SME Credit Assessment in the UAE: A Complete Underwriting Guide for Banks

UAE banks assess an SME by triangulating four independent record sets — the trade licence and corporate register, Al Etihad Credit Bureau data, twelve months of bank statements, and FTA VAT 201 filings — because audited financial statements are only compulsory above AED 50 million of revenue. Each document corroborates the others. None is trusted alone.

Key facts

• Audited accounts are not the baseline they are in most markets. Ministerial Decision No. 84 of 2025 requires audited financial statements only from taxable persons with revenue exceeding "AED 50,000,000 (fifty million United Arab Emirates dirhams) during the relevant Tax Period," plus every Qualifying Free Zone Person regardless of revenue (UAE Ministry of Finance, *Ministerial Decision No. 84 of 2025 on Audited Financial Statements*). Below that line, an unaudited management pack is legitimate — and your file has to work anyway.
• The Central Bank tells you to build your own view. Under the Credit Risk Management Regulation C 3/2024, in force from 30 November 2024, "LFIs must limit their reliance on external credit assessment" and must develop "their own independent view of the Credit Risk" (CBUAE Rulebook, *Credit Risk Management Regulation*).
• SME credit demand is at a record. The CBUAE Credit Sentiment Survey for Q4 2025 found that "credit conditions for SMEs improved markedly, with the demand measure hitting its highest level since 2014," with the SME demand net balance at +29.1pp against +24.5pp for large firms — while "rejection rates were higher for SMEs than for large firms" (CBUAE, *Credit Sentiment Survey Q4 2025*).
• The segment is the economy. As of mid-2022 there were 557,000 SMEs in the UAE, contributing "as much as 63.5 per cent to the non-oil GDP" (The Official Portal of the UAE Government, *Small and Medium Enterprises*).
• YuSight delivers 3x faster decision turnaround on files exactly like the one worked below, by classifying the UAE document set — trade licence, MOA, AECB report, VAT 201s, bank statements — spreading it once, and generating a cited credit assessment memo from the same figures.

Why does the UAE credit file look different from any other market?

Because the document hierarchy is inverted. In India the CMA data pack and audited accounts sit at the top and everything else corroborates them. In the US the tax return is the anchor. In the UAE, the most reliable, most consistently available, hardest-to-falsify documents in an SME file are the trade licence, the AECB report, the bank statement and the VAT 201 — and the audited accounts, where they exist at all, are frequently the weakest link.

Four structural facts drive this:

1. There is no personal income tax and no individual tax return. The corroboration a US or Indian lender gets from a promoter's personal filings does not exist. Personal creditworthiness comes almost entirely from AECB.
2. Corporate tax arrived only for financial years beginning on or after 1 June 2023. There is no long historical run of tax-verified revenue to compare against.
3. The corporate register is emirate-level and free-zone-level, not federal. Dubai's Department of Economy and Tourism, Abu Dhabi's DED, each of the roughly four dozen free zones and the two financial free zones each maintain their own registry. The commonly quoted figure of "over 40 free zones" is not confirmed on a federal government page; u.ae lists free zones by emirate without a total.
4. One promoter usually holds several licences. Mainland trading entity, free-zone logistics entity, offshore holding vehicle. Consolidation is your job, not the borrower's, and it is the single most common source of understated group leverage. This is multi-entity document mapping in its purest form.

What entity is actually borrowing — mainland, free zone, offshore or DIFC/ADGM?

Establish this before you read a single number. The entity type governs where the borrower may trade, which court enforces your security, and what registry you can search.

The trading-restriction and premises rows above are drawn from general practice and zone-authority guidance, not from a single federal source. Confirm each against the specific zone's regulations before writing them into policy — treatment of mainland access, in particular, varies zone by zone and has changed repeatedly.

Two practical consequences for the credit committee paper:

• An offshore vehicle cannot generate operating cash flow. If the borrower of record is a RAK ICC or JAFZA Offshore company, your repayment source is dividends, rent or intra-group flows from operating entities you must also assess. Underwrite the operating entity or take its guarantee.
• A DIFC or ADGM borrower changes your recovery model, not your credit model. Common-law courts, English-language documentation and a public register are an advantage; the underlying business risk is unchanged.

The UAE Government portal lists the licence-verification portals for each emirate, including Dubai's eservices.dubaided.gov.ae and Abu Dhabi's TAMM tahaqaq service, alongside the Ministry of Economy and Tourism's National Economic Registry (u.ae, *Verify business licences*). Verifying a licence takes about ninety seconds and it catches the two problems no amount of spreading will: an expired licence and a name that does not match the account.

