UAE UBO Requirements: Which Law Actually Applies, Who Is Exempt, What the Three Registers Contain, and Where You File

Start with the thing that invalidates most of what you will read elsewhere. The UAE's beneficial ownership rules are set by Cabinet Resolution No. 109 of 2023 on Regulating the Real Beneficiary Procedures, in effect since 16 November 2023, with penalties under Cabinet Decision No. 132 of 2023, issued 15 December 2023 [1][2]. Almost every guide still in circulation quotes Cabinet Decision No. 58 of 2020 and Cabinet Decision No. 53 of 2021. Both are superseded, and if a page cites either as current, everything downstream of it needs checking.

That is not a pedantic point about footnotes, because numbers travel with instruments. The widely repeated "file within 60 days of incorporation" figure traces back to the repealed 58/2020, and we could not confirm it for the current regime, so this guide does not publish it as one. The same applies to the tidy tables mapping an exact dirham penalty to each breach. We could not verify that annex, so you get the range and the escalation logic.

Since 2013, our team has filed real beneficiary registers for mainland and free zone entities, and cleaned up filings under the old regime that nobody thought to revisit. What follows is the operational version: which instrument applies, who is exempt, what the three registers contain, how you identify a real beneficiary when nobody holds 25%, and where you file. This is a guide, not legal advice.

Which UBO law actually applies in the UAE right now?

Cabinet Resolution No. 109 of 2023 governs real beneficiary procedures, effective 16 November 2023, and Cabinet Decision No. 132 of 2023 governs penalties. Together they replaced Cabinet Decision 58 of 2020 and Cabinet Decision 53 of 2021, which is what most published guidance still quotes as current [1][2][3]. The obligations survived each change largely intact, which is why the error persists: a page quoting 58/2020 still describes something recognisable, so nobody notices it is repealed.

An honest note on sourcing. The official portal at uaelegislation.gov.ae blocks automated access. We checked the content of Resolution 109/2023 against a hosted mirror of the primary text and against law-firm reporting, and we are telling you that rather than implying we read the gazette. The canonical references are legislation 2176 for Resolution 109/2023 and legislation 2314 for Decision 132/2023 [1][2]. Open them in a browser.

Real Talk: When a registrar or a bank's financial crime team asks which instrument your filing was made under, "the UBO law" is not an answer. Name the resolution. We watched an account opening stall three weeks because a provider's cover letter cited 58/2020, and the analyst read that as evidence the file had not been touched since 2021. It had been. The letter was just old.

Who must comply, and who is genuinely exempt?

Every legal person licensed or registered on the UAE mainland or in a non-financial free zone is in scope. The exemptions are narrow: wholly government-owned companies, companies listed on a recognised stock exchange with adequate disclosure requirements, and entities in the financial free zones DIFC and ADGM, which run their own regimes [1][3]. That is the whole list, and everything else is in scope, including the single-shareholder free zone company that has never traded and the holding vehicle with no staff.

Both exemptions are read literally. The listing exemption attaches to the company whose shares are listed, so a private UAE subsidiary of a listed group files. Wholly government-owned means wholly, so a joint venture in which a government entity holds 70% is in scope, and its private shareholders are exactly who the register exists to record. Our mainland company setup page sets out what a mainland licence involves.

Why is "free zone companies are exempt" wrong?

Because only DIFC and ADGM sit outside the federal regime, and even they are not obligation-free. They answer to their own registrars under their own beneficial ownership rules. Every non-financial free zone, which is nearly all of them, is squarely inside Cabinet Resolution 109 of 2023 [1][4].

This is the error we correct most often in a first meeting, and it usually is not the client's fault. Free zones offer privacy from the public record: your name is not searchable by a competitor. They do not offer exemption from disclosure to the registrar. Those two get compressed into "free zones are private", then into "free zones are exempt", and by the time it reaches a founder it is a licensing pitch. Ajman Media City publishes its own UBO guidance to licensees, which is not what an exemption looks like [4].

Common Mistake: Assuming that because your free zone has not chased you, you are not obliged. Registrar follow-up is uneven, and a quiet inbox is not a compliance position. The obligation sits on the company, not on the registrar to remind you. When a zone starts a sweep, and several have, the companies hit hardest are those with years of unfiled changes rather than one missed form.

