A contractor wins a subcontract on a major infrastructure project in Abu Dhabi. The award is documented, the trade licence is valid, the commercial registration is in order. For most procurement and compliance functions in the UAE, that is where the due diligence stops. It should not be.
The Problem Most Procurement Teams Are Not Asking About
A contractor wins a subcontract on a major infrastructure project in Abu Dhabi. The award is documented, the trade licence is valid, the commercial registration is in order. For most procurement and compliance functions in the UAE, that is where the due diligence stops. It should not be.
The UAE construction and infrastructure market was valued at USD 66.89 billion in 2024 and is forecast to reach USD 96.06 billion by 2030, growing at a compound annual rate of 6.06%. The country hosts more than 45 operational free zones, each with its own registration authority and its own standards for what counterparty information it collects, retains and discloses. That combination, a project economy of extraordinary scale and a corporate registration environment of genuine structural fragmentation, creates a vendor risk problem that licence verification cannot resolve.
The argument here is specific: a valid trade licence in the UAE tells you that a company exists and is permitted to carry out certain activities. It does not reliably tell you who controls it, who ultimately benefits from it, whether those persons appear on sanctions or adverse watch lists, or whether the entity has the operational substance its licence implies. In the current regulatory environment, with Federal Decree-Law No. 10 of 2025 in force and a FATF fifth-round mutual evaluation anticipated in mid-2026, that gap carries direct legal and commercial consequence for the organisations engaging these vendors.
The Structural Information Gap in the UAE Vendor Landscape
The UAE's corporate registration environment has improved materially since the country's placement on the FATF grey list in 2022 and its removal from increased monitoring in February 2024. Cabinet Resolution No. 109 of 2023 amended the UBO framework established by Cabinet Resolution No. 58 of 2020 and requires every commercial entity to identify and register its ultimate beneficial owners, disclose nominee arrangements, and update that register within 15 working days of any change.
That framework covers mainland companies, free zone entities in commercial zones, and offshore companies registered in UAE jurisdictions. It does not cover entities incorporated in the financial free zones: DIFC and ADGM operate separate, FSRA and DFSA-supervised regimes with their own beneficial ownership and AML requirements. The result is a patchwork: over 45 free zones, each maintaining its own registrar, and a UBO disclosure obligation that sits with the licensing authority of each zone rather than in a single searchable national register accessible to counterparties.
For a procurement team, compliance function or legal counsel conducting vendor due diligence, this means that the UBO declaration filed with a free zone authority in Fujairah is not accessible in the same manner as records held by the mainland Department of Economic Development, and neither provides a real-time searchable database comparable to, say, the UK Companies House register. You are reliant on what the vendor chooses to provide, supplemented by whatever the licensing authority will disclose on request. The UAE's 2024 National Risk Assessment explicitly identified the misuse of legal persons and nominee structures as a key typology, and required DNFBPs to strengthen due diligence measures for complex or opaque ownership structures accordingly. That observation applies with equal force to the procurement functions of project owners, developers, family offices and investment entities engaging service providers and subcontractors.
What a Licence Tells You and What It Does Not
The structural gap sits between regulatory status and operational reality. A trade licence confirms that a company has been registered, that it holds an activity permit, and that it has met the administrative requirements of its licensing authority at the point of registration. It does not confirm:
— Who the ultimate natural persons controlling the entity are, beyond the formal ownership structure submitted at incorporation
— Whether those persons are subject to sanctions, have adverse regulatory history, or are politically exposed
— Whether the entity has the operational capacity, workforce and infrastructure its licence implies
— Whether the entity was established to perform the contracted services or to act as an intermediary in a layered payment or procurement structure
The CBUAE's own typologies guidance identifies contractor and vendor fraud as a documented risk category, with red flags including entities that sub-contract all actual work to undisclosed third parties, round-number payments received from unassociated parties, and relationships with sub-contracted industry intermediaries that obscure the true beneficial flow of contract value. The UAE FIU's January 2024 Financial Crime Typologies report reinforced that shell entities conducting no real operations, and the use of false information to establish businesses, remain active and documented threat vectors in the UAE financial sector.
The nomination and layering dynamic is well established. A vendor is awarded a contract. That vendor does not perform the work: it passes the contract to another entity, often without the knowledge of the contracting organisation, and the economic benefit flows to persons or structures that were never visible at the point of engagement. Cabinet Resolution No. 109 of 2023 requires nominee directors and shareholders to be disclosed, and nominee status to be registered. The regulatory obligation is on the vendor to disclose. The contracting organisation has no independent right of access to the register. If the vendor does not disclose, or discloses an incomplete structure, the counterparty faces the consequences of a relationship they cannot properly see.
