ESR, UBO and AML Compliance in the UAE

"Compliance" is sold in the UAE as a single annual bundle. It is not one thing. Three unrelated regimes sit behind the word, they are administered by three different authorities, and one of them stopped applying to current financial years in 2024.

Economic Substance Regulations asked a narrow group of businesses to prove they had real activity in the country. Beneficial ownership rules ask every licensed legal person to know, record and disclose the natural people behind it. Anti-money-laundering rules impose customer due diligence, record keeping and suspicious transaction reporting on financial institutions and on a defined list of non-financial businesses — a list that includes accountants, auditors and company service providers.

The practical problem for a reader is not that these are hard. It is that the instruments underneath all three changed recently, and a great deal of published guidance — including some government summary pages — still describes the previous version. Every rule on this page is cited to the instrument that is currently in force, checked on 17 August 2026.

Economic substance is the idea that a company booking income in a jurisdiction should have a proportionate amount of real activity there — people, premises and expenditure — rather than a letterhead. The UAE introduced the concept in 2019 in line with the OECD Inclusive Framework and the EU Code of Conduct Group, and re-issued it as Cabinet of Ministers Resolution No. 57 of 2020.

The regulations never applied to every company. They applied to a Licensee — a juridical person or unincorporated partnership registered in the UAE, including in a free zone or a financial free zone — that carried on one of nine relevant activities.

On 14 October 2024 the Ministry of Finance announced the cancellation of economic substance reporting requirements for companies for financial years ending after 31 December 2022, under Cabinet Decision No. 98 of 2024, which amends Cabinet Decision No. 57 of 2020. The Ministry framed the change as aligning with the introduction of the federal corporate tax regime, on the reasoning that corporate tax now does the work the substance rules were doing.

So the answer to "is ESR mandatory in the UAE" is: not for any financial year ending after 31 December 2022. There is no current ESR filing deadline. If a provider is quoting you an annual fee for an ESR filing covering a current financial year, ask which financial year it relates to before you pay it.

What has not gone away is history. The Ministry's announcement is explicit that companies remain responsible for fulfilling compliance obligations for prior years, for responding to information or amendment requests from regulatory authorities or the Federal Tax Authority, and for paying any penalties the Federal Tax Authority has imposed. A notification or report that was due for a financial year ending on or before 31 December 2022 was not retrospectively forgiven.

Two details make that more than theoretical. First, Ministerial Decision No. 100 of 2020 gives the National Assessing Authority a six-year limitation period, running from the end of the relevant financial year, in which to decide whether a Licensee met the substance test — and that limitation does not apply at all where the Authority was prevented from deciding by gross negligence, fraud or deliberate misrepresentation. Second, the same guidance requires Licensees and Exempted Licensees to retain the underlying records for six years from the end of the financial year. A 2022 year is therefore still inside both windows.

UBO stands for ultimate beneficial owner: the natural person who really owns or controls a company, as opposed to whoever appears on the licence. The point of the rules is that a chain of holding companies, a nominee shareholder or a nominee director should not be able to hide a human being from the authorities.

Article 5(1) of Cabinet Decision No. 109 of 2023 sets the test. The beneficial owner of a legal person is whoever owns or exercises ultimate control over it through direct or indirect ownership of 25% or more of the capital, or who holds 25% or more of the voting rights, including through a chain of ownership or control, or through control by any other means — the example given in the text is the right to appoint or dismiss the majority of the directors.

The Decision then works down a cascade. If more than one person shares a holding, all of them are treated as owning and controlling that percentage. If every avenue has been exhausted and no natural person with ultimate controlling ownership can be identified, or there is doubt that the person identified is really the beneficial owner, the person who exercises control by other means is treated as the beneficial owner. If that fails too, the natural person holding the senior management position is deemed to be the beneficial owner. There is no outcome in which a company has no UBO on file.

A nominee is explicitly not the answer. Under the AML executive regulation, a nominee shareholder voting on someone else's instructions, and a nominee director managing on someone else's instructions, are each expressly not the beneficial owner by virtue of that role.

Most published UAE guidance on beneficial ownership cites Cabinet Decision No. 58 of 2020 on the regulation of the procedures of the real beneficiary. That instrument is no longer in force.

Article 22 of Cabinet Decision No. 109 of 2023 abrogates Cabinet Decision No. 58 of 2020, together with any conflicting provision. The new Decision was issued on 6 November 2023 and came into force the day after its publication in the Official Gazette, issue 763. The penalty schedule moved at the same time: Cabinet Decision No. 132 of 2023, issued 15 December 2023 and published in Official Gazette issue 766, abrogates Cabinet Decision No. 53 of 2021 and substitutes its own schedule of fines.

