With the World Expo taking place in Dubai in October this year, 2020 is set to be an exciting year for the UAE. Much has been written about the UAE being an important gateway to other markets in the Middle East and Africa, given its status as a sophisticated financial, commercial and cultural hub in the region. A key incentive is the fact that currently, no income or corporate tax is payable in the UAE, although VAT at 5% has recently been introduced. Consequently, one of the most frequent questions we get asked by clients is: what are the key legal concerns when launching a company in the UAE and the wider GCC region?

1. To be incorporated, or not to be?

The chief concern we receive typically surrounds whether to establish a legal presence in the UAE, and if so, in what form. Investors have the option of setting up a presence either "onshore" or in one of the available "free zones" established throughout the UAE. The three legal forms used the most are:

  • Limited Liability Company (LLCs): LLCs may transact in onshore UAE, but may only conduct all activities included in its license in the respective emirate. LLCs may sue and be sued in their own name, with shareholders' liability limited to the capital they have invested in the LLC.
  • Branch: A branch is an extension of the foreign parent company (it does not have independent legal personality), and may only enter into contracts or conduct activities that the parent company is permitted to engage in pursuant to its constitutional documents.
  • Representative office: A representative office of a foreign company (like a branch) is not a separate legal entity, but is more limited than a branch in that it may only carry out marketing and promotional activities for the parent foreign company. It may not undertake any business or trade activity.

Given the restrictions on business activity facing branches or representative offices, the most popular approach is to establish an LLC. Importantly however, UAE law requires foreign investors to share ownership of the LLC with a UAE national (also referred to as a local partner), who must own 51% of the shares (with 49% retained by the investor). A new Foreign Direct Investment (FDI) Law now permits 100% foreign ownership of LLCs in certain sectors, however this incentive is not applicable in certain protected sectors, including exploration and production of petroleum products, transport services, banking and utilities services.

Whilst the shareholder ownership restrictions may initially sound troubling to investors wary of sharing control, parties typically enter into a suit of agreements which ultimately provide the investor with beneficial ownership and control of the affairs (and dividends) of the LLC. However a fixed fee (or profit share arrangement) is typically negotiated and paid to the local partner in exchange. Incorporating an LLC is essential for selling goods and services in onshore UAE, as compared to free zone companies, which generally cannot do so.

2. Which free zone?

If incorporating onshore is not necessary, investors may instead incorporate a free zone entity (FZE) where 100% foreign ownership is permitted. Key benefits of incorporating an FZE include:

  • No foreign exchange controls;
  • Zero tax rates on corporate income for up to 50 years (although the tax exemption may vary between different free zones);
  • No restriction on capital repatriation - FZEs may repatriate 100% of their capital and profits overseas;
  • No currency restrictions; and
  • No import or re-export duties (except for products entering the UAE or GCC).

The key limitation is that FZEs cannot transact or do business directly in onshore UAE (they may only transact within their free zone). To conduct business onshore, FZEs must appoint a UAE registered company to act as a distributor or otherwise set up a branch office in the respective Emirate.

However with 45 free zones available in the UAE (each with different laws and which cater to different industries, such as finance, technology and/or media), investors can face decision fatigue when choosing which free zone they wish to incorporate in. For this reason, it is crucial that legal advice be sought regarding which free zones provide the optimal fit for investors.

3. Mergers and acquisitions (M&A) in the UAE: A Silicon Valley in the desert?

We frequently field queries from clients on the M&A landscape in the UAE and the challenges in conducting acquisitions. The $580 million acquisition of Souq.com by Amazon in 2017 and the $3.1 billion acquisition of Careem by Uber in 2019 had a significant impact on the UAE corporate landscape, as it highlighted the latent potential behind the UAE's technology and start-up scene. The World Expo builds on this, with policy-makers highlighting disruptive technologies such as blockchain as focal interests.

A number of UAE free zones (such as the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM)) have invested heavily in supporting and growing technology-related business. The Dubai government has launched the Dubai Future Accelerator Programme for supporting young entrepreneurs and the DIFC continues to build on its successful FinTech accelerator programme which provides mentorship from leading financial institutions to entrepreneurs. These developments have had a positive effect in both spurring entrepreneurship and increasing M&A interest from venture capitalists and private equity firms seeking to diversify their portfolios. Both of these free zones also offer tech licences aimed at start-up companies, which allow low cost access to obtaining a trade licence with a limited number of work visas attached.

On M&A deals, due diligence is often a key issue for clients, because company searches are generally unavailable for companies registered in onshore UAE or many of its free zones. Only the relevant company can obtain a copy of the company's trade licence and commercial registration certificate. Further, articles or memoranda of association, financial information and other relevant information are not freely available and thus need to be acquired from the target. This can make it difficult for buyers to conduct an adequate assessment of the target.

Another practical consideration for would-be acquirers is the foreign ownership restrictions highlighted above - that foreign investors are restricted to owning only 49% of the shares in an onshore UAE LLC. To ensure a foreign investor can exercise a satisfactory level of control over the target company, investors often enter into nominee arrangements with the target company's local partners and shareholders so they hold their shares on behalf of investors. In this way, the investor acquires economic ownership of shares in the target company above the allowed registered shareholding threshold (in addition to the legally permitted 49% shareholding in the target's shares).

The M&A landscape is constantly subject to change given that new rules continue to be introduced in the UAE. With the new FDI Law and VAT rules as well as a number of new regulations on corporate governance, merger control, data protection, and employment coming into force, it is critical that investors seek legal advice before making deals in the region.

