العربية

Regulation hub

Regulator page

Federal law across every sector

Who it applies to: Every firm operating in the UAE, alongside its sector regulator.

Instruments that apply

UAE Personal Data Protection Law (PDPL)

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data

Number and year
Federal Decree-Law 45/2021
Issuer
UAE federal government; regulator is the UAE Data Office (Federal Decree-Law 44/2021)
Status
In force since 2 Jan 2022 (Art. 31). Executive Regulations NOT issued as of the latest sources (Chambers Mar 2026; BusinessDubai Aug 2026). Firms get six months to comply after the Regulations are issued. The Data Office is not fully operational.
Applies to
Processing of personal data in the UAE (onshore and non-financial free zones). It excludes government data, health and banking or credit data with their own laws, and free zones with their own data laws (DIFC, ADGM) (Art. 2(2)).
Notes

Article numbers come from secondary summaries of the Arabic text. Cabinet Decisions 111/2023 and 33/2024, cited by some blogs as Executive Regulations, are unverified. Transfers between onshore and DIFC/ADGM count as cross-border.

AML/CFT/CPF Law

Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing

Number and year
Federal Decree-Law 10/2025
Issuer
UAE federal government
Status
In force from 14 Oct 2025. Repeals and replaces Federal Decree-Law 20/2018.
Applies to
Financial institutions, DNFBPs and VASPs onshore and in free zones (the DIFC and ADGM apply it through their own rulebooks).
Notes

Article numbers come from law-firm summaries; the official text was not read.

AML Executive Regulations 2025

Cabinet Decision No. 134 of 2025 (Executive Regulations of Federal Decree-Law 10/2025)

Number and year
Cabinet Decision 134/2025
Issuer
UAE Cabinet
Status
Published in Official Gazette 811 on 15 Nov 2025; in force 14 Dec 2025. Repeals Cabinet Decision 10/2019.
Applies to
FIs, DNFBPs and VASPs.
Notes

Sources call it either 'Cabinet Resolution' or 'Cabinet Decision'. The official English text was not available to the FSRA when it issued its notice; article numbers are not verified.

Targeted Financial Sanctions regulation

Cabinet Decision No. 74 of 2020 regarding the Terrorism Lists Regulation and Implementation of UN Security Council Resolutions on the Suppression and Combating of Terrorism, Terrorist Financing, Countering the Proliferation of Weapons of Mass Destruction and its Financing

Number and year
Cabinet Decision 74/2020
Issuer
UAE Cabinet; implemented by the Executive Office for Control and Non-Proliferation (EOCN)
Status
Still cited as the governing instrument by the CBUAE TFS page and FSRA Notice 80/2025 (2 Jul 2025). No successor was found.
Applies to
All natural and legal persons, with specific duties on FIs, DNFBPs and VASPs.
Notes

The 2021 CBUAE hawala guidance gave 2 business days for an FFR; the current CBUAE page and the 2025 FSRA notice say 5 business days. Use 5, but treat sector guidance as overriding. The EOCN site (uaeiec.gov.ae) blocked automated access.

Beneficial Owner Procedures

Cabinet Resolution No. 109 of 2023 on Regulating the Beneficial Owner (Real Beneficiary) Procedures; penalties in Cabinet Decision No. 132 of 2023

Number and year
Cabinet Resolution 109/2023
Issuer
UAE Cabinet; Ministry of Economy and Tourism and licensing authorities as registrars
Status
In force (reported from 16 Nov 2023). Abrogates Cabinet Decision 58/2020. Penalties: Cabinet Decision 132/2023 (issued 15 Dec 2023).
Applies to
Onshore and non-financial free zone companies. Excludes wholly government-owned companies, companies listed on a recognised exchange, and DIFC and ADGM entities, which have their own regimes.
Notes

The official text could not be read (portal blocks automation). It is unclear whether the 15-day window is calendar or working days. The preamble still references Federal Decree-Law 20/2018, which has since been replaced by Federal Decree-Law 10/2025.

Commercial Companies Law

Federal Decree-Law No. 32 of 2021 on Commercial Companies (as amended by Federal Decree-Law No. 20 of 2025)

Number and year
Federal Decree-Law 32/2021
Issuer
UAE federal government; Ministry of Economy and Tourism
Status
In force; the 2025 amendments took effect 15 Oct 2025.
Applies to
UAE companies, foreign companies active onshore, and mainland branches or offices of free zone companies.
Notes

Article numbers for the amendments were not verified.

