UAE Compliance 2026: ESR, UBO & AML Guide

The UAE's compliance framework for businesses has undergone a quiet but radical restructuring. For years, founders managed three parallel obligations: VAT returns, ESR filings (economic substance), and UBO declarations (beneficial ownership). As of 2026, one of those is dead, one is dramatically stronger, and the underlying AML framework has been rewritten from scratch.

If your understanding of UAE compliance is based on what you learned during company setup in 2023 or 2024, it is outdated. Here is what changed, why, and what you need to do now.

ESR Is Dead — CT Substance Now

What ESR Was

Economic Substance Regulations required UAE companies conducting specified "Relevant Activities" to demonstrate they had adequate economic presence in the UAE — real office space, real employees, real expenditure, real decision-making. This meant filing an annual ESR Notification and, for companies generating Relevant Income, a detailed ESR Report.

Why It Was Abolished

The UAE introduced federal corporate tax effective June 2023. Corporate tax itself requires substance: free zone companies claiming QFZP status must demonstrate adequate substance, transfer pricing rules require arm's-length documentation for related-party transactions, and general anti-abuse provisions capture artificial arrangements lacking economic substance.

ESR became redundant. The corporate tax regime achieves the same policy objective — ensuring companies have real economic presence — through a more integrated, better-resourced framework.

What Replaces It

UBO Penalties Up to AED 100,000

While ESR was being dismantled, the Ultimate Beneficial Owner (UBO) regime was being weaponized. Cabinet Decisions No. 109/2023 and No. 132/2023 transformed UBO from a largely administrative filing into a high-stakes compliance obligation with serious consequences.

New UBO Regime (CD 109/2023)

Cabinet Decision No. 109 of 2023, issued November 2023, regulates the "Real Beneficiary Procedures" for all licensed and registered business entities in the UAE — including those in non-financial free zones.

Who is a Beneficial Owner?

Under Article 5, a natural person who:

• Directly or indirectly owns 25% or more of the legal person's capital, OR
• Has the right to vote 25% or more in the legal person, OR
• Has the authority to appoint or dismiss the majority of directors/managers

Where no natural person meets these thresholds, the Beneficial Owner is the natural person serving as Senior Management.

What must you do?

• Establish and maintain a Register of Real Beneficiary
• Disclose complex ownership structures (chains of control, nominee arrangements)
• Provide data to the Registrar upon request
• Update information within mandated timeframes

UBO Penalties (CD 132/2023)

Cabinet Decision No. 132/2023 imposes administrative penalties for UBO violations — and they are material:

The nuclear option: Article 3(1) of CD 132/2023 authorizes the Registrar to suspend commercial licenses and close commercial establishments in cases of repeated violations. This is not a fine you can absorb as a cost of doing business — it is an existential threat to your company.

Common UBO Mistakes

1. "My company has a corporate shareholder, so I don't have a UBO." Wrong. You trace through the corporate chain until you find a natural person. A holding company in the BVI or Caymans doesn't eliminate the obligation — it makes it more complex.

2. "I already filed UBO when I set up the company." Filing at incorporation is step one. You must update within 30 days of any change — share transfers, new investors, director changes, or changes to the chain of control.

3. "Free zone companies are exempt." No. CD 109/2023 explicitly applies to entities in non-financial free zones. Only financial free zones (DIFC, ADGM) have their own regimes — and they too have UBO requirements.

The New AML Law (DL 10/2025)

The most sweeping change in UAE compliance came on September 30, 2025, with the publication of Federal Decree-Law No. 10 of 2025 Concerning Combating Money Laundering, Terrorism Financing, and the Financing of Proliferation. Effective October 14, 2025, it repealed and replaced Federal Decree-Law No. 20 of 2018 (the previous AML law) and its amendments (Decree-Law No. 26 of 2021).

What the New AML Law Changed

While the full text runs to 37+ articles, the key operational changes for UAE businesses are:

1. Expanded scope of obligated entities. The definition of "Designated Non-Financial Businesses and Professions" (DNFBPs) has been reviewed and in some cases expanded. Real estate agents, dealers in precious metals and stones, corporate service providers, auditors, and legal professionals all have obligations.

2. Stronger enforcement powers. The new law grants supervisory authorities expanded powers to investigate, inspect, and sanction. The days of light-touch AML supervision for non-financial businesses are over.

3. Enhanced goAML integration. Registration on the goAML platform, the FIU's suspicious transaction reporting system, is now explicitly mandated for a broader range of businesses. Failure to register is itself a violation.

4. Alignment with FATF standards. The new law addresses specific FATF recommendations that were identified during the UAE's mutual evaluation. The UAE was placed on the FATF "grey list" in March 2022 and removed in February 2024 — the new law is designed to prevent a return.

5. Cabinet Resolution No. 134 of 2025 — accompanying implementing regulations providing detailed operational requirements, issued alongside the new law.

Who Does the AML Law Apply To?

