The portal logins are the company, and most founders never hold them

Ownership of a UAE company is a matter of record — the licence, the memorandum, the shareholder documents in the file. Control of it lives in about seven online accounts, and not one of those documents has an opinion about who is holding them. That gap is where the trouble starts. A founder can be the sole shareholder on every document in the file and still be unable to renew a licence, issue a work permit, cancel a visa or file a return without asking somebody else to sign in first.

This is not an exotic failure. It is the ordinary outcome of a formation done competently by a firm that never separated doing the work from owning the access. The licence arrives, the visas arrive, everyone is pleased, and the credentials stay in an inbox at the consultancy because that is where they were created. A year or two later the relationship sours, or the account manager leaves, or the firm stops answering, and the company finds that its name on the trade licence buys it nothing at the sign-in screen.

What follows is the set of accounts that constitute control of a UAE company: what each one governs, whose name it belongs in, what a consultant legitimately needs instead of your password, and what recovery looks like when it is already gone. How much of a Dubai formation runs through one digital window to begin with, and which of its steps still end at a person rather than a screen, is a separate question answered on Dubai's formation portals.

The three questions that decide who actually runs the company

Set passwords aside for a moment. A password is the weakest claim anyone has on an account, because it is the easiest thing to change. Ask these three questions of every account below instead.

Where does the one-time code land? Whoever holds the mobile number of record can complete a transaction whatever the password says.

Where does a password reset land? Whoever holds the email address of record can take the account back at any time, quietly, without asking you.

Who can add and remove other users? On a multi-user portal, the administrator can create access for people you have never met and remove yours.

Those three describe rungs rather than alternatives, because each claim on an account defeats every claim beneath it — which is why a handover of passwords settles so much less than it appears to.

The rung at the foot of it is the one this page keeps returning to: whoever holds the email address and the mobile number of record has no need of the claims above them, and whoever holds only a password does not hold the company. It is also the order to fix things in, from the bottom upward, because repairing a rung while somebody else still holds the one below it repairs nothing.

Answer those three for each account and you have an accurate map of who controls the company. Everything else — who typed the application, whose office the file sits in, whose name is on the invoice — tells you nothing.

1. UAE PASS is a person, and it is the only account here that can never be handed over

UAE PASS is the national digital identity. It is issued to an individual against a valid Emirates ID and an active UAE mobile number, it signs that individual in to federal and local government services, and it produces a digital signature carrying that individual's name.

It is not a company asset and there is no legitimate version of transferring it. If a consultant holds a UAE PASS that authenticates as you, every signature it produces is attributed to you, and you will not know what has been signed until something arrives that you did not agree to. The correct arrangement is that you hold your own, each shareholder and manager holds their own, and delegation happens through the mechanisms further down this page — a written authority, a named sub-user, an appointment the authority itself records — never through a shared identity.

The practical consequence is worth stating plainly: if your UAE PASS was set up during formation on a phone number you do not control, that is the first thing to fix, before the licence renews.

2. The licensing account can change who owns the company, not merely renew it

Mainland companies in Dubai are administered through the Department of Economy and Tourism's channels, where the licence holder views and amends business data, renews the licence and manages the activities behind it. Sign-in runs through UAE PASS. Free zone companies have the equivalent under a different name — the DMCC Member Portal, the DIFC Client Portal, ADGM's online filing portal, and a member portal in every other zone — through which the zone acts as incorporating authority, landlord and immigration sponsor at once.

This is the account that matters most, because the transactions behind it are not clerical. A licence renewal, an activity amendment, a change of manager, a change in the ownership record and, in most zones, the application to cancel the company all run through it. Somebody holding this account holds the ability to alter the company's constitutional facts.

It should sit in the company's name, with the founder or a director as the account holder and the company's own email address of record. Where a zone supports named sub-users, a consultant gets a sub-user with a scoped role. Where it does not, the consultant is given the credentials for a specific transaction and the password is changed afterwards — which sounds fussy and takes ninety seconds.

