Choosing a PRO Partner: A Due-Diligence Checklist

A provider may describe itself as fast, experienced and trusted. You cannot check any of those words. You can check its licence, and you can make it put the rest in writing.

That is the whole method. Separate what a register can confirm from what only the provider can tell you, then refuse to accept the second category verbally.

If you are still deciding what PRO work actually covers, start with the map of transactions and authorities. This article assumes you have decided to outsource and are now choosing who to trust with your company's files.

Why this decision deserves a checklist

Once you outsource, a provider can end up holding three things that are hard to take back: your company's portal access, your employees' personal documents, and your deadlines. So look hardest at the handover, the record-keeping and the tracking of renewals.

The checklist below has six parts. Parts one and two can be verified against official sources. Parts three to six are commitments you ask for in writing. None of them requires you to take a provider's word for anything.

Part one: confirm the provider is a licensed business

Look the licence up yourself. Do not rely on a PDF the provider sends you.

For a Dubai mainland company, the Invest in Dubai licence search lets anyone search by "License Number, Dubai Unified License (DUL) Number, English Business Name, or Arabic Business Name". Dubai Economy and Tourism's e-services help page describes the same enquiry: type the licence number or business name, complete the verification characters, and search.

For other emirates, the UAE Government Portal keeps a list of licence and trade name enquiry tools by emirate. It links Abu Dhabi's enquiry service on TAMM and a federal option, the National Economic Register, which it describes as a service where businesses "can view online their business licence details" and "get instant information about existing companies and business activities in the UAE".

When you find the record, check three things against the provider's own paperwork:

1. The legal name matches the name on the proposal and the invoice.
2. The licence is current on the day you look.
3. The activities listed on the licence plausibly cover what you are buying.

On the third point, be careful about what you conclude. We did not find an official page naming a single licensed activity that a PRO or government transaction provider must hold, on the Invest in Dubai activity search, the UAE Government Portal and the authority pages reviewed on 18 September 2026. So do not reject a provider because its activity is worded differently from a competitor's. Ask it, in writing, which licensed activity covers the services in the proposal. If it cannot answer, that is your finding.

A free zone provider holds a licence from its free zone authority rather than from Dubai Economy and Tourism. Ask for it, and check it with that authority, on its public register where it publishes one.

Part two: understand which channels the provider actually uses

Government transactions reach the authorities through defined channels, and some of those channels are restricted. Asking a provider how it submits is a practical test of whether it understands the process.

A few published facts are useful here.

• MOHRE services can be used by the establishment itself. On its establishment card page MOHRE states that the service "is provided free of charge through MOHRE website and App" and that "Business centers charge a maximum commission of AED72". A provider using a service centre should be able to show you which part of a charge is the government fee and which is a centre commission.
• ICP states, on its establishment card service, that "the application for the initial approval and the establishment card issuance be submitted exclusively through the authorized service providers". A provider that handles your immigration file should be able to name the channel it uses for that step.
• GDRFA Dubai separates its smart portal logins into "Individuals" and "Establishment / Typing Center".
• The Ministry of Foreign Affairs answers the question "Can someone attest my documents on my behalf?" with "Anyone can attest documents on your behalf." Attestation does not require a special agent, which matters when you compare quotations. The full attestation chain is set out separately.

None of this tells you a provider is good. It tells you whether the provider can explain its own route, and whether it is charging for something you could do directly.

Part three: passports and original documents

Ask about custody of passports and original documents directly.

Two published statements set the frame. The UAE Government Portal states: "The confiscation of workers' passports is prohibited and workers do not require their employer's permission to leave the country." Federal Decree-Law No. 33 of 2021, Article 13, lists among the employer's obligations to "Not withhold the official documents of the Worker".

Those obligations sit with the employer. Treat a provider's handling of your employees' documents as if it were your own. That is why custody belongs in the contract, not in a conversation.

Ask for a written custody procedure that answers these questions:

• Which transactions, if any, need an original document rather than a scan?
• Who inside the provider receives originals, and how is receipt recorded?
• How long does the provider hold a document, and what is the return trigger?
• How is return recorded, and does the employee sign for it?
• What happens to originals held on the day the contract ends?

A provider that answers "we never hold originals longer than needed" has not answered. The question is how that is recorded.

