with their registrar. This applies across mainland and freezone structures and is not optional.
Do freezone companies have to comply with UAE AML rules?
Yes. Freezone companies, whether in DMCC, IFZA, RAKEZ, ADGM, DIFC or elsewhere, are subject to UAE federal AML legislation and their freezone authority's own regulations. ADGM and DIFC operate under their own frameworks that closely mirror FATF standards and in some respects go further.
My UAE company is just a holding company with no customers. Do AML rules still apply?
They apply in a more limited form. You still have UBO filing obligations and must respond accurately to bank KYC requests. Whether you need a full AML programme depends on whether your activity is classified as a Designated Non-Financial Business or Profession (DNFBP). A holding company that does not conduct DNFBP activities typically sits outside the full programme requirement, but the UBO and beneficial ownership obligations remain.
What triggers enhanced due diligence from my UAE bank?
Banks apply enhanced due diligence to accounts where the beneficial owner is a politically exposed person (PEP), where transactions involve higher-risk jurisdictions, where the account shows activity inconsistent with its declared purpose, or on periodic review cycles. Providing clean, consistent corporate documents and responding promptly to requests is the most reliable way to avoid delays.
What happens if I ignore a KYC request from my UAE bank?
Banks are required to restrict or close accounts where KYC documentation is not provided within the required window. This is not discretionary, it is a regulatory obligation on the bank. In practice it means your account can be frozen or terminated, which then creates downstream problems with your licence renewals and visa status.