If you are still choosing where to incorporate, our free zone company setup page covers how the zones differ, including how their portals handle ongoing filings.

What are the three registers you have to keep?

Three, not one: a real beneficiary register, a register of partners or shareholders, and nominee director or manager declarations where the arrangement exists. Companies routinely maintain the first, forget the second, and have never heard of the third [1]. The second catches people because it feels redundant, given you already have a memorandum and a licence showing shareholders. It is a distinct standing record with its own content requirements, and a registrar asking for it will not accept a licence printout.

The dates do more work than they appear to. Recorded became-and-ceased dates are what evidence your 15-day notifications were made on time.

One further requirement is widely reported: an obligation to appoint a UAE-resident contact person reachable by the Registrar. We flag it as reported but not independently confirmed against the primary text of 109/2023, so we are not publishing a field list for it. Ask your registrar whether it applies. It is a cheap question and a bad thing to guess about. If you have a nominee arrangement, our guide to nominee director agreements covers what the private side must contain; the disclosure obligation sits alongside it, not instead of it.

How do you identify a real beneficiary?

A natural person owning or controlling 25% or more of shares or voting rights, directly or indirectly. If nobody meets that, the person exercising control by other means. If still nobody, the senior management official is recorded [1][3].

It is a cascade, not a menu: each step opens only when the one above produces nobody. A company with two 50% shareholders does not get to record its general manager instead because that is tidier.

The word doing the heavy lifting in step 1 is indirectly. You do not stop at the shareholder named on your licence. Where a corporate shareholder sits above you, follow the chain up to natural persons, multiplying the holdings along the way.

Quick Math: Your UAE company's only shareholder is an offshore holding company owning 100% of it, itself owned 60% and 40% by two individuals. Both are real beneficiaries at those figures. Now change one fact: the holding company owns 45% of your UAE company, with 55% split between eleven individuals at 5% each. The 60% individual now holds 27% indirectly, above the threshold, and must be recorded. The 40% individual holds 18%, below it. None of the eleven qualify. Thirteen human owners, exactly one real beneficiary, and the multiplication is the working you show a registrar.

Step 2 is where dispersed ownership lands, and it is the step most often skipped. Control by other means is not limited to appointment rights: veto rights over budgets or key appointments, control under a shareholders' agreement or funding arrangement, or a family arrangement that never appears in a share register all count. If a person can determine what the company does, the fact that they hold no shares is precisely why the test exists.

Step 3 is a last resort you should be able to justify in writing. Recording the general manager while a 30% shareholder sits in the file is an inaccurate register, and inaccurate data is itself a violation [2].

Pro Tip: Build the ownership chain once, properly, as a diagram with percentages at every level. Every later event, a transfer, a new investor, a restructuring above you, becomes a five-minute update rather than a fresh reconstruction. It is also the most useful document you can hand a bank's onboarding team, a recurring theme in why UAE banks reject business account applications. If you are unsure where the threshold falls in your chain, talk to a setup expert→

What is the 15-day rule, and what counts as a change?

Any change to real beneficiary information must be notified within 15 days, confirmed from the primary text of Cabinet Resolution 109 of 2023 [1]. It runs from the change, not from when your office noticed it. A transfer signed abroad on the first does not restart its clock when the copy reaches Dubai on the twentieth.

That last row is worth sitting with. The three registers do not move in lockstep: plenty of events change your shareholder register without touching the real beneficiary register, and a change of control with no share movement does the reverse.

Based on our experience, the breach we see most is not refusal to file. It is a group restructuring two levels up, executed by a corporate team with no idea a UAE subsidiary's register depended on it. Nobody was told, so nobody filed, and the gap surfaced eighteen months later in a bank review. The fix is dull: whoever signs off group-level ownership changes needs a standing note that the UAE entity has a 15-day clock. Running that calendar alongside renewals, accounting and tax is what our post-setup services team handles, because the register is an event-driven obligation, not a formation task.

Where do you actually file? There is no federal UBO portal

You file with your licensing authority, which is your registrar. There is no single federal UBO database companies submit into. The Ministry of Economy is the federal policy owner and coordinator, not the filing counter [3][6]. This is widely muddled, including by people selling the filing as a service, and the confusion is understandable: the policy is federal and the Ministry publicly reviews and promotes the regime [3]. But the register attaches to your licence record, and that sits with whoever issued it.

