CBUAE Law fully operative from 16 September 2026, post-transition enforcement era begins.
16 September 2026 marks the close of the one-year transitional period under Federal Decree-Law No. (6) of 2025 (the New CBUAE Law), which came into force on 16 September 2025 consolidating banking, payment, and insurance regulation under a single legislative framework. From 16 September 2026, all entities within scope are subject to the full enforcement architecture of the New CBUAE Law with no transitional relief. The CBUAE has confirmed that no blanket extension of the transitional period has been granted, and enforcement against non-compliant entities, including those newly brought within scope by Article 62’s expanded technology-provider licensing perimeter, commenced with immediate effect.
Key Takeaways:
- The CBUAE’s enforcement toolkit under the New Law is materially sharper than under its predecessor: maximum administrative fines rise from AED 200 million to AED 1 billion; fines for Authorised Individuals rise from AED 2 million to AED 5 million; a minimum AED 1 million fine applies to any person carrying on or promoting licensed financial activities without authorisation; and the CBUAE may now publish enforcement decisions including the names of violating institutions and individuals, creating direct reputational consequences alongside financial penalties.
- Article 62, the technology-neutral licensing trigger that extends CBUAE supervision to any person facilitating a licensed financial activity regardless of the medium, technology, or form employed, is now fully operative. Fintech platforms, API providers, payment infrastructure operators, open finance service providers, and decentralised platforms that enable banking, insurance, or payment activities must be either licensed or have a documented regulatory opinion from the CBUAE confirming they fall outside scope. Operating without this clarity from 16 September 2026 carries Article 170 criminal liability risk.
- For insurance companies, the transitional alignment period has closed: capital adequacy frameworks, governance structures (Board composition, independent actuarial functions, internal audit), claims handling SLAs, fraud prevention controls, and outsourcing arrangements must now comply fully with Articles 78 to 106 of the New CBUAE Law and implementing instruments issued under it. The CBUAE’s consolidated supervision of banking and insurance means that insurance compliance gaps are now assessed within the same supervisory and enforcement framework as banking violations.
- Businesses whose Article 62 exposure remains unresolved should seek immediate external legal guidance on their regulatory position. For licensed entities that completed regularisation within the transitional period, the post-16 September focus shifts to sustaining ongoing compliance with the New CBUAE Law’s enhanced prudential, conduct, and consumer protection obligations, including the strengthened fraud notification requirements, the AED 1 billion fine ceiling, and the CBUAE’s power to debit fines directly from accounts held at licensed institutions.
UAE Corporate Tax, first annual returns due 30 September 2026 for companies with financial years ending 31 December 2025.
30 September 2026 is the filing deadline for the first annual UAE Corporate Tax returns for companies whose first tax period ended on 31 December 2025. Under Article 47 of Federal Decree-Law No. (47) of 2022 on the Taxation of Corporations and Businesses (the CT Law), the Corporate Tax return must be filed within nine months of the end of the relevant tax period. For the large majority of UAE businesses with a calendar-year financial year, this means the CT return for Tax Period 1 (1 January 2025 to 31 December 2025) is due on 30 September 2026, a deadline that has now arrived and with it the first substantive test of CT compliance for most UAE corporate groups.
Key Takeaways:
- The Corporate Tax return must be filed electronically through the Federal Tax Authority’s EmaraTax portal. Key information required includes: taxable income computation, adjustments for exempt income (qualifying dividends, participation exemption, group relief), deductible and non-deductible expenses, depreciation and amortisation, transfer pricing adjustments for related-party transactions, and the quantum of any tax loss carry-forward. The FTA has published a CT return filing guide and a series of public clarifications addressing common computational questions; both should be reviewed before filing.
- Transfer pricing is among the most complex areas of CT compliance for groups with UAE-resident entities transacting with related parties. Businesses with related-party transactions or connected-person arrangements exceeding AED 50 million (or belonging to a large multinational enterprise group) must prepare and maintain a Master File and Local File compliant with the OECD Transfer Pricing Guidelines, as incorporated into UAE law by Ministerial Decision No. (97) of 2023. The Local File must document the arm’s length basis for each material category of related-party transaction and must be available for submission to the FTA within 30 days of request.
- The Small Business Relief election, available to businesses with revenue not exceeding AED 3 million in the relevant tax period, must be made in the CT return for the period in which relief is claimed. Businesses that qualify and wish to elect should confirm eligibility against the conditions in Ministerial Decision No. (73) of 2023 before filing. The election is irrevocable for the period to which it applies and cannot be made retrospectively after the return deadline.
- The CT payment obligation arises on the same date as the filing deadline, 30 September 2026 for calendar-year taxpayers. Late filing and late payment each carry separate administrative penalties under Cabinet Decision No. (75) of 2023: AED 500 per month for the first 12 months of late filing (then AED 1,000 per month) and 14% per annum on unpaid tax. CT compliance teams should ensure that both the return and the payment are processed through EmaraTax before 30 September 2026 and retain documented evidence of both submissions.
DFSA issues AML Rule-Making Instrument No. 435 of 2026, AML Annual Return due 30 September 2026.
