The FTA Tax Audit in the UAE

Before anything else, work out which one you are dealing with. The phrase collides across three entirely separate worlds, and two of them have nothing to do with UAE tax. Getting this wrong wastes weeks, because the deadlines, the law and the regulator are all different.

The powers are specific and enumerated, which is useful: anything outside them is not part of the audit. Article 16(1) lets the Authority audit any person to verify compliance. Article 16(3) lets it do so at its own premises, at your place of business, or anywhere else you conduct business, store goods or keep records. Article 17 lets the tax auditor take original records or copies of them, and take samples of goods, devices or other assets. Article 18 confines the audit to the Authority's official working hours unless the Director General decides otherwise in a case of necessity.

The Executive Regulation goes further into detail. Article 17 of Cabinet Decision No. 74 of 2023 lets the auditor inspect the premises, the documents and assets there, data and records stored electronically, and the accounting systems themselves — the software, not just its printouts. Article 18 lets the auditor copy documents, mark originals as inspected, and seize documents and assets for as long as completing the audit requires, with a written record of what was taken owed to you within ten business days of the seizure.

Almost every published account of a UAE tax audit describes the mood of one and not the clocks in it. The clocks are what matter, because several of them are yours to miss. All of the following are business days as defined in Article 1 of the Tax Procedures Law — any day except weekends and official Federal Government holidays, which is not the same thing as the FTA's opening hours.

The FAF is the single most searched and least explained part of this subject. It is a standard file of accounting data that tax accounting software must be able to generate on demand, designed by the FTA so that a request for records during an audit can be answered with one export rather than a month of extraction. The specification lives in the FTA's Requirements Document for Tax Accounting Software, dated October 2017, which sets out both the functional requirements for accredited software and the exact field layout of the file.

On format, the document is unambiguous. The FAF must be a pure collection of data in comma-separated values (.csv), broken down by invoices, credit notes and so on; the taxpayer must not be able to modify any value in it; and it must not be an image file. Businesses must be able to choose the period the file spans, and the software must be able to produce it from data held in a single source or in several. The document also states plainly that receiving a FAF does not stop FTA auditors verifying your original source documents, and that owning software which can generate one does not reduce your record-keeping obligations.

There is no separate list of "audit requirements" waiting to be triggered. The requirement is the ordinary record-keeping obligation — Article 4 of the Tax Procedures Law — enforced at the moment it is tested. What changes during an audit is the retention clock, which extends automatically.

Article 3 of Cabinet Decision No. 74 of 2023 sets the base periods: five years following the tax period for a taxable person, five years from the end of the calendar year the document was created for everyone else, and seven years for real estate records. On top of that it adds an extra four years where a dispute with the Authority is running (or until the dispute is finally settled, whichever is later), an extra four years while a tax audit is ongoing, and an extra four years where the Authority notified you of its intention to audit before the base period expired. Two further extensions were built for late corrections: one extra year from a voluntary disclosure submitted in the fifth year, and two extra years where a refund application is pending a decision, a clause added by Cabinet Decision No. 17 of 2026.

Other clocks sit outside that decision and run longer. Article 56 of Federal Decree-Law No. 47 of 2022 requires corporate tax records for seven years after the end of the tax period. Article 26(2) of the Commercial Companies Law requires accounting registers to be kept at the head office for five years. Quote the one that applies to the record in front of you rather than saying "seven years" by reflex.

No FTA-published "tax audit checklist" could be located in the Authority's guides library when it was checked on 17 August 2026, and you should be sceptical of any third-party document presented as one. The binding equivalent does exist, though, and it is better than a checklist because it is enforceable: Article 17(1) of the Executive Regulation tells you exactly what an auditor may inspect, and Article 3 tells you exactly what must still be in your hands to show them.

Working backwards from those two articles gives a defensible preparation list. It is not a promise about what any individual auditor will ask, and nobody should sell it to you as one.

This is the highest-value fact on the page, and it is a straight comparison of two items in the same penalty table. Under item 10 of the table annexed to Cabinet Decision No. 75 of 2023, submitting a voluntary disclosure for an error in a return, an assessment or a refund application carries a monthly penalty of 1% of the tax difference, running from the day after the return's due date until the disclosure is submitted. Under item 11, failing to submit that voluntary disclosure before being notified that you will be subject to a tax audit carries a fixed penalty of 15% of the tax difference as well as the same 1% per month.

