The UAE UBO Register and goAML: Company Obligations, Deadlines and Penalties in 2026

Every company registered on the UAE mainland or in a commercial free zone must maintain a register of beneficial owners and a register of partners or shareholders, and file their data with the Registrar — the licensing authority of its own jurisdiction. The requirement sits in Cabinet Decision No. 109 of 2023 on Regulating the Beneficial Owner Procedures. A separate obligation, covering a different population, is registration on the Financial Intelligence Unit’s goAML platform: it applies to financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers.

Under Article 5 of Cabinet Decision No. 109 of 2023, a beneficial owner is the natural person who owns or exercises ultimate control over a legal person through direct or indirect ownership of 25% or more of its capital, or who holds 25% or more of the voting rights, including through a chain of ownership or control or by other means — such as the right to appoint or dismiss the majority of its directors.

A change of perimeter that many have missed. Federal Decree-Law No. 10 of 2025 on anti-money laundering, counter-terrorist financing and proliferation financing has applied since 14 October 2025, repealing and replacing Federal Decree-Law No. 20 of 2018. Yet Article 1 of Cabinet Decision No. 109 of 2023 still defines the "Decree-Law" as the 2018 statute and points to Cabinet Decision No. 10 of 2019 as the implementing regulation, whereas the implementing regulation since 14 December 2025 is Cabinet Decision No. 134 of 2025. The cross-references inside the UBO decision point to repealed instruments; documentation should follow the chain in force.

The scope of this article — what is here and what is not. This article covers two formal obligations: keeping the registers under Cabinet Decision No. 109 of 2023 and registering on goAML — who is caught, what data, on what deadlines, under what penalties. The substantive AML compliance of designated non-financial businesses and professions — the risk-based approach, customer due diligence, the institutional risk assessment, the compliance officer role and the logic of supervisory inspections — is the subject of a separate UPPERSETUP article on DNFBPs, linked in the sources. A DNFBP needs both: the perimeter and deadlines here, the processes there.

What follows treats the two obligations separately: what each register must contain, the deadlines measured in days, the sanctions under Cabinet Decision No. 132 of 2023, and how the goAML population differs from the UBO population.

1. Two Chains of Instruments That Must Not Be Conflated

The beneficial owner register and the goAML system are governed by different instruments and different authorities. Conflating the two blocks is the most common error at the diagnostic stage.

Block 1. Beneficial ownership

•     Cabinet Decision No. 109 of 2023 on Regulating the Beneficial Owner Procedures. Issued on 22/04/1445H, corresponding to 6 November 2023, published in the UAE Official Gazette issue No. 763, and under Article 23 coming into force from the day following publication. Article 22 repealed Cabinet Decision No. 58 of 2020, published in Official Gazette No. 685 (annex) at p. 17.

•     Cabinet Decision No. 132 of 2023 on administrative penalties for breaches of the beneficial owner procedures. Issued on 15 December 2023, replacing Cabinet Decision No. 53 of 2021. Article 18 of Cabinet Decision No. 109 of 2023 refers expressly to a list of penalties issued by Cabinet decision on the proposal of the Minister of Finance and in coordination with the Minister of Economy. Per Baker McKenzie, the new decision clarified the descriptions of the penalties and split several previously grouped breaches into more itemised violations.

The commencement-date discrepancy resolves once issue date and effective date are separated. Some commentary dates the entry into force of Cabinet Decision No. 109 of 2023 to 6 November 2023, other commentary to 16 November. The primary text gives a formula: the decision takes effect from the day following publication in the Official Gazette. 6 November 2023 is the issue date stated in the text itself, while Baker McKenzie records the decision as coming into effect on 16 November 2023. Describing it as "effective from 6 November" conflates the issue date with the commencement date.

Article 1 of Cabinet Decision No. 109 of 2023 defines the "Ministry" as the Ministry of Economy and the "Minister" as the Minister of Economy. The decision predates the renaming to Ministry of Economy and Tourism, so both names appear across instruments and the portal for the same body.

A formulation that circulates in commentary and is wrong. Many publications write "Cabinet Resolution No. 58 of 2020 as amended by Resolution No. 109 of 2023". That is incorrect: Article 22 of Resolution No. 109 of 2023 repealed Resolution No. 58 of 2020 rather than amending it. The practical significance is that policies and contracts must not cite the 2020 instrument as being in force.