The Dubai Financial Services Authority (DFSA) published Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module Rule-Making Instrument (No. 435) 2026, amending the DFSA AML Module to align with Federal Decree-Law No. (10) of 2025 on Anti-Money Laundering and Combating the Financing of Terrorism (the Federal AML Law) and its implementing Cabinet Resolution No. (134) of 2025, both effective October 2025. The RMI updates the DFSA’s AML/CFT and sanctions compliance framework for DIFC-licensed firms, which operate under a dual regime, federal AML law applies directly to DIFC entities alongside DFSA Rulebook requirements. September 30 is also the annual deadline for DIFC-licensed firms to submit their AML Annual Return to the DFSA.
Key Takeaways:
- RMI No. 435 of 2026 aligns the DFSA AML Module’s definitions, risk-based approach requirements, customer due diligence standards, and suspicious transaction reporting obligations with the Federal AML Law (Federal Decree-Law No. 10 of 2025) and its implementing Cabinet Resolution, ensuring that DFSA-regulated firms’ compliance frameworks are consistent with the enhanced federal AML/CFT/CPF standards now in force across the UAE. The key federal changes include materially increased criminal penalties, expanded personal liability for senior managers, and a new proliferation financing (CPF) compliance tier.
- The DFSA requires all Relevant Persons, DIFC-authorised firms with AML/CFT obligations, to submit an AML Annual Return by 30 September each year. The return requires firms to report on their AML/CFT programme, governance and oversight arrangements, customer risk profile, suspicious transaction reporting activity for the year, and training and awareness metrics. The Compliance Officer must certify the return; incomplete or materially inaccurate returns may trigger supervisory follow-up or enforcement action.
- DIFC firms that have not yet updated their AML/CFT policies, risk assessments, and CDD procedures to reflect both the Federal AML Law 10/2025 changes and the RMI 435 amendments should treat the September 30 AML Annual Return deadline as the forcing event for completing that alignment exercise. The most material areas requiring review are the enhanced CPF risk assessment requirements, updated PEP definitions and screening thresholds, expanded beneficial ownership verification standards, and the revised suspicious activity reporting obligations.
- Firms operating across DIFC and the UAE mainland face a compounding compliance requirement: the DFSA AML Module (as amended by RMI 435) applies to their DIFC entity, while the CBUAE AML Rulebook and the Federal AML Law apply to any mainland operations or entities. AML compliance functions should maintain jurisdiction-specific frameworks and ensure that group-level AML policies correctly differentiate obligations across the two regimes rather than applying a single undifferentiated standard.
UAE MoHRE Ministerial Resolution No. 340 of 2026, first full quarter of WPS enforcement completed.
Ministerial Resolution No. 340 of 2026, which overhauled the UAE Wage Protection System (WPS) effective 1 June 2026, has now completed its first full quarter of enforcement. The Resolution, which introduced a unified salary payment deadline of the 1st of each Gregorian month, raised the WPS compliance threshold from 80% to 85%, removed the 30-day grace period for new employee registration, and sharpened the enforcement escalation timeline, is being actively monitored by MoHRE’s AI-powered systems cross-referencing WPS submissions, trade licence data, and CBUAE payment records. September 2026 marks the end of the first full 90-day cycle under the new regime, providing a clear picture of which employer categories are struggling with compliance.
Key Takeaways:
- The unified salary payment deadline, wages for the preceding month due on the 1st of the following Gregorian month, eliminates the flexibility that previously existed under the graduated timelines in the repealed Resolution 598 of 2022. Employers with payroll cycles that historically ran on a 7th, 10th, or 14th-of-month basis must have restructured their payroll funding timelines, bank transfer mandates, and WPS submission schedules to meet the 1st of month deadline. Employers that have not done so face Day 11 administrative penalties under Cabinet Resolution 21 of 2020 (commonly cited at AED 1,000 to AED 5,000 per affected worker) and accelerated escalation to work permit suspension.
- The increase in the WPS compliance threshold from 80% to 85% means that the threshold for triggering a compliant wage transfer is higher: at least 85% of the establishment’s total registered wages (after lawful deductions) must be transferred through WPS-approved channels within the payment window. Employers with high proportions of workers receiving cash supplements, accommodation allowances, or third-party payroll delegations should audit whether their WPS-registered wage totals accurately reflect all qualifying wage components and that the 85% threshold is met in practice, not only in payroll records.
- The removal of the 30-day grace period for new employees is among the most operationally impactful changes for high-turnover sectors, hospitality, retail, construction, and logistics, where frequent new hires were previously given a one-month buffer before WPS enrolment was required. Under Resolution 340, new employees must be enrolled in WPS from their first pay cycle. HR onboarding processes must be updated to ensure WPS registration is completed contemporaneously with the issuance of the first salary, not at the end of the first month.
- Payroll delegation to third parties remains permissible under Resolution 340 but requires formal notification to MoHRE of the delegate’s identity and scope of delegation, and the establishment remains fully responsible for WPS compliance regardless of the delegation arrangement. Group payroll centres, shared service centres, and outsourced payroll providers must confirm that their WPS submissions correctly identify the MOHRE establishment file to which each salary payment relates, and that delegation arrangements are formally registered with MoHRE in accordance with Article requirements.
