United Arab Emirates
This report analyses the implementation of the AEOI Standard in the United Arab Emirates with respect to the requirements of the AEOI Terms of Reference. It assesses both the legal frameworks put in place to implement the AEOI Standard and the effectiveness of the implementation of the AEOI Standard in practice.
The methodology used for the peer reviews and that therefore underpins this report is outlined in Chapter 2.
Overall findings
AEOI legal framework
The United Arab Emirates’ legal framework implementing the AEOI Standard is in place and is consistent with the requirements of the AEOI Terms of Reference. This includes the United Arab Emirates’ domestic legislative framework requiring Reporting Financial Institutions to conduct the due diligence and reporting procedures (CR1) and its international legal framework to exchange the information with all of the United Arab Emirates’ Interested Appropriate Partners (CR2).
Effectiveness of AEOI in practice
The United Arab Emirates’ implementation of the AEOI Standard is on track with respect to the requirements of the AEOI Terms of Reference to ensure the effectiveness of the AEOI Standard in practice. This includes ensuring Reporting Financial Institutions correctly conduct the due diligence and reporting procedures (CR1) and exchanging the information in an effective and timely manner (CR2). The United Arab Emirates is encouraged to continue its implementation process accordingly, to ensure its ongoing effectiveness.
Overall rating in relation to the effectiveness in practice: On Track
General context
The United Arab Emirates commenced exchanges under the AEOI Standard on a non-reciprocal basis in 2018 (i.e. it sends but does not receive information).
The United Arab Emirates has a decentralised regulatory system to provide for Reporting Financial Institutions to collect and report the information to be exchanged. There are now six Regulatory Authorities specified by Cabinet Resolution No. (5/11) of 2020, with each Regulatory Authority of the United Arab Emirates having enacted rules to cover the entities they regulate. These are:
The Central Bank (CB)- Notice No. 404/2016, amended on 20 August 2020;
The Securities and Commodities Authority (SCA) - Decision of the Chairman of the SCA Board of Directors No. (25 / R.M) of 2017 Concerning the Issuance of Regulation for Common Standards to Prepare the Tax Reports, amended on 3 August 2020;
The Insurance Authority (IA) - Insurance Authority Circular No. 34 issued on 9 September 2020;
The Dubai International Finance Centre (DIFC) - Common Reporting Standard Law No. (2) of 2018 and the CRS Regulations of the Board of Directors of the DIFCA, amended on 30 July 2020;
The Abu Dhabi Global Market (ADGM) - Common Reporting Standard Regulations 2017, amended on 24 June 2020; and
Ministry of Finance (MoF) – CRS Guidance Notes issued in 2016, revised and reissued on 3 August 2020.
The United Arab Emirates also made reference to Federal Decree-law No. 20 of 2018 relating to anti-money laundering for the purposes of the identification of Controlling Persons under the AEOI Standard.
Centralised guidance was also issued by the Ministry of Finance. The Guidance and the aforementioned rules enacted by Regulatory Authorities are legally binding.
Under this framework Reporting Financial Institutions were required to commence the due diligence procedures in relation to New Accounts from 1 January 2017. With respect to Preexisting Accounts, Reporting Financial Institutions were required to complete the due diligence procedures on High Value Individual Accounts by 31 December 2017 and on Lower Value Individual Accounts and Entity Accounts by 31 December 2018.
Following the initial Global Forum peer review, the United Arab Emirates amended its legislative framework to address issues identified, the last of which was effective from 20 August 2020.
With respect to the exchange of information under the AEOI Standard, the United Arab Emirates is a Party to the Convention on Mutual Administrative Assistance in Tax Matters and activated the associated CRS Multilateral Competent Authority Agreement in time for exchanges in 2018.
Table 1 sets out the number of Financial Institutions in the United Arab Emirates that reported information on Financial Accounts in 2021 as defined in the AEOI Standard (essentially because they maintained Financial Accounts for Account Holders, or that were related to Controlling Persons, resident in a Reportable Jurisdiction). It also sets out the number of Financial Accounts that they reported in 2021. In this regard, it should be noted that the United Arab Emirates requires the reporting of Financial Accounts based on a prescribed list of exchange partners and some accounts may be required to be reported more than once (e.g. jointly held accounts or accounts with multiple related Controlling Persons), which is reflected in the figures below. These figures provide key contextual information to the development and implementation of the United Arab Emirates’ administrative compliance strategy, which is analysed in the subsequent sections of this report.
