Opening a corporate bank account in the UAE

A trade licence on its own will not open a company account in the UAE. Two texts decide what the bank has to collect first. Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing was issued on 30 September 2025 and repealed Federal Decree-Law No. 20 of 2018 at Article 41. Its executive regulations, Cabinet Resolution No. 134 of 2025, were issued on 29 October 2025 and repealed Cabinet Resolution No. 10 of 2019 at Article 70. Article 6 requires the identity of the customer and the beneficial owner to be verified before or during the opening of the account.

The second text is new. The Central Bank's Small to Medium Sized Enterprises (SME) Customer Protection Regulation, C 2/2026, took effect on 13 September 2026, replacing the SME Market Conduct Regulation, C 1/2021. Clause 3.20 of the old regulation said institutions should seek to have systems that open an account within three business days for an applicant presenting low money laundering and terrorist financing risk. Clause 4.46 of the new one says they must, and it fixes when the three days start to run.

The documents the rules actually name

Article 9(1)(b) of Cabinet Resolution No. 134 of 2025 sets the basic information for a customer that is a legal person: name, legal form, memorandum of association, the tax registration number of legal persons subject to corporate tax and the unique reference number if there is one; the address of the registered office or principal place of business, with the name and address of a foreign person's legal representative in the State; articles of association or other equivalent approved documents; and the names of the persons holding senior management positions.

Article 9(2) deals with whoever sits in front of the banker. That person must be shown to be duly authorised, and is then identified under Article 9(1)(a) by the name on the identity card or travel document, nationality, address, date and place of birth, employer where applicable, and a true copy of a valid identity card or travel document.

That list is short. The pack a relationship manager hands across is not. Audited accounts, tenancy contracts, sample invoices and organisation charts rest on the institution's own risk policy under Article 5 rather than on any provision naming them. Ask which requested documents are statutory and which belong to the internal standard. Clause 4.49 of C 2/2026 requires clear disclosure of the minimum documentary requirements.

The 25 per cent test

Article 10 puts the beneficial owner at the natural person who ultimately owns, individually or jointly, an actual controlling ownership interest or shares of 25 per cent or more. Where nobody can be identified that way, or there is doubt that the holder is the beneficial owner, the test moves to whoever exercises legal or actual control by any other means. If that fails as well, the relevant natural person in a senior management position is identified instead. A company with an unresolved chain above it does not escape the question. It ends with a manager's passport in the file.

The same figure runs through Cabinet Decision No. 109/2023 on the regulation of the real beneficiary procedures, which the licensing registrar applies. Article 8 requires a legal person to keep a beneficial owner register and to record any change within 15 days of learning of it. Article 11 requires that register and the register of partners or shareholders to reach the registrar within 60 days of licensing. Financial free zones sit outside that decision by Article 3(2)(b), so DIFC and ADGM companies answer to their own registries.

Purpose of the account, which is where the business plan comes in

No article uses the words business plan. Article 9(3) requires the bank to understand the purpose and intended nature of the business relationship, and Article 9(4) the nature of the customer's business and its ownership and control structure. Where risk is higher, Article 5(2)(c) calls for additional information on the purpose of the relationship or the reasons for expected transactions. Those provisions sit behind the questions about monthly turnover, the countries money will arrive from and travel to, the main counterparties, and how the company gets paid. Article 8 then requires transactions to be checked against what the bank already holds, for the life of the relationship. A description that does not match the licensed activity creates a problem on day one and on every day after it.

Source of funds and source of wealth

Enhanced due diligence under Article 5(2)(c) includes reasonable measures to identify the source of funds and wealth of the customer and the beneficial owner, additional information drawn from public databases and open sources, and senior management approval to commence or continue the relationship. It also includes making the first payment through an account in the customer's name at an institution subject to equivalent due diligence standards. Fund the new account from an account already in the company's or the owner's name. Not in cash, and not from a third party.

Article 16 makes source of funds and wealth compulsory rather than risk-dependent for foreign politically exposed persons, with senior management approval before the relationship starts or continues. The definition in Article 1 reaches spouses, children and their spouses, parents, and known close associates including anyone holding joint beneficial ownership of a company with a PEP. A shareholder's father-in-law can decide the approval route for a small trading company.

The three-day clock

Clause 4.46 counts its three business days from the day the customer made the request and provided all documents and information the bank needs. An incomplete file never starts the clock. The obligation falls away entirely where the institution is adhering to the UAE's financial crime compliance requirements. It reaches only customers inside the SME definition at clause 1.33, which carries across the thresholds in Cabinet Resolution No. 22 of 2016, and sole proprietors are included by clause 1.13. A larger company falls outside C 2/2026, and a limited liability company of any size falls outside the Consumer Protection Regulation, C 8/2020, which covers natural persons and sole proprietorships.

Why applications are refused

Article 14(1) is the blunt one. An institution is prohibited from establishing or continuing a business relationship where it is unable to apply customer due diligence measures, and it must consider submitting a suspicious transaction report. Article 15 bars anonymous accounts, accounts held under obviously fictitious names, and dealings with shell banks. Article 23 requires enhanced due diligence, and whatever countermeasures the supervisory authority sets, where a relationship involves a person from a country the National Committee identifies as high risk. A shareholder resident in such a country does not end an application. It changes who signs it off.

Correspondent banking pulls the same way. Under Article 26 a UAE bank must understand a respondent institution's business and reputation and obtain senior management approval before establishing a new correspondent relationship, and it may not deal with shell banks. A correspondent's limits reach the account opening desk.

Clause 3.12 of C 2/2026 requires the reason for a rejection to be disclosed in writing, then removes that duty where the reason relates to financial crime risks. An applicant is entitled to a written reason, except in the cases where the reason is the one they most want to hear. Clause 4.31 requires institutions to act with due skill, care and diligence when considering account opening, regardless of size, profits, market standing, nationality of ownership, years of presence or type of business activity, and then adds the qualifier below.

After the account opens

Article 25 requires transaction records to be kept for at least five years from completion of the transaction or termination of the relationship, and due diligence records, account files and correspondence for at least five years from whichever listed event is most recent, account closure and the completion of a supervisory inspection among them. Article 8 requires the file to stay current, which is why a bank asks again for material it already holds. Clause 4.43 of C 2/2026 stops it charging for that work.

Two deadlines belong in the company's calendar rather than the banker's. Fifteen days to record a change in the beneficial owner register under Article 8 of Cabinet Decision No. 109/2023, and 60 days from licensing to file that register with the registrar under Article 11. A bank asking for the register in year three will be handed whatever is in it.