VAT and Corporate Tax registration (TRN)

Federal Decree-Law No. 8 of 2017 on VAT and Federal Decree-Law No. 47 of 2022 on the Taxation of Corporations and Businesses - Tax Registration Number

Number and year
FDL 8/2017; FDL 47/2022
Issuer
Federal Tax Authority (FTA)
Status
In force.
Applies to
VAT-registered and corporate-tax-registered persons, including vendors.
Notes

The TRN format and verification steps come from a secondary source; the FTA page was not fetched. The VAT and CT law numbers are well established but were not re-fetched this session. Check whether the FTA offers an API before building automated checks.

UAE e-invoicing

Ministerial Decision No. 243 of 2025 (Electronic Invoicing System) and No. 244 of 2025 (Implementation Framework)

Number and year
MD 243/2025; MD 244/2025
Issuer
Ministry of Finance
Status
Pilot from 1 Jul 2026. Businesses with revenue of AED 50m or more: appoint an Accredited Service Provider by 31 Jul 2026 and go live 1 Jan 2027. Others: appoint by 31 Mar 2027, live 1 Jul 2027. Government entities: appoint by 31 Mar 2027, live 1 Oct 2027.
Applies to
B2B and B2G invoicing by UAE businesses; B2C is excluded for now.
Notes

Official Ministry of Finance texts were not fetched.

Penal Code - bribery offences

Federal Decree-Law No. 31 of 2021 Promulgating the Crimes and Penalties Law (as amended by Federal Decree-Law 36/2022)

Number and year
Federal Decree-Law 31/2021
Issuer
UAE federal government
Status
In force from 2 Jan 2022.
Applies to
Individuals and legal persons; public and private sectors.
Notes

Article numbers come from law-firm guides; the official text was not read. The corporate-liability article and the reporting-exemption article number were not verified.

Cybercrime Law

Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes

Number and year
Federal Decree-Law 34/2021
Issuer
UAE federal government
Status
Issued 20 Sep 2021; in force 2 Jan 2022. Repeals Decree-Law 5/2012. The portal shows a last update of 4 Apr 2024; no amendment is listed.
Applies to
Everyone, including vendors with access to client systems.
Notes

The law imposes no general incident-reporting duty on businesses.

Labour Law, agencies and WPS

Federal Decree-Law No. 33 of 2021 on the Regulation of Labour Relations; Ministerial Decision No. 51 of 2022 (employment agencies); Ministerial Resolution No. 598 of 2022 (Wages Protection System)

Number and year
FDL 33/2021; MD 51/2022; MR 598/2022
Issuer
UAE federal government; Ministry of Human Resources and Emiratisation (MoHRE)
Status
In force (FDL 33/2021 from 2 Feb 2022, per general knowledge).
Applies to
Private-sector employers onshore and in non-financial free zones (the DIFC and ADGM have their own employment laws), including outsourcing and temporary-work agencies.
Notes

Kept brief by design. The WPS due date and the law's effective date were not checked against official text.

National Economic Register (NER) and licence checks

National Economic Register ('Growth' platform)

Issuer
Ministry of Economy and Tourism, with emirate licensing authorities
Status
Operating. Integration with licensing authorities and free zones is ongoing (Aug 2026 workshop with 33 entities).
Applies to
Verifying onshore economic licences, and free zones as they integrate.
Notes

The Ministry of Economy is now the Ministry of Economy and Tourism (moet.gov.ae). The fields the NER displays (status, expiry) were not verified.

Working week and public holidays

Federal government working week; Cabinet Resolution No. 27 of 2024 on Official Holidays

Number and year
Cabinet Resolution 27/2024
Issuer
UAE Cabinet; FAHR and MoHRE announce the dates
Status
Working week in force since 1 Jan 2022. Cabinet Resolution 27/2024 in force since 1 Jan 2025 (Morgan Lewis).
Applies to
Deadline calculation for business-day timelines across all regimes.
Notes

The 2026 dates come from news reports of official FAHR and MoHRE announcements. Commemoration Day (30 Nov or 1 Dec) is not on the u.ae list. Note that the FSRA 24-hour cyber clock runs through weekends and holidays.

Arabic as the prevailing legal text

Language of UAE federal and emirate legislation

Issuer
UAE Legislation portal; Dubai Legislation Portal
Status
Standing practice.
Applies to
All onshore federal and emirate legislation. The CBUAE publishes regulations in Arabic and English in the Official Gazette. The DIFC and ADGM legislate in English.
Notes

Arabic titles were not captured from official pages for any instrument, so title_ar is null throughout.

