Regulatory auditing in Dubai is the independent examination of a company’s financial records, systems, and disclosures to confirm that the business is operating within the laws and rules that govern it in the United Arab Emirates. A financial audit asks whether the numbers are accurate. A regulatory audit asks a wider question: is this company complying with everything the federal government, the Federal Tax Authority (FTA), the Ministry of Economy, and its licensing or free zone authority require of it? For most businesses in Dubai, the annual statutory audit is the main vehicle through which that compliance is tested and evidenced.
The stakes have risen sharply. With the arrival of UAE Corporate Tax and tighter rules under the Commercial Companies Law, an audit is no longer a year-end formality. It has become a legal checkpoint that ties directly to trade license renewal, tax filing, and a company’s standing with banks and regulators. This guide, prepared with reference to the compliance practice at BCL Globiz, a Dubai based accounting and advisory firm, explains what a regulatory audit covers, which laws sit behind it, who must comply, and what happens if a business does not.
Regulatory, statutory, and internal audits: the difference
These terms are often used loosely, so it helps to separate them. A statutory audit is an independent review of financial statements required by law, confirming they give a true and fair view under International Financial Reporting Standards (IFRS). A regulatory audit focuses on compliance with specific laws, regulations, and standards set by the authorities. An internal audit is a voluntary, management-facing review of controls and risk. In the UAE these overlap heavily, because the statutory audit is the document authorities rely on to confirm regulatory compliance. In practice, a Dubai company that completes a proper statutory audit has usually satisfied the core of its regulatory audit obligations at the same time.
A regulatory audit in the UAE typically examines whether a company has met the following:
- Its obligations under the Commercial Companies Law, including keeping proper accounting records and preparing financial statements under IFRS.
- Its Corporate Tax and VAT positions, including whether the figures filed with the FTA are supported by the accounts.
- Anti-Money Laundering (AML) controls and Ultimate Beneficial Owner (UBO) disclosures where these apply.
- The specific conditions of its trade license or free zone authority, which frequently require audited statements at renewal.
The UAE laws behind regulatory auditing
Three federal laws form the backbone of regulatory auditing in Dubai.
Federal Decree-Law No. 32 of 2021 (the Commercial Companies Law) took effect on 2 January 2022 and replaced the earlier Federal Law No. 2 of 2015. It requires mainland companies to appoint a licensed auditor, keep accounting records for at least five years, and prepare financial statements in line with internationally recognised accounting standards.
Federal Decree-Law No. 41 of 2023 regulates the auditing and accounting professions. It confirms that only licensed, independent professionals and firms registered with the Ministry of Economy may perform statutory audits and sign audit reports. A key point for business owners: the same firm cannot both keep your books and audit them, because independence is a legal condition of the audit.
Federal Decree-Law No. 47 of 2022 (the Corporate Tax Law) applies to financial years beginning on or after 1 June 2023. It introduced a standard Corporate Tax rate of 9 percent on taxable income above AED 375,000, with a 0 percent rate on income up to that amount. This law is the single biggest reason regulatory auditing has become central to running a business in Dubai.
The role of the Federal Tax Authority (FTA)
The FTA administers both Value Added Tax (VAT), which has applied at a standard rate of 5 percent since 1 January 2018, and Corporate Tax. The FTA has the power to open a tax audit and inspect a company’s records, returns, and supporting documents through the EmaraTax portal. If the accounts and the tax filings do not reconcile, the exposure is real.
Timing is where many businesses come under pressure. A Corporate Tax return is due within nine months of the end of the tax period. For a financial year ending on 31 December 2025, that means a filing deadline of 30 September 2026. Because the audited financial statements feed the tax return, the audit needs to be finalised well before that date. Leaving both to the final quarter is how errors and missed tax savings creep in. Firms such as BCL Globiz build audit readiness into monthly bookkeeping so the year-end close is not a scramble; you can read more on their Corporate Tax advisory services.
Who must have audited financial statements (Ministerial Decision No. 84 of 2025)
The clearest current rule on mandatory audits for Corporate Tax comes from Ministerial Decision No. 84 of 2025, which took effect for tax periods starting on or after 1 January 2025 and replaced the earlier Ministerial Decision No. 82 of 2023. Under this decision, three categories of taxpayer must prepare and maintain audited financial statements:
- Standalone taxable persons (not part of a tax group) whose revenue exceeds AED 50 million during the tax period.
- Every Qualifying Free Zone Person (QFZP), regardless of revenue. Without an audit, the FTA cannot apply the 0 percent qualifying rate, and the income is taxed at the standard 9 percent instead.
- All tax groups, which must now prepare audited special purpose aggregated financial statements for each tax period, regardless of the group’s revenue.
For a non-resident person, only revenue derived through a permanent establishment or nexus in the UAE counts toward the AED 50 million threshold. On accounting standards, Ministerial Decision No. 114 of 2023 permits full IFRS for all businesses, and allows the lighter IFRS for SMEs only where revenue does not exceed AED 50 million. Businesses below the threshold that are not QFZPs or part of a tax group are not forced to audit for Corporate Tax purposes, although they must still keep adequate books and records.
