How to Verify UAE Supplier Bank Accounts: IBAN and Licence
Verifying a supplier in the UAE is harder than in Europe, and for a specific structural reason. There is no national payee-name check to tell you the account belongs to the company you are paying, and there is no single company register to look the company up in. Instead there are 23-character IBANs that validate mathematically but confirm nothing about ownership, and more than forty separate licensing authorities, any one of which may be the only place your supplier's trade licence exists. This guide covers what you can actually verify, in what order, and where the gaps sit.
Sources: UAE Ministry of Economy, via the National Economic Register; UAE Financial Intelligence Unit strategic analysis.
The account layer, and its limits
The Central Bank of the UAE made IBANs mandatory for domestic and international transfers in 2011, and the IBAN is now the sole identifier for electronic interbank payments in the country. Every UAE IBAN is exactly 23 characters.
Validation is genuinely useful as a first pass. You can confirm the length is 23, run the MOD-97 check digit calculation defined in ISO 13616, and confirm the three-digit bank identifier corresponds to a licensed UAE bank. That catches transcription errors and obviously fabricated details.
One quirk causes a disproportionate number of failed payments. The account number field is always 16 digits and zero-padded on the left. Suppliers frequently supply their raw account number with the leading zeros stripped, producing a 21 or 22-character string that every validator rejects. It usually indicates carelessness rather than fraud, but it has to be corrected before the payment will settle.
The UAE has no equivalent of European Verification of Payee, UK Confirmation of Payee, or the Indian penny-drop check. There is no national service that will return a match, close match or no match before you send a payment. This is the single most important thing to understand about UAE supplier verification.
One qualification, because it is often misread as a safety net. Beneficiary name and IBAN are expected to correspond for a payment to process straight through, and a mismatch can cause a transfer to be delayed, repaired manually or returned. That is a settlement control operating inside the banking system after you have instructed the payment — not a lookup you can perform beforehand. It will not tell you that the account belongs to a fraudster rather than your supplier, because a fraudster's account and a fraudster's name match perfectly well.
Aani, the instant payment platform launched by Al Etihad Payments in October 2023, allows transfers using a mobile number, email address or QR alias rather than a full IBAN, and settles in seconds. It is a retail rail with per-transaction limits, not a corporate payment channel, and alias-based routing is not the same thing as a payee-name confirmation service. For B2B supplier payments the position is unchanged: you validate the IBAN structurally, and you establish who owns it by other means.
Because the account layer cannot answer the ownership question, the burden shifts to the company layer. In most of our country guides the company check is the part buyers skip. In the UAE it is the part that does the work.
The company layer: there is no single register
The most common mistake in UAE due diligence is assuming a national companies register exists. It does not, and understanding why saves a great deal of wasted searching.
Under Federal Decree-Law No. 32 of 2021 on Commercial Companies, every company must be entered in the Commercial Register maintained by its relevant licensing authority. Licensing is a local matter, devolved to each emirate. So the authoritative record of a UAE company sits with whichever body issued its trade licence.
There are a great many such bodies: an economic department in each of the seven emirates, more than forty free zone authorities, the two financial free zone registrars, and the offshore registries. The Ministry of Economy puts the total number of companies registered across them at more than 1.4 million.
| Type | Licensed by | What this means for you |
|---|---|---|
| Mainland | The emirate's economic department — DET in Dubai, ADDED in Abu Dhabi, SEDD in Sharjah, and equivalents in the other four emirates. | Search the economic department for that emirate. A Dubai licence will not appear in Abu Dhabi's records. |
| Commercial free zone | The free zone authority itself — DMCC, JAFZA, RAKEZ, DAFZA, IFZA, Meydan and many more. | Each maintains its own separate register. A DMCC company does not appear on the Dubai mainland register at all. |
| Financial free zone | DIFC Registrar of Companies, or ADGM Registration Authority. | Common-law jurisdictions with their own companies law and their own public registers. Constitutionally separate from the rest of the UAE. |
| Offshore | RAK ICC, JAFZA Offshore. | Registers are not publicly searchable. Expect to rely on documents the supplier provides. |
The practical consequence is simple and catches people out constantly: searching the wrong register returns nothing, and nothing looks exactly like a company that does not exist. A DIFC-incorporated entity is not on the Dubai mainland register. That is not a red flag. It is the wrong search.