What does the trade licence tell you, and what does it not?

The trade licence is the UAE equivalent of an incorporation certificate, a registration number and a permitted-activity schedule in one page. Federally there are "six types of licences … industrial, commercial, professional, tourism, agricultural and crafts," while Abu Dhabi issues seven types and Dubai eight (u.ae, *Steps to start a business on the mainland*).

Read six fields, in this order:

1. Licence number and issuing authority. This is the key you will use to verify, and the key that ties documents to entities in a group file.
2. Issue date and first-issue date. The renewal date tells you the licence is live; the first issue date tells you the vintage of the business. A licence renewed for the eighth time is a very different risk from one first issued fourteen months ago.
3. Legal form. LLC, sole establishment, civil company or branch. A sole establishment has no separate legal personality from its owner — the personal guarantee is automatic and the AECB individual report is the primary credit document, not a supporting one.
4. Activity list. Mainland licences carry named, coded activities. A borrower asking for an import-finance line whose licence permits only "management consultancy" is either mis-selling the request or trading outside its licence. Both are findings.
5. Partners / shareholders as printed on the licence. Compare against the MOA. They diverge more often than you would expect, usually because a share transfer was executed and the licence not yet reissued.
6. Manager / general manager. The person the authority recognises as able to bind the company. Not always the person who signed your application.

What the licence does not tell you: turnover, employee count, premises size, whether the activity is actually being carried on, or whether a second licence exists elsewhere. Mainland licences are generally renewed annually; some emirates and free zones now offer multi-year licences. Confirm the renewal cycle for the specific authority rather than assuming twelve months.

How do you establish ownership and control — MOA, shareholding and UBO?

The Memorandum of Association is the binding document, and the law is explicit about its form: "The Memorandum of Association of a Company and each amendment thereto shall be made in Arabic and authenticated by the Competent Authority, otherwise, the Memorandum of Association or the amendment thereto shall be deemed null and void" (Article 14(1)) (Federal Decree-Law No. 32 of 2021 on Commercial Companies, published by the Ministry of Economy and Tourism).

Four things to extract and then reconcile:

• Share capital and paid-up capital. Often nominal and rarely a guide to net worth. Do not treat stated capital as equity.
• Shareholding percentages, matched line by line against the licence and against the shareholding disclosed in the audited or management accounts.
• Amendments. Every share transfer, capital change and manager change should exist as an authenticated addendum. Missing amendments mean the register you are relying on is stale.
• Ultimate beneficial owner. UAE companies must maintain registers of shareholders and beneficial owners under the federal UBO regime. The current instrument is widely reported as Cabinet Decision No. 109 of 2023, replacing Cabinet Decision No. 58 of 2020, with a beneficial owner generally defined as a natural person holding or controlling 25% or more. We could not confirm the decision number, the threshold or the filing deadlines on a federal government page; verify before writing them into an onboarding SOP.

The credit point behind the compliance point: in UAE SME lending, the UBO is usually also the guarantor, the source of shareholder funding, and the borrower on the other three licences in the group. Identify them once and the rest of the file organises itself.

Which identity and permission documents matter?

For every signatory, shareholder above your threshold, and personal guarantor:

The AECB is explicit that a company credit report requires the "Emirates ID of partner, shareholder, or manager from trade licence," an application number and a copy of the trade licence, presented at an Al Ansari Exchange branch (u.ae, *Credit report of individuals and companies*). If you cannot assemble those three things, you cannot pull the report — which makes the identity pack a prerequisite, not paperwork.

What do you get from AECB, and what do you have to get elsewhere?

Al Etihad Credit Bureau gives you five things: a credit score, an income utilisation ratio, "payment history — it is a record of your loan and bill payments for the last 36 months," a summary of credit contracts, and court obligations, collected "from banks, financial companies, telecom and utility providers, courts and government entities" (u.ae).

Pull both reports on every SME file — the company report on the licensed entity, and the individual report on each partner and guarantor. In UAE SME lending the personal file is often the better predictor, because the entity may be four years old while the promoter has fifteen years of UAE repayment history behind them. The three-digit number itself is a triage instrument, not a decision; see what the 300–900 bands actually mean before you set a cut-off, and read the facility-level instalment, cheque and default records before you rely on the summary.