Block 2. Anti-money laundering and goAML

•     Federal Decree-Law No. 10 of 2025 on anti-money laundering, counter-terrorist financing and proliferation financing. In force from 14 October 2025; it repealed and replaced Federal Decree-Law No. 20 of 2018. The chain runs: Federal Law No. 4 of 2002 → Federal Decree-Law No. 20 of 2018 → amended by Federal Decree-Law No. 26 of 2021 → amended by Federal Decree-Law No. 7 of 2024 → repealed and replaced by Federal Decree-Law No. 10 of 2025.

•     Cabinet Decision No. 134 of 2025 — the implementing regulation to Federal Decree-Law No. 10 of 2025, in force from 14 December 2025. It replaced Cabinet Decision No. 10 of 2019, the implementing regulation to the 2018 statute.

Federal Decree-Law No. 10 of 2025 established two new bodies: a Supreme Committee for the Supervision of the National Strategy on AML/CFT/CPF, affiliated with the Presidential Court, and a National Committee for Combating Money Laundering, the Financing of Terrorism and Proliferation Financing, chaired by the Governor of the Central Bank.

Supervision is split by sector: the Central Bank for banks and finance, the Securities and Commodities Authority for capital markets, the Ministry of Economy and Tourism for DNFBPs, and the DIFC and ADGM regulators for the financial free zones. The Financial Intelligence Unit sits within the Central Bank and operates through goAML.

2. Who Must Keep a UBO Register, and Who Is Exempt

Under Article 3(1) of Cabinet Decision No. 109 of 2023, the requirements apply to the Registrar and to legal persons licensed or registered in the UAE, including commercial free zones.

Three exempt categories

•     Companies wholly owned by the federal or local government, and any companies wholly owned by such companies.

•     Financial Free Zones — the Dubai International Financial Centre and the Abu Dhabi Global Market. The exemption here means a different legal basis rather than no obligation: DIFC operates its Beneficial Ownership Regulations and ADGM its Beneficial Ownership and Control Regulations, with disclosure running through the centre’s own authority rather than the Ministry of Economy and Tourism.

•     The Governmental Partner — a federal or local government contributing to or holding shares in a company.

UAE offshore companies — RAK ICC, JAFZA Offshore and equivalents — sit in commercial rather than financial free zones and fall within the Cabinet Decision No. 109 of 2023 regime in full. A multi-layered structure through closed jurisdictions does not remove the duty to disclose the ultimate natural person.

A commercial free zone is not a financial free zone. The exemption in Article 3(2)(b) reaches only the Financial Free Zones, meaning DIFC and ADGM. Every other free zone — DMCC, IFZA, JAFZA, RAKEZ, Meydan, SHAMS and the rest — is commercial and falls squarely within the regime. A company in a commercial free zone files with its zone’s registrar, not directly with the Ministry of Economy and Tourism.

A separate carve-out for listed groups

Article 6(2) exempts from the duty to obtain and maintain beneficial owner data those legal persons owned by a company listed on a regulated market subject to disclosure requirements that ensure sufficient transparency of beneficial ownership, and majority-owned subsidiaries of such a listed company.

3. How the Beneficial Owner Is Identified: Three Tiers

Article 5 builds the definition as a sequence: you move to the next tier only where the previous one produces no result.

1.  Tier one — ownership and control. A natural person owning, directly or indirectly, 25% or more of the capital, or holding 25% or more of the voting rights, including through a chain of ownership or control and through control by other means — such as the right to appoint or dismiss the majority of directors.

2.  Tier two — control by other means. Where all possible means have been exhausted and no natural person with ultimate controlling ownership is identified, or where there is doubt that the person exercising control is the beneficial owner, the natural person who exercises control by other means is treated as the beneficial owner.

3.  Tier three — senior management official. Where no natural person is identified at the previous tier, the person holding the position of higher management official is deemed the beneficial owner.

Article 5(4) closes the standard fragmentation attempt: where more than one person participates in owning or controlling a percentage of the capital, they are all treated as owners and controllers of that percentage. Splitting a 25% holding across several individuals does not remove them from the definition.

Article 5(2) requires the Registrar’s risk-based approach to be taken into account, particularly for complex ownership structures. Article 1 defines a Complex Ownership Structure as an institutional mechanism identifying a legal person as part of a group of intricately linked entities aimed at concealing the identity of the natural person who owns or controls it.

4. The Registers a Company Must Maintain

Cabinet Decision No. 109 of 2023 establishes two mandatory registers and a separate disclosure regime for nominee board members.