4. Intellectual Property (IP) - cause for copyright concern?

For many companies today, IP rights are the fundamental assets behind their product or service offering. However many clients are unaware of how IP creation and ownership is governed. There are five distinct intellectual property rights that are recognised in the UAE: (i) trade marks; (ii) copyright; (iii) patents; (iv) protection of industrial designs; and (v) confidential information.

As a civil law country, the general position is that a company should look to register its important IP rights where possible. With registered rights, enforcement is possible against infringers/counterfeiters. Whilst the IP protection regime is relatively expensive compared to other countries, it can be a false economy to not register your key rights where possible to do so, as it can be difficult to remove misappropriated rights.

Another key difference under UAE law can be the ownership of copyright. In particular, companies need to pay particular attention to the terms of their employment contracts to ensure that they (the employer) make it clear that any IP rights created during the employment of their employees are owned by the company. In the UAE, there is no automatic transfer of copyright from employee to employer following the creation of the 5th copyright work, therefore it is necessary to put in place a system for confirmatory assignments from employees. Businesses should ensure that employment contracts contain an assignment clause in order for the rights to transfer, but then put in place a system to identify and confirm the assignment of rights once created.

Companies which only rely on a general assignment clause within their employment contracts assigning all future works may therefore not be the owner of certain IP rights and should ensure confirmatory assignment agreements are entered into with relevant employees. In order to overcome the restriction on future assignments, UAE based companies should consider creating a system of confirmatory assignments with employees whether this may be at the end of the day or at the end of a project. There is less concern within the DIFC (and with hopes that other free zones will follow suit) with the enactment of a new IP law. The DIFC position now reflects UK law, with copyright works created by an employee in the course of employment automatically subsisting with the employer without the need for confirmatory assignment, provided the rights were created within the scope of the employee's employment. DIFC companies are still recommended to include the IP provisions in employment contracts.

This is but one small facet of the IP issues that companies operating in the UAE must consider. An in depth discussion with a legal advisor is strongly recommended for any brand or company seeking to ensure their IP rights are adequately protected in the UAE.

5. Data Protection

Following the onset of the General Data Protection Regulation (GDPR) which had wide reaching effects across businesses in the EU, the UAE is following suit by also implementing stringent data protection laws that protect individuals and their personal data. This is naturally presenting regulatory and operational challenges for businesses seeking to operate in the UAE.

There is no single legislative framework governing data protection in the UAE, the law is instead, spread across a number of federal laws, such as the UAE Constitution, the Penal Code, the Civil Code, and specific legislation relating to cybercrimes and electronic transactions. These laws together impose regulations on:

  • protection against the interception and disclosure of personal data and includes a prohibition on the publication of people's private or familial lives without the concerned individuals' consent;
  • the wrongful invasion of privacy rights;
  • the abuse and misuse of electronic information such as fraud, hacking and identity theft; and
  • the authenticity and reliability of electronic data as well as the security of electronic transactions.

The DIFC, Dubai Healthcare City and the Abu Dhabi Global Market Free Zones have their own laws specifically dealing with privacy and data protection. In June 2019, the DIFC issued a public consultation on its proposed new data protection law, set to replace the existing Data Protection Law. The proposed new law will be more closely aligned with the General Data Protection Regulation ("GDPR") and includes stricter consent requirements, greater emphasis on self-regulation, requires the appointment of Data Protection Officers and carrying out of data protection impact assessments where processor/controllers are engaging in "High Risk Processing Activities", and permits data transfers to jurisdictions that are not pre-approved where the relevant processor/controller deems 'adequate safeguards' to be in place.

In May 2019, Federal Law 2 of 2019 (the "Health Data Law") came into force to regulate the processing of data originating in the UAE relating to healthcare data and makes use of GDPR principles such as:

  • Accuracy - ensuring all data is accurate and reliable;
  • Purpose - health data must not be used except for the purpose of health services;
  • Consent - no disclosure to third parties without prior consent of the patient or data subject; and
  • Security - personal data must be kept safe from unauthorised damage using appropriate security measures.

Although the Health Data Law is aimed at health service providers, the law has wider ramifications for businesses in the UAE given that it applies to health data, which may also be processed and retained by companies (e.g.. Businesses that store individuals' information such as gender, sexuality or other information for marketing purposes). The Health Data Law currently prohibits transferring health data outside of the UAE unless authorised by the relevant health authority. Businesses using online cloud processors will need to take note and institute relevant safeguards.

One important point on which the Health Data Law departs from the GDPR is in relation to the data retention principle: health data in the UAE must be retained for as long as it is required and in any event not less than 25 years from the date on which the last procedure on the individual was conducted.

Sanctions for breaching the rules include fines ranging from AED 1,000 to AED 1,000,000 for the most serious breaches. Whilst these rules really only apply to healthcare service providers, we will likely see a more general data protection law being enacted with application across industries in the UAE. Similar data protection rules are already in effect in free zones such as the DIFC, which generally follow policies in the UK and the EU.

Concluding remarks

The UAE is an incredibly dynamic market which continues to spark interest and curiosity from investors worldwide. At Gowling WLG, we provide high quality legal advice to entrepreneurs, investors and major companies, many of which have pioneered disruptive technology and are seeking to scale their operations by tapping into the strong purchasing power and drive to build "smart societies" in the Middle East.

Please feel free to reach out to us if you are interested in having a conversation about your business and what we can do to help you grow in the Middle East.