What AECB will not give you: cash flow, trade credit from suppliers, guarantees given to other lenders' borrowers, or exposure sitting in the promoter's other licences. Those come from the bank statement, the MOA set and direct questioning.

Which financial records will actually exist?

This is where UAE underwriting diverges hardest from the textbook. Work down this list and stop at the first level the borrower can actually supply.

Company law requires an audit — Article 27(1) of the Commercial Companies Law states that "Every Joint Stock Company or Limited Liability Company shall have one or more auditors to audit the accounts of the Company on a yearly basis," and Article 26(2) requires accounting registers to be kept "for a period of at least (5) five years." In practice, enforcement below the corporate tax threshold is uneven and a large share of the SME segment arrives with Level 2 or worse. Say so in the memo rather than pretending Level 1 exists.

How do bank statements, VAT returns and WPS data substitute for audited accounts?

By building the same P&L from three directions and seeing whether they meet.

• Turnover comes from VAT 201 declared supplies — Box 1 plus Box 4 plus Box 5, never Box 1 alone. The VAT 201 box-by-box read is the reference; the reconciliation to bank credits is where the argument gets settled.
• Collections and cash discipline come from the bank statement: credit turnover net of transfers, cheque returns, overdraft excesses, month-end balance behaviour. The technique is the same as any bank statement analysis, but with two UAE-specific reads — post-dated cheque presentation clusters, and salary debits on the WPS cycle.
• Wage cost and headcount come from the WPS file. Ministerial Resolution No. 340 of 2026, effective 1 June 2026, requires employers to pay wages "on the first day of each Gregorian month" for the preceding month, with an establishment treated as compliant when it transfers "at least 85% of the total wages due to workers by the due date," up from 80% (Morgan Lewis, *UAE Introduces New Wage Protection System Resolution Effective 1 June 2026*). For an underwriter, a WPS file that slips from the first of the month to the eighteenth over two quarters is a liquidity signal that predates every other one in the file.
• Debt comes from AECB plus the bank statement plus direct enquiry. Instalments hitting the account that do not appear on the bureau are undisclosed borrowing — the classic bureau-versus-statement reconciliation.

What does the CBUAE actually require of your process?

Enough that "we looked at the score and the statements" will not survive a supervisory review. The Credit Risk Management Standards set out what an underwriting framework must cover: "credit approval, credit limits, due diligence and financial information from the Obligor, methodology for Credit Risk analysis, collateral and risk mitigation, credit file documentation, and legal documentation" (CBUAE Rulebook, *Credit Risk Management Standards*).

Four requirements to lift straight into your SME policy:

• Collect real financial information. "LFIs must collect comprehensive financial information and cash flow projections from their Obligors, contingent Obligors and guarantors," and must not reach decisions "mostly based on subjective information."
• Understand the whole obligation set. The due diligence process must capture "all financial obligations of their Obligors" — which in the UAE means every licence in the group, not just the applicant.
• Analyse the right metrics. The Standards name "leverage, debt service coverage ratio, liquidity, net worth and operating cash flows," and require assessment of the "ownership structure of the Obligor."
• Document the file. "The credit files must be well documented and include all information necessary to ascertain the current financial condition of the Obligor," including "current financial statements, financial analyses and internal rating documentation" plus forward-looking projections.

Separately, on the retail and personal-guarantee side, licensed institutions must "verify information with the Credit Information Agency," must "perform a new check with the Al Etihad Credit Bureau for an updated credit history," and must "verify the Consumer's income against reliable sources and must not rely solely on the Consumer's self-declaration of income" (CBUAE Rulebook, *Article 7: Responsible Financing Practice*, N 1158/2021). The 50% debt burden ratio ceiling — "50 percent of gross salary and any regular income from a defined and specific source at any time" — sits in Article 3 of the mortgage regulations and binds the guarantor's personal capacity even when the borrower is a company.

For sizing, the CBUAE's own SME definition is worth adopting rather than inventing one: in the trading sector, a medium enterprise is "51 – 200 employees; or < AED 250 million annual revenues," a small enterprise "6 – 50 employees; or < AED 50 million annual revenues," and a micro enterprise "< 5 employees; or < AED 3 million annual revenues" (CBUAE Rulebook, *Small to Medium Sized Enterprises (SME) — Market Conduct Regulation*).

