UBO & AML Compliance for Free Zone Companies

Running a UAE free zone company involves more than maintaining a valid business licence. Depending on your company structure and business activity, you may also have obligations relating to Ultimate Beneficial Ownership, commonly called UBO, and Anti-Money Laundering compliance.

For most companies in UAE commercial free zones, UBO compliance means identifying the natural person or persons who ultimately own or control the business, maintaining accurate beneficial ownership records and keeping the relevant registrar updated.

AML compliance is different. Not every ordinary free zone company automatically becomes a Designated Non-Financial Business or Profession, or DNFBP. The more extensive AML requirements apply according to the company’s activity and circumstances.

Understanding the distinction can prevent two common mistakes: assuming that a free zone company has no UBO responsibilities, or assuming that every free zone business has exactly the same AML obligations.

The Basics

What Is UBO?

A beneficial owner is the natural person who ultimately owns or controls a company.

Under the UAE beneficial ownership rules, the starting point is generally a natural person who directly or indirectly owns or controls 25% or more of the company’s capital or voting rights.

Control can also arise through other means, such as having the right to appoint or remove the majority of the company’s directors or otherwise exercising effective control over the business.

Importantly, the analysis should not stop simply because another company appears as the shareholder.

For example, imagine a Shams Free Zone company is 100% owned by a foreign holding company. The holding company itself is not the final UBO because the objective is to identify the natural person behind the ownership structure.

The company therefore needs to trace the ownership chain until the relevant individual or individuals are identified.

If no natural person can be identified through the ownership test, the regulations provide further tests based on control by other means and, ultimately, senior management.

Companies are expected to maintain accurate and up-to-date beneficial ownership information.

What Is AML Compliance?

Anti-Money Laundering compliance is designed to prevent businesses and financial systems from being used for money laundering, terrorism financing and proliferation financing.

The UAE AML framework requires certain regulated businesses to apply controls covering areas such as:

• customer due diligence
• beneficial owner identification
• risk assessments
• transaction monitoring
• suspicious transaction reporting
• internal AML policies
• compliance management
• record keeping

The important point for a free zone company is that AML obligations are largely connected to the business activity and risk profile.

Holding a free zone licence by itself does not automatically mean every company has the same AML compliance requirements.

Who It Applies To / Thresholds

Who Must Comply With UBO Requirements?

UAE beneficial ownership rules broadly apply to legal persons licensed or registered in the UAE.

This includes companies operating in commercial, non-financial free zones, subject to specific exclusions under the applicable legislation.

Shams companies therefore generally fall within the UAE beneficial ownership framework.

The main UBO ownership threshold is 25% or more of capital or voting rights, whether the interest is held directly or indirectly.

However, ownership percentage is not the only test.

A natural person who exercises ultimate control over the company through other means can also qualify as a beneficial owner.

This means companies with more complex ownership structures should look beyond the immediate shareholder shown on the licence or incorporation documents.

Does AML Apply to Every Free Zone Company?

Not in exactly the same way.

Certain business activities fall within the DNFBP framework and therefore face more extensive AML obligations.

Important DNFBP categories can include:

• real estate brokers and agents
• dealers in precious metals and precious stones
• independent accountants and auditors
• trust and company service providers
• certain legal professionals when conducting specified activities

Some categories also have transaction thresholds.

For example, dealers in precious metals and precious stones can fall within the DNFBP framework when carrying out qualifying cash transactions at or above the applicable regulatory threshold.

This distinction matters in practice.

A free zone company carrying out graphic design, software development or ordinary consultancy services should not automatically assume that it has the same AML obligations as a corporate service provider, real estate business or precious metals dealer.

The exact licensed activity and the activities actually carried out by the company should be reviewed.

How to Comply, Step by Step

Step 1: Map Your Ownership Structure

Start with the company’s direct shareholders.

Then trace ownership through every corporate layer until you identify the natural person or persons who ultimately own or control the business.

This becomes especially important where the structure includes:

• holding companies
• multiple corporate shareholders
• nominee arrangements
• trusts
• companies incorporated in several jurisdictions

Apply the 25% ownership or voting-right test first.

If nobody meets that test, consider whether an individual exercises control through other means.

Step 2: Create and Maintain the Beneficial Owner Register

A UAE legal person subject to the UBO framework is generally required to maintain a Beneficial Owner Register.

The information normally includes details such as:

• full name
• nationality
• date and place of birth
• residential or notification address
• passport or identification information
• the basis on which the person qualifies as the beneficial owner
• the date on which the person became or ceased to be a beneficial owner

The company should also maintain the required Partners or Shareholders Register.

These records should remain accurate rather than being prepared only during company formation and then forgotten.

Step 3: Submit the Required UBO Information

The relevant beneficial ownership and shareholder information must be provided to the appropriate registrar or licensing authority in accordance with applicable requirements.

Companies should also be prepared to provide supporting information if requested by the registrar.

