Acquiring a business in the Middle East is rarely the same as acquiring one in London or New York. Different legal systems, different regulatory regimes, different commercial practices, and different ways that risk hides in places you would not expect to look.

If you are buying a company in the UAE, Saudi Arabia, Qatar, Bahrain, or any of the GCC states, the standard due diligence playbook needs adapting. The categories you investigate are similar. What you actually find, and what it means, can be very different.

This is a working checklist of the areas where buyer-side due diligence in the region tends to surface real problems. It is not exhaustive, and it does not replace getting local legal advice on a specific transaction. But it is a starting framework for the questions you should be asking before you sign.

Before you start: get the structure right

Before due diligence, you need to know what you are buying.

Are you buying shares, or assets? In the GCC, this is not just a tax question. Share acquisitions inherit all the historic liabilities of the target company. Asset acquisitions let you pick what you want and leave the rest, but they trigger different licensing, employment, and regulatory consequences.

Are you buying from local shareholders, foreign shareholders, or both? In some sectors, foreign ownership thresholds still apply. In others, restrictions have been removed but the existing shareholding structure may not have been updated.

Is the target onshore (mainland) or in a free zone? Free zone companies have their own rules and authorities. Some free zones make M&A easier; others are administratively heavy.

Get the deal structure right before due diligence starts. Otherwise you will be due-diligencing the wrong thing.

Corporate and ownership

The first thing to verify is what you think you are buying. In the GCC, corporate records are not always as clean as they appear.

Things to check:

• The current shareholding register and historical share transfers
• Whether all share transfers were properly approved by the relevant authority (DET in Dubai, Ministry of Commerce in Saudi Arabia, etc.) and whether the necessary fees were paid
• Whether the company’s articles of association are up to date and consistent with current shareholding
• Any side arrangements between shareholders (nominee structures, beneficial ownership arrangements, profit-share deals) that may not appear in the formal records
• Whether the company has been properly maintaining its commercial license and trade name registration

A common discovery: shareholder structures that worked under earlier foreign ownership rules but were never updated after the 2021 reforms. The shareholding on paper may not reflect the actual economic ownership. Untangling this before completion is much cheaper than untangling it after.

Regulatory and licensing

Every GCC business operates under one or more government licenses. The license is the company’s right to operate.

Things to check:

• All current licenses, permits, and approvals (commercial license, professional license, industry-specific licenses)
• Whether the licenses are current, fully paid, and not subject to conditions or restrictions
• Whether the actual activities of the business match the activities authorised by the license
• For regulated industries (financial services, healthcare, education, construction, media), whether all sector-specific approvals are in place
• Any pending license renewals, applications, or regulatory inquiries
• Whether the acquisition itself requires regulatory approval

The trap: a business that has drifted away from its licensed activities. A trading license that now covers a software development business is a regulatory violation waiting to surface. Buyers sometimes inherit this problem without realising it.

Commercial contracts

Material commercial contracts need to be reviewed for change-of-control provisions, termination rights, and continuing obligations.

Things to check:

• Top customer contracts (do they survive change of control? do they require consent for an acquisition?)
• Top supplier contracts (same questions)
• Distribution and agency agreements (UAE Commercial Agencies Law gives registered commercial agents significant protections that an acquisition cannot easily extinguish)
• Lease agreements for premises (transfer requirements, landlord consent)
• Bank financing and loan documents (change-of-control defaults, financial covenants)
• Any government contracts (often non-assignable)

In the UAE specifically, registered commercial agencies are a known trap. If the target distributes products through a registered commercial agent, terminating that agent post-acquisition can give rise to significant compensation claims under UAE Commercial Agencies Law. Investigate this before assuming you can restructure distribution.

Employment and workforce

GCC employment law is jurisdiction-specific and changes regularly. The workforce of an acquired business often comes with obligations that surprise foreign buyers.

Things to check:

• The total headcount, broken down by nationality, residency status, and role
• End-of-service benefit accruals (this is a significant liability in the UAE and elsewhere; the target’s balance sheet may not fully reflect it)
• Compliance with UAE Emiratisation rules (or Saudization in KSA, similar quotas in other GCC states)
• Visa and labour card status of foreign employees
• Outstanding employee disputes, labour court matters, or claims
• The terms of employment contracts for senior executives, particularly any retention bonuses, change-of-control payments, or non-compete provisions

In Saudi Arabia, Saudization (the Nitaqat system) is enforced through scores that affect what the business can do (visa issuance, contracts, government work). A target with a poor Saudization score may have constraints you did not account for.

In the UAE, the recent introduction of mandatory savings schemes, end-of-service benefit reforms, and broader changes to labour law mean that employment obligations are evolving. Make sure your diligence covers the current law, not just the law as it was three years ago.

Tax and VAT

GCC tax regimes have changed dramatically. UAE corporate tax (9%) only came into effect in 2023. Saudi Arabia has VAT, corporate income tax, and Zakat. Other states have their own regimes.