Table 2 sets out the number of exchange partners to which information was successfully sent by the United Arab Emirates in the past few years (including where the necessary frameworks were in place, containing an obligation on Reporting Financial Institutions to report information, but no relevant Reportable Accounts were identified). These figures provide key contextual information in relation to the United Arab Emirates’ exchanges in practice, which is also analysed in subsequent sections of this report.
In order to provide for the effective implementation of the AEOI Standard, in the United Arab Emirates:
the Ministry of Finance has overarching responsibility for exchanging information with the United Arab Emirates’ exchange partners; and has the responsibility to ensure the effective implementation of the due diligence and reporting obligations by Reporting Financial Institutions that are not supervised by certain other regulatory authorities. Those other regulatory authorities with responsibility for the effective implementation by Reporting Financial Institutions subject to their supervision are the Central Bank, the Insurance Authority, the Securities and Commodities Authority, the Abu Dhabi Global Markets Regulatory Authority and the Dubai International Financial Centre Regulatory Authority;
technical solutions necessary to receive and validate the information reported by Reporting Financial Institutions were put in place through the UAE Data Exchange Portal; and
the Common Transmission System (CTS) is used for the exchange of the information, along with the associated file preparation and encryption requirements.
It should be noted that the review of the United Arab Emirates’ legal frameworks implementing the AEOI Standard concluded with the determination that the United Arab Emirates’ domestic and international legal frameworks are In Place. This has been taken into account when reviewing the effectiveness of the United Arab Emirates’ implementation of the AEOI Standard in practice.
Findings and conclusions on the legal frameworks
The detailed findings and conclusions on the AEOI legal frameworks for the United Arab Emirates are below, organised per Core Requirement (CR) and then per sub-requirement (SR) as extracted from the AEOI Terms of Reference (see Annex C).
CR1 Domestic legal framework: Jurisdictions should have a domestic legislative framework in place that requires all Reporting Financial Institutions to conduct the due diligence and reporting procedures in the CRS, and that provides for the effective implementation of the CRS as set out therein.
The United Arab Emirates’ domestic legislative framework is in place and contains all of the key aspects of the CRS and its Commentary requiring Reporting Financial Institutions to conduct the due diligence and reporting procedures (SRs 1.1 – 1.3). It also provides for a framework to enforce the requirements (SR 1.4).
SR 1.1 Jurisdictions should define the scope of Reporting Financial Institutions consistently with the CRS.
The United Arab Emirates has defined the scope of Reporting Financial Institutions in its domestic legislative framework in a manner that is consistent with the CRS and its Commentary.
SR 1.2 Jurisdictions should define the scope of Financial Accounts and Reportable Accounts consistently with the CRS and incorporate the due diligence procedures to identify them.
The United Arab Emirates has defined the scope of the Financial Accounts that are required to be reported in its domestic legislative framework and incorporated the due diligence procedures that must be applied to identify them in accordance with the CRS and its Commentary.
SR 1.3 Jurisdictions should incorporate the reporting requirements contained in Section I of the CRS into their domestic legislative framework.
The United Arab Emirates has incorporated the reporting requirements in its domestic legislative framework in accordance with the CRS and its Commentary.
SR 1.4 Jurisdictions should have a legislative framework in place that allows for the enforcement of the requirements of the CRS in practice.
The United Arab Emirates has a legislative framework in place to enforce the requirements in accordance with the CRS and its Commentary.
CR2 International legal framework: Jurisdictions should have exchange relationships in effect with all Interested Appropriate Partners as committed to and that provide for the exchange of information in accordance with the Model CAA.
The United Arab Emirates’ international legal framework to exchange the information is in place, is consistent with the Model CAA and its Commentary and provides for exchange with all of the United Arab Emirates’ Interested Appropriate Partners (i.e. all jurisdictions that are interested in receiving information from the United Arab Emirates and that meet the required standard in relation to confidentiality and data safeguards) (SRs 2.1 – 2.3).
SR 2.1 Jurisdictions should have exchange agreements in effect with all Interested Appropriate Partners that permit the automatic exchange of CRS information.
The United Arab Emirates has exchange agreements that permit the automatic exchange of CRS information in effect with all its Interested Appropriate Partners.