The 1% accrues either way. The 15% is purely the price of having waited, and the moment it becomes unavoidable is the moment the audit notification lands. Cabinet Decision No. 40 of 2017 as amended runs the same structure for VAT and excise tax. Note also the outer limit: Article 46(6) of the Tax Procedures Law, renumbered by Federal Decree-Law No. 17 of 2025, bars any voluntary disclosure more than five years after the end of the relevant tax period, save for one narrow case tied to a refund application on which the Authority has not yet decided.

The limitation is Article 46, and it was renumbered on 1 January 2026 by Federal Decree-Law No. 17 of 2025, so citations written against the older text are now pointing at the wrong clauses. Verified against the consolidated 33-page publication of 3 December 2025.

Article 46(1): no tax audit and no tax assessment more than five years from the end of the relevant tax period. 46(2): if you were notified that audit procedures had commenced before those five years expired, the Authority may continue, provided the audit is completed or the assessment issued within four years of the date of notification. 46(3): where the matter relates to a voluntary disclosure submitted in the fifth year, one year from the date of that disclosure. 46(4), the clause inserted in 2025, gives two years from submission where the matter relates to a refund application made in the fifth year. 46(7): fifteen years from the end of the tax period in which tax evasion occurred. 46(8): fifteen years from the date registration should have happened, where a person failed to register at all.

Two articles sit either side of it and are worth knowing. Article 19 lets the Authority audit a matter it has already audited, if new information surfaces that might affect the outcome — a previous clean audit is not a permanent release. Article 47 provides that payable tax and administrative penalties of which you have already been notified do not lapse with time; the five-year clock governs whether the Authority may look and assess, not how long it may pursue what it has already assessed.

A tax audit does not end in a report card. Where the Authority concludes that the figures are wrong, Article 23 requires it to issue a tax assessment and notify you within ten business days; where it cannot determine the actual amount, Article 23(2) allows an estimated assessment, which it must amend when new relevant information surfaces and re-notify within ten business days of the amendment. Article 20 of the Executive Regulation fixes the minimum contents of an assessment: your name and address, the TRN, the assessment reference number, the tax type, a tax summary showing what was reported and what was adjusted, the reasons the assessment is based on, the net tax due or refundable, and the payment date and method.

Separately, Article 24 requires an administrative penalties assessment, notified within five business days, for the fifteen categories of violation it lists — which include failing to keep records, failing to produce them in Arabic, and failing to facilitate the auditor. Article 24(5) confirms the obvious but frequently missed point that paying a penalty does not discharge the tax. Once notified, both are debts collectable by the Authority under Articles 20(2) and 21(2) of the Executive Regulation.

Disagreeing with any of it runs through a staged route with its own deadlines — assessment review, reconsideration, the Tax Disputes Resolution Committee and then the courts — which is set out in full on the penalties and disputes page rather than repeated here.

No FTA bank details. Not here and not from any third party. "FTA bank account" requests are one of the most reliable payment-diversion fraud patterns in existence: a plausible-looking page publishes an account number, a real liability is paid into it, and the money is gone while the liability remains outstanding and keeps accruing penalties. Payment instructions for a UAE tax liability are generated inside your own EmaraTax account, against your own registration, and that is the only place they should ever be read from. If an email, an invoice or a consultant hands you bank details for a tax payment, verify them in the portal before anything moves.

No audit-probability figure. The FTA publishes no statistic on how many taxpayers are audited, on selection criteria, or on the chance of any particular business being picked. Any percentage you see quoted for this is invented. The Requirements Document says only that the FTA audits businesses at its discretion, and that is the whole of the published position.

No success rates, case studies or client outcomes. This site has none published, so it will not describe any. No fee for audit support is quoted, because none is published, and a figure invented to look reassuring would be worth less than nothing on a page about tax risk.

No claim to represent you. Nothing here states or implies that this site, or anyone associated with it, is a registered tax agent, a tax agency or an FTA-approved firm. Only a name and a registration number you can check yourself against the FTA's own register would be worth anything, and none is published yet.

On the community threads. Searches for fta audit reddit are usually looking for what an audit is really like. The Authority has no presence on Reddit and nothing posted there is authority for anything. Anecdotes about response times and auditor behaviour may be genuinely useful for calibration; they are not a source for a deadline, a penalty amount or a legal position. Every figure on this page was read in the primary text or on the Authority's own pages on 17 August 2026.