We do not exit when complexity enters. We stand by our clients through every regulatory shift, audit, and challenge. Unwavering support is the foundation of our firm.
We use cookies to ensure our website functions properly and to understand how you interact with our site. Privacy Policy
Federal Decree-Law No. 17 of 2025 amended the UAE Tax Procedures Law from 1 January 2026: the audit limitation extends to fifteen years for evasion and refund claims lapse at five years. With a new penalty regime from April 2026, the FTA audit is decided by the records, not the meeting.
A tax audit feels like the moment the risk arrives. The notice lands, the deadline runs, and the founder treats the audit as the event to be survived. The framing is wrong. The Federal Tax Authority audit does not create the exposure. It discovers an exposure that already exists in the records, in the positions taken, and in the documentation that was or was not built when the transactions happened. By the time the notice arrives, the outcome is largely fixed. The audit is the test of work done years earlier, and it is failed or passed long before the auditor reads the first ledger.
That is the operative truth of the UAE's tax-procedure framework as it stands in 2026, and it is the reason the regime now rewards the taxpayer who corrects before being caught and penalises the one who waits. The Federal Decree-Law No. 17 of 2025 amendments to the Tax Procedures Law, the Cabinet Decision No. 17 of 2026 amendments to the Executive Regulation, and the new administrative penalty regime under Cabinet Decision No. 129 of 2025 all push in the same direction: the voluntary disclosure made before an audit notice is cheap, the error found by the auditor is expensive, and the window to act closes as the FTA's visibility increases. With e-invoicing about to feed transactional data to the FTA in near real time, that visibility is increasing fast.
For the corridor founder this is the second half of a single story. The transfer-pricing analysis sets out how an intercompany structure is built to be defensible; this article sets out what happens when the Federal Tax Authority comes to test it. The two are the same exposure viewed at two moments: the structuring decision and the audit. A management fee, a Qualifying Free Zone Person position, a related-party charge, or a substance claim is taken when the transaction is structured and tested when the audit runs. The audit-defence file is not assembled when the notice arrives. It is the same contemporaneous documentation that the position required in the first place.
The clinical reading is that there is no audit defence separate from the records. The arguments a taxpayer can make in an audit are constrained by the documents he can produce, the positions he disclosed, and the deadlines he met. A strong technical position with no contemporaneous evidence loses to a weaker position that is fully documented, because the burden sits on the taxpayer. The audit rewards the file, not the eloquence.
This article walks the statutory frame as reformed for 2026, how an FTA audit actually runs, the limitation periods that determine how far back the FTA can reach, the voluntary disclosure that is the central defence, the penalty regime from April 2026, the dispute chain from reconsideration to the Federal Court, the five recurring audit-defence traps, and the sequencing with the rest of the corridor compliance stack. The audit is not the moment the risk arrives. It is the moment the record is read.
The UAE tax-procedure framework is a layered structure of a primary law, an executive regulation, and a penalty schedule, all of which moved in late 2025 and 2026.
The Tax Procedures Law (Federal Decree-Law No. 28 of 2022). The Tax Procedures Law is the common procedural code for all UAE federal taxes. It governs registration, record-keeping, returns, audits, assessments, penalties, and disputes, and it applies to Value Added Tax under Federal Decree-Law No. 8 of 2017 and to Corporate Tax under Federal Decree-Law No. 47 of 2022 alike. The audit powers sit in Articles 16 to 20: the FTA's right to conduct a tax audit, its right to access original records or copies, the timing of the audit, the treatment of new information that appears after an audit, and the obligation of the audited person to cooperate.
Federal Decree-Law No. 17 of 2025. Federal Decree-Law No. 17 of 2025 amended the Tax Procedures Law with effect from 1 January 2026. Three changes matter most for audit exposure. The limitation period for audits and assessments, generally five years from the end of the relevant tax period, can now extend to fifteen years in cases of tax evasion or failure to register for tax. The right to claim a refund of a credit balance now lapses if no claim is made within five years, replacing the previous indefinite carry-forward. And the FTA gained the power to issue binding directives on how the Tax Procedures Law and the other federal tax laws apply to transactions, binding on both the FTA and the taxpayer, which standardises the interpretation an auditor will apply.
The Executive Regulation (Cabinet Decision No. 74 of 2023, amended by Cabinet Decision No. 17 of 2026). The Executive Regulation operationalises the law. Its audit provisions sit in Articles 15 to 22: tax auditing, notification of the audit, audit procedures, the seizure and retention of documents and assets, the result of the audit, the tax assessment, the assessment of administrative fines, and the procedures and measures that follow. Cabinet Decision No. 17 of 2026 amended the Executive Regulation with effect from 1 April 2026. It removed the requirement to file a voluntary disclosure where a correction makes no difference to the tax due, extended record-keeping by two years where a refund application remains undecided, and allowed the FTA to extend the period for which it seizes documents or assets, with notice where possible.
The administrative penalty schedule (Cabinet Decision No. 129 of 2025). The penalty regime was reissued by Cabinet Decision No. 129 of 2025 with effect from 14 April 2026. It reduced and simplified many penalties, aligned the procedural penalties with the Corporate Tax penalty schedule under Cabinet Decision No. 10 of 2024, and, significantly for audit exposure, reduced the penalty applied to an assessment raised after a tax audit. It also restructured the voluntary-disclosure penalty, examined below, into a monthly charge.
