Regulatory Compliance for International Groups of Companies

Regulatory Compliance for International Groups of Companies in the UAE Practical Guide to Building a Compliance System in the United Arab Emirates

Mainstream

Regulatory compliance for an international group of companies in the UAE is not a one-time license. It is a permanent regulatory risk management system that affects every business unit.

The question is not whether the company is registered correctly. The main question is whether the group can prove to the regulator at any time that all its local structures, operations and beneficiaries fully comply with the rapidly changing legislation of the UAE.

Effective compliance begins with three checks:

Does the group have an up-to-date map of all applicable regulatory requirements in each jurisdiction of presence (mainland, free zones, financial zones).A system of collection, verification and submission of mandatory reporting (UBO, ESR, AML, VAT, corporate tax) is established?Are there a working mechanism of internal control that prevents violations, rather than fixing them after the fact?

If these three issues are not resolved, the international group risks not just fines, but suspension of licenses, blocking of accounts, personal management responsibility and reputational losses throughout the Middle East.

When an international group requires a system regulatory compliance in the UAE

Systemic compliance is required if:

• group opens or already has several legal entities in the UAE (mainland company, branch, structures in free zones)
• Group companies conduct different activities that require separate licenses
• In the structure there are offshore holdings or SPVs
• Businesses are subject to Economic Substance Regulations (ESR)
• Disclosure of ultimate beneficiaries (UBO) and maintenance of registers
• The operations affect regulated sectors: Financial services, crypto-assets, healthcare, education, dual-use goods trade
• The company is obliged to comply with AML/CFT UAE legislation and sanctions regimes
• processing of personal data is subject to the UAE PDPL and Zone Acts (DIFC, ADGM)
• The group plans bank financing, audit or preparation for a tax residency certificate

The mistake that most international groups make

Many groups start with the question:

What license is the easiest and fastest to obtain?

That's the wrong first question.

The right question is:

What corporate and operating architecture will ensure full compliance with minimal regulatory risks, taking into account real-world operations, beneficial structure and profit plans?

Sometimes it is more profitable to have one mainland company with the right kind of activity than three cheap free-zone structures that do not pass the test of economic presence. Sometimes you need to urgently clean up UBO-registers before opening an account. It is sometimes more critical to set up transfer pricing and documentation before the first tax audit.

Regulatory compliance in the UAE does not require a set of licenses, but a strategic compliance architecture.

Step 1. To create a regulatory map of the group in the UAE

The first thing to do is not to update the licenses, but to map all applicable requirements.

Key elements of the regulatory map:

• the type of activity of each legal entity and its actual operations
• Incorporation jurisdiction (mainland, freezone, DIFC, ADGM)
• licensing authority (DET, DMCC, JAFZA, DIFC, ADGM, SCA, Central Bank, etc.)
• The applicable law on companies (Federal Decree-Law No. 32/2021, zonal regulations
• Economic Substance (Licensed Activities)
• UBO, nominee directors, registers (Cabinet Decision No. 132/2023 et al.)
• AML/CFT requirements (Federal Decree-Law No. 20/2018, NC decisions)
• tax regime (corporation tax 9%, VAT 5%, transfer pricing)
• Data Protection Obligations (Federal Decree-Law No.) 45/2021 and zonal DP laws
• Immigration and Labor Laws (MOHRE, Visa Quotas, WPS)

If the map is incomplete, the group will inevitably miss deadlines or submit incorrect information. The regulator in the UAE does not accept ignorance of the legislation as an excuse.

Step 2. Check licenses and permits

The international team must confirm that every activity it actually engages in is fully licensed.

It is necessary to check:

• Specific description of the activities in the license (activity codes)
• Lack of “hidden” regulated activities (consulting, financial intermediation, e-commerce, crypto-assets, event management)
• availability of necessary additional approvals (external permissions from regulators – SCA, Central Bank, TDRA, Ministry of Health, etc.)
• compliance of the legal address and physical office with the type of license and zone (for example, flexi-desk is not acceptable for certain activities)
• Proper registration of local service agent or local partner (for mainland companies with foreign participation)
• Compliance with limits on the number of employees, visa quotas and rent
• the relevance of licenses and contracts with service agents, the absence of automatic renewals without checking the terms of

Regular audit of licenses is not a one-time project, but an element of the compliance system. The regulator may fine for activities that go beyond the scope of the license, even if the violation is committed unintentionally.