Part four: personal data

The files a provider handles for you can include personal data. MOHRE's work permit service, for example, lists a passport copy and the job offer signed by the employer and the employee among its documents.

The UAE's general data protection law is Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, in force from 2 January 2022 according to the UAE Legislation portal. Its Article 2 applies it to processing by "Each Controller or Processor residing in the State". The same article excludes several categories from its scope, including "Companies and establishments located in free zones in the Country and have special legislations regarding Personal Data protection".

Which regime applies to a given provider is a legal question, and it depends on several factors in Article 2, including where each party is established. That is exactly why you should ask rather than assume. Request:

• the provider's written data handling policy;
• where your documents are stored, and in which systems;
• who inside the provider can see them;
• how long copies are kept after a transaction closes;
• how copies are deleted or returned when the contract ends.

If data protection is material to your business, have your own adviser review the answers. This article does not assess any provider's compliance with the law.

Part five: fees, separated

A quotation for government work can combine amounts that belong to different people. Ask to see them apart.

The UAE Government Portal states that visa charges "are stated on each service card on the websites of ICP and GDRFA-D". So a provider that bundles a single "visa package" price is combining a published number with its own. Ask to see the split.

This article publishes no RINJAZ fee. Ask any provider, us included, to set its fee out in writing, separate from the government lines.

If you are weighing a per-transaction arrangement against a monthly one, the retainer article sets out what a scope of work should contain.

Part six: escalation, access and hand-back

These are the clauses you will only read when something goes wrong, so read them now.

Escalation. Who do you call when a file is stuck, and within what time does that person respond? A named person and a written response window are commitments. "Our team is always available" is not.

Portal access and credentials. Many government portals are accessed with UAE PASS, which is a personal digital identity. The UAE PASS Terms of Use state that the account holder is "solely responsible for the security of your username, password, registration information, and PIN and for any use of your UAE PASS account". Ask how the provider accesses your portals without anyone sharing a personal login. The UAE PASS access guide covers how to structure this.

Hand-back. When the relationship ends, what do you receive? At minimum, a list of open transactions with their status, every original document returned against signature, and every login or authorisation the provider held on your behalf removed or transferred. Put a hand-back period in the contract.

References. Ask for two clients of a similar size and sector, and ask them one question: how did the provider handle a transaction that went wrong?

Practical asset: the vendor-screening sheet. Score each provider from 0 to 2 on each line. 0 means no answer, 1 means a verbal answer, 2 means a written answer or an official record you checked yourself. (1) Licence found on an official register, name matches. (2) Licence current on the day checked. (3) Licensed activity covering the proposed services, confirmed in writing. (4) Submission channel named for each transaction type. (5) Written custody procedure for originals. (6) Written data handling policy. (7) Fee schedule separating government, third-party and service lines. (8) Named escalation contact and response window. (9) Portal access method that does not rely on shared personal logins. (10) Written hand-back terms. (11) Two references contacted. Compare totals, but read the zeros first. A single 0 on lines 1, 2, 5 or 9 is worth more attention than a high total.

Three answers that should make you pause

These are our editorial red flags, not findings about any named firm.

• A claim of personal connections inside an authority. A provider prepares, submits and follows up. The authority decides. A claimed connection is either untrue or a reason for concern.
• A promise about the outcome. No private provider can decide, or promise, an outcome that belongs to an authority.
• A request for your UAE PASS PIN. See part six.

What this checklist does not do

It does not tell you which provider to choose, and it does not rank anyone. It turns claims you cannot check into commitments you can enforce. If the answers are good, the decision is yours. If you are still deciding whether to outsource at all, the in-house versus outsourced comparison is the better place to start.

Information verified against official sources on 18 September 2026.

Screen RINJAZ against this checklist. Ask us for the same items this checklist asks of every provider: trade licence details you can check on the official register yourself, a data handling policy, a custody procedure for original documents, and references. Ask us to answer each line of the screening sheet in writing, and score our answers the same way you score anyone else's. RINJAZ is a privately licensed UAE service provider. It is not a government entity and does not act for any authority.

One boundary applies to every provider on your shortlist, us included. A PRO provider's role, within whatever its licensed activity covers, is to prepare files, submit them through the correct channel, coordinate the steps and track progress. The relevant authority, whether MOHRE, ICP, GDRFA, the Ministry of Foreign Affairs or a licensing department, makes every decision on every application, and no provider can promise the outcome.