The Regulatory Exposure That Falls on the Contracting Party
Under Federal Decree-Law No. 10 of 2025, which came into force on 14 October 2025 and superseded Decree-Law No. 20 of 2018 as the principal AML/CFT instrument, senior management faces personal liability, including potential imprisonment, for negligence in AML controls. The CBUAE's April 2026 guidance package under the new Decree-Law explicitly requires licensed financial institutions to maintain written, institution-specific CDD programmes, extend beneficial ownership verification to risk-sensitive thresholds, and scrutinise trade documentation for misrepresentation of goods, services and counterparty identity.
The implication for non-financial entities is proportionate but real. Any organisation that is a DNFBP under the current framework, including real estate developers, corporate service providers, dealers in precious metals and stones, and accountants operating in or from the UAE, carries formal AML obligations that extend to their counterparties and vendors. The UAE Ministry of Economy's Circular No. 6 of 2025 required all DNFBPs to adopt a structured, two-stage customer and counterparty risk assessment process: first assess the risk profile, then apply proportionate due diligence measures. Accepting a vendor on the basis of a licence copy and a sanctions database query does not satisfy that standard.
For organisations that are not formally DNFBPs, there is still direct exposure through predicate offence liability. Federal Decree-Law No. 10 of 2025 retains and broadens the doctrine that any person who knowingly handles, conceals or transfers funds derived from a predicate offence commits a money laundering offence. Bribery, fraud and procurement corruption are predicate offences. An organisation that engages a vendor that turns out to be a conduit for procurement fraud, and that cannot demonstrate it applied reasonable due diligence to that engagement, is not merely an innocent victim. It is a potential subject of inquiry.
The FATF fifth-round mutual evaluation, expected in mid-2026, will assess the UAE's AML and CFT effectiveness across 11 immediate outcomes. The direction of supervisory pressure is clear. The tolerance for process-level compliance without demonstrable substance is diminishing.
Practitioner Implications: What Due Diligence on a UAE Vendor Actually Requires
The following represents the minimum defensible standard for organisations engaging material vendors and subcontractors in the UAE project economy. These are not recommendations for regulated entities alone. They reflect the level of inquiry that a sophisticated organisation should be able to demonstrate under examination.
Establish the UBO chain, not just the registered owner. Identify the natural persons who ultimately own or control at least 25% of the vendor entity, the threshold established under Cabinet Resolution No. 109 of 2023, and screen those persons against sanctions lists, PEP databases and adverse media. The trade licence alone does not discharge this obligation.
Verify operational substance. A licensed entity with no employees, no physical premises, and no track record of the contracted activity is a risk indicator, regardless of its licence status. Check whether the entity has the workforce, equipment and references proportionate to the contract value.
Identify nominee and intermediary arrangements. Where a vendor's corporate structure involves nominee shareholders, nominee directors, or a corporate shareholder in a jurisdiction that does not publish beneficial ownership, treat this as a trigger for enhanced due diligence. The UAE's 2024 NRA identified nominee structure misuse as a key typology.
Screen across the ownership chain, not only at entity level. Sanctions screening and adverse media checks should be applied to the identified UBOs, not only to the company name. A clean entity held by a sanctioned or PEP-connected natural person is not a clean counterparty.
Incorporate contractual protections. Contracts should include representations on UBO accuracy, rights to audit the vendor's beneficial ownership disclosures, and termination provisions triggered by material changes to control structure or the identification of undisclosed ownership. Contracts structured without these provisions leave the engaging organisation with no formal mechanism to respond when the counterparty's risk profile changes.
Apply periodic review, not one-time onboarding checks. Ownership structures change. The Cabinet Resolution No. 109 of 2023 requirement for vendors to update UBO registers within 15 days does not guarantee that a contracting party is notified. Your own review cycle is the control.
The Question Boards and Principals Are Not Yet Asking
The UAE's regulatory architecture has moved faster since 2022 than most commercial due diligence processes have. The gap is not between what the law requires of vendors and what vendors do. The gap is between the due diligence that contracting organisations apply to their customer pipelines and the due diligence they apply to the vendors they pay. For many organisations, the latter is substantially weaker.
A licensed counterparty is not a known counterparty. In a project economy of USD 66.89 billion, with a FATF evaluation in progress and a regulatory environment that now imposes personal liability at senior management level, the cost of that confusion is no longer abstract.