Risk Governance

Source of funds is where a payment came from. Source of wealth is how a fortune was made, and a UAE bank, an FIU, HMRC and a buyer each ask it their own way. The families who answer calmly built the file years before anyone asked; it is an architecture of evidence, not a letter written under a freeze.

The UK-UAE-Ireland corridor is no longer three rulebooks. It is one system that enforces itself across borders, where a UAE tax position, an AML freeze and a UK or Irish exit are read from the same facts. A problem in one regime strands what another was timed around, and the skill is sequencing, not optimisation.

A UK resident must declare the income and gains from a Dubai property to HMRC. The UAE now shares account data under the Common Reporting Standard, so undeclared rent and gains are discoverable, and the Worldwide Disclosure Facility is the route to correct past years before an enquiry does it for you.

On 1 July 2026 the Supreme Court dismissed BlueCrest's appeal and narrowed the significant influence test in the LLP salaried member rules. Commercial importance, including running a large and profitable desk, is no longer enough to keep a member outside the rules, and the exposure is retroactive PAYE and NIC.

The trade licence is issued in days; the bank account is a separate underwriting decision that a large share of new companies fail. A flexi-desk with no registered tenancy, an undocumented source of funds, a vague activity, or an opaque ownership chain is what turns a Dubai account application into a rejection.

Abandoning or liquidating a distressed UAE company does not sever the tax liability. De-registration requires every return filed and every dirham of tax and penalty paid, the wind-up is itself a taxable event, and personal exposure can reach a director through tax evasion and company law.

The UK's Register of Overseas Entities can carry the wrong ownership analysis where a trust or nominee sits behind the registered shareholder. A routine annual update confirms the record for the period but does not correct historic errors, so a wrong original registration may need refiling rather than an update.

Companies House identity verification takes minutes for some directors and fails for others. The difference is often a non-UK passport or no UK credit history. This note explains why GOV.UK One Login fails, and when an Authorised Corporate Service Provider is the practical route to the personal code.

A UAE structure built between 2018 and 2022, an offshore company or nominee owners holding an operating LLC with no real presence, is no longer neutral. It is the single point of failure behind account freezes, transfer-pricing audits, residence challenges, and the loss of free zone status.

A frozen UAE corporate account is not one problem but three: a bank anti-money-laundering hold, a court precautionary attachment, and a Federal Tax Authority recovery measure. Each has a different cause and a different cure, and the freeze halts payroll under the stricter June 2026 Wage Protection System within days.

Since 1 September 2025, a large organisation is criminally liable under section 199 ECCTA 2023 where an associated person commits a fraud intended to benefit it. The only defence is reasonable fraud prevention procedures. For a UK-UAE-Ireland corridor group, the UK nexus reaches conduct abroad.

From 1 January 2026, UK reporting cryptoasset service providers must run due diligence on every user under the Cryptoasset Reporting Framework. The first report is due by 31 May 2027. For a family office holding crypto through trusts, FICs, or holding companies, the look-through to controlling persons is the exposure.

The UK Senior Accounting Officer regime under Schedule 46 Finance Act 2009 applies to UK-incorporated companies whose turnover exceeds £200 million or whose balance sheet exceeds £2 billion, aggregated across the UK 51% group. The duty is not a certificate. It is the architecture of tax accounting controls.

UK PS21/3 and EU DORA reframed operational resilience from a technology question into a board one. The test is not whether a firm has a continuity plan, but whether it can keep an important business service inside a defined impact tolerance. Both point at the same weak spot: the third parties the firm does not control.