Things to check:

• Tax registration status and compliance for corporate tax, VAT, and any other applicable taxes
• All tax filings for the past several years (penalties for late or incorrect filing can be substantial)
• Open tax inquiries or audits
• Transfer pricing documentation if the target has cross-border related-party transactions
• Economic substance compliance (UAE companies engaged in certain activities must demonstrate real substance and file annual reports)
• Any tax exemptions or preferential treatments the target relies on, and whether those continue post-acquisition

The relatively new tax regimes mean that some targets do not yet have a long track record of compliance. Recent missteps that have not been audited yet can become problems after closing.

Real estate and assets

Asset registration in the GCC can be complex.

Things to check:

• All real estate the target owns or leases, with proper title documents
• Whether ownership is direct or through holding structures (e.g. real estate held through offshore companies)
• Any mortgages, security interests, or encumbrances on assets
• Vehicle ownership and registration
• Inventory and equipment, with proper title and insurance
• Intellectual property registrations (trademarks, patents, designs) in each relevant jurisdiction

In some GCC jurisdictions, foreign ownership of real estate is restricted to specific zones or requires special approval. A target’s real estate holdings may include assets that the buyer cannot legally hold post-acquisition under the same structure.

Intellectual property

Often under-diligenced in regional M&A because IP enforcement has historically been less of a concern than in other markets. This is changing.

Things to check:

• All registered IP in the target’s name (trademarks, patents, designs, copyrights)
• IP that is used in the business but not formally owned by the target (parent company IP, licensed-in IP, founder-owned IP)
• Domain names and online assets
• Software licenses, including compliance with license terms
• Any IP litigation or disputes
• Trade secret protection practices (employee NDAs, confidentiality agreements, access controls)

The risk: a target that has built its business on IP it does not actually own, or that is licensed from a related party under terms that will not survive change of control.

Litigation and disputes

Pending and threatened litigation is a standard diligence area, but in the GCC there are local specifics.

Things to check:

• All current litigation, arbitration, and regulatory proceedings
• Court records in each relevant jurisdiction (the target may have proceedings in multiple emirates or countries)
• Outstanding judgments or arbitral awards against the target
• Disputes that have not yet been formally filed but are being threatened or negotiated
• Director and officer liability exposure
• Insurance coverage for existing claims

A practical issue: in some GCC jurisdictions, court records are not centrally searchable. A thorough review may require local counsel to make direct inquiries with relevant courts.

Anti-bribery and corruption

For buyers from jurisdictions with extraterritorial anti-corruption laws (US FCPA, UK Bribery Act, EU Anti-Corruption rules), this is critical. Inheriting a target’s pre-acquisition corruption issues can create successor liability.

Things to check:

• Whether the target has interactions with government officials in its normal course of business (government contracts, licensing, customs, public procurement)
• Existing compliance policies and training
• Use of third-party agents, distributors, or consultants in dealings with government
• Gifts, hospitality, and entertainment practices
• Donations and charitable contributions
• Whether the target has previously been subject to any corruption-related inquiries

This is one area where it is worth investing in a specialised compliance diligence, particularly for targets in sectors with heavy government interaction.

Sanctions and trade compliance

Given the geopolitical environment, sanctions diligence is more important than it used to be.

Things to check:

• Whether the target, its key shareholders, or directors are subject to any sanctions in any jurisdiction
• Whether the target has done business with sanctioned counterparties or in sanctioned countries
• Compliance procedures for screening counterparties
• Use of correspondent banking and exposure to dollar-clearing requirements

A target with hidden exposure to sanctioned parties is a serious problem. This is increasingly an area where buyers want certainty.

Data and privacy

Several GCC jurisdictions have introduced or updated data protection laws (UAE PDPL, Saudi PDPL, DIFC Data Protection Law, ADGM Data Protection Regulations). Compliance is patchy.

Things to check:

• Data inventory: what personal data does the target collect, process, and store
• Compliance with applicable privacy laws
• Cross-border data transfer arrangements
• Cybersecurity practices and history of breaches
• Privacy notices, consent mechanisms, and data subject rights compliance

This area is still maturing in the region, and many targets have gaps. The question is whether the gaps are manageable or material.

How to structure the diligence process

For cross-border acquisitions in the Middle East, the most effective diligence is usually:

1. Initial scoping with target and seller counsel to understand the structure and identify obvious issues early
2. Coordinated diligence across local counsel in each relevant jurisdiction (not just the headquarters jurisdiction)
3. Site visits and management interviews to validate what the documents show
4. A diligence report that flags issues by materiality, not just lists everything found
5. Negotiation of warranties, indemnities, and escrow arrangements to allocate identified risks

A good diligence process surfaces risks early enough to either price them into the deal, negotiate protections, or walk away if the risks are not acceptable.

The bottom line

M&A in the Middle East rewards careful preparation. The same deal that looks straightforward at headline level often has structural or regulatory complications that only emerge through proper diligence. Local legal expertise is not optional; it is the difference between a clean acquisition and inherited problems.

The cost of doing diligence properly is a fraction of the cost of dealing with what you missed.

GLAS represents buyers and sellers in cross-border M&A across the Middle East, GCC, and Latin America. We work alongside our country partners to deliver multi-jurisdiction diligence and structuring on transactions of all sizes. If you are evaluating an acquisition in the region and want a legal view on the diligence approach, get in touch.

Contact Details:
Call: +1 (202) 669-7464
Email: info@glasvc.com