Who conducts the audit, and under what law?
Tax audits are conducted by the Federal Tax Authority, the federal body that administers VAT, Excise Tax, and Corporate Tax across all seven emirates. Because the FTA is a federal authority, the rules governing an audit in Dubai, Abu Dhabi, Sharjah, or anywhere else in the UAE are the same. The emirate does not change the process.
The legal framework rests on four instruments:
- Federal Decree-Law No. 28 of 2022 on Tax Procedures, the main procedural law (which replaced Federal Law No. 7 of 2017), as amended by Federal Decree-Law No. 17 of 2025, effective 1 January 2026.
- Cabinet Decision No. 74 of 2023, the Executive Regulation, which sets the operational detail of how audits run.
- Cabinet Decision No. 129 of 2025, the restructured administrative penalty framework, effective 14 April 2026.
- The relevant Tax Laws themselves (the VAT Law, the Excise Tax Law, and the Corporate Tax Law), which set the substantive rules the FTA checks against.
Why does the FTA audit a business? Common triggers
The FTA’s stated strategy is that audits are risk-driven, not random. Every registrant is scored against its filing patterns, declared turnover, industry, refund history, and past compliance behaviour. Before contacting a business, the FTA already reviews data it holds, including past VAT returns, Corporate Tax filings, customs data, and third-party information, so auditors enter with specific focus areas.
Patterns that commonly raise a business’s risk score include:
- Mismatches between VAT returns and Corporate Tax filings, or between filings and customs or accounting records.
- Large, frequent, or last-minute VAT refund claims.
- Inconsistent or unusually low margins compared with industry peers.
- Missing or weak transfer pricing documentation for transactions with related parties, group companies, or overseas entities.
- Late filings, repeated corrections, or gaps in record-keeping.
- Operating in a sector the FTA scrutinises closely, such as real estate, e-commerce, logistics, gold and precious-metals trading, or professional services.
The scale of enforcement is worth noting. The FTA reported roughly 93,000 inspection visits in 2024, a 135 percent year-on-year increase, and approximately 103,680 inspection visits in the first half of 2026, up around 21 percent. Data analytics and the phased rollout of e-invoicing are making the FTA’s selection increasingly precise.
Types of FTA tax audit
In practice, FTA audits fall into three broad formats, selected according to risk:
- Desk audit: a remote review conducted through the EmaraTax portal, where the FTA requests returns, invoices, and reconciliations for specific issues or periods.
- Field audit: an on-site inspection at the taxpayer’s premises, where auditors may examine systems, contracts, and stock, and interview staff. These are typical for higher-risk or more complex cases.
- Hybrid audit: an initial electronic review followed by targeted on-site work where material risks are identified.
The tax audit process, step by step
An FTA audit follows a consistent, structured sequence with fixed deadlines. The main stages are:
- Notification. The audit begins with formal written notice through EmaraTax. Under Article 16 of the Executive Regulation, the FTA must generally give at least 10 business days’ notice before commencing an audit, though shorter notice is permitted where tax evasion is suspected. The notice sets out the tax type, the periods under review, and the initial documents required.
- Document submission. The business submits the requested records within the stated deadline, commonly 5 to 10 business days for the first batch. Organised, indexed responses that map clearly to the returns under review tend to keep the audit narrow.
- Review and queries. Auditors examine the records, often through iterative rounds of questions. Clear and timely replies help limit scope; delays or vague answers can trigger deeper review.
- Audit findings. The FTA communicates its findings and usually gives the business an opportunity to respond before anything is finalised.
- Assessment. If the FTA concludes that tax was underpaid, incorrectly calculated, or unpaid, it issues a Tax Assessment under Article 23 of the Tax Procedures Law, specifying the additional tax due and any administrative penalties.
- Dispute and appeal. A business that disagrees can pursue the statutory appeal route, starting with a reconsideration or assessment review request (currently within 40 business days of the assessment), then the Tax Disputes Resolution Committee, and, for larger disputes, the federal courts. Deadlines are strict, so the response should begin immediately.
What documents does the FTA typically request?
The exact list depends on the tax type and the scope of the audit, but the audit file usually starts with the tax returns and the calculations behind them, supported by:
- Tax returns (VAT, Excise, or Corporate Tax) and the workings used to prepare them.