SR 2.2 Such an exchange agreement should be put in place without undue delay, following the receipt of an expression of interest from an Interested Appropriate Partner.
The United Arab Emirates put in place its exchange agreements without undue delay.
SR 2.3 Jurisdictions should ensure that the exchange agreements in effect provide for the exchange of information in accordance with the requirements of the Model CAA.
The United Arab Emirates’ exchange agreements provide for the exchange of information in accordance with the requirements of the Model CAA.
Findings and conclusions in relation to effectiveness in practice
The detailed findings and conclusions in relation to effectiveness in practice of AEOI for the United Arab Emirates are below, organised per Core Requirement (CR) and then per sub-requirement (SR) as extracted from the AEOI Terms of Reference (see Annex C).
CR1 Effectiveness in practice: Jurisdictions should ensure that in practice Reporting Financial Institutions correctly implement the due diligence and reporting procedures, which includes a requirement for jurisdictions to have in place an administrative framework to ensure the effective implementation of the CRS.
The United Arab Emirates’ implementation of the AEOI Standard is on track with respect to ensuring that Reporting Financial Institutions are correctly conducting the due diligence and reporting procedures and are therefore reporting complete and accurate information. This includes ensuring effectiveness in a domestic context, such as through having an effective administrative compliance framework and related procedures (SR 1.5), and collaborating with exchange partners to ensure effectiveness (SR 1.6). The United Arab Emirates is encouraged to continue its implementation process to ensure its ongoing effectiveness.
SR 1.5 Jurisdictions should ensure that in practice Reporting Financial Institutions identify the Financial Accounts they maintain, identify the Reportable Accounts among those Financial Accounts, as well as their Account Holders, and where relevant Controlling Persons, by correctly conducting the due diligence procedures and collect and report the required information with respect to each Reportable Account. This includes having in place:
an effective administrative compliance framework to ensure the effective implementation of, and compliance with, the CRS. This framework should:
be based on a strategy that facilitates compliance by Reporting Financial Institutions and which is informed by a risk assessment in respect of the effective implementation of the CRS that takes into account relevant information sources (including third party sources);
include procedures to ensure that Financial Institutions correctly apply the definitions of Reporting Financial Institutions and Non-Reporting Financial Institutions;
include procedures to periodically verify Reporting Financial Institutions’ compliance, conducted by authorities that have adequate powers with respect to the reviewed Reporting Financial Institutions, with procedures to access the records they maintain; and
effective procedures to ensure that Financial Institutions, persons or intermediaries do not circumvent the due diligence and reporting procedures;
effective enforcement mechanisms to address non-compliance by Reporting Financial Institutions;
strong measures to ensure that valid self-certifications are always obtained for New Accounts;
effective procedures to ensure that each, or each type of, jurisdiction-specific Non-Reporting Financial Institution and Excluded Account continue to present a low risk of being used to evade tax; and
effective procedures to follow up with a Reporting Financial Institution when undocumented accounts are reported in order to establish the reasons why such information is being reported.
In order to ensure that Reporting Financial Institutions correctly conduct the due diligence and reporting procedures, the United Arab Emirates implemented all of the requirements in accordance with expectations. The key findings were as follows:
The United Arab Emirates has implemented an overarching strategy to ensure compliance with the AEOI Standard developed after conducting a risk assessment that takes into account a range of relevant information sources, such as information held by regulators and other government entities, reported data and peer notifications. The United Arab Emirates has prepared a Compliance Programme Guide setting out the detailed procedures that each regulator responsible for implementing the AEOI Standard must follow and has put in place a committee with representatives of all regulators, to ensure effective cooperation between the authorities. The compliance strategy facilitates compliance and incorporates a credible approach to enforcement, and the United Arab Emirates intends to keep such compliance strategy and risk assessment under review to ensure its effectiveness on an ongoing basis.
The United Arab Emirates has worked to understand its population of Financial Institutions, including relevant non-regulated entities, with each regulatory authority utilising information from its list of supervised entities and the Ministry of Finance combining those lists for an overall view. The Foreign Financial Institution list for FATCA purposes and records held by the Ministry of Finance for other purposes are also checked. The United Arab Emirates requires nil reporting and the regulatory authorities have taken action to monitor and follow up on failures to report and the reasons for nil reporting by some Reporting Financial Institutions. The United Arab Emirates intends to keep its understanding of its Financial Institution population up to date on a routine basis.