The AML law applies to "Financial Institutions" and "DNFBPs." For most StartupOS users, the relevant category is DNFBPs, which includes:

• Real estate brokers and agents
• Dealers in precious metals and stones
• Corporate service providers (company formation agents, PRO services)
• Auditors and accountants
• Lawyers and notaries (when conducting specified transactions)
• Trust and company service providers

If your business falls into any of these categories, you have obligations under the AML law — including customer due diligence (CDD), suspicious transaction reporting (STR) via goAML, record-keeping, and appointment of a compliance officer.

goAML Registration Required

The goAML portal, operated by the UAE Financial Intelligence Unit (FIU), is the mandatory channel for submitting Suspicious Transaction Reports (STRs) and other AML-related filings. Registration is mandatory for all obligated entities.

Penalties for non-registration or non-reporting can include fines, license suspension, and in serious cases, criminal prosecution. The FIU actively monitors registration status and cross-references with licensing databases.

VAT — Still Here, Getting Tighter

While corporate tax and AML dominate headlines, VAT remains the most operationally frequent compliance obligation for most UAE businesses. And it's getting harder, not easier.

Key VAT Changes in 2026

Under Federal Decree-Law No. 16 of 2025 (amending the VAT Law, effective January 1, 2026):

1. Self-invoicing for reverse charge abolished. You no longer need to issue a tax invoice to yourself for imported services. But the documentation requirement hasn't gone away — the FTA will verify contracts, purchase orders, and payment evidence instead.

2. Input VAT recovery requires due diligence. The FTA can deny input VAT recovery where you "knew or should have known" that the supply was connected to tax evasion. Accepting a VAT invoice at face value is no longer sufficient documentary defense.

3. Five-year credit expiry. Excess input VAT credits can no longer be carried forward indefinitely. Credits expire five years after the tax period in which they arose. Credits from 2021 start expiring in 2026.

VAT Registration Thresholds

VAT Filing Deadlines

• Quarterly filing for most businesses
• Due within 28 days of the end of the tax period
• Filed through the FTA EmaraTax portal
• Late filing: AED 500–1,000/month penalty

The Combined Compliance Calendar

Here is what a typical UAE SME must track annually as of 2026:

How to Build a Compliance Stack

Given that ESR is gone and UBO is stronger, here is the compliance stack every UAE business needs:

Minimum Compliance (< AED 3M)

1. VAT registration and quarterly filing (if revenue > AED 375,000)
2. Corporate tax registration and annual filing
3. UBO Register establishment and maintenance
4. Trade license annual renewal
5. Tenancy contract (Ejari for Dubai mainland) renewal
6. Record-keeping (5–15 years)

Standard Compliance (3M–50M)

All of the above, plus: 7. Audited financial statements (mandatory for QFZPs) 8. Transfer pricing documentation (if related-party transactions exist) 9. Annual corporate tax compliance review

Full Compliance (> AED 50M)

All of the above, plus: 10. goAML registration and STR reporting capability 11. AML/CFT compliance program (policies, procedures, training) 12. Appointment of AML Compliance Officer 13. Customer due diligence (CDD) procedures 14. Independent audit of AML controls (for financial institutions)

Frequently Asked Questions

The Bottom Line

The UAE's compliance framework has undergone its most significant restructuring since the introduction of VAT in 2018. Three changes define the 2026 landscape:

1. ESR is dead — no more filings, no more reports. But substance hasn't disappeared; it migrated to corporate tax.
2. UBO is serious — AED 20,000–100,000 fines and the threat of license suspension for non-compliance. This is no longer a paperwork formality.
3. AML is rewritten — Federal Decree-Law No. 10/2025 replaces the 2018 law with stronger enforcement and broader scope.

For founders, the operational message is: fewer filings (ESR gone), higher stakes (UBO penalties), and deeper integration (compliance obligations now cross-reference each other through shared data systems).

Sources

• Cabinet Decision No. 98 of 2024 — Amendment of Economic Substance Regulations (abolition)
• Cabinet Decision No. 57 of 2020 — Original Economic Substance Requirements
• Cabinet Decision No. 109 of 2023 — Regulating Beneficial Owner Procedures
• Cabinet Decision No. 132 of 2023 — Administrative Penalties for UBO Violations
• Federal Decree-Law No. 10 of 2025 — Concerning Combating Money Laundering, Terrorism Financing, and Financing of Proliferation (New AML Law)
• Federal Decree-Law No. 20 of 2018 — Previous AML Law (now repealed)
• Cabinet Resolution No. 134 of 2025 — Implementing Regulations for New AML Law
• Federal Decree-Law No. 16 of 2025 — VAT Law Amendments
• Federal Decree-Law No. 17 of 2025 — Tax Procedures Law Amendments
• K&L Gates — ESR Filings Cancelled (October 2024)
• Awatif Mohammad Shoqi Advocates — UBO Under CD 109/2023 and CD 132/2023
• UAE Financial Intelligence Unit — goAML Portal
• UAE Federal Tax Authority (tax.gov.ae)
• UAE Ministry of Economy (moet.gov.ae)

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements vary by emirate, free zone, and business activity. Consult a licensed UAE compliance advisor for guidance specific to your situation. Verify current requirements with the relevant authorities — regulations are evolving.