The beneficial owner register and the register of partners or shareholders

Register	Mandatory data	Basis
Beneficial owner register	Full name, nationality, date and place of birth; place of residence or address for notifications; travel document or identity card number with country and dates of issue and expiry; the basis and date on which the person became beneficial owner; the date on which that status ceased	Article 8(2)
Register of partners or shareholders — general	The number of shares or stocks owned by each, their categories and associated voting rights; the date of acquiring the capacity of partner or shareholder	Article 10(1)
Register of partners or shareholders — natural persons	Full name per the identity card or travel document, nationality, address, place of birth, the name and address of the employer, and a true copy of a valid identity card or travel document	Article 10(1)(c)
Register of partners or shareholders — legal persons	Name, legal form and articles of association; head office or main workplace address, and for a foreign legal person the name and address of its legal representative in the UAE; the statute or similar document; the names of persons in senior management positions with their document data	Article 10(1)(d) and Article 4(1)
Data of represented persons	The register of partners or shareholders includes the data of the persons represented by each trustee or nominee board member	Article 10(3)

Nominee board members

A manager or board member acting as a nominee must notify the legal person of that status and submit the data referred to in Article 10 within 15 days of acquiring the capacity. A person who acquired the status before publication of the decision had to notify the legal person within 30 days of publication.

Article 1 defines a Nominee Board Member as any natural person acting in accordance with the directions, instructions or will of another person, officially appointed or holding a position in the legal person and usually representing shareholders, members or another relevant entity. Changes to the data and cessation of the status must be notified to the legal person within 15 days.

5. Deadlines: Everything Is Measured in Days

The regime runs on short, event-linked deadlines. The table below consolidates every period fixed by Cabinet Decision No. 109 of 2023.

Period	Obligation	Basis
60 days	Create the beneficial owner register — from the date the decision was issued or from the date the legal person came into existence	Article 8(1)
60 days	File the data of both registers with the Registrar — from the date the decision took effect or from licensing and registration	Article 11(1)
15 days	Update the beneficial owner register and record any change — from the date of becoming aware of it	Article 8(1)
15 days	Update the register of partners or shareholders — from the date of becoming aware of the change	Article 10(1)
15 days	File any amendment or change of data or information with the Registrar	Article 15(2)
15 days	Notify a person that their name has been entered in the beneficial owner register where the data was not provided by them or with their knowledge	Article 8(3)
15 days	Disclose to the Registrar the details of shares issued in the name of persons or board members and their identity	Article 11(6)
14 days	Provide any additional data requested by the Registrar	Article 11(2)
30 days	Deliver the registers to the liquidator, running from the date of the liquidator’s appointment — an obligation of the legal person at the dissolution or liquidation stage	Article 11(7); item 14 of the schedule to Cabinet Decision No. 132 of 2023
30 days	File a grievance with the Grievances Committee against an administrative penalty	Article 19(1)
5 years	Retention of the registers and all data by the liquidator, from the date of dissolution or liquidation	Article 11(8)

6. What to Do When the Beneficial Owner Does Not Respond

Article 7 governs the situation where a company identifies a natural person who could be a beneficial owner but whose ownership details are not correctly recorded in the register.

4.  The company inquires about that person’s status as its beneficial owner.

5.  If 15 days pass from the date of the inquiry without a response, the company issues a notification to that person.

6.  The notification must contain evidence of its issuance under the decision, the details the company believes to be correct with a request for the missing data, and a request that the addressee state whether they are the beneficial owner, confirm or correct the details, and supply anything missing.

7.  If the addressee fails to comply within 15 days of the notification being sent, the company enters the notified details in the register.

Article 7(4) allows the company to rely on the person’s written response when determining the identity of the beneficial owner — unless it has reasonable grounds to suspect the answer is misleading or incorrect, in which case it records the nature of that person’s ownership as beneficial owner and notifies them accordingly.

Silence from the beneficial owner does not relieve the company. Article 7 is built so that a non-response leads not to suspension of the process but to entry in the register of whatever details the company holds. Responsibility for the existence and completeness of the register rests on the legal person regardless of the beneficial owner’s willingness to co-operate.

7. Prohibitions and Duties Discovered Late

Article 11(5) expressly prohibits a legal person licensed or registered in the UAE from issuing bearer share warrants.