The institutions responsible for implementing the United Arab Emirates’ compliance strategy appear to have the necessary powers and resources to discharge their functions. With respect to resourcing, the Ministry of Finance and each of the regulatory authorities of the United Arab Emirates has assigned the equivalent of 1-2 full time staff who are required to have specified skills and experience, to monitor and ensure compliance by Reporting Financial Institutions, which have access to IT systems and tools to conduct risk assessments.
It appears that the regulatory authorities have procedures in place to effectively enforce the requirements for regulated Financial Institutions, such as the carrying out of desk audits and onsite reviews, including through the inspection of records of Reporting Financial Institutions and the application of dissuasive penalties or sanctions. Each regulatory authority has carried out desk audits or onsite reviews, or both. It also appears that the United Arab Emirates is ready to take effective action to address circumvention of the requirements if such circumvention is detected, and that action is being taken to follow up on undocumented accounts. The regulatory authorities have commenced checks to ensure self-certifications are obtained as required.
It is noted that the United Arab Emirates does not have a jurisdiction-specific list of Non-Reporting Financial Institutions or Excluded Accounts for ongoing monitoring.
Table 3 provides a summary of the specific activities undertaken, or that are planned to be undertaken, in relation to each of the key parts of the framework described above.
In terms of the Financial Account information collected and sent by the United Arab Emirates, the presence of the key data point of dates of birth and the level of undocumented accounts appeared to be in line with most other jurisdictions, it was found to include a much lower proportion of Tax Identification Numbers with respect to the individuals associated with the accounts when compared to most other jurisdictions.
Feedback from the United Arab Emirates’ exchange partners indicated that, compared to what they generally experience when seeking to match information received from their exchange partners with their taxpayer database, they achieved a relatively lower level of success when seeking to match information received from the United Arab Emirates. Furthermore, five exchange partners highlighted issues with respect to the information received having low rates of valid Tax Identification Numbers. Follow-up discussions confirmed that the United Arab Emirates is aware of these issues and is taking action to address them.
Based on these findings it was concluded that, overall, the United Arab Emirates is meeting expectations in ensuring that Reporting Financial Institutions correctly conduct the due diligence and reporting procedures, including by having in place the required administrative compliance framework and related procedures. It was also noted that there is room for improvement with respect to addressing the issues raised by exchange partners. The United Arab Emirates is therefore encouraged to continue its implementation process accordingly, including by addressing the recommendation made.
The United Arab Emirates should continue to address the issues raised by its exchange partners.
SR 1.6 Jurisdictions should collaborate on compliance and enforcement. This requires jurisdictions to:
use all appropriate measures available under the jurisdiction’s domestic law to address errors or non-compliance notified to the jurisdiction by an exchange partner; and
have in place effective procedures to notify an exchange partner of errors that may have led to incomplete or incorrect information reporting or non-compliance with the due diligence or reporting procedures by a Reporting Financial Institution in the jurisdiction of the exchange partner.
It should be noted that, as the United Arab Emirates exchanges information on a non-reciprocal basis and does not therefore receive information, it is not required to have in place procedures to notify its exchange partners. SR 1.6 b) has therefore not been assessed in this case.
In order to collaborate on compliance and enforcement, the United Arab Emirates implemented all of the requirements in relation to issues notified to them (i.e. under Section 4 of the MCAA or equivalent) in accordance with expectations. In particular, the United Arab Emirates received a notification from one partner, which it investigated and subsequently provided a response to the partner.
Based on these findings it was concluded that the United Arab Emirates is fully meeting expectations in relation to collaborating with its exchange partners to ensure that Reporting Financial Institutions correctly conduct the due diligence and reporting procedures. The United Arab Emirates is encouraged to continue its implementation process accordingly, to ensure its ongoing effectiveness.
CR2 Effectiveness in practice: Jurisdictions should exchange the information effectively in practice, in a timely manner, including by sorting, preparing, validating and transmitting it in accordance with the AEOI Standard.
The United Arab Emirates’ implementation of the AEOI Standard is on track with respect to exchanging the information effectively in practice, including in relation to sorting, preparing and validating the information (SR 2.4), correctly transmitting the information in a timely manner (SRs 2.5 – 2.7) and providing corrections, amendments or additions to the information (SR 2.9). The requirements in relation to the receipt of the information (SR 2.8) have not been assessed as the United Arab Emirates exchanges information non-reciprocally, so does not receive information. The United Arab Emirates has shown improvement over time and is encouraged to continue its implementation process accordingly, to ensure its ongoing effectiveness.
