RAK ICC Record Keeping : What to Keep, and for How Long

What are the record keeping rules for RAK ICC companies and registered agents?

RAK ICC record keeping sits on two legal layers that operate together. The first is the federal anti-money-laundering framework — Federal Decree-Law No. 20 of 2018 on AML/CFT and its Implementing Regulation, Cabinet Decision No. 10 of 2019 — which imposes a five-year retention obligation on financial institutions and DNFBPs. The second is Regulations 101–107 of the RAK ICC Business Companies Regulations 2018, which set out what a RAK ICC company itself must keep and where.

RAK ICC Registered Agents and DNFBPs are obliged to maintain detailed records, documents, data and statistics for every type of financial transaction, alongside the records tied to their AML/CFT risk assessment and mitigation measures. The standard is not simply "keep something" — supervised institutions must hold the records in an organised fashion that permits data analysis and the tracking of financial transactions, and must make them available to the Competent Authorities immediately upon request.

That "immediately upon request" standard is what separates a compliant archive from a box of paper. A regulator or law-enforcement request does not come with weeks of notice, so records that cannot be located and produced quickly fail the test even if they technically exist somewhere. This is why record keeping is a live control inside every UAE anti-money-laundering compliance programme, not a filing task to catch up on at year end.

For a RAK ICC company, the obligation is unavoidable because so much of the structure runs through the registered agent. The agent holds the records, carries the access duty, and answers to both RAK ICC and the federal authorities — which means an owner who neglects their paperwork is not only exposing their own company but complicating their agent’s compliance position at the same time.

What counts as a “company record” under the RAK ICC regulations?

A company record is broadly defined. Under the framework it means any register, index, record, accounting records, agreement, memorandum, Articles, minutes, annual validations or any other document that the Law requires the agent to keep. The definition is deliberately wide so that nothing material to understanding the company falls outside it.

Regulations 101–107 of the RAK ICC Business Companies Regulations 2018 then give the working list of what must be held. It is expressed as a floor, not a ceiling — the documents to be kept "include but are not limited to" the items below.

Notice how the list runs from the constitutional (Memorandum and Articles, register of directors) through the governance layer (notices, minutes and resolutions) to the financial and transactional layer. A complete record set spans all three — keeping only the incorporation documents while neglecting minutes and invoices leaves the company non-compliant, because the governance and financial layers are exactly what a regulator uses to reconstruct what the company actually did.

The register of directors and the resolutions layer connect directly to the company’s wider obligations. The same underlying facts feed the beneficial-ownership record and any change filings, which is why a single, well-maintained document set is far more efficient than reconstructing information separately each time an authority, a bank or an auditor asks.

Which records must you keep for five years?

The federal AML framework requires DNFBPs and Corporate Service Providers to retain records for a period of five years across six defined subject areas. This is the retention backbone that applies regardless of the RAK ICC-specific document list, and it maps onto the whole customer lifecycle from onboarding to exit.

Two of these categories are quietly demanding. Ongoing monitoring is not a document you file once; it is a continuous record that has to show the relationship was watched throughout its life, so the evidence accumulates year on year rather than being captured at a single point. Reliance on third parties for CDD catches out firms that outsource onboarding checks — if another party performed the due diligence, you must still be able to produce that party’s records on request, which means securing them contractually up front rather than assuming the third party will hold them for you.

Suspicious Transaction Reports deserve particular care. An STR and the reasoning behind it must be retained for the full period, and because filing an STR is itself a sensitive act, the record needs to be held securely and separately, accessible to the right people and no one else.

What are “records and underlying documentation”?

Records and underlying documentation are the accounts and records — invoices, contracts and similar documents — that evidence the company’s financial life. The RAK ICC Business Companies Regulations 2018 define this by reference to three areas the documentation must cover, and together they amount to a full account of the money and the assets moving through the company.

This is, in substance, a bookkeeping obligation dressed in regulatory language. To evidence money in and out, sales and purchases, and assets and liabilities, you need the same ledgers, invoices, contracts and bank records that any properly kept set of accounts produces. A company that maintains proper accounting records throughout the year satisfies most of this obligation as a by-product; a company that does not is left trying to reconstruct years of activity from fragments.