Requirements by topic, and how NexaPair covers them

Mapped from our source-by-source research, checked on 3 November 2026. High-confidence items were checked on an official page; Secondary source means law-firm or other secondary sources only; To be confirmed means reported but not verified.

Due diligence

  • Free zone companies trading onshore must set up a mainland branch or representative office. Check that free zone vendors serving onshore clients have one. Secondary source

    Commercial Companies Law

    Covered by
    • LiveDue diligence cases by tier
    • LiveExplainable risk score with factor weights and minimum-tier rules

  • Companies can now re-domicile between free zones and the mainland, so re-check the vendor's registering authority at each review. Secondary source

    Commercial Companies Law

    Covered by
    • LiveDue diligence cases by tier
    • LiveExplainable risk score with factor weights and minimum-tier rules

  • A TRN is 15 digits and starts with '100'. Verify it on the FTA's public EmaraTax TRN verification service (no login; CAPTCHA). The result shows legal name, TRN and status. One TRN generally covers VAT and corporate tax, but status can differ by tax type. Secondary source

    VAT and Corporate Tax registration (TRN)

    Covered by
    • LiveTRN format check with EmaraTax evidence
    • LiveDue diligence cases by tier
    • LiveExplainable risk score with factor weights and minimum-tier rules

  • Temporary work and outsourced labour must go through licensed agencies. The agency carries the employer's obligations even if the client defaults, and keeps worker records for at least 2 years. The client (beneficiary) must provide OHS and keep workers within agreed duties and hours. Secondary source

    Labour Law, agencies and WPS · MD 51/2022 · Timing: Agency record retention: at least 2 years

    Covered by
    • LiveDue diligence cases by tier
    • LiveExplainable risk score with factor weights and minimum-tier rules

  • Check onshore licences and activities via the NER (growth.gov.ae). Confirm against the issuing authority (DED/DET, free zone authority, or the DIFC/ADGM registers), since free-zone coverage in the NER is not confirmed. Secondary source

    National Economic Register (NER) and licence checks

    Covered by
    • LiveUAE trade licence record with evidence review and expiry alerts
    • LiveDue diligence cases by tier
    • LiveExplainable risk score with factor weights and minimum-tier rules

Contracts

  • Processors act on controller instructions and both apply technical and organisational security measures. The processor article number was not verified (believed to be Art. 8). Secondary source

    UAE Personal Data Protection Law (PDPL)

    Covered by
    • LiveContracts and obligations

Ongoing monitoring

  • Continuous monitoring obligation. Secondary source

    AML/CFT/CPF Law · Art. 19

    Covered by
    • LiveAlerts for sanctions, GST filing, financial health and litigation
    • LiveDue diligence cases by tier

  • Wages must be paid through WPS; MoHRE sanctions apply for delays. For outsourced staff on site, ask for WPS compliance evidence. To be confirmed

    Labour Law, agencies and WPS · MR 598/2022 · Timing: Salaries due via WPS by the 15th of the following month (secondary source)

    Covered by
    • LiveAlerts for sanctions, GST filing, financial health and litigation
    • LiveDue diligence cases by tier

Registers and record keeping

  • Keep CDD and transaction records for at least 5 years from the most recent event. Secondary source

    AML Executive Regulations 2025 · Timing: Minimum 5 years

    Covered by
    • LiveOutsourcing register
    • LiveCSV and JSON exports of 10 registers, including the audit trail

Incident reporting

  • The controller reports a breach that harms privacy, confidentiality or security to the Data Office, with investigation results; data subjects may also need notice. Detailed timing awaits the Executive Regulations. Secondary source

    UAE Personal Data Protection Law (PDPL) · Art. 9 · Timing: Immediately on becoming aware (period to be set by Executive Regulations)

    Covered by
    • LiveIncident records
    • LiveIncident reporting clocks across regulators: CBUAE, ADGM and the "immediately" rules

Cross-border data transfer

  • Transfers are allowed to jurisdictions the Data Office approves as adequate, or where there is a treaty. Secondary source

    UAE Personal Data Protection Law (PDPL) · Art. 22

    Covered by
    • LiveCross-border transfer assessment under the PDPL or the DIFC and ADGM data protection laws

  • Without adequacy: limited derogations such as contractual undertakings, explicit consent and contract necessity. Details depend on the Executive Regulations. Secondary source

