Common Business Compliance Advisory Mistakes to Avoid in Dubai
Free zone status changes who licenses you. It does not remove the federal layer underneath.
A single Dubai company can answer to four or five separate bodies, and an obligation owed to one is no answer to another. This article starts with a table matching each obligation — trade licence, company filings, regulated financial activity, corporate tax and VAT, employment, personal data — to the authority that supervises it onshore, in a free zone, and in DIFC or ADGM. It then works through the failures that recur when a company's own position is checked: a licence that no longer describes what the business does, statutory registers and beneficial ownership records left to drift, corporate tax treated as the accountant's problem when the answers turn on group structure and intercompany pricing, and both of the opposite errors people make about economic substance.
Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant
Most compliance failures in Dubai are not sophisticated. They are administrative: a filing nobody owned, a licence activity that stopped matching what the business does, a register that was never updated after the shares moved. Regulators here do not usually discover these through investigation. They discover them at renewal, at audit, when a bank asks for updated documents, or when a counterparty runs its own checks before a transaction.
Each of the failures below is one that comes up repeatedly when a company's own position is checked, and each is set out with the step that closes it. A check of this kind is a defined piece of work rather than an open-ended review, and our corporate lawyers in Dubai run it as one.
Mistake one: not knowing who your regulator is
"Compliance" in the UAE is not one relationship. A single company can answer to four or five separate bodies, and an obligation owed to one is no answer to another. Before anything else, a business should be able to write down its own list. For most companies it looks something like this.
| Obligation | Who supervises it |
|---|---|
| Trade licence and permitted activities | The emirate's economic department for mainland companies; the free zone authority or registrar for free zone companies |
| Company filings, registers, changes of shareholder or director | The same licensing body; in the financial free zones, the DIFC Registrar of Companies or the ADGM Registration Authority |
| Regulated financial services activity | DFSA in DIFC; FSRA in ADGM; the federal regulators onshore |
| Corporate tax and VAT | The Federal Tax Authority |
| Employment and work permits | The federal labour ministry for mainland and most free zones; DIFC and ADGM apply their own employment legislation |
| Personal data | The federal regime under Federal Decree-Law No. 45 of 2021; DIFC and ADGM each have their own data protection law and regulator |
The common error is to assume that being in a free zone replaces the federal layer. It does not. Free zone status changes who licenses you and, in DIFC and ADGM, which company and employment law applies to you. Federal criminal law, the federal tax law and the federal anti-money laundering regime apply regardless.
Mistake two: the licence no longer describes the business
Companies grow into activities their licence does not cover — a consultancy that starts reselling software, a trading company that begins offering installation and maintenance. It is easy to miss because nothing happens until it does: a customs entry is rejected, a bank queries an invoice that does not match the licensed activity, or a licence renewal is refused pending an amendment.
The fix is unglamorous. Once a year, read the activity list on the licence next to the last twelve months of invoices. Where they have diverged, amend the licence or stop doing the activity. Where an activity needs a separate approval from a sector authority, the trade licence alone is not enough.
Mistake three: registers and beneficial ownership left to drift
Companies are required to maintain their statutory registers, including a register of ultimate beneficial owners, and to notify the registrar of changes. This is the obligation most often ignored, because nothing in the daily operation of the business depends on it — until a bank, a buyer or an auditor asks for the file and finds that the recorded shareholding has not matched reality for years.
Reconstructing the chain afterwards is far more work than maintaining it. Every share transfer, every change of director or authorised signatory, and every change in the ownership of a corporate shareholder should trigger the same short routine: update the register, notify the registrar, and file the resolution.
Mistake four: treating corporate tax as an accounting matter
Corporate tax was introduced by Federal Decree-Law No. 47 of 2022 and applies for financial years starting on or after 1 June 2023. The rate is 0% on taxable income up to AED 375,000 and 9% above that. Two beliefs cause most of the trouble.
The first is that a free zone company is outside the regime. It is not. A free zone entity registers and files in the same way as a mainland one, and the relief available to free zone persons is conditional: the conditions attach to what the entity does and who it deals with, they are tested activity by activity, and they are not satisfied merely by holding the licence.
The second is that this is purely the accountant's problem. It is not, because the answers depend on legal facts: what the group structure is, which entity contracts with the customer, how related-party transactions are priced and documented, and whether intercompany arrangements exist on paper at all. Charges passing between companies under common ownership have to be priced as they would have been between strangers, and the pricing has to be capable of being shown. Where the intercompany arrangements were never written down, writing them down is the first piece of work rather than the last. VAT, at 5% under Federal Decree-Law No. 8 of 2017 as amended by Federal Decree-Law No. 18 of 2022, sits alongside this as a separate registration and filing obligation.
Mistake five: getting the economic substance position backwards
The Economic Substance Regulations were cancelled for financial years ending after 31 December 2022 by Cabinet Decision No. 98 of 2024. Two opposite errors follow from this, and we see both.
The first error is to keep the machine running: a business that still budgets for a substance exercise, and still asks its adviser to prepare one, is paying for something that no longer exists. The second is to read the cancellation as covering what came before it. It does not. Obligations for the financial years from 2019 to 2022 remain, and a company that failed to notify or report for those years should deal with that position rather than assume it has expired.
Mistake six: assuming anti-money laundering rules apply only to banks
The UAE anti-money laundering regime reaches well beyond financial institutions, and the businesses it catches are often ordinary commercial ones: property brokerage and agency, trade in precious metals and stones, audit work, and the formation or administration of companies for clients. A business in one of those categories carries obligations of its own — customer due diligence, record keeping, a person responsible for compliance, staff who can recognise a suspicious transaction, and reporting through the designated channel when one appears.
The mistake is not usually refusal. It is treating the document as the obligation. The obligation is the work the document describes: the assessment actually carried out on the business, the checks actually run on a customer before the business was taken on, the training that actually happened. Each of those is judged on the record it leaves behind, and a manual with no file underneath it is the position supervisors find most often.
Mistake seven: no minutes, no authority, no file
Good governance in a small company is not a committee structure. It is a decision record. Who was authorised to sign that contract, and under what instrument? Was the related-party loan approved by anyone other than the person who received it? Where is the resolution appointing the current general manager?
These questions arrive at the worst moments — during due diligence, in a dispute with a departing partner, or when a regulator asks how a decision was taken. A company that keeps board and shareholder minutes, a current schedule of powers of attorney, and a signed record of who may bind it answers them in an afternoon. A company that does not spends weeks reconstructing them. Setting up that discipline is what our corporate governance advisory work covers in practice.
If something has already been missed
Late is better than concealed. Filings can be corrected, registers can be brought up to date, and tax positions can be revisited through the correction routes the legislation provides. What makes an omission materially worse is signing a later declaration that repeats it, or answering a regulator's question with information you have not verified. Establish the facts first, then decide the sequence in which to correct them, and correct the record in your own words before someone else characterises it for you.
Related Services: Explore our business compliance advisory and business lawyer services in Dubai for practical legal support in this area.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
