Who Should Own Your WhatsApp Business Account in the UAE?

The company should own a WhatsApp Business account in the UAE, not an employee. In practice, that means the account sits inside your company's Meta business portfolio, at least two trusted people hold full control, and day-to-day agents get only the access they need. Do this and your shared team inbox keeps working when a sales rep, dispatcher or customer service agent leaves.

Meta's own pages do not mention the UAE. The UAE angle here comes from how local businesses work: a trade licence, a mainland or free zone entity, a team that changes often, and a customer base that expects to reach you on WhatsApp.

Who should own a WhatsApp Business account in the UAE?

The legal entity on your trade licence should own it, through a Meta business portfolio that the owner or general manager controls. Meta says that when you create a business portfolio you get full control, can add assets, and can add people from your organisation. Business assets can belong to only one portfolio.

Here is how the common choices compare.

The phone number matters too. Use a SIM registered to the company, not a personal number, and keep the SIM somewhere the owner can reach.

What do the Meta roles mean?

Meta uses a few access levels, and the labels are still changing. "Full control" was formerly called "admin", and some screens may say "full access". Treat them as the same top level.

Per Meta, only people with full control can add partners or share assets with them. Another person with full control may need to approve the action. That second approver is one reason to have two owners.

How do you set it up, step by step?

Follow these steps in order. Allow time for business verification, which Meta's secondary guides say can take days.

1. Create a role-based company email. Use something like whatsapp-admin@yourcompany.ae on your own domain. Do not use a staff member's personal address.
2. Create or find the business portfolio. Search your team's emails and ask who set up your Meta ads or Facebook page. Many companies already have one without knowing.
3. List the people. In Business settings, open the People list. Remove anyone who has left. Note who has full control.
4. Set two full-control people. The owner or GM, plus one trusted backup such as the finance or operations head. Turn on two-step verification for both.
5. Match the business details to your trade licence. Enter the legal name and address as they appear on the licence. Meta decides which documents it accepts, so check its verification page. Free zone companies (for example in DMCC, JAFZA or Dubai Silicon Oasis) should use the free zone licence details.
6. Move the WhatsApp account into the portfolio. The account should be an asset of the company portfolio. If it sits in someone else's portfolio, ask for a transfer or partner share before they leave.
7. Assign agents with the least access they need. Give each agent only the tasks they perform. Never share one login between agents.
8. Add a system user if software connects through the API. See the next section.
9. Write a one-page leaver step. Remove the person's portfolio access on their last day, before the exit paperwork is finished.

A note on the Inbox sync flow

If someone adds a WhatsApp account through the Inbox sync flow, Meta says the request needs approval from someone with full control. The requester then gets full control of that WhatsApp account. So read the request before you approve it. Sync covers the WhatsApp Business app, not the API, and brings in contacts and up to six months of individual chat history. Meta says it is only available in certain regions, and the UAE is not on the excluded list on that page. Check the page again before you rely on it.

When do you need a system user?

You need a system user when software, such as a shared inbox or order notification tool, connects to the WhatsApp Business Platform. A system user is not a person. It keeps working when staff change, because it is not tied to anyone's login.

Meta's get-started guide describes the path:

1. Go to Business settings, then System users, and choose Add.
2. Choose Assign assets and select the WhatsApp account.
3. Turn on "Manage WhatsApp Business accounts" under Full control.
4. Generate a permanent access token for the system user.

Meta's partner documentation names the token permissions whatsapp_business_management, whatsapp_business_messaging and whatsapp_business_manage_events. It also says an app with those permissions can have one admin system user and one employee system user, and that you should use the admin system user for production. Store the token in your company password manager, not in a chat or on someone's laptop.

What if your provider or agency owns the account today?

Ask them directly: "Which business portfolio holds our WhatsApp Business account, and who has full control of it?" Meta's documentation says a partner can work on a client's account when the client shares it with the partner's portfolio ID, so ownership can stay with you.

Some providers have also written to customers about moving off older set-ups in which the provider held the account. Check any notice from your provider and keep a copy. Moving an account between portfolios has rules, so confirm the current steps on Meta's help pages before you plan around it. If you are changing provider, ask for the handover plan before you cancel anything.

If you are looking at a shared inbox for WhatsApp, Instagram and Messenger, such as Quickship's Meta Messaging Module, apply the same rule: connect it to your company's portfolio, not to a person's profile.

What if the only full-control person has left?

First, check the People list. Meta's developer support page says any portfolio user with basic access or more can see who has full control, and that a business can submit a request to add a user with full control. The request may need proof that you are the business, such as your trade licence.

Do not create a new portfolio as a quick fix. The assets in the old portfolio stay there. Meta's help pages are the place to check current recovery steps, because screens and terms change.

Which checklist should logistics and e-commerce owners use?

Print this and tick it once a quarter.

• The WhatsApp account is in our company's portfolio, not a person's
• Two people hold full control, and both are current staff
• Both use company email and two-step verification
• The number is on a company-registered SIM
• Every agent has their own login and the least access needed
• A system user exists for any API connection, and its token is in a company vault
• Former staff and old agencies are removed from the People list
• Our provider has told us in writing who owns the account
• Our leaver step includes removing Meta access on the last day
• Only opted-in contacts receive WhatsApp broadcasts

A worked example

Say a Dubai e-commerce seller selling on Amazon.ae and noon has five agents. Orders, COD confirmations and delivery questions arrive on one number. The number was registered by an operations supervisor under a personal login. When they resign, the seller cannot add a new agent, because nobody else has full control.

If the seller had followed the steps above, the owner and finance head would both have full control. Removing the supervisor would take a minute. The agents would continue working.

Why does this matter under UAE data law?

Chat histories hold customer names, phone numbers, addresses and sometimes delivery details. That is personal data your company is responsible for. The UAE Government Portal lists the data protection laws, including the federal personal data protection law. Check it with your legal adviser for what applies to you.

For you, the practical point is simple. If chats live in a personal login, you cannot control who still has them. Keep them in a company portfolio, remove access when people leave, and message only contacts who opted in.

Common mistakes

• Letting an agency or freelancer create the portfolio in their own name
• Having one full-control person and no backup
• Using a personal email for the main login
• Forgetting to remove ex-staff, especially seasonal drivers' dispatchers and call-centre agents
• Sharing one login across a shift team
• Approving a sync or access request without reading who it gives full control to
• Mixing up "full control" and "full access" and assuming they differ