Step 3. Requirements for Economic Substance (ESR)

If a group company conducts Relevant Activity (banking, insurance, fund management, headquarters, holding, leasing, distribution and service centers, intellectual property, shipping), it is obliged to comply with the requirements of economic presence.

For compliance with the ESR, it is necessary to confirm annually:

• Real meetings of the Board of Directors in the UAE (minutes, quorum, physical presence)
• Sufficiently qualified staff in the UAE
• Operating expenses proportional to the activities
• physical office, relevant activities
• Lack of “artificial” outsourcing of key activities without control

Errors in ESR reporting lead to fines, information exchange with the tax authorities of the parent jurisdiction and the risk of losing tax advantages. The group needs to build a proof base in advance, rather than collecting documents before the deadline.

Step 4. Ensure Beneficial Ownership Transparency (UBO)

The UAE requires companies to fully disclose ultimate beneficiaries and maintain internal registers.

The international group is obliged to:

• UBO (direct or indirect ownership of 25% or otherwise control)
• register UBO in the licensing authority’s register and in the Emirates Business Register system (for mainland companies)
• submit data on nominee directors and persons exercising control
• Update the registers in case of any changes in the ownership structure (penalty for non-provision – up to the administrative suspension of activities)
• Maintain internal registers of participants, beneficiaries and nominees (Register of UBO, Register of Members, Register of Nominee Directors)
• ensure the protection and confidentiality of the data submitted in accordance with the legislation

The concealment or late updating of UBO information is one of the most serious violations in the UAE, especially after the country was included in the FATF’s grey list and subsequently removed. The controls have become much stricter.

Step 5. AML/CFT and Sanctions Compliance

Even if the group is not a financial institution, it is subject to the UAE anti-money laundering and counter-terrorism financing legislation if its activities are classified as DNFBP (designed non-financial businesses and professions) or related to trading in precious metals, real estate, corporate services, etc.

Mandatory Compliance Elements:

• Appointment of Compliance Officer (MLRO) and Registration
• implementation of KYC/CDD procedures for clients and counterparties
• Customer risk assessment, including PEP and sanction checks
• Automated or manual screening of sanctions lists (UN, UAE Local List, OFAC, EU, UK)
• Mandatory reporting of suspicious transactions to the Financial Intelligence Unit (FIU) through the go AML platform
• Periodic training of AML/CFT staff
• Independent audit of the AML program

Violation of AML/CFT requirements entails not only large fines, but also criminal liability for management. It is critical for the international group to ensure uniform standards for counterparty verification across all jurisdictions.

Step 6. Ensure compliance in the field of data protection

With the adoption of Federal Decree-Law No. 45/2021 (PDPL) and the current laws in the DIFC (Data Protection Law, 2020) and ADGM (DP Regulations 2021) the protection of personal data has become an obligatory element of compliance.

The team needs to:

• Determine the roles of the controller and processor for each structure
• obtain the consent of data subjects (employees, customers) for processing, unless there is another legal basis
• appoint a Data Protection Officer if required by the scope of the activity
• Implement data breach response and regulator notification procedures (TDRA)
• to ensure cross-border data transfer only to countries with adequate levels of protection or on the basis of contractual guarantees;
• Data Protection Impact Assessment for High Risk Processing
• implement privacy, storage and deletion policies in Arabic and English

Failure to comply with the PDPL can result in fines, suspension of data processing and reputational risks, especially for groups serving the consumer sector.

Step 7. Reinforce Employment and Immigration Compliance

The UAE Labor Law (Federal Decree-Law No.) 33/2021) and the MOHRE and ICP immigration rules create a separate set of obligations.

Key points of control:

• registration of employment contracts strictly according to approved MOHRE forms
• Renewal of visas and Emirates ID
• Payment of wages through Wages Protection System (WPS)
• Emiratisation quotas (for companies with 50 employees or more)
• No Objection Certificate (NOC) when changing sponsors
• Working hours, overtime, end-of-service gravitation
• Compulsory health insurance (in Abu Dhabi and Dubai)
• Compliance with the rules of remote work and work-from-home, if applicable

Employment disputes in the UAE are handled quickly, and failure to comply with procedures often leads to the blocking of the company’s immigration file, which paralyzes all operations.