Article 11(4) requires every legal person to give the Registrar the name of a natural person residing in the UAE authorised to disclose all data required by the law, the implementing regulation and the decision, with that person’s address, contact details and a valid copy of their travel document or identity card.

Article 8(5) blocks opaque share transfers: a legal person may not register or give effect to any document on a change of ownership unless the transferee provides a statement of whether the transfer changes the beneficial owner and how. The statement must carry the new beneficial owner’s data for entry in the register.

Professional privilege: the single exception

Article 12(3) exempts attorneys, other independent legal professionals and independent statutory auditors from submitting data obtained while assessing the legal position of the legal person, defending or representing it before the judiciary, in arbitration, mediation or conciliation, or when giving a legal opinion connected with judicial proceedings, whether obtained before, during or after those proceedings.

Article 6(2) sets the counting rule: for collecting administrative fines, part of a day counts as a full day and part of a month as a full month.

Both stages require correction as well as payment. A second-stage fine always comes with a fresh warning carrying its own correction period — 15 or 30 days depending on the violation. A company that pays the fine but does not correct moves to the third stage at double the amount, with licence suspension in prospect. Paying does not close the violation.

Article 2 of Cabinet Decision No. 132 of 2023 applies the penalties to legal persons licensed or registered in the country, including non-financial free zones — wording that confirms commercial free zones sit inside the perimeter and financial free zones outside it.

Cabinet Decision No. 132 of 2023 was issued on 02/06/1445 H, corresponding to 15 December 2023, published in Official Gazette issue No. 766 at p. 33, and takes effect the day after publication. Article 8 repealed Cabinet Decision No. 53 of 2021.

The same stale cross-references as in the principal decision. Article 1 of Cabinet Decision No. 132 of 2023 defines the "Decree-Law" as Federal Decree-Law No. 20 of 2018 and the "Implementing Regulations" as Cabinet Decision No. 10 of 2019. Both are repealed — the first by Federal Decree-Law No. 10 of 2025 from 14 October 2025, the second by Cabinet Decision No. 134 of 2025 from 14 December 2025. The outdated cross-references therefore sit in both beneficial ownership decisions, not just one.

Beyond the fine, non-compliance blocks licence renewal and creates a banking problem: registrar, licensing authority and bank work from the same ownership picture, and a mismatch is a ground for refusal, review or account freezing.

9. goAML: Who Must Register

goAML is the platform of the UAE Financial Intelligence Unit, hosted by the Central Bank, and the single channel for suspicious transaction reporting and sector returns. The population differs from the UBO population: the duty attaches to the activity, not to incorporation.

Who registers

•     Financial institutions. Banks, exchange houses, insurers and finance companies supervised by the Central Bank of the UAE.

•     Designated non-financial businesses and professions. Real estate brokers and agents; dealers in precious metals and stones; auditors and accountants; corporate service providers. These sectors are supervised federally by the Ministry of Economy and Tourism.

•     Virtual asset service providers. Federal Decree-Law No. 10 of 2025 expressly extended the perimeter to VASPs. Providers regulated by the Securities and Commodities Authority or by Dubai’s Virtual Assets Regulatory Authority also register.

•     Commercial gaming operators. Article 3 of Cabinet Resolution No. 134 of 2025 introduced commercial gaming as a new DNFBP category, with a customer due diligence threshold of AED 11,000 per transaction. The AED 55,000 threshold for dealers in precious metals and stones is retained unchanged.

goAML registration does not depend on the type of trade licence, on whether the company sits on the mainland or in a free zone, or on the size of the business. The activity is what determines the duty.

Registration runs in two stages: pre-registration in the Service Access Control Manager (SACM) to obtain a username, then activation of the goAML account. New entities register as the duty arises.

The key distinction between the two regimes. Almost every company on the mainland or in a commercial free zone must keep a UBO register. Only financial institutions, DNFBPs and virtual asset service providers must register on goAML. An ordinary trading or consultancy company outside those categories keeps a UBO register but does not register on goAML. The converse does not hold: a DNFBP carries both duties at once.

10. What Is Reported Through goAML, and When

Several report types run through goAML, some tied to sector thresholds rather than to a subjective assessment of suspicion.

•     Suspicious transaction reports — where money laundering or terrorist financing is suspected, including at the establishment of a business relationship and when carrying out transactions.

•     Suspicious activity reports — where customer behaviour looks suspicious without a single triggering transaction.

