UAE Corporate Compliance: A Practical Guide for Businesses

The UAE has established itself as one of the most dynamic commercial jurisdictions in the region.  A standing built, in part, on the deliberate expansion of its regulatory framework. Federal legislation now governs an extensive range of corporate matters: taxation, beneficial ownership, anti-money laundering, climate-related reporting, data protection, and employment. These obligations apply to every entity doing business in the Emirates, irrespective of size, sector, or structure, and they have increased considerably in scope and complexity in recent years.

Compliance in this jurisdiction is not discharged by a routine licence renewal or an annual tax filing. It is a structured, year-round legal discipline, continuous from the first day of incorporation, that demands active management and consistent diligence. Every aspect of a business’s operations must be properly authorised and every approval must be held and renewed on time.

For smaller enterprises, the stakes are particularly acute as penalties that a large organisation may absorb as an administrative matter can carry material operational and financial consequences for a growing business.

The businesses that navigate this environment successfully are those that treat compliance not as a reactive obligation, but as an integral part of how they operate.

Key Legislation: The Current Framework

The following instruments form the core of the applicable corporate compliance framework as at April 2026:

• Federal Decree-Law No. 32 of 2021 on Commercial Companies, as substantially amended by Federal Decree-Law No. 20 of 2025, modernises governance standards for onshore entities, introducing new rules on share classes, shareholder protections, exit mechanisms, and constitutional document requirements now taking full effect in 2026.
• Federal Decree-Law No. 47 of 2022 (Corporate Tax Law), imposes a 9% federal tax on business profits exceeding AED 375,000. The first corporate tax return for financial year 2024 was due 30 September 2025; the return for FY 2025 is due 30 September 2026.
• Cabinet Decision No. 129 of 2025 (Tax Procedures), effective 14 April 2026, replaces the prior penalty framework and serves as the unified procedural code for Corporate Tax, VAT, and Excise Tax.
• Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, consolidates and strengthens the UAE’s AML/CFT framework, with updated obligations on all Designated Non-Financial Businesses and Professions (DNFBPs).
• Federal Decree-Law No. 11 of 2024 on Climate Change, in force from 30 May 2025, imposes mandatory greenhouse gas monitoring, reporting, and reduction obligations on all UAE entities, including SMEs and free zone companies, with no minimum size or revenue threshold. Penalties range from AED 50,000 to AED 2,000,000.
• Emiratisation requirements: In 2026, private-sector companies with 50 or more employees are required to achieve a 10% Emiratisation rate in skilled roles by end of 2026, through consistent annual increments of 2%. Companies with 20 to 49 employees operating across 14 designated economic sectors, including finance, real estate, and information technology, are subject to a separate obligation based on which at least two UAE nationals must be employed. Non-compliance in both cases attracts graduated financial contributions, the quantum of which is calibrated to company size and the number of unfilled positions.

One principle underlies all of the above: in the UAE, nothing is permitted by default. Every commercial activity requires a license; every license is issued subject to conditions; every condition carries a renewal cycle; and every renewal cycle is governed by a deadline. The failure to maintain any one of these in good standing can disrupt the company’s day-to-day operations and, in the most serious cases, render its activities unlawful in their entirety.

Annual Compliance Obligations: A practical Overview

The following sets out the principal recurring obligations applicable to UAE-registered entities by way of illustration only. Specific requirements will vary according to entity type, jurisdiction of registration, and licensed activity, and businesses are advised to seek tailored legal advice in respect of their individual circumstances.

CORPORATE LICENSING & PERMITS

• Trade licence: must be renewed annually before expiry. Late renewal attracts daily fines and risks suspension. Each renewal is also an obligation to verify that licensed activities accurately reflect the business being conducted.
• Activity-specific permits: a trade licence does not authorise every aspect of a business’s operations. Healthcare, financial services, food and beverage, education, and transport activities require separate sectoral approvals with independent renewal cycles.
• Establishment card: required for all visa-sponsoring companies; renewed annually with the General Directorate of Residency and Foreigners Affairs.
• Registered office/Ejari: the address on the licence must be supported by a valid, registered tenancy agreement at all times.

IMMIGRATION & WORKFORCE

• Employment contracts: must comply with MoHRE-prescribed templates, accurately reflecting remuneration and role. Annual review is advisable wherever terms have changed.
• Workplace policies: Federal Decree-Law No. 33 of 2021 on the Regulation of Employment Relationships requires employers to maintain documented policies addressing the following:
  • Leave entitlements
  • Working hours
  • Grievance and disciplinary procedures
  • Protection of employee rights
  • Health and safety in the workplace
  • End of service gratuity: a statutory entitlement accruing to all qualifying employees must be accurately calculated and provisioned for each member of staff. Miscalculation of gratuity is among the most frequently encountered employment law disputes in the UAE and carries direct financial exposure for the employer. This obligation applies equally to SMEs, where gratuity provisions are frequently overlooked.
• Record-keeping: employers are required to maintain accurate employment records for each member of staff, including contracts, payroll records, and any amendments to terms of employment.
• Emiratisation: applicable companies must track and meet annual Emiratisation targets or face graduated financial penalties.

