United Arab Emirates

Art. 8(1) requires a legal person to create and keep a Beneficial Owner's Record and update it within 15 days of learning of a change. Art. 11(1) requires submission to the Registrar, and Art. 15(2) requires amendments to be submitted within 15 days. Nominee board members must notify the company within 15 days (Art. 9). Wholly government-owned companies and financial free zones are exempt (Art. 3(2)).

Art. 4 prohibits processing without the data owner's consent unless a listed exception applies, and Art. 5 requires lawful, transparent, purpose-limited processing. Art. 13(2) requires the controller to give the data subject, before processing starts, the information in Art. 13(1)(b), (d) and (g): the purposes, the receiving sectors or establishments and the safeguards for cross-border processing. Arts. 13-18 give rights of access, portability, correction, erasure, restriction, objection and review of automated decisions.

Art. 6(1) requires designated sources to measure emissions regularly, prepare an emissions inventory, submit periodic reports to the Ministry of Climate Change and Environment or the competent authority and take reduction measures; records are kept for five years. The law sets no fixed reporting dates (Art. 6), applies only to sources the Ministry or authority designates, and fines breaches AED 50,000 to AED 2,000,000 (Art. 15). Sources had one year from entry into force to adjust, extendable by Cabinet (Art. 18).

Art. 41 of DIFC Law No. 5 of 2020 requires a controller to notify the Commissioner 'as soon as practicable in the circumstances' of a breach that compromises a data subject's confidentiality, security or privacy. A processor must alert the controller 'without undue delay'.

Art. 22 of Cabinet Resolution No. (134) of 2025 requires institutions to appoint a Compliance Officer at management level who is independent in decisions and suitably qualified; the officer reviews suspicious transaction data, reports to Senior Management and trains staff. Art. 21 requires internal policies, controls and procedures approved by Senior Management covering CDD, suspicious transaction reporting, compliance management, staff screening, training and an independent audit function. The parent requirement is Art. 19(1)(d) of Federal Decree by Law No. (10) of 2025.

Art. 25(1) requires financial and cash transaction records to be kept for at least five years after the transaction is completed or the business relationship ends. Art. 25(2) sets the same minimum for CDD records, counted from the latest trigger such as account closure, completed inspection, investigation or final court judgment. The parent duty is Art. 19(1)(f) of Federal Decree by Law No. (10) of 2025.

Art. 6(1) requires customer and beneficial owner identity to be verified before or during the relationship or before a transaction. Art. 7 applies CDD at the start of a relationship, on suspicion and where earlier data is doubtful, and for occasional transactions of AED 55,000 or more (AED 3,500 or more for wire transfers). Art. 14(1) bars establishing or continuing a relationship if CDD cannot be completed. Art. 16 requires senior management approval, source of funds and wealth checks and enhanced monitoring for foreign PEPs. Art. 10(1)(a) sets a 25% beneficial ownership threshold.

Art. 18(1) of Federal Decree by Law No. (10) of 2025 requires institutions to notify the Financial Intelligence Unit 'without delay and directly' when they suspect proceeds or related funds. Art. 18(1)(a) of Cabinet Resolution No. (134) of 2025 requires an immediate report without delay when they suspect, or have reasonable grounds to suspect, a crime; banking or professional secrecy is no excuse.

Art. 5(1) of the Payment Token Services Regulation sets three licence categories: Dirham payment token issuer, custodian and transferor, and conversion. Art. 6(2) requires UAE-incorporated applicants outside Financial Free Zones, and Art. 13(1) sets issuer capital of AED 15 million plus 0.5% of outstanding token value. Art. 2(3) prohibits algorithmic stablecoins and privacy tokens.

Art. 36(2)(a) of Cabinet Resolution No. (134) of 2025 requires the originating provider to obtain and retain accurate originator and beneficiary information and send it immediately and securely to the beneficiary provider; Art. 36(2)(b) requires the beneficiary provider to obtain and keep it and make it available on request. Art. 7(3) applies CDD to occasional virtual asset transactions of AED 3,500 or more. The Central Bank's Virtual Assets Travel Rule sets the data fields and the privacy token ban.

Art. 15(a) of Law No. (4) of 2022 states that no person may conduct the activity in the Emirate without a VARA permit; Art. 16(a) lists seven categories of activity that need one. VARA may suspend a permit for up to six months or revoke it (Arts. 18, 20). At federal level, Art. 4(1) of Cabinet Decision No. (111) of 2022 also bars virtual asset activity without a licence, outside Financial Free Zones.