•     Dealer in Precious Metals and Stones Reports (DPMSR) — for transactions equal to or exceeding AED 55,000 in cash or by wire transfer, with identification documents attached.

•     Real Estate Activity Reports (REAR) — on property transactions settled in cash at or above AED 55,000, or settled in virtual assets.

•     Sanctions-list reports on partial and confirmed matches and on the freezing of funds.

The AED 55,000 threshold is set by Article 3(3) of Cabinet Decision No. 134 of 2025: dealers in precious metals and stones are DNFBPs where they carry out a single cash transaction, or linked cash transactions, at or above AED 55,000. The amount carried over unchanged into the new regulation but on a new legal basis.

The sector circulars that drive the reporting mechanics

•     DPMSR. The basis is Ministry of Economy Circular No. 08/AML/2021, in force from 12 June 2021 and listed among the instruments on the Ministry’s AML page. It requires identity documents from individuals and the trade licence from corporate counterparties on transactions at or above the threshold, registration of the details in goAML, and retention of records for at least five years.

•     REAR. The basis is Ministry of Economy Circular No. 05/2022 for real estate agents and brokers. The trigger is settlement in cash at or above AED 55,000 on a single or linked freehold transaction, or settlement in virtual assets in any amount.

The tipping-off prohibition is a standalone requirement: the reporting entity may not tell the customer that a report has been filed or how it is progressing.

11. AML Penalties

Administrative AML penalties are imposed by the sector supervisor. For DNFBPs that is the Ministry of Economy and Tourism.

The two fine ranges that commentary presents as contradictory operate at different levels. Federal Decree-Law No. 10 of 2025 sets the general statutory range — AED 10,000 to AED 5,000,000 per violation, the floor lowered from AED 50,000 and the ceiling retained. Cabinet Resolution No. 71 of 2024 sets the sector schedule for DNFBPs supervised by the Ministry of Justice and the Ministry of Economy: a unified list of 41 violations with fines from AED 50,000 to AED 1,000,000.

Cabinet Resolution No. 71 of 2024 replaced Cabinet Resolution No. 16 of 2021, raised the ceiling to AED 1,000,000 and introduced doubling for repeat violations. It remains listed among the instruments in force on the Ministry of Economy and Tourism’s AML page alongside Cabinet Resolution No. 134 of 2025.

The practical conclusion for a DNFBP. Work from the Cabinet Resolution No. 71 of 2024 schedule rather than the statutory range: the schedule carries the specific violation and its amount, and it is what the supervisor applies. Take the figure from the annexed list of 41 violations.

Fines are imposed per breach and stack: one inspection identifying several failings produces several penalties.

Federal Decree-Law No. 10 of 2025 also carries criminal sanctions. Breach of targeted financial sanctions instructions brings imprisonment and a fine of not less than AED 20,000, or either. Breach of Article 10, refusal to provide information, deliberate concealment or knowingly providing false information carry imprisonment and a fine, or either. On conviction the court may confiscate the seized funds, without prejudice to bona fide third parties.

12. What Federal Decree-Law No. 10 of 2025 Changed

The 2025 statute is not a renumbering exercise: it changed the construction of the offence, the perimeter of obliged persons and the institutional structure of supervision.

•     A lower evidentiary threshold. Article 2 frames the offence around a person who knows, or has sufficient evidence or circumstantial evidence supporting their knowledge, that the funds derive wholly or partly from a predicate offence. Prosecutors no longer need to prove actual knowledge of criminal intent; knowledge may be deemed from objective circumstances.

•     A wider perimeter. Virtual asset service providers are brought into scope and proliferation financing is designated as a distinct strand.

•     A new institutional structure. A Supreme Committee affiliated with the Presidential Court and a National Committee chaired by the Central Bank Governor were established, and the Financial Intelligence Unit gained greater autonomy and enhanced powers, including digital integration through goAML.

•     Disclosure duties moved into the statute. Requirements previously held in secondary instruments were incorporated into Article 10 of the Decree-Law itself, with the Federal Authority for Identity and Citizenship, Customs and Ports Security designated as the responsible authority in coordination with the Central Bank.

The enactment of Federal Decree-Law No. 10 of 2025 followed the European Union’s decision to remove the UAE from its list of high-risk jurisdictions with strategic AML/CTF deficiencies.

13. How the UBO Register and goAML Connect in Practice

Formally these are two independent duties, but they meet at three points, and that is where problems arise.