Cabinet Decision No. 109 of 2023 was made under Federal Decree-Law No. 20 of 2018, which has itself since been repealed. It survives that repeal: Article 41(3) of Federal Decree-Law No. 10 of 2025 keeps the regulations, resolutions and circulars issued under the 2018 law in force, so far as they do not conflict with the new law, until superseding instruments are issued. The Ministry of Economy and Tourism continues to publish both Decisions on its financial crimes legislation page.

The obligation is not a single annual return. Cabinet Decision No. 109 of 2023 requires a legal person to maintain two internal registers, keep them current, and hand the data to its Registrar.

The Beneficial Owner's Record must be created within 60 days of the Decision's issuance or of the company coming into existence, and updated within 15 days of the company becoming aware of any change (Article 8(1)). For each beneficial owner it must hold: full name, nationality, date and place of birth; the residence or notification address; the travel document or identity card number with its issuing country and issue and expiry dates; the basis and date on which the person became a beneficial owner; and the date they ceased to be one.

The Register of Partners or Shareholders must record, for every partner or shareholder, the number and class of shares held and the voting rights attached, and the date the person acquired that capacity — plus full identity data for natural persons and the Article 4 basic data for legal persons. It too must be updated within 15 days. Anyone acting as a trustee or a nominee board member must be recorded as such, along with the details of the people they represent.

Two further duties are easy to miss. A legal person may not register or give effect to any document changing its ownership unless a statement is provided saying whether the transfer changes the beneficial owner and, if so, giving the new owner's data (Article 8(5)). And a licensed or registered legal person may not issue bearer share warrants at all (Article 11(5)).

Yes, for the great majority of UAE companies. Article 3(1) applies the Decision to the Registrar and to legal persons licensed or registered in the country, including the commercial free zones. It is not a mainland-only rule.

Article 3(2) exempts three categories: companies wholly owned by the federal or a local government, and companies wholly owned by such companies; financial free zones; and a governmental partner — a federal or local government that contributes to or holds shares in a company. In practice that means the Dubai International Financial Centre and Abu Dhabi Global Market sit outside this Decision. If your entity is registered in one of them, do not apply these deadlines; check the beneficial ownership rules of the financial free zone itself.

There is a narrower relief in Article 6(2). A UAE-licensed legal person owned by a company listed on a regulated market that is already subject to disclosure requirements ensuring sufficient transparency about the beneficial owner — or by a majority-owned subsidiary of such a listed company — is exempt from the obligation in Article 6(1) to obtain and maintain adequate, accurate and up-to-date beneficial owner data.

Cabinet Decision No. 132 of 2023 sets the schedule. It applies to legal persons licensed or registered in the UAE including non-financial free zones, and it is structured in three steps: a written warning with a correction window on the first violation, a fine plus a fresh warning on the second, and a doubled fine on the third. On a third violation the Registrar may in addition suspend the commercial licence and close the premises, with the suspension lifted once the fine is paid and the underlying failure corrected (Article 3(2)).

A grievance against a penalty may be filed with the Registrar's grievances committee within 30 days of notification, and the committee decides on any request to stay enforcement within 45 working days (Article 19 of Cabinet Decision No. 109 of 2023).

This is the change that most published guidance has not caught up with, and it matters more than the ESR cancellation because the AML obligations are continuous.

Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing was issued on 30 September 2025. Article 41(1) repeals Federal Decree-Law No. 20 of 2018 outright. The Decree-Law enters into force two weeks after publication in the Official Gazette.

Cabinet Decision No. 134 of 2025, the executive regulation of the new Decree-Law, was issued on 29 October 2025. Article 70 repeals Cabinet Decision No. 10 of 2019, and the Resolution enters into force 30 days after publication.

The UAE Financial Intelligence Unit publishes both as the governing framework, and the Ministry of Economy and Tourism lists both at the head of its financial crimes legislation page. The name of the regime changed too: proliferation financing is now named in the title alongside money laundering and terrorist financing, and obligations run to virtual asset service providers as a named category rather than by extension.

Article 41(3) softens the transition. Executive regulations, resolutions and circulars issued under the 2018 law, and in force when the new law was issued, remain effective so far as they do not conflict with it, until superseding instruments are issued. That is why the beneficial ownership Decisions of 2023 and the Ministry of Economy's goAML circulars still stand.

