KYC in the UAE: CBUAE Requirements & Business Verification Guide 2026
Complete guide to KYC requirements in the UAE. CBUAE regulatory framework, required documents, free zone vs mainland companies, and verification process.
The United Arab Emirates occupies a unique position in the global financial landscape. As a major trade hub connecting East and West, the UAE hosts tens of thousands of international businesses, manages enormous capital flows, and offers a range of corporate structures designed to attract foreign investment. Dubai and Abu Dhabi are global financial centers with sophisticated regulatory frameworks.
At the same time, the UAE has faced significant scrutiny from international AML watchdogs. The country was placed on the FATF grey list in March 2022 and exited in February 2024 following substantial reforms to its AML/CFT framework. This context makes thorough KYC on UAE entities particularly important for international banks, compliance teams, and due diligence practitioners.
This guide explains the UAE regulatory framework for KYC, the different company types you will encounter, the documents required for verification, and specific risk considerations.
The UAE Regulatory Framework
The UAE's AML/CFT framework is built around several key pieces of legislation and regulatory bodies:
Central Bank of the UAE (CBUAE): The primary financial sector regulator. The CBUAE issued its AML/CFT Standards in 2021, setting detailed requirements for licensed financial institutions regarding customer due diligence, beneficial ownership identification, transaction monitoring, and suspicious activity reporting.
AML/CFT Law No. 20 of 2018: The foundational federal law governing AML and counter-terrorism financing in the UAE. Updated in 2020 (Federal Decree-Law No. 26 of 2021), this law defines money laundering offenses, sets out obligations for financial institutions and designated non-financial businesses and professions (DNFBPs), and establishes the UAE's Financial Intelligence Unit (UAEFIU).
Executive Office of AML/CFT: Established in 2021 to coordinate the UAE's national AML/CFT policy across government entities and regulators.
Free Zone Regulators: Companies in UAE free zones are regulated by their respective free zone authority rather than by federal regulators. The key free zone financial regulators are the Dubai Financial Services Authority (DFSA, regulating the DIFC) and the Financial Services Regulatory Authority (FSRA, regulating ADGM). Each has its own AML/CFT framework broadly equivalent to international standards.
Ministry of Economy: Supervises DNFBPs (lawyers, accountants, real estate agents, gold dealers) for AML/CFT compliance.
UAE Company Types: What You Will Encounter
The UAE has a diverse corporate landscape reflecting its multiple regulatory zones:
Mainland Companies (Onshore) These companies are registered with the Department of Economic Development (DED) of the relevant emirate (e.g., DED Dubai, ADDED Abu Dhabi). A mainland company can operate anywhere in the UAE and conduct government contracts. Key types include: - LLC (Limited Liability Company): The most common form for foreign investors. Historically required 51% UAE national ownership, but onshore reforms in 2020 now allow 100% foreign ownership in most sectors. - Branch of a foreign company: A branch registered in the UAE but legally an extension of the parent company. - Professional License Company (Civil Company): Used for professional services.
Free Zone Companies The UAE operates over 40 free zones, each with its own regulatory framework and set of permitted activities. Key features: - 100% foreign ownership always permitted - No UAE national shareholder requirement - Typically restricted to operating within the free zone or internationally (not in the UAE mainland without a separate license) - Major free zones: JAFZA (Jebel Ali), DIFC (Dubai International Financial Centre), ADGM (Abu Dhabi Global Market), DMCC (Dubai Multi Commodities Centre), SAIF Zone, RAK ICC
Offshore Companies Different from free zone companies, offshore companies (e.g., RAK ICC, JAFZA offshore) are not permitted to conduct business within the UAE. They are holding structures, used for international trade, asset protection, or estate planning. Offshore companies have minimal public registry information and are a heightened KYC risk.
Documents Required for UAE KYC
For a UAE mainland company, a comprehensive KYC pack typically includes:
Entity verification documents: - Trade License: The primary operating document issued by the DED or relevant authority. It shows the company name, license number, activity, expiry date, and registered address. Trade licenses in the UAE must be renewed annually. - Memorandum and Articles of Association (MOA): The founding document showing ownership structure, capital, and permitted activities. - Certificate of Incorporation (where applicable) - Share Certificate(s): Documenting the shareholding structure. - Establishment Card (for businesses employing staff)
UBO and director verification: - UBO Declaration: The UAE introduced mandatory UBO disclosure requirements for all legal entities. The UBO must be registered. - Emirates ID for UAE-resident directors and UBOs - Passport copies for non-resident directors and UBOs - Power of Attorney if relevant
For free zone companies, replace DED documents with the relevant free zone authority's certificate of incorporation and license.
For DIFC/ADGM entities, the regulatory filings with the DFSA or FSRA provide additional verification information.
Specific Risk Considerations for UAE Entities
Even after exiting the FATF grey list in 2024, UAE entities require careful risk assessment:
Free zone vs. mainland risk differential: Free zone companies with no UAE mainland operations and a non-resident beneficial owner present a higher risk profile than established mainland companies with verifiable UAE presence. The combination of 100% foreign ownership, limited public registry information, and restricted domestic operations creates opacity risk.
Offshore company heightened risk: UAE offshore companies (RAK ICC offshore, JAFZA offshore) are used legitimately for international holding structures but also as vehicles for concealing beneficial ownership. Apply enhanced due diligence automatically for offshore structures.
Trade-based money laundering: The UAE's role as a major re-export hub means it is a known jurisdiction for trade-based money laundering (TBML). Watch for over- or under-invoicing, phantom shipments, and triangular trade structures involving UAE entities.
Real estate exposure: Dubai's real estate market has historically been identified as a channel for money laundering. Companies with significant UAE real estate activity warrant additional scrutiny.
PEP exposure: The UAE is home to numerous PEPs from across the Middle East, Africa, and South Asia. Screen carefully for PEP exposure in ownership and management structures.
Shell company indicators: Large numbers of UAE offshore and free zone entities exist as holding structures with no operational substance. Verify real business activity through trade license scope, employee count, physical premises, and client references.