•     Bank compliance. A bank must identify and verify the beneficial owner and understand the ownership structure. It reconciles what the company states against the registers and its own checks, so an opaque or inconsistent ownership chain is a leading reason an account is refused, reviewed or frozen.

•     Counterparty diligence by a DNFBP. A corporate service provider, auditor or real estate broker must identify the client’s beneficial owner as part of customer due diligence. A company without a correct UBO register creates a problem not only for itself but for its service provider, for whom it is a standalone breach.

•     Licence renewal. The licensing authority is the Registrar for UBO purposes, so the state of the register is checked at renewal. An unresolved breach blocks renewal whether or not a fine has already been imposed.

14. Common Mistakes

Mistake 1. Assuming a free zone is outside the UBO regime

The exemption in Article 3(2)(b) reaches only the Financial Free Zones — DIFC and ADGM. Every commercial free zone falls fully within the regime and files with its own registrar. The cost: a register that was never created is a standalone breach with escalating sanctions and a blocked licence renewal, usually discovered at the renewal itself.

Mistake 2. Fragmenting a holding below 25%

Article 5(4) states expressly that where several persons participate in owning or controlling a percentage, all of them are treated as its owners and controllers. A "four partners at 24.9% each" construction does not escape the definition, and Article 5(2) requires a risk-based approach to complex ownership structures. The cost: a structure built for opacity becomes itself an indicator of a complex ownership structure and a reason for heightened registrar attention.

Mistake 3. Missing the 15-day update window

The 15-day period runs not from the date of the change but from the date of becoming aware of it, and applies simultaneously to the beneficial owner register, the register of partners or shareholders, and the filing of changes with the Registrar. The cost: missing the deadline is itself a breach and triggers escalation, even where the data is ultimately filed in full and accurately.

Mistake 4. Not appointing a UAE-resident authorised person

Article 11(4) requires the name, address, contact details and document copy of a natural person residing in the UAE authorised to disclose data. The cost: when the Registrar makes a request there is formally no one to answer it, and the window to supply additional data is only 14 days from the request.

Mistake 5. Confusing the two regimes and skipping goAML

Keeping a UBO register does not replace goAML registration, and goAML registration does not discharge UBO duties. A corporate service provider, auditor, real estate broker or precious metals dealer carries both at once. The cost: failure to register on goAML is an AML breach with its own fine range, materially higher than UBO sanctions.

Mistake 6. Citing repealed instruments

Federal Decree-Law No. 20 of 2018 was repealed on 14 October 2025, Cabinet Decision No. 10 of 2019 was replaced by Cabinet Decision No. 134 of 2025 on 14 December 2025, Cabinet Decision No. 58 of 2020 was repealed and Cabinet Decision No. 53 of 2021 replaced. Internal policies and contracts citing the old instruments formally point at provisions that no longer exist. The cost: on inspection, a mismatch between internal documentation and the framework in force is recorded as a standalone internal-control deficiency.

15. Which Duties Apply to Whom

Category	UBO register under CD 109 of 2023	goAML registration	Supervisory authority
Mainland company, ordinary trading or consultancy activity	Required	Not required unless the activity is a DNFBP activity	The emirate’s department of economic development as Registrar
Company in a commercial free zone	Required	Not required unless the activity is a DNFBP activity	The free zone authority as Registrar
Corporate service provider, auditor, accountant	Required	Required	Registrar for UBO; Ministry of Economy and Tourism for AML
Real estate broker or agent	Required	Required	Registrar for UBO; Ministry of Economy and Tourism for AML
Dealer in precious metals and stones	Required	Required	Registrar for UBO; Ministry of Economy and Tourism for AML
Virtual asset service provider	Required where registered outside a financial free zone	Required	Securities and Commodities Authority or VARA
Commercial gaming operator	Required	Required: a new DNFBP category under Article 3 of Cabinet Resolution No. 134 of 2025	Registrar for UBO; the relevant AML supervisor
Company in DIFC or ADGM	Cabinet Decision No. 109 of 2023 does not apply; the DIFC Beneficial Ownership Regulations or the ADGM Beneficial Ownership and Control Regulations apply instead	Per the rules of the relevant centre	DFSA or FSRA
Company wholly owned by federal or local government	Not applicable	By activity	Not applicable

16. Step-by-Step Compliance Route

8.  Determine whether the company falls within the UBO regime by testing it against the three exempt categories — government-owned companies, financial free zones, governmental partner.