Two consequences follow. Hold licences in more than one jurisdiction, say a Dubai mainland company and a RAKEZ entity, and you have two obligations with two registrars, where getting one right does nothing for the other. And the requirements are not uniform: some zones want certified passport copies, some an attested declaration, some the chain diagram, and some have a form that does not accommodate step 2 control cleanly. Ask your zone, do not assume.

So "we filed the UBO" is not a complete sentence. Filed where, under which licence, on what date. We have taken over files where a group believed it had filed for four entities and had filed for one, because a single portal login covered several companies. Keep the confirmations, per entity, dated.

What are the penalties, and how does escalation work?

Cabinet Decision No. 132 of 2023 sets a range of roughly AED 20,000 to AED 100,000 across individual violations, including failing to maintain a register, failing to file, failing to notify a change, and providing incomplete or inaccurate data. A warning-first, progressive approach applies to a first violation, escalating on repeat or sustained non-compliance [2].

We are deliberately not publishing a table mapping an exact figure to each breach. You will find those elsewhere, presented with great confidence. We could not verify that annex, and a precise number we cannot stand behind is worse than a range we can.

The warning-first design means discovering a problem is good news, provided you act on it. A first violation found and corrected is a very different outcome from the same violation left standing across three renewal cycles. The worst position is not "we found a gap", it is "we found a gap in 2024, agreed someone would look at it, and here we are".

What can a registrar do beyond a fine?

More than most founders expect. Article 3(1) of Cabinet Decision No. 132 of 2023 empowers the Registrar to suspend the commercial licence and close the establishment for repeated violations [2]. That is an operational consequence, not a financial one, which is why this should not sit mentally alongside minor administrative fines.

Consider what a suspension does to a working business. Your bank sees it. Staff visa processing runs off the licence. Renewals stop. None of that is proportionate to the effort of keeping a register accurate, which is the point of the power. A quieter channel also operates before any formal action: banks routinely ask for beneficial ownership documentation, and a company that cannot produce a coherent register is telling a compliance analyst how it is run.

Pro Tip: Treat the register as a banking document as much as a regulatory one. The chain diagram, the current real beneficiary register, the shareholder register with classes and voting rights, and the submission confirmations should live in one folder you can send in a single email. Businesses that can do that clear onboarding noticeably faster than those reconstructing the answer each time.

How does UBO differ from your own AML and CDD obligations?

This is the distinction essentially no competing page draws, and it costs regulated businesses real money. Filing your own UBO register is a corporate disclosure duty owed to your registrar. Verifying a client's beneficial ownership before acting for them is a customer due diligence duty under the AML framework [5]. They share the 25% concept and are legally distinct. Two recent developments there, Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, are worth knowing exist; we flag them as recent and evolving rather than describing their content, because only their existence was surface-confirmed.

Designated Non-Financial Businesses and Professions, or DNFBPs, carry the customer-side duty: real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, and independent lawyers and notaries for certain transactions. They register on goAML, run by the UAE Financial Intelligence Unit, and run their own due diligence [5][7].

Here is the consequence that gets missed. A client's UBO register filing does not discharge your CDD obligation toward that client. A corporate service provider, auditor, broker or accountant cannot accept "our UBO is filed with DMCC" as verification. You verify independently from source documents and document it. Their filing is an input, not your output. The reverse holds too: a DNFBP with flawless CDD on every client has done nothing about its own register.

Common Mistake: A corporate service provider treating the registrar filings it makes for clients as evidence of its own AML programme. Those were made on behalf of others, under a different instrument, to a different body. Its own register, its own goAML registration and its own CDD files are three separate things, and a supervisor will ask for all three. Our guide to UAE AML and CFT compliance sets out what the customer-side programme must contain.

What do DIFC and ADGM do differently?

They run their own beneficial ownership regimes under their own registrars, outside Cabinet Resolution 109 of 2023. Outside the federal regime does not mean outside a regime.

