RAK ICC Business Plan for Enhanced Due Diligence

What is a RAK ICC business plan and when is one requested?

A RAK ICC business plan is a document the Registry asks for through your registered agent when a company falls under a high-risk factor during Know Your Customer and due diligence checks. It is not part of standard incorporation. It sits inside the Enhanced Due Diligence pack — alongside source of wealth, source of funds, address proof, a valid UAE visa where one exists, and an EDD confirmation letter — and it is requested precisely because the Registry wants to understand what the company will actually do and where its money will come from. If you are being asked for one, the file has been risk-rated upward, and how you answer matters.

The context is regulatory, not commercial. In line with the UAE National Risk Assessment and the federal anti-money-laundering and counter-terrorist-financing framework, RAK ICC applies a risk-based approach to onboarding and to ongoing monitoring. At incorporation it collects passports, address evidence, local and home-country addresses, an Ultimate Beneficial Owner declaration and a sanctions questionnaire for every proposed director, senior manager and UBO — and where a corporate director is involved, the full corporate pack including certificate of incorporation, trade licence, current memorandum and articles, and a certificate of incumbency or good standing. Where that initial screen flags risk, the Registry contacts the agent for a better understanding of the client and the client's business, and asks the agent to perform Enhanced Due Diligence. The business plan is one of the outputs.

This matters for how you write it. A plan submitted to an investor argues why the business will succeed. A plan submitted under EDD has to demonstrate something narrower and harder: that the business is real, coherent, and consistent with everything else on file. Reviewers are testing whether the stated activity explains the stated money, whether the people named have the background to run it, and whether the numbers hang together. Fastlane prepares these as part of our UAE company incorporation and corporate structuring services, and the difference between a plan that clears in days and one that generates three rounds of follow-up is almost always internal consistency rather than length.

Which risk factors trigger a business plan request?

Risk factors vary case by case, but the common ones are associations with sanctions, a high-risk country, a high-risk activity, a Politically Exposed Person, and criminal activity or adverse media. The business plan is most often requested where the trigger is a high-risk country of residence or a high-risk business activity — because in both cases the Registry's question is fundamentally "what is this company going to do?"

RAK ICC does not publish its full risk criteria, and it should not be expected to. But the inputs are largely public. The EU list of high-risk third countries is a useful guide to jurisdiction risk. High-risk activities move over time and follow FATF and other applicable international standards — FATF's risk-based approach guidance for trust and company service providers goes into how activity type feeds a risk rating, and the UK guidance paper for corporate service providers covers the same ground in more detail. Where political exposure is involved, Section 4, Article 15 of Cabinet Decision No. 10 of 2019 requires additional measures, including establishing source of funds and continuous monitoring of the relationship.

Two points that catch people out. First, appearing on a screening list as a PEP does not automatically make someone a PEP for these purposes — the Registry may come back to the agent for clarification, and false positives are common. Second, adverse media does not automatically mean high risk either, particularly where the allegation is not from a credible source. The Registry may ask the agent to verify the allegation, obtain a police clearance letter, or supply an updated report or copies of court judgment documents in criminal matters.

What must a RAK ICC business plan contain?

RAK ICC publishes a suggested template with four sections: Executive Summary, Execution, Company Overview, and Financials — the last split into financial results and funding. The template is described as an exhaustive list of possible contents, which means not every sub-point will apply to every company, but the four-section skeleton is what a reviewer expects to see. Submit it on the company's letterhead.

Length is not the point. A focused eight-to-twelve-page plan that answers all four sections directly will clear faster than a forty-page document with an impressive design and vague financials. What the Registry and your registered agent need is enough substance to write a defensible risk assessment — and that means specificity: named markets, named suppliers, real qualifications, and numbers with stated assumptions behind them.

How do you write the Executive Summary section?

The Executive Summary must answer five questions: what the business opportunity is, what your solution to that opportunity is, who your target market is, who your competitors or the current alternatives are, and what you believe your company's advantages are. Write it last, keep it to one or two pages, and make it self-contained — a reviewer should be able to understand the business from this section alone.

The competitor question is the one people skip, and skipping it is a mistake. Naming competitors demonstrates that you understand the market you claim to be entering. A plan that says "there is no competition" reads as either unexamined or evasive, and both raise the risk rating rather than lower it. If you genuinely occupy a niche, say who the nearest alternatives are and why customers currently use them.

Match the activity description to your licensed activity. If the company is licensed for general trading but the summary describes a payments platform, you have created a discrepancy that has to be resolved before the file can close — and activity mismatches are among the fastest routes to a follow-up query. Where the business genuinely spans several activities, say so explicitly and explain the relationship between them rather than leaving the reviewer to reconcile it.

What goes in the Execution section?