The federal aggregation layer: the National Economic Register
There is one place to start, and most English-language guidance omits it. The Ministry of Economy operates the National Economic Register (NER), a federal aggregation layer that consolidates licensing data from the mainland economic departments and most free zones into a single public search.
The NER is a federation point, not a replacement. The underlying authorities remain the actual registrars, and the depth of what the NER displays varies by source. Use it to establish which authority licensed the company, then go to that authority for the detail — ownership, share capital, directors and the current licence status.
Start at the National Economic Register to identify the licensing authority. Then query that authority directly. Trying to guess between dozens of registers, or concluding a company is fake because it is absent from the one you happened to check, is the most common failure mode in UAE supplier verification.
Use the licence number, not the name
Company names are a poor identifier in the UAE. Arabic-to-English transliteration varies, names are frequently similar — trading companies built on common Arabic words are not unique — and trading names differ from registered names. The trade licence number, or the DIFC or ADGM registration number, is the stable identifier. Ask for it, and verify against it.
Note also that licence number formats differ by emirate and by free zone. There is no single national format to validate against, which is another reason a structural check on the number is worth little compared with querying the issuing authority.
What a trade licence check confirms
A current trade licence tells you the entity is legally registered and permitted to conduct the activities listed on it. Two fields matter most in a payment context. The expiry date — UAE trade licences are typically annual, and an expired licence means the company is not currently authorised to trade. And the listed activities — a supplier invoicing you for services well outside its licensed activities is worth a question, because it may indicate either an unlicensed operation or an invoice that does not correspond to real trade.
The one check that returns a name: the TRN
There is a single free, public UAE lookup that takes an identifier and returns the registered legal name behind it, and it is consistently underused by foreign buyers.
The Tax Registration Number is a 15-digit number issued by the Federal Tax Authority to VAT-registered entities, introduced with VAT on 1 January 2018. It always begins with 100 and contains no letters. Since corporate tax was introduced in June 2023, the TRN also functions as the corporate tax identity, making it the closest thing the UAE has to a unified tax identifier.
The FTA's TRN verification tool is free, requires no account, and — this is the part that matters — returns the legal name registered against the number. Compare that name to the entity on the invoice and to the trade licence. It is not payee-name matching against a bank account, but it is a name you can check against an independent, authoritative source, and in a market with no VoP that is worth having.
It also protects your own tax position. Only a validly registered person may charge VAT, so paying 5% VAT against an invalid TRN means the input tax cannot be recovered. That is a direct cost, separate from any fraud concern.
A trade licence number comes from the licensing authority and proves the company may trade. A TRN comes from the Federal Tax Authority and proves it is registered for tax. A DIFC or ADGM registration number comes from those registrars. They are not interchangeable, and a supplier supplying one when asked for another is worth a follow-up question rather than an assumption.
One caveat: not every legitimate supplier has a TRN. VAT registration is mandatory only above the AED 375,000 taxable turnover threshold, with voluntary registration available above AED 187,500. A small supplier below the threshold will have no TRN and should not be charging you VAT either. A supplier charging VAT without a valid TRN is the combination that should stop the invoice.
Ownership: what you can and cannot see
The UAE has a comprehensive beneficial ownership regime, and almost none of it is public.
Cabinet Decision No. 109 of 2023 on the Regulation of Real Beneficiary Procedures, in force since 16 November 2023, replaced the earlier Cabinet Decision No. 58 of 2020. It requires every legal entity licensed on the mainland or in a commercial free zone to identify its real beneficiary and maintain three registers: a register of real beneficial owners, a register of partners or shareholders, and a register of nominee directors where applicable. Those registers are filed with the entity's licensing authority, which acts as registrar.