9.  Separately determine whether the activity is a DNFBP, financial institution or virtual asset service provider activity: that drives the goAML duty.

10.     Map the ownership structure to natural persons and apply the Article 5 test in sequence: 25% of capital or votes, then control by other means, then the senior management official.

11.     Check whether several persons participate in a single holding: if so, all of them are treated as owners and controllers of that holding.

12.     Create the beneficial owner register with the full data set under Article 8(2) and the register of partners or shareholders under Article 10.

13.     Collect notifications from nominee board members and record the data of the persons they represent in the register of partners or shareholders.

14.     Appoint a natural person residing in the UAE authorised to disclose data, and give the Registrar their name, address, contact details and document copy.

15.     File the data of both registers with the Registrar of the relevant jurisdiction — the emirate’s department of economic development or the free zone authority.

16.     For DNFBPs, register on the goAML portal, appoint a compliance officer, and implement customer due diligence and reporting procedures.

17.     Build a change-monitoring process on the 15-day clock: changes in participants, change of beneficial owner, changes to personal data, issuance of shares in the name of board members.

18.     Refresh internal policies and contracts, replacing references to repealed instruments with Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025.

19.     Test readiness for a Registrar request: the window to supply additional data is 14 days from the request.

17. Frequently Asked Questions

Must free zone companies keep a UBO register in the UAE?

Yes, if it is a commercial free zone. Article 3(1) of Cabinet Decision No. 109 of 2023 extends the requirements expressly to commercial free zones. Only the financial free zones — DIFC and ADGM — are exempt, and they operate their own regimes.

What ownership threshold makes someone a beneficial owner in the UAE?

Direct or indirect ownership of 25% or more of the capital, or holding 25% or more of the voting rights, including through a chain of ownership or control or through control by other means such as the right to appoint or dismiss the majority of directors.

What penalties apply to UBO breaches in the UAE?

Penalties sit in the schedule to Cabinet Decision No. 132 of 2023 and attach to the specific violation, escalating from a written warning to a fine and then to double that fine. Failing to establish either register, or to disclose ownership layers in a complex structure, runs AED 50,000 at the second stage and AED 100,000 at the third, with possible licence suspension.

Who must register on the goAML system?

Financial institutions, designated non-financial businesses and professions — real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers — and virtual asset service providers. The duty does not depend on licence type, mainland or free zone status, or business size.

Does goAML registration replace the UBO register?

No. They are independent duties covering different populations. Almost every mainland and commercial free zone company keeps a UBO register, while only financial institutions, DNFBPs and virtual asset service providers register on goAML. A DNFBP carries both.

Which AML statute is currently in force in the UAE?

Federal Decree-Law No. 10 of 2025, in force from 14 October 2025. It repealed and replaced Federal Decree-Law No. 20 of 2018 as amended by Federal Decree-Law No. 26 of 2021 and Federal Decree-Law No. 7 of 2024. The implementing regulation is Cabinet Decision No. 134 of 2025, in force from 14 December 2025.

18. Key Takeaways

•     A UBO register is mandatory for all mainland and commercial free zone companies; government-owned companies, financial free zones and the governmental partner are exempt.

•     The beneficial ownership threshold is 25% of capital or votes, directly or indirectly, including control by other means.

•     The test has three tiers: ownership and control, then control by other means, then the senior management official.

•     Where a holding is shared, all participating persons are treated as its owners and controllers.

•     Key deadlines: 60 days to create the register and file first, 15 days to update and notify the Registrar, 14 days to answer a request, 30 days to hand the registers to the liquidator.

•     Issuing bearer share warrants is expressly prohibited by Article 11(5).

•     A company must appoint a UAE-resident natural person authorised to disclose data to the Registrar.

•     Penalties in the schedule to Cabinet Decision No. 132 of 2023 attach to the specific violation: AED 5,000 to AED 100,000, doubling at the third stage. Failing to establish either register, or to disclose ownership layers in a complex structure, is the costliest.

•     A liquidator who fails to keep the registers for five years is fined AED 100,000 immediately, with no warning stage.

•     goAML registration is mandatory for financial institutions, DNFBPs, virtual asset service providers and commercial gaming operators, and does not discharge UBO duties.

•     The reporting threshold for dealers in precious metals and stones is AED 55,000; for commercial gaming operators the due diligence threshold is AED 11,000.