Execution covers how the business will actually run: the plans for marketing and sales of the product or service, the locations and facilities from which the company will operate, manufacture or provide services, the technology, equipment and tools to be used, the business milestones the company expects to achieve, and the key business partners, suppliers and service providers. This is the substance section, and it is where a real business separates itself from a paper one.

Be concrete about location. An offshore company that will operate through a UAE mainland or free zone affiliate, a foreign parent, or a network of contractors should say so and name the arrangement. Vagueness here creates two problems: the reviewer cannot assess operational risk, and the description may sit awkwardly against the company's substance position for tax purposes. If the company relies on outsourced fulfilment or third-party logistics, name the providers or describe the category and the contractual basis.

Milestones should be dated and modest. "Sign first three distribution agreements by Q2 2027" is useful. "Become the regional market leader" is not. The point of milestones in an EDD context is to give the reviewer — and your agent at the next monitoring cycle — something checkable, so that a refreshed plan can be assessed against what you previously said you would do.

What does the Company Overview section need to prove?

Company Overview names the people and evidences their competence: the names and qualifications of the promoters, and the names, profiles and qualifications of the management team and of key staff. Under a risk-based approach, this is where the Registry tests whether the humans behind the structure plausibly belong to the business being described.

Qualifications means more than job titles. Include professional credentials, relevant sector experience with dates, and prior ventures where they support the story. If a promoter has fifteen years in commodity trading and the company will trade commodities, that alignment does real work in a risk assessment. If the promoter's background is entirely unrelated to the stated activity, explain the connection — an investor, a family business, an acquired operation — rather than leaving the gap open.

Keep the names in this section consistent with the rest of the file. The promoters and management named here should reconcile to the directors, senior managers and ultimate beneficial owners already declared in the KYC pack, the UBO declaration and the sanctions questionnaire. Where a person appears in the plan but not in the corporate documents — or controls the business in practice without appearing on the register — that is exactly the sort of discrepancy UAE AML and beneficial ownership compliance exists to surface, and it is far better addressed by you upfront than by the reviewer afterwards.

How do you build the financial projections for a RAK ICC business plan?

The Financials section requires expected revenue for the first year and the following two years, expected expenses over the same period, expected net profit or loss by year, and — critically — the key assumptions used to arrive at those numbers. The assumptions are not optional garnish. They are what allows a reviewer to judge whether the projections are reasonable rather than invented.

Build the numbers from drivers, not from a target. Start with a unit: clients, contracts, containers, licences, billable days. State how many you expect in year one, at what average value, and why. Then let revenue fall out of that. Expenses should be split into the categories that actually apply — personnel, agent and registry fees, professional fees, marketing, rent or facility costs, technology — so the reviewer can see the shape of the business rather than a single lump.

Underneath that table, the plan should state the assumptions plainly: six retainer clients in year one based on three existing relationships plus three in advanced discussion; average fee benchmarked against the promoter's current engagements; headcount rising from two to five over three years; no debt financing; no acquisition assumed. Five or six sentences of that kind do more for the file than another ten pages of narrative.

Two disciplines are worth applying. First, make the projection consistent with the capital you say you are injecting — a plan showing AED 1.2m of first-year revenue funded by AED 20,000 of capital and no borrowing needs an explanation of working capital. Second, keep the projection consistent with the accounting you will actually produce. Where the entity is within scope for UAE reporting, projections that bear no resemblance to the eventual financial statements are an unhelpful thing to have on file — our accounting and bookkeeping services exist partly to keep that gap closed.

How do you evidence funding and source of funds in the plan?

The Funding sub-section must state three things: the capital required, the source of that funding, and the planned usage of funds. This is the highest-scrutiny part of the whole document, because it is where the business plan connects directly to the anti-money-laundering question the EDD process exists to answer.

Be specific about origin. "Shareholder funds" tells a reviewer nothing. "AED 250,000 injected by the sole shareholder from the proceeds of the sale of a residential property in March 2026, supporting documentation attached" tells them everything and closes the question in one line. Where funding will come in stages, say when and on what trigger. Where a third party is funding the business — a parent company, an investor, a family member — name them, because an unnamed funder is a gap the file cannot close.

Planned usage should map to the expense lines in the projection. If you say AED 250,000 of capital is required and the expense table shows AED 780,000 of year-one costs against AED 1,200,000 of revenue, explain the timing — capital covers the first four months of operating costs until receivables begin, for example. Reviewers are not looking for perfection here; they are looking for a coherent explanation that does not contradict itself.

How does the business plan interact with source of wealth?

They answer different questions and must not contradict each other. Source of wealth describes how the individual accumulated their total wealth over time — employment, business ownership, investments, property sales, inheritance or gifts. Source of funds describes where the specific money entering this company came from. The business plan describes what the company will do with it. All three land in the same file, and a reviewer reads them together.