3. The establishment card is a document; the ICP and GDRFA accounts are the control

Two separate things get confused here constantly. The establishment card — sometimes still called the immigration card — is a record issued against your trade licence that carries your visa quota and parents every entry permit and residence issued under the company. It is a document. Having a copy of it does nothing.

The account is what issues, renews and amends it, and what processes every entry permit, status change and cancellation underneath it. Federally that is ICP's establishment channel; in Dubai it is GDRFA's smart services, with the Amer network of accredited centres available to submit on your behalf. ICP is explicit that its services should be obtained only through its own official and authorised channels, which is a useful line to have in mind when somebody offers you a private shortcut.

The exposure here is not abstract. A person holding this account can issue a visa under your company, and can cancel one. If a departing employee's residence is cancelled by a firm you no longer instruct, the consequences land on the employee and the liability lands on you. Our visa services page covers the permit categories themselves; this page is only about who holds the key to them.

4. MOHRE says the signature card belongs to the owner, and it means it

Your MOHRE establishment record holds your establishment number, your classification tier, your quota, and the owners and authorised signatories the ministry has on file, with specimen signatures against each. Everything you do as an employer — offer letters, contracts, work permits, cancellations, the salary file — runs through it or through the Tas'heel network on its behalf.

MOHRE also issues an electronic signature card, and its own guidance is unusually direct about who may use one: the card is for the business owners and for the persons the ministry has authorised to sign on their behalf. That is a rule about identity, not about convenience. Where an establishment has no representative of its own, the ministry's answer is that it applies for a card through an accredited service centre — not that it lends its card to a third party.

The transferable point is that MOHRE already provides the legitimate mechanism. If a firm handles your labour file, the person doing it should be recorded with the ministry as your authorised signatory, which is auditable and revocable. A firm using the owner's card instead has chosen the arrangement that leaves no record.

5. EmaraTax separates the taxable person from the login, and only one of the two is yours by law

This is the account most often misunderstood, and the distinction is worth getting right.

EmaraTax has an online user profile, which is an email address and a password, and it has a taxable person, which is your company. One online user profile can have several taxable persons linked to it. That is how a tax firm ends up as the entry point for dozens of client companies at once: the firm's email address is the profile, and every client's company hangs off it. The tax record is still yours. The door is theirs.

The FTA supports both a proper answer and a repair. The proper answer is the Tax Agent: a person on the FTA's own record of Tax Agents, appointed by you, linked to your taxable person through a request you submit and the agent approves, and governed by Federal Decree-Law No. 28 of 2022 on Tax Procedures. An agent appointed that way represents you before the Authority on the record — and the obligations still belong to you, which is the point. A firm that holds your login instead of taking the appointment has skipped the record, and the reason is usually that it is not on it.

The repair is that the FTA publishes a procedure for linking an existing tax record to a different email address, and a function for managing the online users attached to a taxable person. Access is recoverable. It is easier to recover before a deadline than during one: a corporate tax return falls due within nine months of the end of the tax period, and that is not the week to discover your sign-in belongs to somebody who has stopped replying. VAT and corporate tax covers the filings themselves.

6. Dubai Trade hands one person the power to create users you have never met

If the company imports, exports or holds space in a Dubai free zone connected to the customs system, it will have a Dubai Trade profile and a Dubai Customs business code. Two properties of that account deserve attention.

First, at least one Authorised Signatory is recorded on the profile, along with the business details behind it. Second, the administrator — the authorised person on the account — can create additional users. Those users are indistinguishable from you to the system, and nothing tells you when one appears.

So the question for this account is not only who has the password but who is the administrator, and the honest answer at many small trading companies is that nobody has checked since the code was issued. Open it and look at the user list. It takes a minute and it is the single most revealing thing on this page.

7. The email address and mobile number of record outrank every password above them

Everything so far can be undone by this one. Nearly every account above recovers through an email address of record, and most confirm a change with a code sent to a phone. If both belong to the consultancy, the consultancy holds the company regardless of what you were told about credentials, and no handover of passwords changes that.