The phrase "and the matters in respect of which the receipt and expenditure takes place" is the part owners underestimate. It is not enough to show that AED 200,000 came in and AED 150,000 went out — the documentation must explain why. A payment without a contract or invoice behind it, or a receipt with no explanation of what it was for, is an incomplete record even though the number itself is captured. The narrative behind each figure is part of the requirement.

Where must RAK ICC company records be kept?

The default location is the office of the registered agent. A RAK ICC company is obliged to keep and make available all relevant documents — as prescribed by Regulations 101–107 — at its registered agent’s office, so that the agent can meet its own access and production duties without chasing the client.

Records can be held somewhere else, but only on a specific condition. The directors may determine another place for the records provided the company gives an undertaking that the registered agent will, at any time it requests, have access to and be provided with the company’s records and underlying documentation without delay. In other words, moving the records off-site does not move the responsibility — the agent must still be able to reach them instantly.

The practical trap here is the offshore owner who keeps everything on a laptop in another country and assumes that is sufficient. It is not, unless the undertaking is in place and the records can genuinely be produced to the agent without delay. Cloud storage the agent can be granted access to, or a clear protocol for immediate delivery, is what turns an off-site arrangement into a compliant one — not merely the fact that the documents exist somewhere.

Because the registered agent carries this access duty, agents are entitled to ask for records at any time, and a responsive owner keeps the relationship simple. An agent who cannot obtain a company’s records is an agent whose own compliance is compromised, and that is precisely the situation that leads agents to query, restrict, or ultimately step away from a client.

How long must records be retained, and does dissolution end the obligation?

Records must be kept for at least five years from the date of their creation — and, crucially, the retention period continues to apply even once the company has been struck off or dissolved. Winding up the company does not wind up the obligation to preserve its records.

This is the point most owners get wrong, and it is the one with the sharpest consequences. There is a natural assumption that closing a company draws a line under everything, including its paperwork. It does not. The records of a dissolved RAK ICC company must still be retained through the balance of their five-year windows, because an authority may need to examine the affairs of a company that no longer exists — and "the company was dissolved" is not an answer to a lawful request for its records.

Worked example. A RAK ICC company is struck off on 30 June 2026. Its oldest live invoices date from 2023; its final contracts and bank records were created in the first half of 2026. Even though the company no longer exists, the 2023 documents must be retained until 2028, and the 2026 documents until 2031 — each on its own five-year clock. Whoever managed the company at closure is responsible for ensuring those records remain available for the whole period. A clean liquidation that also settles record custody is straightforward; a closure that simply deletes the files leaves an obligation breached for years, discoverable the moment anyone asks.

This is why record custody belongs on the closure checklist alongside settling tax and obtaining a liquidation audit report. The point at which a company is wound up is exactly the point at which its records are most likely to be lost — and most likely to be needed.

What form must RAK ICC company records take?

Form follows function. The records and underlying documentation must be in a form that is sufficient to show and explain the company’s transactions, and that will, at any time, enable the financial position of the company to be determined with reasonable accuracy. Those two tests — explain the transactions, and reveal the financial position at any moment — are the yardstick against which a record set is judged.

"At any time" is the demanding phrase. It means the records cannot be a shoebox that gets reconciled once a year into accounts; they must be maintainable in a state where the company’s position can be worked out whenever it is asked for. In practice, that points firmly towards contemporaneous bookkeeping — recording transactions as they happen — rather than a year-end scramble, because only current records can answer an out-of-cycle request accurately.

The two columns are the same company at two levels of discipline. The difference is not how much money the business makes — it is whether the records can show and explain the transactions and reveal the financial position on demand. Building the left-hand column is largely a matter of maintaining ongoing bookkeeping and a simple retrieval system, and it is far cheaper than the alternative.

How do AML record-keeping and tax record-keeping differ?

They are separate obligations that overlap in practice. The AML framework and the RAK ICC Business Companies Regulations set the five-year retention discussed above. Separately, a RAK ICC company that is within scope of UAE corporate tax or VAT carries its own record-keeping duties under the FTA’s tax rules — and those retention periods are not identical to the AML period, so you plan to the longest requirement that applies to each document.

Please verify the tax figures. The AML and RAK ICC five-year positions are set by the instruments named above. The corporate tax and VAT retention periods are shown as commonly cited durations and should be confirmed against the current Federal Tax Authority rules before you rely on them — they are marked [VERIFY] for that reason. The safe operating principle regardless of the exact numbers is simple: keep each record for the longest retention period that any applicable regime imposes on it. A single document can be caught by AML, RAK ICC and tax rules at once, and the longest clock governs.