RAK ICC's guidance sets out three steps for establishing source of wealth: obtain information on net worth, obtain information on where that net worth came from, and verify the information on a risk-sensitive basis. Exact figures are not required at step one and are often impractical to obtain. At step three, the level of corroboration should reflect the client's risk profile — for high risk, copies of trust deeds, audited accounts, or reliable independent third-party information from a lawyer or accountant; for low risk, public information, open sources and official documents provided by the client.

Good practice, per the same guidance, is to document and challenge source-of-wealth information rather than accept it at face value, escalate through the Money Laundering Compliance Officer where approval is required, and follow up proactively on gaps for PEPs and other higher-risk clients. Poor practice is applying the same inadequate measures regardless of risk, over-relying on unverified information, or failing to distinguish source of funds from source of wealth in the first place. If you cannot articulate that distinction in your own submission, the file will not close cleanly.

Why do RAK ICC business plans get rejected or sent back?

Almost never because they are too short. Plans get sent back for internal contradiction, missing sections, unevidenced funding, or a mismatch between the plan and the rest of the compliance file. Each of those is avoidable at drafting stage and expensive to fix afterwards, because every round trip runs through your registered agent and adds weeks.

One further failure mode deserves its own mention: submitting a plan that is materially the same as one filed for a different company in the same group or by the same agent. Registries and agents see volume, and near-identical plans across unrelated entities are a pattern, not a coincidence. Write the plan for the company that is actually being reviewed.

Who signs the business plan and how is it submitted?

The plan is submitted on the company's letterhead and goes to RAK ICC through your registered agent — not directly. You cannot file it yourself, because all dealings with the Registrar pass through the licensed agent. In practice it is signed by a director or an authorised signatory, dated, and accompanied by whatever supporting documents the funding and source-of-wealth statements rely on.

1. Confirm exactly what has been asked for — the business plan often arrives bundled with a source-of-wealth request, an EDD confirmation letter, address proof and a sanctions questionnaire. Get the full list from your agent in writing before you start.
2. Reconcile the corporate file first — check that directors, senior managers and UBOs on record match the people you intend to name in the plan. Fix discrepancies before drafting, not after.
3. Draft the four sections — Executive Summary, Execution, Company Overview, Financials (results and funding), following the RAK ICC template structure and omitting sub-points that genuinely do not apply.
4. Build the three-year projection with stated assumptions — revenue, expenses and net profit or loss by year, driven from units and prices, with five or six sentences of assumptions underneath.
5. Assemble the funding evidence — name the capital, its origin and its planned usage, and attach the bank statements, sale agreements or professional confirmations that support it.
6. Submit through the registered agent and keep the record — put it on letterhead, sign and date it, and retain a copy with the supporting material so an independent reviewer could follow the reasoning later.

On that last point: the guidance is explicit that records should let an independent reviewer, internal or external, understand the source of wealth and how it was acquired from what was recorded. Document the questions asked and the answers given, and keep copies of everything supplied or independently obtained. That record is what protects you at the next monitoring cycle.

Does a RAK ICC business plan create UAE corporate tax exposure?

The plan does not create tax exposure — but it does document activity and profit expectations that sit alongside your tax position, and it is worth understanding that a RAK ICC company is not outside the UAE tax net. RAK ICC companies are UAE-incorporated persons and are assessed under Federal Decree-Law No. 47 of 2022 like any other. "Offshore" describes the registry, not a tax exemption.

Two practical consequences. First, if the company is within scope, corporate tax registration and filing obligations apply, and the administrative penalty regime under Cabinet Decision No. 75 of 2023 (as amended by Cabinet Decision No. 10 of 2024) applies to failures. If registration has not been completed, deal with it — UAE corporate tax registration is AED 199 and takes far less effort than the plan you are already writing. Our corporate tax filing service covers RAK ICC and other offshore entities alongside mainland and free zone companies.

Second, the substance narrative in your Execution section has downstream consequences. Where the company underpins a tax residency certificate application or a treaty position, the operational description you file under EDD should be consistent with the substance you later assert. Filing a plan that describes all operations as taking place abroad and then claiming UAE tax residence on the same entity is a contradiction you will have to explain. Think about both files at the same time.

One closing note on the wider obligation. As a Designated Non-Financial Business or Profession, a registered agent that becomes suspicious a company may be involved in money laundering, terrorist financing or other crimes must consider its reporting duty and file through the UAE Central Bank's goAML platform. That obligation sits behind every EDD request you receive — which is why a clear, consistent, well-evidenced business plan is not bureaucracy for its own sake. It is how a legitimate business demonstrates it is one.