Setting Up a Satellite Data or Ground-Segment Company in the UAE

The first piece of work is a plain description of what the company sells.

A satellite-data or geospatial analytics company buys or receives imagery and sells insight. The Agency's permit applies even without hardware: Federal Decree Law No. 46 of 2023 names receiving, storing, processing, distributing, archiving and disposing of space data as regulated, and lists remote sensing and Earth observation as space activities. For geospatial data the law also provides for coordination with the Federal Centre for Geographic Information. The commercial risks then sit in the data licence, the permitted customer uses and the resolution of what it handles.

A ground-segment company supplies software or runs managed services that talk to satellites: scheduling, downlink processing, telemetry. If it also operates a ground station, TDRA applies. Spectrum authorisation is needed for every earth station antenna that communicates with a satellite, whichever way it transmits, and TDRA's service page gives 25 days as the expected time. Satellite communication activities also need a no-objection certificate from the Agency first, with the final permit issued by the communications authority. Treat the antenna as a workstream of its own.

A mission-support or engineering consultancy sells hours and expertise to civil operators. The Agency has a one-working-day route for low-risk activities that lists consultations in the field of space. It asks for a precise activity description, a summary of technical capability and the commercial licence. The added check is that its clients' own authorisations are in order.

A component or payload supplier builds hardware for others. The space law lists the manufacture, assembly, testing, storage and trade of space technologies as a space activity, so the Agency permit applies. Article 21 also puts space activities under UAE import and export legislation, including dual-use goods. This is the business most likely to meet export-control and customs rules, because physical items cross borders and may have more than one use.

Write which of these you are, and which you are not. Many founders discover they are one business with the second one planned for year three.

A founder often assumes that one approval covers the lot. It does not. The UAE Space Agency looks at the activity: what is launched, operated, controlled or done with space data, by whom and for what purpose. TDRA looks at the signal and the equipment: for a ground station, a spectrum authorisation for each earth station antenna. The two meet on satellite communication activities, where the Agency gives a no-objection certificate and the communications regulator issues the final permit.

For a software-only company, do not ask whether the Agency has any interest, because the law already lists processing space data as regulated. Ask in writing which permit route fits the exact service. The Agency's one-working-day route covers a short list of low-risk activities, such as space consultancy and tracking services. The standard authorisation is listed at 5 working days and asks for an organisational structure, key personnel profiles, passports and UAE IDs of owners, proof of technical capability, a detailed activity description and the commercial licence. Keep the permit with your corporate records, because banks and customers may ask for it. The space company licensing guide covers the activity side in more depth.

Civil space technology often has defence relevance. Imaging resolution, encryption, precision timing and certain components can fall under export rules in the country of origin, in the UAE or both. Article 21 of the UAE space law places space activities under the country's import and export legislation, including dual-use goods, and lets government entities set further controls with the Agency by Cabinet resolution. For a UAE company that bears on what it may import and re-export, and who it may sell to.

The practical step is a restricted-customer and restricted-use policy that you can show a bank, a supplier or an investor. It does not need to be long. It should say who screens customers, how end-use is checked, and what happens when a customer cannot be cleared. A company that handles sensitive hardware should read the dual-use technology guide before signing its first supply contract.

Many founders in this field have a parent abroad that owns the intellectual property, the satellites or the research. The UAE company then offers sales, local engineering, data services or a regional operations centre. That can work if the intercompany contracts say who owns what, who is responsible for authorisations and who bears the risk of loss. A space permit is not freely transferable: under Article 5 of the space law an assignment needs the Agency's prior approval, so the UAE company should plan its own permit rather than assume it can take over the parent's.

Choose the entity once those roles are written, because the Agency's permit routes ask for the commercial licence among the documents. The licence comes before the permit application, not after. A company that mostly sells data to Gulf customers may suit a different base than one that needs lab space or a ground station. The comparison of mainland and free-zone setup sets out the practical differences, and the UAE Government's business portal is the starting point for how each is administered. For a team relocating to run the business, residence visas for the founding team come after the activity description is settled, not before.

How Velarozone works in this sector: the plan settles the Space Agency and TDRA position first, then picks the free zone once both answers are known.

A data company has to decide where imagery and customer information are processed and stored. Storing and archiving space data is itself a regulated activity under the space law, so who hosts the data is a regulatory fact as well as a commercial one. If the company will rely on a cloud provider, the contract should say who controls access and where the data physically sits. Founders who are choosing a hosting partner may find the cloud managed service provider guide useful as a comparison point, since a managed provider has its own obligations.

Security is part of the commercial case, and for a permit holder it is also a duty. Article 22 of the space law requires an operator to assess risks to its physical and electronic assets, keep a risk management plan with an emergency response mechanism and give the Agency a copy. Customers in energy, government and finance will ask for a security description and an incident-response plan before they sign, so one set of documents can serve both.