The good news is that one well-run set of accounting records serves all of these regimes simultaneously. The invoices, contracts, ledgers and bank records that satisfy the RAK ICC "records and underlying documentation" requirement are the same ones the FTA expects for corporate tax and VAT. Maintaining them once, properly, discharges most of the obligation across every framework rather than duplicating effort for each.

What happens if you fail to keep proper records?

There are consequences at both levels of the framework. Under the RAK ICC Business Companies Regulations 2018, a company that contravenes the record-keeping obligations commits a contravention of the Regulations and is liable to a fine not exceeding level 3. Under the federal AML framework, failing to maintain the required records is an AML control failure that exposes a DNFBP or Corporate Service Provider to administrative penalties in its own right.

The RAK ICC penalty is expressed as a "level 3" fine under the Regulations’ own scale; confirm the current dirham value of a level-3 fine with your registered agent, as the specific amount is set by RAK ICC and is not restated here [VERIFY]. The federal AML penalties for record-keeping failures escalate with the seriousness and repetition of the breach and sit alongside wider supervisory measures [VERIFY — confirm the current federal AML penalty schedule against the Ministry of Economy before relying on figures].

The consequence owners feel first, though, is rarely the fine. It is the registered agent. An agent who cannot obtain a company’s records — because they were never kept, or cannot be produced without delay — cannot meet its own obligations, and agents in that position query the relationship, restrict services, and ultimately resign. A RAK ICC company without a registered agent cannot operate and is exposed to being struck off. Poor record keeping therefore threatens the company’s existence long before any penalty is formally assessed.

How do you build a compliant record keeping system?

A compliant system is a matter of written policy plus disciplined execution. When formulating the relevant policies, procedures and controls, the framework points to a set of considerations that turn a vague duty into an operating routine — covering who is responsible, how records are handled, how they are secured, and how the system is tested.

1. Assign roles and responsibilities — define who owns the risk assessment, implementation, review and updating of record-keeping and data-protection policies, including business-contingency and escalation procedures.
2. Define the record lifecycle — set out logging, cataloguing and organisation, archiving, handling and transferring of records, and the controlled destruction of expired records once they clear their retention period.
3. Secure the data — apply physical and cyber security to protect both active and archived records from unauthorised access.
4. Test and assure — run appropriate audit and quality-assurance testing so the system is checked, not just assumed to work.
5. Enable immediate production — organise everything so records can be retrieved and provided to the agent or authorities without delay on request.

The destruction step is as important as the retention step. A good policy does not keep everything forever — it destroys records in a controlled way once they have genuinely cleared their retention period, with a log of what was destroyed and when. Uncontrolled deletion is the risk; controlled, documented disposal at the right time is good governance, and it keeps the archive manageable.

For most RAK ICC owners, the efficient route is to combine this with outsourced bookkeeping and record keeping so that the financial records are maintained contemporaneously and correctly from the outset, and to coordinate closely with the registered agent so the corporate records and the access undertaking are in order. Built once, the system runs quietly; retro-fitted after a request lands, it is a scramble.

Who is responsible — the company or the registered agent?

Both, in different ways. The company is obliged to keep and make available its records, and to give the access undertaking if it holds them anywhere other than the agent’s office. The registered agent carries the duty to hold, or be able to obtain, those records and to produce them to the authorities — which is why the agent is entitled to demand them from the company at any time.

This shared structure is the reason the two parties have to work together rather than assume the other is handling it. A common failure is the owner who believes the agent automatically holds a complete record set, and the agent who assumes the owner is keeping the underlying financial documents. The gap between those assumptions is where records go missing. The fix is an explicit understanding of who holds what, backed by the undertaking where records sit off-site.

In practice, the cleanest arrangement is for the constitutional and governance records to live with the registered agent, and for the financial records and underlying documentation to be maintained through a bookkeeping function that keeps them current and immediately retrievable. That way each party holds what it is best placed to hold, and neither is relying on an assumption about the other.

Key terms used in RAK ICC record keeping

Record-keeping compliance uses a precise vocabulary drawn from the AML framework and the RAK ICC Business Companies Regulations 2018. These are the terms that recur across policies and regulator requests.