ESR is gone. The UAE walked off both grey lists. VARA rewrote its crypto rulebook. And the executive regulations to the federal data-protection law are still not out. Here is what genuinely reshapes the model — no gloss.
The 2026 regulatory picture in the Emirates is not about "tightening in general." It is about a shift. Some old rules were retired, some moved inside the corporate tax regime, and some are still on the runway. Read the Emirates business climate through consultancy landing pages from two years ago, and you may prepare filings that no longer exist. Or miss the real substance conditions now baked into QFZP.
Below is the map — what actually deserves attention if you run a DMCC entity, sit inside a free zone structure, operate a fintech arm, or plan to relocate.
Was the Economic Substance Regulation really abolished?
Yes. Cabinet Decision No. 98 of 2024 removed ESR obligations from financial years starting on or after 1 January 2023. The Ministry of Finance made the public announcement in October 2024.
This is not liberalisation for its own sake. The logic is cleaner. Once the 9% corporate tax landed, substance requirements moved inside the tax regime — running a parallel reporting stream had lost its point. The Federal Tax Authority confirmed:
- ESR notifications and reports for periods starting on or after 1 January 2023 no longer need to be filed;
- administrative penalties for non-compliance in periods ending after 31 December 2022 are cancelled;
- penalties already paid for those periods are refundable.
Periods from 2019 to 2022 stay under the old regime. Anything left unfiled for those years is still a live question.
One subtle point people forget. Abolishing ESR does not abolish substance as a concept. It abolishes the separate reporting stream.
Where did the substance requirements actually move?
Into the Qualifying Free Zone Person rules under corporate tax. Those rules now decide whether a free zone company keeps 0% on qualifying income — or gets recast at the standard 9%.
In practical terms:
- a legal address is no longer enough — you need a real office in the free zone, scaled to the business;
- staff must physically work from the zone, not from a laptop in another jurisdiction;
- operating expenses must match the declared activity in size and nature;
- from 2025, QFZP entities are required to audit their financial statements — backfilling substance after the fact does not work.
The price of a slip is heavy. Fail even one criterion in a single tax period and QFZP status is lost for five years — the current period plus the next four. No partial credit. No proportionate relief.
| Before 2023 | 2023–2026 |
|---|---|
| Separate ESR filings to the Ministry of Finance | ESR filings abolished |
| Fines for ESR non-compliance | Fines for periods after 31.12.2022 cancelled |
| Substance checked as a stand-alone item | Substance embedded in QFZP under corporate tax |
| Audit for free zone entities — not always | From 2025, audit mandatory for QFZP |
The practical shift: substance stopped being a compliance-team tick. It became a condition for keeping the 0% rate — which puts it squarely on the CFO's and owner's desk.
What actually changed in AML after the UAE left both grey lists?
The UAE exited the FATF grey list on 23 February 2024, and on 9 July 2025 the European Parliament confirmed the removal of the UAE from the EU high-risk list. Both moves reshape how European banks and correspondents handle Emirati clients.
Here is what sits behind the headline. The UAE implemented all 15 action items agreed with FATF, and by the 2024 follow-up report 39 of 40 recommendations were rated "compliant" or "largely compliant." Between July and October 2024, 32 domestic gold refineries had their licences suspended — 256 AML breaches were logged against them. Enforcement, not theatre.
For an ordinary company, this cuts two ways:
- European banks no longer apply automatic enhanced due diligence to UAE clients, so UAE trade with the EU gets operationally lighter;
- internal AML control, in turn, tightened — especially across DNFBP sectors (real estate, precious metals, law firms, corporate service providers);
- KYC and UBO reviews on beneficial owners are not a paperwork exercise. The Central Bank of the UAE and MOEC now inspect on a regular cadence.
Deloitte and AO Shearman put it plainly in their 2025 reviews: coming off the list does not mean the standards dropped — it means they are now enforced for real. Not a scare story. Operational reality.
The PDPL is already in force, but the executive regulations are still not out — what should you do?
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data has been live since January 2022, and as of early 2026 the executive regulations remain unpublished. Once they land, companies get six months to align.
The situation is odd. The obligations exist. The implementation detail does not. Yet DLA Piper and Chambers converge on the same take: waiting on the regulations and doing nothing is a poor strategy. The statute already spells out the fundamentals.