•     The AML statute in force is Federal Decree-Law No. 10 of 2025 from 14 October 2025, with Cabinet Decision No. 134 of 2025 from 14 December 2025.

19. Summary

Every company registered on the UAE mainland or in a commercial free zone must maintain a register of beneficial owners and a register of partners or shareholders and file their data with the Registrar — the licensing authority of its jurisdiction. The requirement sits in Cabinet Decision No. 109 of 2023 on Regulating the Beneficial Owner Procedures, issued on 6 November 2023, published in UAE Official Gazette issue No. 763, coming into force from the day following publication, and repealing Cabinet Decision No. 58 of 2020. Exempt are companies wholly owned by the federal or local government, the financial free zones DIFC and ADGM, and the governmental partner. Under Article 5 a beneficial owner is a natural person owning directly or indirectly 25% or more of the capital or holding 25% or more of the voting rights, including through a chain of ownership or control and through the right to appoint or dismiss the majority of directors; failing that, the person exercising control by other means, and failing that, the senior management official. Key deadlines: 60 days to create the beneficial owner register and to make the first filing of both registers with the Registrar; 15 days to update the registers, to file changes with the Registrar, to notify a person of entry in the register and to disclose shares issued in the name of board members; 14 days to supply additional data on request; 30 days for the liquidator to deliver the registers; 5 years of retention by the liquidator. A nominee board member notifies the company of that status within 15 days. Article 11(5) prohibits the issue of bearer share warrants. Penalties are set by Cabinet Decision No. 132 of 2023 of 15 December 2023, replacing Cabinet Decision No. 53 of 2021, and escalate from a written warning to an administrative fine and licence suspension; a grievance is filed with the Grievances Committee within 30 days and a stay request is decided within 45 working days. A separate duty — registration on the Financial Intelligence Unit’s goAML platform hosted by the Central Bank — applies to financial institutions, designated non-financial businesses and professions (real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers) and virtual asset service providers; the reporting threshold for dealers in precious metals and stones is AED 55,000. The AML statute in force is Federal Decree-Law No. 10 of 2025, effective 14 October 2025, which repealed Federal Decree-Law No. 20 of 2018; the implementing regulation is Cabinet Decision No. 134 of 2025, in force from 14 December 2025.

20. Sources

Tier 1 — primary sources and official materials

•     Ministry of Economy and Tourism — Cabinet Decision No. 109 of 2023 on Regulating the Beneficial Owner Procedures (official English text, PDF)

•     CBUAE Rulebook — Federal Decree-Law No. 10 of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing

•     CBUAE Rulebook — Federal Decree-Law No. 20 of 2018 with the repeal note referencing Law No. 10 of 2025

•     UAE Financial Intelligence Unit — AML/CFT Laws & Related Decisions, including Cabinet Decision No. 134 of 2025

•     Ministry of Economy and Tourism — AML section: the instruments currently in force

•     UAE Legislation — Cabinet Resolution No. 71 of 2024: unified list of violations and administrative fines (PDF)

Tier 2 — professional commentary

•     DLA Piper — UAE Issues New AML Law to Strengthen Anti-Money Laundering and Counter-Terrorist Financing Framework

•     White & Case — The UAE enacts a new AML law: key changes and what this means for your business

•     DWF — UAE Law No. 10/2025 on Fighting Financial Crimes

•     Mondaq — Federal Decree by Law No. 10 of 2025 Regarding Anti-Money Laundering

•     Lexis Middle East — Cabinet Decision No. 109/2023 On the Regulation of the Real Beneficiary Procedures

Related UPPERSETUP analysis

•     Crypto Business in the UAE in 2026: VARA, FSRA, DFSA, VASP Licences and Banking Compliance

•     How to Set Up a Company in the UAE in 2026: Mainland, Free Zone, Offshore, Taxes, Banking

•     DIFC 2026: Jurisdiction, Structures, Regulators and Taxes

Need to bring a structure into compliance? UPPERSETUP handles compliance projects across the UAE, Kazakhstan and Hong Kong: diagnosing UBO applicability and DNFBP status, mapping ownership to natural persons, building the registers and filing with the Registrar, goAML registration and internal procedure design. Discuss your project with UPPERSETUP

Disclaimer

This material is provided for informational purposes only and does not constitute legal, tax, financial, investment or consulting advice. Before making any decision, obtain individual professional advice reflecting your specific circumstances, jurisdiction, company status and current regulatory requirements. Information is current as of August 2026.