Step 8. Implement tax compliance (Corporate tax, VAT, TP)

With the introduction of the federal corporate tax (CT) in 2023, international groups need to:

• Evaluate the tax residency of each company in the UAE
• Register with the FTA and get a TRN for the CT
• Determine whether the company is subject to a 0% (Qualifying Free Zone Person) or 9% rate
• prepare financial statements in accordance with the IFRS
• Implement transfer pricing: Controlled Transaction Documentation, Master File and Local File for Groups that Exceed Thresholds
• Provide arm’s length principle for intragroup operations
• check the correctness of VAT registration (over 375,000 AED requires mandatory registration, voluntarily - from 187 500 AED)
• timely submit VAT declarations (quarterly) and CT declarations (annually)
• Maintain primary documentation for at least 7 years after the end of the tax period

Tax compliance requires not only correct calculations, but also a competent structure of intragroup contracts. Incorrectly executed cross-border services, royalties or financing can lead to additional tax and fines.

Step 9. Develop or adapt internal policies and procedures

Compliance on paper doesn't work. The international group should implement uniform standards adapted to the requirements of the UAE.

Minimum set of internal documents:

• Code of Conduct with local business practices
• Anti-Bribery & Corruption Policy (with federal law, UK Bribery Act, FCPA)
• AML/CFT Compliance Manual (for DNFBP or financial institutions)
• Data Protection Policy and Data Breach Response Plan
• Whistleblowing Policy (Protection of Applicants, Information Channel)
• Conflict of Interest Policy for Management and Board Members
• Third Party Due Diligence Procedure with Mandatory Sanctions Screening
• Gifts & Hospitality Register
• Delegation of Authority (especially for joint ventures with a local partner)

All policies must be in English (and, if necessary, Arabic), approved by a local government, communicated to employees and backed up by regular training.

Step 10. Build a monitoring and reporting system

A one-time compliance project does not protect against risks. A continuous system is needed.

Elements of an effective system:

• Regulatory reporting calendar (licenses, UBO, ESR, AML, VAT, CT, statistics)
• Regular compliance audit (annual or more often depending on risk profile)
• Regulatory Watch with Policy Adaptation
• Internal and external lines of information on violations
• Reporting Compliance Officer to the Board of Directors or the Group Owner (at least quarterly)
• periodic due diligence of key counterparties and updates of KYC files
• Incident analysis and near-misses to adjust control procedures

It is this level that distinguishes the compliance group from the regulatory risk management group.

Specifics of freezone, continent and financial zones: What to choose and how to combine

The choice between jurisdictions should not be based solely on the convenience of registration. The architecture must be in line with business objectives and withstand the test of economic presence and beneficial transparency.

Typical mistakes of international groups in building compliance in the UAE

1. License received, but ESR notifications are missed, UBO is not filed. Fines accumulate imperceptibly, but lead to the blocking of the regulator's services.
2. Sales, services or operations on the mainland through a free-zone structure without complying with the rules lead to violation of licensing conditions and the risk of business closure.
3. Do not update UBO-registers when changing the ownership structure of the group Change of shareholder in the parent company should be reflected in the registers of the UAE in a short time. A delay is a direct violation visible to the regulator.
4. Intragroup services without documentation, loans at non-market rates, unreasonable royalties are all under scrutiny by the Federal Tax Authority.
5. Ignore AML unless the company is financial brokers, corporate service providers, precious metal traders – all are required to comply with AML. Ignorance of DNFBP status does not absolve from liability.
6. Policies developed in Europe may contain provisions that contradict local labor or criminal law, or do not take into account the peculiarities of working with local agents.
7. The regulator expects that the staff knows AML procedures, data handling, sanctions restrictions. The lack of training is an aggravating factor.