The most concrete one is timing. ADGM uses a 30-day change-notification window against the federal 15 days. If you hold entities in both systems you are running two clocks off the same corporate event, so work to the shorter one everywhere. A team trained on "15 days" and applying it in ADGM is early, which costs nothing. A team trained on 30 and applying it in Dubai is late by half a month.

DIFC likewise maintains its own framework under the DIFC Registrar of Companies. Choosing a financial free zone does not remove a beneficial ownership obligation, it changes which rulebook and registrar you answer to. If holding structures are what you are designing around, our holding company setup guide covers how the layers interact, and the UAE commercial companies law guide covers the corporate law backdrop.

What should you prepare before you file?

Assemble the documents first. A filing that stalls almost always stalls on evidence rather than on the form, and the evidence usually involves other people in other time zones.

The two rows creating the longest delays are offshore constitutional documents and dated transfer instruments. A certified memorandum from a jurisdiction you incorporated in six years ago takes weeks, not days, and is not something to start on day eleven of a fifteen-day window.

Based on our experience, the next time sink is a transfer everyone remembers but nobody can date. Fix the paperwork first, because a register built on a guessed date is inaccurate data, and that is a violation [2].

What happens on a share transfer or a new investor?

Both start the 15-day clock on the date the change takes effect. Work backwards from that, because the compliance step comes last in the sequence and is the one nobody schedules.

A transfer moving anyone across the 25% line produces two entries, not one. The incoming holder becomes a real beneficiary on a date; the outgoing holder ceases to be one on a date. A register recording only the arrival is incomplete, and the cessation date is what a registrar looks for.

A new investor is the same mechanics plus dilution. Bringing someone in at 30% dilutes everyone else, so a founder who sat at 26% may sit at 18% after the round, and that cessation is notifiable even though nobody would call it the point of the transaction. Where the transaction happens above you, offshore, the trigger is identical and the visibility is worse: your share register did not move, but your indirect ownership did.

Real Talk: Deal timetables and compliance timetables do not agree. Completion is a date the lawyers optimise for; the fifteen days after it is a period nobody has been assigned. Put the register update on the completion checklist with a named owner and it takes twenty minutes. Leave it off and it becomes a discovery in next year's bank review, by which point the fix involves explaining a fourteen-month gap. Ongoing filings and record maintenance are what our post-setup services team runs, so a completion date never quietly becomes a violation date. If a transaction is coming, talk to a setup expert→

Where an entity carries obligations beyond the register, our economic substance regulations guide covers what else attaches to a running UAE structure.

Real Client Stories

Real examples from businesses we have helped, with details changed for privacy.

The company that had filed, correctly, under the wrong regime. A Dubai mainland trading company filed a real beneficiary register in 2021 and had the receipt to prove it. Ownership had not changed, so the position looked settled. What had changed was the instrument, and the register had never been reviewed against Cabinet Resolution 109 of 2023 [1]. Two gaps surfaced: no cessation date for a shareholder who exited in 2020, and no register of partners or shareholders at all. That came from treating a 2021 filing as permanently completed. We rebuilt all three registers, refiled through DET, and put the chain diagram in the corporate folder.

The nominee arrangement nobody had called one. A free zone company had been set up years earlier with a family friend holding shares for the actual owner, documented in a private side letter and never mentioned. The client did not think of it as a nominee structure; he thought of it as a favour. When we ran the ownership analysis for a bank onboarding, the registered shareholder held 100% and the real beneficiary was somebody else, which is exactly what the nominee declaration exists to capture [1]. We declared it to the zone registrar, recorded the real beneficiary with the commencement date, and tightened the documents. Had the bank found the discrepancy first, that conversation would not have ended with an account.

The restructuring that never reached Dubai. A UAE subsidiary of a European group had a stable local share register and a clean record. Two levels above it, the group reorganised, and one individual's indirect stake moved from 22% to 34%. Nobody in Dubai was told. The gap ran over a year and was found in a bank review, not by a registrar. We notified the change, documented the remediation, and added a standing instruction to the group's transaction checklist. The highest-risk changes happen where nobody is watching.

Get your register right, and keep it right

Beneficial ownership compliance is not difficult. It is just easy to leave in a state that was accurate the day it was filed and has been quietly wrong since. The obligation is continuous, the clock is fifteen days, the registrar is your licensing authority rather than a federal portal, and the instruments to quote are Resolution 109 of 2023 and Decision 132 of 2023 [1][2].