What you can act on today:
- a data-processing register;
- consent and legal bases for every data flow;
- retention and deletion policies;
- Data Processing Agreements with vendors (marketing tools, CRMs, cloud providers);
- an incident-notification procedure — the process needs to exist, even if there is nowhere to file it yet.
There is a separate layer worth flagging. DIFC and ADGM each run their own data-protection regimes — the DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021. Both sit closer to GDPR and are fully operational. A group with a DIFC holding company and a mainland operating company runs under two regimes at once — worth engineering into the legal architecture, not bolting on later.
What did VARA change for crypto in 2025 — and how should you read it in 2026?
On 19 May 2025 the Dubai regulator VARA published Version 2.0 of its Rulebooks; existing VASPs had to be fully compliant by 19 June 2025. All twelve activity-based rulebooks were revised at once — a rewrite of this scale had been anticipated for some time.
Core shifts:
- A new asset class — ARVA (Asset-Referenced Virtual Assets). These are virtual assets pegged to real-world assets (RWA tokens). Issuing one now requires a VARA licence, on the same footing as FRVA (fiat-referenced) tokens.
- A mandatory wind-down plan for every VASP. Whether or not the firm plans to exit — the plan has to exist and be kept current.
- Recalibrated capital thresholds. The activity threshold that triggers higher capital requirements is tied to annual revenue (VARA now works from an AED 700,000 reference, replacing the previous AED 500,000 cash-based threshold — always check the live Rulebook for the exact figure, it gets revised).
- Sharper market-abuse and STR standards. Market-conduct rules and suspicious-transaction reporting are aligned with international practice; STR filing via goAML is on a near real-time footing.
RWAs deserve a paragraph. Tokenisation of real-world assets — property, fund interests, commodity contracts — is something the UAE is visibly pushing forward. Codifying ARVA as a category signals that the regulator sees RWAs not as an experiment, but as a market that needs predictable infrastructure. For issuers, that means more predictability and less room for grey-zone workarounds.
One more layer people forget. VARA does not sit alone. Crypto activity in the UAE also falls under the Central Bank of the UAE (for stablecoins and payments), the SCA at the federal level, the FSRA in ADGM and the DFSA in DIFC. You pick the jurisdiction by activity type, not by cost. In our advisory work out of DMCC, this one question — "which regulator do we stand up under" — tends to set the structure, the tax profile and, frankly, the time to market.
How does all of this reshape the Emirates business climate?
The regulatory perimeter matured — tighter in detail, simpler in overall architecture. Fewer parallel filings, more meaningful substance. Set against that, the UAE economy is not "getting easier." It is stopping being an "easy" market in the old sense, and becoming a normal international one — with non-oil sectors now carrying the majority of UAE GDP.
Three takeaways we would put at the top:
- Free zone structures without substance no longer work. No real office, no team, no OPEX in the zone — no 0% QFZP. Not a future threat. A rule of the current tax period.
- AML is infrastructure, not paperwork. Especially for DNFBP. Inspections happen. Licences get pulled. Treating this as a "future requirement" is already late.
- Start data governance now — do not wait for the regulations. When they drop, six months to align will burn fast, especially if the data is scattered across SaaS tools with no register.
Read UAE business news of the last two years end to end and the same line runs through it: the country is aligning to international standards to unlock capital and cross-border trade. Domestic regulatory pressure is part of that deal.
Checklist: what to review in your company right now
- Corporate Tax + QFZP. Auditor lined up for 2025? Substance evidenced — office, staff, OPEX inside the free zone? Qualifying and non-qualifying income streams kept apart?
- ESR. 2019–2022 obligations closed? Periods from 1 January 2023 — nothing to file.
- AML / KYC. UBO register current? Working STR procedure in place? Staff getting trained?
- PDPL. Processing register in place? DPAs with key vendors reviewed? Retention policies live?
- VARA / crypto. If the activity touches virtual assets — is the licence aligned with Rulebook 2.0? Wind-down plan in place?
- Data — DIFC / ADGM. If the structure includes a financial free zone — is the right regime applied (Federal PDPL vs DIFC / ADGM)?
A practical note from DMCC advisory work: do not tackle these in strict deadline order. They are linked. Substance under QFZP drags audit in behind it, audit surfaces AML questions, AML rolls into data governance. Working through them in parallel is cheaper than firefighting each one in isolation.
This piece was prepared by the garant.consulting editorial team. Publisher — Garant Business Consultancy DMCC, Dubai.