The test runs in three tiers, applied in sequence: a natural person owning or controlling at least 25% of shares or voting rights, directly or indirectly; failing that, a person who controls the appointment or dismissal of the majority of directors; failing that, the senior management official responsible for day-to-day operations. Entities wholly owned by government are outside scope, as are the financial free zones — DIFC and ADGM run their own equivalent regimes.
Penalties for non-compliance sit under Cabinet Decision No. 132 of 2023, ranging from written warnings to fines of up to AED 100,000, with possible licence suspension.
UBO data filed with UAE licensing authorities is confidential. It is available to the Ministry of Economy, the Financial Intelligence Unit, competent regulators, courts and law enforcement — not to counterparties. You cannot look up the beneficial owner of a UAE supplier the way you can in some European registers.
Two routes remain. DIFC and ADGM operate public registers with searchable entity data and directors, and ADGM in particular has one of the cleanest interfaces of any registry in the region — so if your supplier is in a financial free zone, you can see considerably more. Otherwise, ownership in practice comes from what the supplier discloses, from documents you request directly, or from registry-sourced data assembled from company filings.
One historical wrinkle worth knowing
Foreign ownership of mainland companies was liberalised in most sectors from June 2021, under the amendments introduced by Federal Decree-Law No. 26 of 2020. Before that, mainland LLCs generally required a UAE national shareholder holding at least 51%. Legacy structures still exist, and a company incorporated before the reform may carry a historic local-sponsor arrangement that makes the declared shareholder picture look different from economic reality. It is not in itself a problem — but it is a reason not to read an old shareholding at face value.
What an IBAN check will not catch
Validating an AE IBAN confirms the string is well-formed and identifies the issuing bank. In a market with no payee-name check, that is a much smaller assurance than buyers assume.
It will not tell you that the trade licence expired four months ago, that the company is licensed for an activity unrelated to what it is invoicing you for, that it sits in a free zone whose register you have never checked, or that control changed hands since you onboarded it. Each of those can accompany a perfectly valid IBAN at a perfectly real bank. There are several company red flags a bank account match alone will not catch, and in the UAE the absence of a name-matching layer makes them more consequential, not less.
One integration, instead of one per registry
MonitorPay provides account verification and registry-sourced company intelligence across 49+ markets through a single API — payee name matching against the account holder, plus registered legal name, identifiers, status, directors, shareholders, beneficial ownership and group structure from over 200 government registries. For a market as fragmented as the UAE, that removes the work of identifying which of more than forty licensing authorities holds your supplier's record and querying each one separately. Available as bulk file checks, REST API or the online platform, with every check logged for audit and continuous monitoring on suppliers already onboarded. MonitorPay does not initiate or hold funds.
Why this matters in the UAE
The UAE is a trade and treasury hub, which means a large volume of first-time payments to counterparties the payer has never met — precisely the conditions invoice fraud is built for.
The country was on the FATF grey list from March 2022 until February 2024, exiting after a substantial reform programme that included the tightened UBO regime, a specialist financial-crime court, and the Executive Office to Combat Money Laundering and Terrorist Financing. The direction of travel is firmly towards transparency. But the reforms strengthened reporting to authorities, not visibility for counterparties, which is why a buyer's practical position has changed less than the headlines suggest.
The UAE Financial Intelligence Unit has reported fraud as a major predicate risk for money laundering, with estimated losses in the order of AED 1.2 billion between 2021 and 2023. Business email compromise features prominently — the case of Ramon Abbas, the influencer known as Hushpuppi, remains the best-known example of the technique operating out of the region.
A request to change an existing supplier's bank details is where most business payment fraud succeeds, and the UAE offers no automated safety net to catch it. With no payee-name check, an instruction to redirect payment to a new AE IBAN will validate perfectly and settle without objection. Treat every change request as a re-verification event: confirm it through a channel you already hold, and re-confirm the trade licence before the change is approved.
A practical verification workflow
For a new UAE supplier, or a change to an existing one, a defensible sequence looks like this:
- Validate the IBAN. Confirm 23 characters, run the MOD-97 check, and confirm the three-digit bank code belongs to a licensed UAE bank. Watch for stripped leading zeros in the 16-digit account field.
- Get the trade licence number. Not the trading name. Ask for a copy of the licence itself.