TAX & FINANCIAL COMPLIANCE

• Corporate Tax: CT return for FY 2025 due 30 September 2026 via the EmaraTax portal. Free zone entities seeking the 0% qualifying income rate must actively maintain and document the required substance conditions, eligibility is not automatic.
• VAT: quarterly filings due on the 28th of the month following each quarter end. Record-keeping of invoices and input tax documentation is a standalone statutory obligation.
• Audit & records:  joint stock companies and certain LLCs must file audited financial statements annually. All entities must retain financial records for a minimum of five years.

CORPORATE GOVERNANCE & REGISTERS

• UBO register: all mainland and free zone companies (except DIFC/ADGM entities and government-owned entities) must maintain a register of ultimate beneficial owners (individuals controlling 25%+ of shares or voting rights), held at the registered address and filed with the licensing authority. Changes must be notified within 15 days. Penalties escalate from a written warning to AED 100,000 and licence suspension.
• Shareholders, directors & commercial register: all changes to ownership, management, or company address must be filed promptly. Resolutions taken on the basis of outdated register information are susceptible to challenge.
• Corporate resolutions & minutes: annual general meetings and board resolutions must be convened, minuted, and retained in accordance with applicable formalities.

AML/CFT

Entities classified as Designated Non-Financial Businesses and Professions (DNFBPs), including real estate brokers, dealers in precious metals and gemstones, legal professionals, accountants, and corporate service providers, are subject to the following under Federal Decree-Law No. 10 of 2025:

• Mandatory registration on the goAML platform of the UAE Financial Intelligence Unit.
• A documented Business Risk Assessment, maintained and updated periodically.
• Consistent Customer Due Diligence procedures for all clients.
• Obligation to file Suspicious Transaction Reports where triggered. Failure to do so is a criminal offence.
• A written AML/CFT programme with annual staff training.

It is worth noting that DNFBP classification is not contingent on the size of the business. A small law firm, a boutique real estate agency, or a sole-practitioner accountancy are subject to the same AML/CFT obligations as their larger counterparts.

Regulatory Consequences Overview

Understanding the regulatory consequences of non-compliance is an essential part of any compliance strategy. The principal categories are as follows:

• Administrative fines ranging from AED 1,000 for minor infractions to AED 2,000,000 for climate reporting violations and AED 500,000 or above for serious AML/CFT failures. Daily fines accrue in several regimes for continuing violations.
• Licence suspension or revocation: a business without a valid licence cannot lawfully operate, employ, or enter into commercial contracts.
• Financial institutions conduct independent UBO and AML verification. Non-compliant companies encounter significant difficulties in opening or maintaining accounts.
• UAE law imposes personal liability on directors, managers, and officers for compliance failures under their oversight. In serious cases, this extends to criminal proceedings.
• In a jurisdiction where commercial relationships are built on trust, a public compliance failure carries consequences that outlast the underlying sanction.

The UAE’s regulatory environment reflects a jurisdiction that is deliberate in its commitment to transparency, governance, and legal certainty. For any business operating in or through the Emirates, compliance is not an administrative overhead, it is the legal foundation upon which the business itself stands. Properly structured and consistently maintained, the cost of compliance is a cost of operation.

Free zone registration does not simplify the compliance picture, and in most cases, it adds to it. The DIFC and ADGM operate under autonomous regulatory frameworks that impose obligations over and above those applicable at the federal level. On data protection alone, DIFC-registered entities are subject to DIFC Data Protection Law No. 5 of 2020, as amended in July 2025, a regime that is entirely distinct from the federal PDPL and carries its own registration, documentation, transfer, and enforcement requirements. ADGM-registered entities are subject to the ADGM Data Protection Regulations 2021, closely aligned with GDPR. Beyond data protection, both jurisdictions impose sector-specific conduct, governance, and cybersecurity obligations through their respective regulators (respectively the DFSA and the FSRA).

For entities operating within these jurisdictions, federal compliance obligations do not fall away, they are supplemented. Compliance programs and calendars must reflect that reality.

Our Corporate and Commercial practice advises businesses across the UAE on the full spectrum of their compliance obligations. If you require a review of your company’s compliance position or wish to discuss a structured compliance programme, please contact our Corporate & Commercial team.

Disclaimer: This briefing is intended for general informational purposes only and does not constitute legal advice. It should not be relied upon as a substitute for specific legal advice on any particular matter.