Worked assessment: Gulf Meridian Trading LLC, Dubai

Step 1 — establish the turnover you believe

Management-to-VAT variance: (68,400,000 − 66,900,000) ÷ 68,400,000 = 2.2%, explained by AED 1.5m of designated-zone sales outside the scope of VAT. Accept. VAT-to-banking variance: (66,900,000 − 63,200,000) ÷ 66,900,000 = 5.5%, explained by AED 3.7m of December receivables collected in January. Accept. Turnover adopted: AED 68,400,000.

Step 2 — earnings and debt service

Annual debt service on existing term loan: principal 1,200,000 + interest 1,180,000 = 2,380,000

• EBITDA DSCR = 4,088,000 ÷ 2,380,000 = 1.72x
• Cash DSCR = (4,088,000 − 172,170 tax − 250,000 unfunded capex) ÷ 2,380,000 = 3,665,830 ÷ 2,380,000 = 1.54x

The two numbers differ by 0.18x and a credit committee will argue about which one the covenant tests. Fix the definition in the term sheet, not afterwards — this is exactly the DSCR definitional dispute that costs banks money at the first test date.

Step 3 — size the working capital gap

Margin at 25% from the borrower's own sources: 15,400,000 × 0.25 = 3,850,000 Permissible bank finance: 15,400,000 − 3,850,000 = AED 11,550,000

The 25% margin is a policy convention, not a CBUAE requirement. Use your own approved margin table.

Step 4 — leverage on the true group

The undisclosed JAFZA entity carries a AED 2,400,000 equipment loan guaranteed by the borrower. It belongs in the numerator.

• Debt / TNW = 17,550,000 ÷ 9,500,000 = 1.85x
• Debt / EBITDA = 17,550,000 ÷ 4,088,000 = 4.29x

Drop the guaranteed AED 2.4m and those become 1.59x and 3.71x. The single act of finding the second licence moved leverage by 0.58x of EBITDA. That is the whole argument for entity triangulation in one line.

Step 5 — bureau overlay

Partner A: AECB individual score 742, no adverse records. Partner B: score 631, one returned cheque fourteen months ago on a personal facility, since regularised. Company AECB report: three active facilities, all current; one closed auto loan settled early.

The AED 2.4m equipment loan appears on the company report of the FZ-LLC, not the borrower's — which is why you pull reports on every licence in the group, not just the applicant's.

Step 6 — recommendation

Approve AED 11,500,000 against the requested 12,000,000, sized to the calculated gap. Conditions: cross-guarantee from Meridian Logistics FZ-LLC; personal guarantees from both shareholders; DSCR covenant at 1.35x tested on the cash definition; quarterly VAT 201 submission; assignment of receivables. Decline the extra AED 500,000 — not because the borrower is weak, but because the gap does not support it, and a limit that exceeds the gap funds something you have not assessed.

How do you structure security and guarantees in the UAE?

Six instruments do most of the work, and each has a UAE-specific catch.

1. Personal guarantee from the UBO. Near-universal in SME lending. Its value depends on the guarantor's personal AECB file and the 50% DBR headroom, not on their stated net worth.
2. Corporate cross-guarantees from every operating licence in the group. Without these your group leverage analysis is decoration.
3. Assignment of receivables, registered on the Emirates Movable Collateral Registry. Registration mechanics and priority rules under Federal Decree-Law No. 4 of 2020 on Securing Interests in Movable Property could not be confirmed at a federal source page for this draft.
4. Mortgage over property, registered with the relevant land department. Slow, strong, emirate-specific.
5. Security cheques. Still standard practice — and their legal character changed materially in 2022, which is covered in the AECB facility-data guide. Do not treat an undated security cheque as a substitute for a registered security interest.
6. Cash margin / lien on deposits. Fastest to enforce, and the only one that does not depend on a court.

How long should a UAE SME file take?

The honest benchmark, from application to credit committee, is two to four weeks in most UAE banks, and the delay is almost never analysis. It is document chase: a missing MOA amendment, an AECB report that needs an original Emirates ID at a branch counter, VAT returns spread across two accountants, statements from a second bank the borrower forgot to mention.

Three things compress it without weakening it:

• Front-load the entity map. Ask for every licence held by every shareholder at application, not at query stage.
• Fix the definitions before spreading. EBITDA, debt, tangible net worth, DSCR. Agree them once, apply them to every file, and the 24 ratios that drive the decision stop being renegotiated per borrower.
• Stop re-keying. Every figure typed twice is a figure argued about twice.