Since 2013, BusinessDubai.ae has completed 700+ company registrations across the UAE and maintained the registers that go with them. We will map your ownership chain to natural persons, tell you which step of the cascade your beneficiaries fall under, build the three registers, file with the right registrar, and put the calendar in place. If you are still choosing between structures, our free zone company setup and mainland company setup pages set out what each route involves. Talk to a setup expert→ for a straight assessment of where your filings stand.

Frequently Asked Questions

What is the current UAE UBO law?

Cabinet Resolution No. 109 of 2023 on Regulating the Real Beneficiary Procedures, effective 16 November 2023, with penalties under Cabinet Decision No. 132 of 2023, issued 15 December 2023 [1][2].

Is Cabinet Decision No. 58 of 2020 still in force?

No. It was superseded by Cabinet Resolution No. 109 of 2023, having itself replaced Cabinet Decision No. 34 of 2020. Any guide citing 58/2020 as current is quoting a repealed instrument [1].

Is Cabinet Decision No. 53 of 2021 still the penalty regime?

No. Penalties are now set by Cabinet Decision No. 132 of 2023, issued 15 December 2023 [2].

Where can I read the primary text?

On the UAE legislation portal, as legislation 2176 for Resolution 109/2023 and legislation 2314 for Decision 132/2023. The portal blocks automated access, so open the links in a browser [1][2].

Who has to comply with UAE UBO requirements?

Every legal person licensed or registered on the UAE mainland or in a non-financial free zone, including entities with no employees and those that have never traded [1].

Are free zone companies exempt from UBO requirements?

No, and this is the most common error in circulation. Only DIFC and ADGM sit outside the federal regime, and they run their own rules. DMCC, IFZA, RAKEZ, JAFZA, Meydan, SHAMS, Dubai South and the rest are all in scope [1][4].

Who is genuinely exempt?

Companies wholly owned by the federal or a local government, directly or through a chain of wholly government-owned entities; companies listed on a recognised stock exchange subject to disclosure requirements ensuring adequate transparency; and DIFC and ADGM entities [1].

Does the listing exemption cover a subsidiary of a listed group?

No. It attaches to the company whose shares are listed. A private UAE subsidiary is not itself listed and files its own register [1].

How many registers do I have to maintain?

Three: a real beneficiary register, a register of partners or shareholders, and nominee director or manager declarations where such an arrangement exists [1].

What goes in the real beneficiary register?

The identity of each real beneficiary, the ownership or voting percentage or the nature of the control exercised, and the dates on which each person became and ceased to be a real beneficiary [1].

Is my trade licence enough for the shareholder register?

No. It is a separate record requiring full shareholder details, the number and class of shares, voting rights, and the date acquired. A licence printout does not contain that [1].

Who counts as a real beneficiary in the UAE?

A natural person owning or controlling 25% or more of shares or voting rights, directly or indirectly. Failing that, the person exercising control by other means. Failing that, the senior management official [1].

Does indirect ownership count towards the 25%?

Yes. Follow the chain up through corporate shareholders to natural persons and multiply along the way. Someone holding 60% of a company that holds 45% of yours holds 27% indirectly [1].

What if no shareholder reaches 25%?

You move to the second test and identify the person exercising control by other means, for example a right to appoint or remove a majority of the directors, or control under a shareholders' agreement [1].

Can I just record the general manager as the real beneficiary?

Only if the first two tests genuinely identify nobody. Recording one while a 30% shareholder sits in the file is inaccurate data, which is itself a violation [1][2].

How long do I have to report a change?

Fifteen days, confirmed from the primary text of Cabinet Resolution 109 of 2023. The clock runs from the change taking effect, not from when you found out [1].

Is there a 60-day initial filing deadline?

Not one we can confirm as current. That figure traces to the repealed Cabinet Decision 58 of 2020. The initial declaration is made at the point of licensing or registration; confirm the exact window with your registrar [1].

Does a restructuring in another country trigger a UAE filing?

Yes, if it changes indirect ownership or control of your UAE entity. Your own share register may not move at all, which is why it is missed most often [1].