Designated Non-Financial Businesses and Professions are the non-bank businesses that AML rules reach. Article 3 of Cabinet Decision No. 134 of 2025 defines the category as any person carrying on one or more of the following.

• Commercial gaming operators, including on board vessels, when conducting a single financial transaction or several apparently linked transactions worth AED 11,000 or more. A transaction involving only gaming chips or instruments does not count.
• Real estate brokers and agents, when concluding transactions or settlements for a customer relating to the purchase or sale of real estate.
• Dealers in valuable metals and precious stones, on any single cash transaction, or several apparently linked transactions, worth AED 55,000 or more.
• Lawyers, notaries, other independent legal professionals and independent accountants — whether practising alone, in partnership or inside a firm — when they prepare, conduct or execute transactions for a customer relating to buying and selling real estate; managing the customer's funds; managing bank, savings or securities accounts; organising contributions for the establishment, operation or management of companies; or establishing, operating or managing legal persons or arrangements, or selling or buying commercial entities.
• Company and trust service providers, when acting as an agent in forming a legal person; acting or arranging for another to act as director, secretary or partner; providing a registered office, business address, place of residence, correspondence address or administrative address; acting or arranging for another to act as trustee of an express trust; or acting or arranging for another to act as a nominee shareholder.

Two things follow. First, the trigger for professionals is the activity, not the profession: an accountant who only prepares management accounts is in a different position from one who sets up companies for clients. Second, if you provide company formation, registered office or nominee services, you are a DNFBP in your own right — the same firm that helps a client with its UBO register is itself supervised.

The Ministry of Economy and Tourism is the supervisory authority for the DNFBP sector at state level and in the commercial free zones.

goAML is the reporting platform built by the United Nations Office on Drugs and Crime and operated in the UAE by the Financial Intelligence Unit. It is where suspicious transaction reports are filed, and registration on it is how a reporting entity becomes reachable.

On the question of a goAML registration deadline: the widely quoted date is historic. The Ministry of Economy extended the deadline for Designated Non-Financial Businesses and Professions to register on goAML to 30 April 2021, by Circular No. 2 of 2021. There is no recurring annual goAML deadline in the way there is a VAT or corporate tax return deadline. Registration is a one-off status you either have or do not have, and the Ministry's position is that failure to register may itself result in penalties. If a business is inside the DNFBP definition today and is not registered, it is already late; the practical deadline is now.

Registration runs in two stages: first the SACM security system, which issues a username, then the goAML portal itself, with a one-time passcode generated by an authenticator app.

The statutory range is in the primary text and can be stated with confidence. Under Article 17(1) of Federal Decree-Law No. 10 of 2025, a supervisory authority may impose on a supervised entity: a warning; an administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation; a ban on operating in the relevant sector; restrictions on the powers of board members, executives or owners found responsible, including appointing a temporary supervisor; suspension or replacement of responsible directors and officers; suspension or restriction of the activity or profession; and revocation of the licence. The authority may impose an incremental fine where the same violation recurs within a year of the previous fine, and may publish the penalties it imposes.

Criminal liability is separate. Article 26(1) punishes money laundering with imprisonment of not less than one year and not more than ten, together with a fine of not less than AED 100,000 and not more than AED 5,000,000, or the value of the criminal property, whichever is greater. Aggravated cases — including abuse of a professional position, use of a non-profit organisation, or an organised criminal group — carry temporary imprisonment and a fine of AED 1,000,000 to AED 10,000,000, or twice the value of the property, whichever is greater. An attempt is punished as the completed offence.

Every figure and deadline on this page comes from one of the following, read directly rather than through a summary. Where a government summary page and an instrument disagree — and on this topic several do — the instrument governs.

• Economic substance: Cabinet of Ministers Resolution No. 57 of 2020, published by the Federal Tax Authority; Ministerial Decision No. 100 of 2020, the ESR guidance and relevant activities guide, published by the Ministry of Finance; and the Ministry of Finance announcement of 14 October 2024 recording Cabinet Decision No. 98 of 2024.
• Beneficial ownership: Cabinet Decision No. 109 of 2023 on regulating the beneficial owner procedures, and Cabinet Decision No. 132 of 2023 on the administrative penalties for breaching it, both published in English by the Ministry of Economy and Tourism.
• Anti-money laundering: Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025, published by the UAE Financial Intelligence Unit and by the Ministry of Economy and Tourism.

This page is a hub. The detail on registering and reporting through goAML, on what an AML programme has to contain, and on how the regulations apply to a specific sector, sits on the pages linked from the sections above. Nothing here is advice on your own facts, and none of it substitutes for the instrument itself.