Checklist for an international group in the UAE

Before you start or audit your compliance system, answer 15 questions:

1. Are all activities covered by existing licenses?
2. Have all applicable regulatory regimes (mainland, free zones, DIFC/ADGM) been defined?
3. Is any company subject to ESR and is there a proof base?
4. Are UBO and Members Registries Updated for All Legal Entities?
5. Are Compliance Officers and, if necessary, DPOs and MLROs appointed?
6. Have KYC and sanction screening procedures been implemented for contractors?
7. Is the company registered in go AML (if DNFBP) and is it ready to file an STR?
8. Does the processing of personal data comply with the PDPL/zonal laws?
9. Are MOHRE employment contracts in place and WPS is being respected?
10. Have you received corporate tax and VAT registrations, are the TCO files ready?
11. Are there locally adapted compliance policies with employee signatures?
12. Have you been trained in AML, data protection, code of conduct?
13. Is there a mandatory reporting calendar and a reminder system?
14. Have you checked your relationships with local agents and partners for conflict of interest?
15. When was the last independent compliance audit conducted?

What a strong regulatory compliance strategy looks like in the UAE

A strong strategy is usually built on four levels:

1. Regulatory Mapping & Risk Assessment: Complete commitment map, risk-based analysis, prioritization.

2. Structural & Documentary Foundation alignment of licenses, registries, corporate structure and internal documents.

3. Operational Compliance: The implementation of KYC, AML screening, data monitoring, reporting, training – compliance processes becomes part of daily work.

4. Monitoring, Audit & Response: Continuous monitoring of changes, regular audits, incident management and continuous system improvement.

Without level four, the system becomes obsolete in a few months. The UAE regulatory environment is changing dynamically and compliance requires lively management.

FAQ

Do you need compliance if a group has only one company in the UAE?

Yeah. The obligations of licensing, UBO, taxes, data protection and labor apply to any company. Scale does not negate requirements, but only affects their scope and complexity.

More importantly: Get a license or build a compliance system?

The license gives you the right to work. Compliance-system gives the right to continue working without fines, blocking and reputational losses. One without the other is a temporary solution.

Can I delegate compliance to an external provider?

Outsourcing of individual functions (UBO registration, ESR reporting, AML screening, DPO) is acceptable and often rational. However, the responsibility for compliance always remains with the licensee and its management.

What are the penalties for violation of compliance in the UAE?

The fines range from several thousand dirhams for late updating of registries to tens and hundreds of thousands for AML violations, license cancellation, criminal liability and prohibition of doing business.

How often should I update the compliance program?

The minimum is an annual review. If there are significant changes in legislation, group structure or operating model, immediately.

Are there extraterritorial sanctions imposed by the United States or the EU in the UAE?

The UAE applies only sanctions imposed at the UN level and locally. However, banks and international partners demand compliance with the US, EU, UK sanctions programs, which should be taken into account in the group’s policy.

Is a Freezone Company Obligated to Comply with the Federal PDPL?

Yes, if it processes personal data within the UAE (not in DIFC/ADGM). There are no Federal PDPL exemptions, but individual zones have their own regulations.

Related services

Corporate Structuring, M&A and Joint Ventures Commercial Contracts Economic Substance, UBO & Corporate Governance Compliance AML/CFT Compliance & Sanctions Data Protection & Cybersecurity Compliance Tax Compliance & Structuring (Corporate Tax, VAT, Transfer Pricing)Employment & Immigration Compliance Regulatory Investigations & Business Integrity International Regulatory Risk & Strategic Advisory

Related material

How to choose the right jurisdiction for business in the UAE: Mainland, Freezone or Financial Area Economic Substance Regulations in the UAE: How to Disclose End Beneficiaries (UBO) Without Errors AML Compliance for Non-Financial Companies in the UAE What you need to know about data protection in the UAE: How to prepare for the Federal PDPL Corporate Tax in the UAE: Compliance Aspects for International Business How to Conduct Compliance Audit in the UAE: Checklist of UAE Labor Law: Compliance risks and minimization Interaction with a local service agent: Legal and compliance aspects

Conclusion

Regulatory compliance for an international group of companies in the UAE does not require formal licenses and policies, but rather a regulatory risk management system built into business processes.

The strong position is based on a precise regulatory map, impeccable corporate transparency, working AML mechanisms, data protection and tax discipline, and the group’s ability to prove economic presence and real control.

In the UAE regulatory environment, it is not the quickest to register a company that wins. The winner is the one who builds a system in advance that can withstand the regulator’s check at any time and adapt to changes without business downtime.