Where do I file my UBO register?

With your licensing authority. Dubai mainland companies file with the Dubai Department of Economy and Tourism through its e-services portal; free zone companies file through their zone's portal [4][8].

Is there a federal UBO portal in the UAE?

No. The Ministry of Economy is the federal policy owner and coordinator, but companies do not submit into a central database. You file with your registrar [3][6].

What are the penalties for UBO non-compliance?

Cabinet Decision No. 132 of 2023 sets a range of roughly AED 20,000 to AED 100,000 across individual violations: failing to maintain a register, failing to file, failing to notify a change, and providing incomplete or inaccurate data [2].

Which exact fine applies to my specific breach?

We do not publish a per-violation mapping, because we could not verify that annex. Take the exact figure from the notice you receive [2].

Do I get a warning before a fine?

A warning-first, progressive approach applies to a first violation, escalating on repeat or sustained non-compliance. Correcting one promptly usually produces a very different outcome [2].

Can my licence be suspended over a UBO failure?

Yes. Article 3(1) of Cabinet Decision No. 132 of 2023 empowers the Registrar to suspend the commercial licence and close the establishment for repeated violations [2].

Do I need a UAE-resident contact person for the registrar?

It is commonly reported, but we could not confirm it against the primary text, so we are not publishing a field list. Ask your registrar whether it applies to your entity [1].

Does filing my UBO register satisfy my AML obligations as a DNFBP?

No. Your register filing is a corporate disclosure to your registrar. Customer due diligence is a separate duty about your clients, evidenced through your own verification and reported through goAML [5][7].

Can I rely on a client telling me their UBO is filed with their free zone?

No. A DNFBP must verify a client's beneficial ownership from source documents and document it. The client's filing is one input, not your conclusion [5][7].

Which businesses are DNFBPs in the UAE?

Real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, and independent lawyers and notaries for certain transactions. All must register on goAML [5][7].

How does ADGM differ from the federal regime?

ADGM runs its own regime through its own registrar and uses a 30-day change-notification window rather than the federal 15 days. If you operate in both systems, work to the shorter clock.

References

A note on these sources. The UAE legislation portal, uaelegislation.gov.ae, blocks automated access, so references [1] and [2] must be opened in a browser. We verified Resolution 109/2023 against a hosted mirror of the primary text and against law-firm reporting. Dubai DET's domains likewise block automated checks, so reference [8] points to the UAE Government portal's mainland licensing page.

[1] UAE Legislation portal. Cabinet Resolution No. 109 of 2023 on Regulating the Real Beneficiary Procedures, effective 16 November 2023, superseding Cabinet Decision No. 58 of 2020. Source for scope and exemptions, the three registers, the 25% test and two fallbacks, and the 15-day notification. Cabinet Resolution No. 109 of 2023

[2] UAE Legislation portal. Cabinet Decision No. 132 of 2023, issued 15 December 2023, superseding Cabinet Decision No. 53 of 2021. Source for the penalty range, the warning-first approach, and the Article 3(1) power to suspend the commercial licence and close the establishment. Cabinet Decision No. 132 of 2023

[3] Ministry of Economy. Review of the Cabinet Resolution on the organisation of real beneficiary procedures. Source for the Ministry's role as federal policy owner and coordinator. Ministry of Economy on the real beneficiary resolution

[4] Ajman Media City Free Zone. UBO guidance to licensees, cited as a worked example of a non-financial free zone applying the federal regime rather than being exempt from it. Ajman Media City UBO guidance

[5] UAE Government portal. Combatting money laundering. Source for the AML and CFT architecture within which beneficial ownership disclosure sits, and the due diligence duties carried by DNFBPs. Combatting money laundering

[6] Ministry of Economy. Federal policy owner and coordinator across licensing authorities, but not a filing destination for company registers. Ministry of Economy

[7] UAE Financial Intelligence Unit. goAML, the registration and reporting platform through which DNFBPs discharge customer-side AML obligations. UAE Financial Intelligence Unit, goAML

[8] UAE Government portal. Running a business on the mainland, covering the emirate-level licensing authorities including the Dubai Department of Economy and Tourism, the registrar Dubai mainland companies file with. Running a business on the mainland