Use a company-controlled mailbox that survives one person leaving — a shared address on your own domain, not a founder's personal account and not a free mailbox created during formation. Put a phone in the hands of a director, not a runner. Then check, account by account, which address and which number each one is actually pointing at, because the answer is frequently not the one on the engagement letter.

Every account, and the one that cannot be delegated at all

Delegation that leaves a record, against delegation that leaves you exposed

The useful distinction is not between doing it yourself and using a firm. It is between an arrangement the authority can see and an arrangement it cannot.

Every arrangement in the left column is revocable in an afternoon and visible to the authority. Every arrangement in the right column is revocable only with the other party's cooperation, which is exactly the cooperation you will not have on the day you need it. Which positions a formation provider may still be holding a year after the licence issued, and the one that cannot be moved without them, is itemised on leaving your formation provider.

Recovery is usually possible, and it is rarely instant

The shape is the same everywhere: you prove the company is yours, you prove you are entitled to act for it, and the authority moves the account. What varies is the evidence and the counter.

• UAE PASS. Nothing to recover — it was never the company's. Create your own, then re-point every account that authenticates through it.
• Free zone member portal. The zone is the incorporating authority and can reissue access to a shareholder or manager on the file. This is the easiest one, and the zone will usually do it on a request from the person shown in its own records.
• DET channels. Access is tied to the licence record and to UAE PASS identity. Bring the licence, the ownership documents, and identification matching the record.
• ICP and GDRFA. Establishment accounts are recovered against the trade licence and establishment card, at the authority's own counters when the online route stalls.
• EmaraTax. The FTA publishes a route for linking an existing tax record to a different email address. Do this before a filing deadline, not during one.
• Dubai Trade. Recovery runs through the authorised signatory recorded on the profile, which is why it matters that the signatory is somebody at your company.

Two cautions. Change the email address and mobile of record first, or you will recover an account that the other party can take back the same day. And do not treat a promise of handover as a handover: sign in yourself, change the password yourself, and look at the user list.

Where holding every credential yourself is the wrong choice

The argument above has a limit, and a page that would not tell you where would not be worth reading.

Where the law puts an intermediary in the middle. Some structures cannot be filed directly. An offshore company held through a licensed corporate agent is administered by that agent by design, and demanding the filing credentials misunderstands the vehicle rather than protecting it. Certain customs and regulated activities are the same. The question there is whether the agent is licensed and replaceable, not whether you can log in.

Where there is nobody in the country to hold it. UAE PASS needs an Emirates ID and a live UAE mobile number. A founder who is not resident, has no Emirates ID and visits twice a year cannot hold the front door to the immigration file in any meaningful sense, and insisting on it produces an account nobody opens. Appoint a resident director or manager who can, and record the appointment properly.

Where one person holds everything and then is unreachable. A single founder with every credential on one phone is a worse arrangement than delegated, recorded access. Illness, a lost handset or a change of number stops the company. Two named holders on each account, and the email of record on a mailbox more than one person can open, is the fix.

Where you will not do the work. An account you hold and never sign in to is not control, it is a gap. Licence renewals, quota, the salary file and tax deadlines arrive whether or not anybody is watching, and nothing in these portals will chase you. If you are not going to run the calendar, hire somebody to run it with recorded access — that is a real purchase. Our PRO and government liaison page sets out which transactions are worth paying for and which are keystrokes you already have access to.

Where the credential is not the problem. If your difficulty is a refused application, a labour dispute or a bank onboarding that has stalled, holding the login changes nothing. That is advice, and it is a different purchase — see banking advisory for the case that comes up most.

What we hold, and what we will not

We ask for scoped access to do a job and we give it back. Where the work allows it we ask to be recorded with the authority itself — as a signatory, as a named sub-user, as whatever formal appointment that authority provides for — rather than asking you for a password. We do not use a client's UAE PASS, we do not sit as the administrator on a client's customs profile, and we do not put our own email address on a company that is not ours.

If we are already holding something on your behalf and you want it back, the answer is yes, at no charge, and we will sit with you while the password is changed. That is not generosity. An arrangement that depends on a client being unable to leave is not a business we would want to be running.

Frequently asked questions