The United Arab Emirates Federal Tax Authority has imposed sweeping new supplier verification rules effective October 1, 2026, transforming VAT compliance from a transactional check into a continuous, risk-based audit process that directly impacts business cash flow and operational workflows.
Why This Matters
• October 1, 2026 deadline: All businesses claiming input VAT must now prove supplier legitimacy before every deduction — not just before the first transaction.
• AED 100,000 aggregate threshold: Even small, frequent purchases from one supplier trigger full compliance — you can’t avoid scrutiny by splitting invoices.
• Bank letter required: For suppliers with annual transactions exceeding AED 375,000, a bank confirmation of a UAE-based account is mandatory — no exceptions.
• Audit exposure: Failure to document due diligence can result in full denial of VAT claims, retroactive penalties, and fines — even if the supplier committed fraud.
The New VAT Reality: You’re Now the First Line of Defense
Gone are the days when a valid Tax Registration Number (TRN) and a clean invoice were enough. The FTA’s Decision No. 13 of 2026 doesn’t just tighten rules — it redefines responsibility. Under this regulation, every business in the UAE is now expected to act like a financial intelligence unit, scrutinizing its suppliers with the same rigor once reserved for high-risk clients in banking.
This shift stems from growing concerns over fraudulent VAT registration schemes, particularly involving shell companies and misrepresented individual landlords. The authority isn’t targeting large corporations; it’s hunting down systemic abuse at the grassroots level — where a sole trader renting office space or operating a micro-logistics service might be fronting for an offshore tax evasion ring.
Supplier Verification: Beyond the Trade License
The regulation makes a sharp distinction between individual and corporate suppliers — and both come with layered obligations.
For individual VAT-registered suppliers, such as an expat landlord receiving Dh500,000 annually in rent, businesses must now verify identity via in-person or virtual meeting and retain a copy of a valid Emirates ID or passport. While the regulation doesn’t mandate current validity of the ID, tax advisors are universally recommending that only unexpired documents be accepted. Why? Because a revoked or expired ID isn’t just a technicality — it’s a red flag the FTA will use to challenge your claim.
For licensed companies, it’s no longer enough to rely on a trade licence. You must obtain and store the official certificate of incorporation — a document that never expires and is the most reliable record of legal existence. But here’s where complexity explodes: you must also verify who is authorized to act on behalf of the company. A sales rep won’t suffice. The person signing the contract or receiving payment must hold legally valid authority — this could mean a notarized power of attorney, board resolution, or official shareholder list from the Department of Economic Development.
The Operational Shock: Physical Verification and Risk Scoring
No longer can you assume legitimacy based on location or reputation. The regulation requires confirmation of the supplier’s actual business premises. You must determine whether their claimed office or warehouse is real, active, and capable of supporting the goods or services you’re purchasing — whether that’s a delivery hub, a manufacturing unit, or a consulting office.
This might sound extreme, but consider the real-world scenario: a company claims to be a software provider from a luxury Dubai office tower. Yet your transaction records show payments routed to a personal bank account in Jordan, with no digital footprint, no online presence, and no credible clients. Under the new rules, you are obligated to investigate — or risk losing the entire VAT claim.
Three key risk indicators trigger an automatic documentation requirement:
• Address changes more than twice in 12 months
• Personnel turnover among key contacts more than twice in 12 months
• Sudden shifts in the nature or volume of supply, inconsistent with the supplier’s licensed activity
For each, you must record clear, rational justification — not just a note, but a dated, signed assessment. An audit isn’t asking for your opinion. It’s demanding evidence you exercised reasonable care.
The Bank Letter Mandate: A Hidden Rule Most Miss
One of the most overlooked obligations is the bank account verification for suppliers whose annual purchases with you total AED 375,000 or more. You must obtain a letter from their bank confirming the account exists and is held in the UAE. No template is provided — but it must contain:
• The supplier’s full legal name
• The account number (or account type, if sensitive)
• The bank’s official letterhead and stamp
• A signature from an authorized banking official
Crucially, the letter doesn’t need to be addressed to you — but it must be original, not forwarded from the supplier. This is a firewall against forged documents.
What This Means for UAE Businesses
This isn’t a compliance update — it’s a business process revolution.
Finance and Procurement teams must act now:
• Rethink onboarding: Every new supplier must undergo verification, regardless of size. A single Dh9,000 purchase from an unknown entity doesn’t trigger rules — but 12 such purchases over a year do.
• Digitize your audit trail: Use secure document storage portals. Physical folders won’t survive an FTA inspection.
• Train procurement staff: They must recognize risk signals — offshore payments, cash-only requests, mismatched addresses — and know how to escalate.
• Review contract clauses: Insert clauses requiring suppliers to provide verification documents upon request — and make non-compliance grounds for termination.
• Monitor continuously: Supplier risk isn’t static. Re-verify every 12 months — even if you’ve dealt with them for a decade.
The October 1, 2026 deadline is not a formality — it’s a turning point. For expats, SMEs, and investors alike: the era of paperwork as a formality is over. In the UAE, compliance isn’t about passing an audit — it’s about proving you never had a chance to fail.