    UAE Personal Data Protection Law (PDPL) · Art. 23

    Covered by
    • LiveCross-border transfer assessment under the PDPL or the DIFC and ADGM data protection laws

Data protection

  • DPO and DPIA duties for high-risk processing. Secondary source

    UAE Personal Data Protection Law (PDPL) · Art. 10 (DPO); Art. 21 (DPIA)

    Covered by
    • LiveContracts and obligations
    • LiveCross-border transfer assessment under the PDPL or the DIFC and ADGM data protection laws

Cyber security controls

  • It is a crime to hack systems (with higher penalties for government systems), harm systems (aggravated for banking, health and critical facilities), or obtain confidential government, financial or commercial data, credentials or personal data without authority. Vendor access controls and contracts should reflect this.

    Cybercrime Law · Arts. 2, 3, 4, 5, 6, 7, 8, 9, 12

    Covered by
    • LivePassive outside-in cyber posture: an A to F grade per vendor, history, scheduled re-checks and grade-drop alerts
    • LiveQuestionnaires in Arabic and English with AI evidence review that a person signs off

Sanctions and AML screening

  • STRs go exclusively to the FIU. The FIU head can suspend transactions for up to 10 days and freeze assets for up to 30 days. Secondary source

    AML/CFT/CPF Law · Art. 11; Art. 5

    Covered by
    • LiveSanctions and PEP screening via OpenSanctions
    • LiveScreening against the UAE Local Terrorist List and the UN list, with freeze and goAML report clocks

  • Report suspicious transactions promptly via the FIU's electronic system (goAML). Secondary source

    AML Executive Regulations 2025 · Timing: Promptly

    Covered by
    • LiveSanctions and PEP screening via OpenSanctions
    • LiveScreening against the UAE Local Terrorist List and the UN list, with freeze and goAML report clocks

  • Screen customers, counterparties, beneficial owners and related persons against the UAE Local Terrorist List and the UN Consolidated List. Subscribe to EOCN email alerts and re-screen immediately after each update.

    Targeted Financial Sanctions regulation · Art. 21 (screening) · Timing: Immediately after each list update

    Covered by
    • LiveSanctions and PEP screening via OpenSanctions
    • LiveScreening against the UAE Local Terrorist List and the UN list, with freeze and goAML report clocks

  • Freeze funds of listed persons without prior notice. Do not provide funds or services without EOCN permission.

    Targeted Financial Sanctions regulation · Art. 15 (freezing) · Timing: Without delay = within 24 hours of the listing decision

    Covered by
    • LiveSanctions and PEP screening via OpenSanctions
    • LiveScreening against the UAE Local Terrorist List and the UN list, with freeze and goAML report clocks

  • Report via goAML: a Fund Freeze Report (FFR) for confirmed matches, and a Partial Name Match Report (PNMR) for potential matches, keeping the suspension in place until instructed. Secondary source

    Targeted Financial Sanctions regulation · Timing: Within 5 business days (CBUAE and FSRA 2025 guidance)

    Covered by
    • LiveSanctions and PEP screening via OpenSanctions
    • LiveScreening against the UAE Local Terrorist List and the UN list, with freeze and goAML report clocks

Beneficial ownership

  • Knowingly giving false or misleading beneficial ownership information is a criminal offence (imprisonment and/or a fine of at least AED 20,000). Secondary source

    AML/CFT/CPF Law · Art. 35(1)

    Covered by
    • LiveBeneficial owners at 25% or control, declared and screened

  • UBO information must be updated when it changes. Secondary source

    AML Executive Regulations 2025 · Timing: Within 15 working days of a change (secondary source)

    Covered by
    • LiveBeneficial owners at 25% or control, declared and screened

  • A beneficial owner is a natural person owning or controlling 25% or more of shares or votes, directly or indirectly. If there is none, record whoever controls by other means; failing that, the senior managing official. Secondary source

    Beneficial Owner Procedures

    Covered by
    • LiveBeneficial owners at 25% or control, declared and screened

  • Keep a beneficial owner register, a register of partners or shareholders, and nominee declarations, and file them with the registrar. Secondary source

    Beneficial Owner Procedures · Timing: Notify changes within 15 days (ADGM uses 30 days)

    Covered by
    • LiveBeneficial owners at 25% or control, declared and screened

  • Fines of roughly AED 20,000-100,000 for register failures; the licence can be suspended for repeated violations. To be confirmed

    Beneficial Owner Procedures · Cabinet Decision 132/2023 Art. 3(1)

    Covered by
    • LiveBeneficial owners at 25% or control, declared and screened

  • LLCs may issue share classes with different voting or economic rights, recorded in the Commercial Register. Control analysis needs the share-class data. Secondary source

    Commercial Companies Law

    Covered by
    • LiveBeneficial owners at 25% or control, declared and screened

Anti-bribery and conflicts of interest

  • Passive bribery by public officials, including foreign officials and international organisation staff.