- Sales and purchase invoices, credit and debit notes, and tax invoices issued and received.
- General ledgers, trial balances, and reconciliations between the returns and the accounts.
- Bank statements, contracts, and, where relevant, customs declarations and shipping records.
- Audited financial statements, where the business is required to prepare them.
- Transfer pricing documentation for transactions with connected persons and related parties.
Penalties and the 2026 changes
From 14 April 2026, the restructured penalty framework under Cabinet Decision No. 129 of 2025 reshaped the cost of non-compliance. Key features include:
- Late payment penalties move to a 14 percent annual, non-compounding rate.
- The fixed penalty applied to an error discovered by the FTA during an audit is reduced to 15 percent of the unpaid tax.
- The voluntary disclosure penalty is restructured to 1 percent per month of the underpaid amount, calculated from the original filing deadline.
The design intent is clear: the framework increases the cost of errors the FTA finds while reducing the cost of self-correction. That gap is the voluntary disclosure window. A separate but equally important change is the audit limitation period. The standard window remains five years from the end of the relevant tax period, but under the 2026 amendments the FTA can now extend audits or assessments to as long as 15 years in cases involving tax evasion or a failure to register, and it can review late refund claims beyond the normal window.
How to stay audit-ready?
Because the notice period can be as short as 10 business days, audit readiness is best treated as a continuous discipline rather than a reaction to a notice. Businesses that reconcile early and document decisions in real time consistently emerge from audits with fewer adjustments and lower penalties. Practical steps include:
- Reconcile VAT and Corporate Tax positions to each other, and to the accounting records, every period.
- Keep a complete, clearly indexed set of invoices, ledgers, returns, and supporting schedules for the full retention period.
- Confirm registration details, Tax Registration Number (TRN), and licensed activities are accurate and up to date.
- Maintain contemporaneous transfer pricing documentation aligned with the arm’s length principle.
- Run a mock audit to stress-test filings before the FTA does, and correct any errors through voluntary disclosure while the cost of self-correction is lowest.
How BCL Globiz supports UAE businesses through tax audits?
BCL Globiz is a Dubai-based accounting and tax advisory firm (part of the BCL Group, registered with the Department of Economic Development under licence number 1072657) that helps UAE businesses stay audit-ready across VAT, Corporate Tax, and Excise Tax. The firm offers integrated compliance under one roof, including accounting and bookkeeping, VAT and Corporate Tax compliance, statutory and internal audits, transfer pricing and benchmarking, and AML support.
For the audit itself, BCL Globiz supports clients end to end: preparing and organising documentation, responding to FTA inquiries, reconciling VAT and Corporate Tax positions, managing voluntary disclosures, and representing clients before the tax authorities. Because its team maintains document trails in line with FTA guidelines throughout the year, clients are positioned to respond to an audit notice with clarity rather than a last-minute scramble.
Learn more about audit support and corporate tax services at BCL Globiz Corporate Tax Services in Dubai.
Frequently asked questions
Is an FTA tax audit the same as a statutory financial audit?
No. A statutory audit is an independent review of financial statements by a licensed auditor. An FTA tax audit is a compliance examination by the government to verify that tax was correctly reported and paid. A business may be required to have both.
How much notice does the FTA give before an audit?
Generally at least 10 business days under the Executive Regulation, with the clock running from the notification date in EmaraTax, not the date the message is opened. Shorter notice is permitted where evasion is suspected.
Can free zone companies be audited?
Yes. The FTA can audit any registered business in the UAE, whether on the mainland or in a free zone, and regardless of size. Qualifying Free Zone Persons face particular scrutiny of their qualifying income claims and substance requirements.
What happens if I disagree with the audit result?
You can pursue the statutory appeal route, beginning with a reconsideration or assessment review request within the current deadline of 40 business days, then the Tax Disputes Resolution Committee, and the federal courts for larger disputes. Acting quickly and with professional support is important, because the deadlines are strict.
How long must I keep records?
At least five years from the end of the relevant tax period as a general rule, with longer periods in certain cases (seven years for corporate tax records and up to fifteen years for real estate). Records may be kept digitally or physically, provided they are complete and accessible on request.