SR 2.4 Jurisdictions should sort, prepare and validate the information in accordance with the CRS XML Schema and the associated requirements in the CRS XML Schema User Guide and the File Error and Correction-related validations in the Status Message User Guide (i.e. the 50000 and 80000 range).
Six exchange partners highlighted particular issues with respect to preparation and format of the information sent by the United Arab Emirates (representing 9% of its partners). These generally related to decryption errors. More generally, 12 (or 17%) of the United Arab Emirates’ exchange partners reported rejecting more than 25% of the files received, of which 3 (or 4%) reported rejecting more than 50% of files received, due to the technical requirements not being met. This is a very high amount when compared to other jurisdictions, although it has reduced over time. It was noted that the United Arab Emirates has already successfully addressed all of the issues raised.
Based on these findings it was concluded that, overall, the United Arab Emirates is meeting expectations in relation to sorting, preparing and validating the information. It was also noted that there is room for improvement with respect to the original preparation of files. The United Arab Emirates should continue its implementation process accordingly, including by addressing the recommendation made.
The United Arab Emirates should review its systems and procedures to sort, prepare and validate the information to ensure they meet the requirements of the AEOI Standard.
SR 2.5 Jurisdictions should agree and use, with each exchange partner, transmission methods that meet appropriate minimum standards to ensure the confidentiality and integrity of the data throughout the transmission, including its encryption to a minimum secure standard.
In order to put in place an agreed transmission method that meets appropriate minimum standards in confidentiality, integrity of the data and encryption for use with each of its exchange partners, the United Arab Emirates linked to the CTS.
Based on these findings it was concluded that the United Arab Emirates is fully meeting expectations in relation to agreeing and using appropriate transmission methods with each of its partners. The United Arab Emirates is encouraged to continue to ensure the ongoing effectiveness of its implementation.
SR 2.6 Jurisdictions should carry out all exchanges annually within nine months of the end of the calendar year to which the information relates.
Feedback from the United Arab Emirates’ exchange partners did not raise any concerns with respect to timeliness of the exchanges by the United Arab Emirates and therefore with respect to the United Arab Emirates’ implementation of this requirement.
Based on these findings it was concluded that the United Arab Emirates is fully meeting expectations in relation to exchanging the information in a timely manner. The United Arab Emirates is encouraged to continue to ensure the ongoing effectiveness of its implementation.
SR 2.7 Jurisdictions should send the information in accordance with the agreed transmission methods and encryption standards.
Feedback from the United Arab Emirates’ exchange partners did not raise any concerns with respect to the United Arab Emirates’ use of the agreed transmission methods and therefore with the United Arab Emirates’ implementation of this requirement.
Based on these findings it was concluded that the United Arab Emirates is fully meeting expectations in relation to sending the information in accordance with the agreed transmission methods and encryption standards. The United Arab Emirates is therefore encouraged to continue to ensure the ongoing effectiveness of its implementation.
SR 2.8 Jurisdictions should have the systems in place to receive information and, once it has been received, should send a status message to the sending jurisdictions in accordance with the CRS Status Message XML Schema and the related User Guide.
It should be noted that, as the United Arab Emirates exchanges information on a non-reciprocal basis and does not receive information, it is not required to have in place systems to receive the information and provide status messages. SR 2.8 has therefore not been assessed in this case.
SR 2.9 Jurisdictions should respond to a notification from an exchange partner as referred to in Section 4 of the Model CAA (which may include Status Messages) in accordance with the timelines set out in the Commentary to Section 4 of the Model CAA. In all other cases, jurisdictions should send corrected, amended or additional information received from a Reporting Financial Institution as soon as possible after it has been received.
The United Arab Emirates appears ready to respond to notifications and to provide corrected, amended or additional information in a timely manner and no such concerns were raised by the United Arab Emirates’ exchange partners and therefore with respect to the United Arab Emirates’ implementation of these requirements.
Based on these findings it was concluded that the United Arab Emirates appears to be meeting expectations in relation to responding to notifications from exchange partners and the sending of corrected, amended or additional information. The United Arab Emirates is encouraged to continue to ensure the ongoing effectiveness of its implementation.