Frequently asked questions

How do UAE banks assess SME creditworthiness?

They triangulate. The trade licence and MOA establish who is borrowing, AECB establishes repayment behaviour for the company and its owners, VAT 201 returns establish declared turnover, and twelve months of bank statements establish whether the cash is actually there. No single document is trusted on its own, because in the UAE audited accounts often do not exist.

What documents does a UAE SME loan file need?

At minimum: valid trade licence, Memorandum of Association with all amendments, Emirates ID and passport with visa page for every shareholder and signatory, board or partner resolution to borrow, twelve months of bank statements from every bank, eight quarters of VAT 201 returns, the last available financial statements, the WPS payroll file, and AECB reports on the company and on each guarantor.

How long does SME credit approval take in the UAE?

Two to four weeks from application to committee is typical. Most of that is waiting for documents, not analysing them. Banks that ask for the full entity map at application rather than after the first review consistently land at the shorter end.

Do UAE SMEs need audited financial statements to borrow?

Not by law, in most cases. Audited statements are mandatory for corporate tax purposes only above AED 50 million of revenue, plus for Qualifying Free Zone Persons. Below that, expect management accounts and build your view from VAT returns, bank statements and WPS data instead.

Does it matter whether the borrower is a mainland or free zone company?

Yes, in three ways. It determines where the company may legally trade, which registry you can search, and which court hears an enforcement action. It does not change the credit analysis itself, but it changes what your security is worth and how quickly you can act on it.

Can a UAE bank lend to an offshore company?

It can, but an offshore vehicle such as a RAK ICC or JAFZA Offshore company does not trade and generates no operating cash flow. The repayment source is elsewhere in the group, so underwrite the operating entities and take their guarantees rather than relying on the holding company's balance sheet.

What is WPS data worth to a credit analyst?

It gives you verified headcount and verified wage cost, monthly, from a government system. More usefully, it gives you timing: an employer whose salary transfers drift later month after month is showing liquidity stress well before it shows up in the accounts or the bureau.

How do you handle a UAE borrower with several trade licences?

Get all of them, pull an AECB report on each, and consolidate. Cross-guarantees between operating entities are standard and should be a condition, not a nice-to-have. The undisclosed sister-company facility is the most common single reason a UAE SME file understates group leverage.

Is the AECB score enough to decide an SME application?

No. It is a triage instrument. It contains no revenue, no margin, no cash flow and no view of the borrower's other licences, and the Central Bank explicitly tells institutions to limit reliance on external credit assessment and form their own view. Use it to sort, then read the file.

What does the CBUAE require in an SME credit file?

Under the Credit Risk Management Standards, comprehensive financial information and cash flow projections from the borrower and its guarantors, capture of all the borrower's financial obligations, analysis of leverage, DSCR, liquidity, net worth and operating cash flows, assessment of the ownership structure, and a documented credit file with current financial statements, analyses and internal rating documentation.

Key takeaways

1. Establish the entity before you read the numbers. Mainland, free zone, offshore or DIFC/ADGM changes what you can verify, where you enforce, and whether operating cash flow exists at all.
2. Assume audited accounts may not exist. Below AED 50 million of revenue they are not compulsory. Build turnover from VAT 201s, cash from bank statements, wage cost from WPS, and say in the memo which level of evidence each number came from.
3. Find every licence. In the worked file above, one undisclosed free-zone entity moved Debt/EBITDA from 3.71x to 4.29x. Group leverage understated by half a turn is the standard UAE SME failure mode.
4. Size to the gap, not to the request. AED 11.55 million of calculated working capital gap supports AED 11.5 million of limit. The extra AED 500,000 funds something you did not assess.
5. Write the definitions down. DSCR on EBITDA or on cash, debt with or without guaranteed group obligations. Decide once, apply always.

YuSight sits alongside your LOS and does the mechanical half of this. It classifies the UAE document set — trade licence, MOA, Emirates ID, AECB company and individual reports, VAT 201s, multi-bank statements — maps each document to the right entity in a multi-licence group, spreads the financials with every figure traced back to its source document and page, and drafts a fully cited Credit Assessment Memo with borrower overview, financial analysis, risk factors and recommendation. Analysts edit rather than re-key, which is where the 3x faster decision turnaround comes from. The 47-item memo checklist is a good way to test whether your current output would survive the same review.

See your first CAM in 30 minutes — book a live demo.