- Identify the licensing authority. Start at the National Economic Register to establish whether the company is mainland, commercial free zone, financial free zone or offshore.
- Verify with that authority. Query the issuing body directly — the emirate's economic department, the free zone authority, or the DIFC or ADGM register — and confirm the registered name, status and licence validity.
- Check the expiry date and activities. An expired licence means the company is not currently authorised to trade. Activities well outside the invoice scope warrant a question.
- Verify the TRN if VAT is charged. Check the 15-digit number on the FTA portal and compare the returned legal name with the invoice and the trade licence. Free, instant, and it protects your input tax recovery as well as flagging a mismatch.
- Establish ownership as far as you can. Public data for DIFC and ADGM entities; otherwise request the shareholder and UBO registers the company is legally required to maintain, and be alert to legacy local-sponsor structures.
- Confirm the account belongs to the company. With no national name-matching service, use a verification provider that performs payee matching, or confirm through your banking relationship.
- Monitor. Trade licences are typically annual, so licence status changes more often than a company register entry elsewhere. Re-verify on every bank-detail change request and monitor the supplier base rather than treating onboarding as one-time.
Bulk, API, or the online platform
Company verification and ownership data on UAE and international suppliers is available through whichever access method fits your team: bulk file checks for onboarding runs and supplier-base reviews, the REST API for verification inside your existing payment workflow, or the online platform for one-off checks with full audit logs.
Frequently asked questions
How do I verify a UAE supplier's bank account?
Start by validating the IBAN structurally: 23 characters, a valid MOD-97 check digit, and a three-digit bank code belonging to a licensed UAE bank. That confirms the account is well-formed and identifies the bank, but not who holds it.
Because the UAE has no national payee-name matching service, confirming that the account belongs to your supplier requires either a verification provider that performs payee matching or confirmation through your banking relationship. Pair it with a company check: get the trade licence number, identify the licensing authority through the National Economic Register, and verify with that authority directly.
What is the UAE IBAN format?
A UAE IBAN is exactly 23 characters: the country code AE, two check digits, a three-digit bank identifier assigned by the Central Bank, and a 16-digit account number. For example, AE07 0331 2345 6789 0123 456. IBANs have been mandatory for domestic and international transfers in the UAE since 2011.
The account number field is always 16 digits and zero-padded on the left. Suppliers often provide their raw account number with leading zeros removed, producing a string shorter than 23 characters that validators reject. This is a common cause of failed UAE payments.
Does the UAE have Verification of Payee or Confirmation of Payee?
No. There is no UAE equivalent of European Verification of Payee, UK Confirmation of Payee, or India's penny-drop check. No national service will tell you whether the name you are paying matches the account holder on a given AE IBAN.
Aani, the instant payment platform launched by Al Etihad Payments in October 2023, allows transfers using a mobile number, email or QR alias, but it is a retail rail with per-transaction limits and alias routing is not a payee-name confirmation service.
Beneficiary name and IBAN are expected to correspond for straight-through processing, and a mismatch can cause a transfer to be delayed, repaired or returned. That is a settlement control that operates after you instruct the payment, not a check you can run beforehand, and it does not help when the account and the name both belong to a fraudster. For B2B payments the ownership question has to be answered outside the payment rails.
How do I verify a UAE supplier's TRN?
Use the Federal Tax Authority's TRN verification tool. It is free, needs no account, and returns the legal name registered against the number. A UAE Tax Registration Number is always 15 digits and begins with 100 — anything with letters or a different length is invalid.
This is the only free public UAE check that takes an identifier and gives you back a name, which makes it unusually useful in a market with no payee-name matching service. Compare the returned name with the invoice and the trade licence. It also protects your input tax: VAT paid against an invalid TRN cannot be recovered.
My UAE supplier has no TRN. Is that a problem?
Not necessarily. VAT registration is only mandatory above the AED 375,000 taxable turnover threshold, with voluntary registration available above AED 187,500. A genuine small supplier below that threshold will have no TRN — and should not be charging you VAT.