    Penal Code - bribery offences · Arts. 275, 276

    Covered by
    • LiveRelationship intelligence: vendor and employee links by phone, bank account, director or address

  • Private-sector bribery: managers or employees soliciting or accepting (passive), and offering or giving (active). Secondary source

    Penal Code - bribery offences · Art. 278 (passive); Art. 279 (active)

    Covered by
    • LiveRelationship intelligence: vendor and employee links by phone, bank account, director or address

  • Active bribery of public officials, trading in influence, and intermediaries. Vendor and agent payments are in scope. Secondary source

    Penal Code - bribery offences · Art. 280; Art. 281; Art. 282

    Covered by
    • LiveRelationship intelligence: vendor and employee links by phone, bank account, director or address

  • A briber or recipient who reports before discovery may be exempt. There is a separate offence of failing to report a crime. To be confirmed

    Penal Code - bribery offences · Art. 323 (failure to report)

    Covered by
    • LiveRelationship intelligence: vendor and employee links by phone, bank account, director or address

Other obligations

  • Corporate fines of AED 5m-100m for ML/TF/PF by representatives; regulator administrative fines up to AED 5m; no limitation period for offences. Secondary source

    AML/CFT/CPF Law · Art. 27(1); Art. 17; Art. 37

    Covered by
    • Your policy and process; no product feature claimed

  • Both issuer and recipient need an Accredited Service Provider. Report system outages to the FTA. Vendor master data must support e-invoicing readiness. Secondary source

    UAE e-invoicing · Timing: Outage report within 2 business days; large-business go-live 1 Jan 2027

    Covered by
    • Your policy and process; no product feature claimed

  • Federal government works Monday to Thursday 7:30-15:30 and Friday 7:30-12:00; the weekend is Saturday and Sunday. Sharjah government works Monday to Thursday with a Friday-to-Sunday weekend. Private sector hours vary.

    Working week and public holidays

    Covered by
    • Your policy and process; no product feature claimed

  • Official holidays: New Year (1 Jan); Eid al-Fitr (29 Ramadan-3 Shawwal); Arafat Day and Eid al-Adha (9-12 Dhul Hijjah); Hijri New Year (1 Muharram); Prophet's Birthday (12 Rabi al-Awwal); National Day (2-3 Dec). A holiday is not moved if it falls on another holiday or a weekend (Art. 3).

    Working week and public holidays · Cabinet Resolution 27/2024, Art. 3

    Covered by
    • Your policy and process; no product feature claimed

  • 2026 dates as announced: Eid al-Fitr 19-21 Mar (22 Mar if Ramadan had 30 days); Eid al-Adha incl. Arafat 26-29 May; Hijri New Year Mon 15 Jun; Prophet's Birthday Fri 28 Aug; National Day 2-3 Dec. 2027: only the fixed dates (1 Jan, 2-3 Dec) are known; Islamic holidays not yet announced. Secondary source

    Working week and public holidays

    Covered by
    • Your policy and process; no product feature claimed

  • English versions on uaelegislation.gov.ae are translations: if they conflict, the Arabic text prevails and is the reference for interpretation. The Dubai DESC law states the same. Bilingual templates should say which language governs.

    Arabic as the prevailing legal text

    Covered by
    • Your policy and process; no product feature claimed

How NexaPair covers this regime

Mapped from the built-in summary. Each line shows whether the feature is live in the product today.

  • LiveCross-border transfer assessment under the PDPL or the DIFC and ADGM data protection laws
  • LiveDeployable in a UAE cloud region
  • LiveSanctions and PEP screening via OpenSanctions
  • LiveScreening against the UAE Local Terrorist List and the UN list, with freeze and goAML report clocks
  • LiveBeneficial owners at 25% or control, declared and screened
  • LiveTRN format check with EmaraTax evidence
  • LiveRelationship intelligence: vendor and employee links by phone, bank account, director or address
See it in the walkthrough

Sources

This is a summary for orientation, not legal advice. Always rely on the official text, and take advice on your own situation. For federal legislation, the Arabic text prevails.

Other regimes