UBO compliance is an ongoing responsibility.

Changes in shareholding, corporate ownership, voting rights or control can require company records and submitted information to be updated.

Step 4: Check Whether Your Activity Falls Within the AML Framework

Review what the company actually does.

Do not make the assessment based simply on the fact that the company is registered in a UAE free zone.

Businesses operating in certain regulated sectors should determine whether they qualify as DNFBPs and whether additional AML requirements apply.

This is especially important for businesses carrying out:

• real estate-related activities
• accounting or auditing
• corporate services
• trust services
• precious metals or precious stones trading
• certain legal services

Step 5: Complete an AML Risk Assessment Where Required

A regulated company should understand the money laundering and financial crime risks connected to its activities.

The risk assessment may consider factors such as:

• customer type
• customer location
• transaction size
• payment method
• source of funds
• countries involved
• products or services provided
• ownership complexity

A higher-risk customer or transaction can require additional checks.

The goal is not simply to collect documents. The business should understand who it is dealing with and whether the relationship presents unusual risks.

Step 6: Conduct Customer Due Diligence

Customer Due Diligence, commonly called CDD, is a core part of AML compliance for regulated businesses.

This can include identifying and verifying:

• the customer
• the beneficial owner
• the purpose of the business relationship
• the ownership and control structure
• relevant source of funds information where required

CDD should not always be treated as a one-time onboarding exercise.

Businesses may need to monitor relationships and update customer information when circumstances change.

Step 7: Appoint an AML Compliance Officer When Required

Businesses subject to the applicable AML framework may need to appoint a compliance officer with appropriate authority, knowledge and independence.

Depending on the size and nature of the business, the compliance function may be responsible for:

• monitoring AML controls
• reviewing unusual activity
• escalating suspicious transactions
• maintaining AML records
• supporting regulatory reporting
• keeping internal procedures updated
• arranging AML training

The exact responsibilities should reflect the company’s activity and risk profile.

Step 8: Register on goAML Where Required

The UAE Financial Intelligence Unit operates the goAML platform.

Businesses required to register can use the system for reporting suspicious transactions and suspicious activities.

For regulated DNFBPs, goAML registration is an important part of the compliance framework.

However, registering on the platform does not complete the company’s AML obligations.

The company still needs appropriate procedures, customer checks, internal controls, monitoring and record keeping.

Step 9: Keep Proper Records

Regulated businesses should keep sufficient records to demonstrate how they have complied with AML requirements.

Records can include:

• customer identification documents
• beneficial ownership information
• risk assessments
• CDD records
• transaction records
• internal compliance decisions
• suspicious activity reviews
• AML policies
• staff training records

Under the current UAE AML framework, many relevant records are generally required to be retained for at least five years, depending on the nature of the record and the applicable rule.

Good record keeping is essential because regulators may need to understand not only what decision a company made, but also how and why it made that decision.

Deadlines & Penalties

UBO compliance includes specific time limits.

A Beneficial Owner Register must generally be established within the applicable regulatory period following the creation or registration of the legal person.

Where beneficial ownership information changes, companies generally need to update their records and notify the relevant registrar within the required timeframe.

A commonly relevant update period under the UAE UBO framework is 15 days after becoming aware of a change.

Companies may also need to respond within a specified period when the registrar requests additional information.

Missing UBO requirements can lead to administrative penalties.

Depending on the type of violation and whether it is repeated, fines can increase significantly.

For example, certain repeated failures relating to required ownership or shareholder registers can lead to penalties reaching tens of thousands of dirhams and potentially higher amounts for further violations.

AML penalties operate separately.

Businesses subject to AML rules can face significant administrative fines where they fail to establish required internal policies, procedures, customer due diligence processes or other compliance controls.

Some AML violations can carry penalties of AED 100,000 or more, depending on the nature and seriousness of the breach.

More serious situations may also lead to additional regulatory action.

For that reason, companies should not wait until licence renewal, a regulator request or a banking review before checking whether their UBO and AML records are in order.

How Shams & FZ+ Help

For a Shams Free Zone company, the first step is understanding which obligations actually apply to the business.

A simple ownership structure may make UBO compliance relatively straightforward.

A company operating in a regulated sector, however, may need a much broader compliance framework covering customer due diligence, risk assessments, transaction monitoring, reporting and record keeping.

Shams provides compliance guidance to help companies understand beneficial ownership requirements and relevant DNFBP obligations.

Shams FZ+ can also support business owners with wider administrative, accounting and compliance-related requirements.

This can be particularly useful for entrepreneurs who want to keep company records, ownership information and financial documentation organised rather than trying to correct problems later.

For UBO compliance, businesses should maintain clear ownership records from the beginning.

For AML compliance, companies operating in regulated sectors should ensure that their policies and procedures reflect the actual risks of their business.

The objective is simple: know who owns the company, know who you are doing business with and keep enough documentation to demonstrate compliance when required.

FAQs