The combination that should stop an invoice is a supplier charging 5% VAT while unable to provide a TRN that validates on the FTA portal. That points either to an unregistered business charging tax it cannot remit, or to an invoice that does not correspond to real trade.
Is there a single UAE company register?
No. Under Federal Decree-Law No. 32 of 2021, every company is entered in the Commercial Register maintained by its licensing authority — and licensing is devolved to each emirate. Mainland companies sit with the emirate's economic department, free zone companies with their free zone authority, and DIFC and ADGM entities with their own registrars. Counting the emirate departments, the free zone authorities and the financial free zone registrars, there are more than forty in total.
The Ministry of Economy's National Economic Register aggregates licensing data from the mainland departments and most free zones into one public search. Use it to identify which authority licensed a company, then query that authority for the detail.
How do I check a UAE trade licence?
Identify the issuing authority first, then check with it. For Dubai mainland that is the Department of Economy and Tourism; for Abu Dhabi, ADDED; for Sharjah, SEDD. Free zone companies must be checked with their own free zone authority — DMCC, JAFZA, RAKEZ, DAFZA and others each maintain separate registers. DIFC and ADGM operate their own public registers.
Search using the trade licence number rather than the company name, since Arabic transliteration varies and similar names are common. Check the expiry date — UAE licences are typically annual — and confirm the listed activities are consistent with what the supplier is invoicing you for.
My UAE supplier does not appear in the register I searched. Is that a red flag?
Usually not. It is far more often the wrong search. A DIFC-incorporated company will not appear on the Dubai mainland register, and a DMCC company will not appear there either. Each free zone is a separate registry, and absence from one says nothing about existence in another.
Establish the jurisdiction first through the National Economic Register or from the trade licence itself, then search the correct authority. Offshore entities such as RAK ICC and JAFZA Offshore are a genuine exception: their registers are not publicly searchable, so verification there relies on documents the supplier provides.
Can I look up the beneficial owner of a UAE company?
Generally no. Cabinet Decision No. 109 of 2023 requires every entity licensed on the mainland or in a commercial free zone to identify its real beneficiary and file registers of beneficial owners, shareholders and nominee directors with its licensing authority. But that data is confidential, available to the Ministry of Economy, the Financial Intelligence Unit, regulators, courts and law enforcement — not to counterparties.
The exceptions are DIFC and ADGM, which run their own regimes and publish searchable registers with entity and director data. Otherwise, ownership information comes from what the supplier discloses, documents you request, or registry-sourced data assembled from company filings.
What counts as a beneficial owner in the UAE?
Cabinet Decision No. 109 of 2023 applies a three-tier test in sequence. First, any natural person who owns or controls at least 25% of the company's shares or voting rights, directly or indirectly. If no one meets that test, any person who controls the appointment or dismissal of the majority of the board. If still no one qualifies, the senior management official responsible for day-to-day operations is recorded as the real beneficiary.
Entities wholly owned by government are out of scope, and the financial free zones DIFC and ADGM operate their own equivalent regimes. Non-compliance penalties under Cabinet Decision No. 132 of 2023 range from written warnings to fines of up to AED 100,000 and possible licence suspension.
Do UAE companies still need a 51% Emirati shareholder?
Not in most sectors. Foreign ownership of mainland companies was liberalised from June 2021 following amendments introduced by Federal Decree-Law No. 26 of 2020, and most mainland LLCs no longer require a UAE national shareholder holding a majority stake.
This matters for verification because legacy structures persist. A company incorporated before the reform may still carry a historic local-sponsor arrangement, which can make the declared shareholding look different from the economic reality. It is not a problem in itself, but an older shareholder record should not be read at face value.
Does a valid IBAN mean a UAE supplier is legitimate?
No, and in the UAE that gap is wider than in most markets. A valid AE IBAN confirms the string is correctly formed and identifies the issuing bank. With no national payee-name check, it does not confirm the account belongs to the company you intend to pay.
Nor does it say anything about the business: the trade licence may have expired, the company may be licensed for unrelated activities, or control may have changed since onboarding. Account validation and company verification answer different questions, and in a market without a name-matching layer the company check carries most of the weight.