Free zone and licensing rules
Dubai’s free zones set their own audit rules on top of the federal framework, so obligations vary by zone. Established zones such as the Dubai Multi Commodities Centre (DMCC), Jebel Ali Free Zone (JAFZA), Dubai Airport Free Zone (DAFZA), and the Dubai International Financial Centre (DIFC) require companies to submit audited financial statements every year, typically within a set window after the financial year-end and as a condition of license renewal. Others historically asked only for proper bookkeeping, but that is changing: from 30 September 2025, for example, IFZA licensees must submit audited or, for qualifying small entities, simplified financials to renew a trade license.
A common misconception is that a dormant or loss-making company escapes the requirement. In many free zones, an inactive company must still file a nil-activity audit or financial report at renewal. Branches of foreign companies registered in the UAE are also generally expected to file audited annual statements.
AML, UBO, and other regulatory layers
Regulatory auditing extends beyond tax and company law. Under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering, businesses classified as designated non-financial businesses and professions must register on the goAML platform, appoint a compliance officer, perform customer due diligence, and report suspicious transactions. Auditors frequently review these controls. Companies must also maintain an accurate Ultimate Beneficial Owner register under Cabinet Decision No. 58 of 2020, identifying individuals who own or control 25 percent or more of the entity. These disclosures are part of what a thorough regulatory review confirms.
What changed with Economic Substance Regulations
Many older guides still tell businesses to file an annual Economic Substance Regulations (ESR) notification and report. That advice is now out of date. Cabinet Decision No. 98 of 2024 cancelled ESR notification and reporting obligations for financial years ending after 31 December 2022, and abolished related penalties for that period. ESR now applies only to the historical window of 1 January 2019 to 31 December 2022. The substance principle did not disappear; it moved inside the Corporate Tax Law, where a Qualifying Free Zone Person must still demonstrate adequate substance to keep the 0 percent rate. Getting this distinction right matters, because filing a report that is no longer required, or ignoring the substance test that still exists, both create risk.
How a regulatory audit works, step by step?
A UAE regulatory audit generally moves through four stages:
- Planning: the auditor scopes the engagement, understands the business and its regulatory profile, and identifies the areas of highest risk.
- Fieldwork: the auditor tests transactions, reconciles bank and ledger records, examines internal controls, and gathers evidence to support the financial statements and tax positions.
- Reporting: the auditor forms an independent opinion on whether the statements give a true and fair view and comply with the applicable standards, then issues the audit report.
- Filing: the audited statements are submitted to the relevant authority, whether a free zone registrar, a licensing body, or in support of the Corporate Tax return with the FTA.
Because query response time from the client often drives half of the total calendar time, the businesses that finish quickly are those whose books were audit-ready before the auditor arrived. That is the value of maintaining clean, reconciled records year-round rather than reconstructing a year in a fortnight.
The cost of non-compliance
Missing an audit or filing obligation is expensive. Consequences range from administrative fines to trade license suspension and, for persistent non-compliance, cancellation. A late Corporate Tax registration alone attracts a penalty of AED 10,000. A free zone company that cannot produce audited statements at renewal can find its license blocked. A Qualifying Free Zone Person that fails to audit can lose the 0 percent rate entirely and be taxed at 9 percent. Regulatory auditing, viewed correctly, is not a cost centre. It is the mechanism that protects a company’s license, its tax position, and its credibility with banks and investors.
How BCL Globiz supports regulatory audits in Dubai
BCL Globiz Accounting and Consulting L.L.C., part of the BCL Group and registered with Dubai’s Department of Economic Development under license number 1072657, is a Dubai based firm whose team of more than 300 professionals includes Chartered Accountants and Certified Public Accountants serving over 1,000 clients across 30 countries. Because auditor independence rules prevent one firm from both keeping and auditing the same books, BCL Globiz focuses on the side businesses most often struggle with: getting audit-ready and staying that way.
That work includes structuring the accounts and documentation to FTA standards, reconciling every bank and card statement, running an audit readiness assessment, liaising with external auditors, and remediating findings before they become problems. For businesses navigating Corporate Tax, VAT, and free zone requirements at the same time, this joined-up approach keeps the regulatory audit predictable rather than stressful. You can explore the firm’s accounting and bookkeeping services for the day-to-day foundation that a clean audit depends on.
Frequently asked questions
Is a regulatory audit mandatory for every company in Dubai?
No. Whether an audit is mandatory depends on your legal structure, revenue, Corporate Tax status, and free zone rules. Mainland companies are generally required to audit under the Commercial Companies Law, every Qualifying Free Zone Person must audit regardless of size, and standalone taxpayers above AED 50 million in revenue must audit for Corporate Tax. Many smaller entities are not federally required to audit but may still need to for license renewal, banking, or investor purposes.
What is the difference between a statutory audit and a regulatory audit?
A statutory audit confirms that financial statements are accurate and true and fair under IFRS. A regulatory audit confirms that the business complies with the laws and rules that apply to it. In the UAE the two are closely linked, because the statutory audit is the document authorities use to verify regulatory compliance.
Who can legally perform an audit in the UAE?
Only an independent auditor or audit firm licensed and registered with the Ministry of Economy, under Federal Decree-Law No. 41 of 2023. The auditor cannot also be the party that prepares the company’s books or acts as its director.
Does a dormant company still need an audit?
Often yes. Many free zones require a nil-activity audit or financial report at license renewal even when a company had no transactions during the year. It is best to confirm the specific rule with your free zone authority or advisor.