The four instruments form one system. The law sets the powers and the limitation periods, the Executive Regulation sets the procedure, and the penalty schedule sets the price of getting it wrong. All four were current as at mid-2026, and the direction of all four is the same: clearer procedure, longer reach for serious cases, and a sharper distinction between the taxpayer who corrects early and the one who is caught.
The audit is a defined procedure, and knowing the steps is the first part of the defence.
Selection. The FTA selects audits on a risk basis. Returns are screened against data the FTA holds, including VAT and Corporate Tax filings, customs data, third-party information, and, increasingly, the transactional data that the UAE e-invoicing system will transmit in near real time. As the data the FTA holds becomes more granular, selection becomes more targeted, and the mismatches that trigger an audit, such as a Corporate Tax position inconsistent with the VAT return or the customs record, become easier for the FTA to see than for the taxpayer to anticipate.
Notice. The Executive Regulation requires the FTA to give prior written notice of a tax audit, typically at least 10 business days, stating the audit's scope and timing. The FTA may conduct the audit without prior notice in defined circumstances, such as where it suspects that notice would prejudice the audit, including suspected evasion. The notice is the start of the visible process, but as set out above, it is not the start of the exposure.
Access and conduct. The FTA may conduct the audit at its own premises or at the place of business, or any place where the person conducts business, stores goods, or keeps records. It may require access to the original records or copies, and the audited person, its tax agent, and its legal representative must cooperate and facilitate the auditor's work. The auditor reviews the records against the returns and the law and raises queries, often iteratively.
Seizure. Where necessary, the auditor may seize documents and assets in the course of the audit and must provide a record of what was seized and the period for which it is expected to be retained. Cabinet Decision No. 17 of 2026 allows the FTA to extend that retention period, notifying the person where possible.
Result and assessment. After the audit the FTA issues the audit result, and where the audit produces additional tax it issues a tax assessment, together with an assessment of any administrative penalties. The assessment is the document that crystallises the liability and starts the dispute clock. Where new information comes to light after an audit that could affect the result, the law permits the FTA to audit again in defined circumstances.
The procedure is the same whether the audit is a VAT audit or a Corporate Tax audit, because both run on the Tax Procedures Law. For a corridor founder with both a VAT registration and a Corporate Tax registration, a single audit can examine both, and an inconsistency between them is a common entry point.
How far back the FTA can reach is set by the limitation periods, and Federal Decree-Law No. 17 of 2025 lengthened them for serious cases.
The general five-year period. The FTA may generally conduct a tax audit or issue an assessment within five years of the end of the relevant tax period. After five years the period is, in the ordinary case, closed. This is why contemporaneous record-keeping is finite in its burden but absolute in its importance within the window: the records that support a position have to survive for the period in which the FTA can still test them.
The fifteen-year period for evasion and non-registration. Federal Decree-Law No. 17 of 2025 confirmed that the period extends to fifteen years in cases of tax evasion or failure to register for tax. The extension is consequential for a founder who took an aggressive position or who failed to register a UAE entity for Corporate Tax on time: the exposure does not close at five years, and the records and the rationale have to be retained and defensible for far longer. The fifteen-year reach is the FTA's answer to deliberate non-disclosure, and it removes the comfort that time alone would close a serious exposure.
The voluntary-disclosure extension. Where a taxpayer submits a voluntary disclosure late in the five-year window, the FTA's period to audit or assess that matter is extended so that the disclosure does not defeat the FTA's ability to examine it. A voluntary disclosure in the final year of the period therefore extends the FTA's reach on that matter, which is a reason to disclose early rather than at the edge of the window.
Record retention. The retention obligation is calibrated to these periods. Corporate Tax records must be kept for seven years under Article 56 of Federal Decree-Law No. 47 of 2022, and the Tax Procedures framework sets retention periods for other records, extended by a further two years under Cabinet Decision No. 17 of 2026 where a refund application is pending, and longer for specific categories such as real estate. The prudent standard is a single retention policy set at the longest applicable period, because the audit can reach any record within its limitation window and the burden of producing it sits on the taxpayer.
The voluntary disclosure is the single most important tool in audit defence, because it is the mechanism by which a taxpayer corrects an error on his own terms before the FTA finds it, and the 2026 penalty regime is built to reward exactly that.
What it is. A voluntary disclosure is a formal correction of an error or omission in a tax return, a tax assessment, or a refund application. Where the error means too little tax was paid or too much was refunded, the taxpayer files a voluntary disclosure to put it right. The standard window to file is 20 business days from the date the taxpayer becomes aware of the error.
The new penalty structure. Cabinet Decision No. 129 of 2025 changed the voluntary-disclosure penalty from a tiered percentage by year to a monthly charge. Under the previous regime the penalty was 5% of the tax difference where the disclosure was made within the first year, rising to 10%, 20%, and 30% in the following years. From 14 April 2026 the penalty is a monthly 1% of the tax difference, for each month or part of a month, from the day after the original due date until the voluntary disclosure is filed. The structure rewards speed in a continuous way: the cost of an error grows by roughly 1% a month for as long as it is left uncorrected, so a disclosure made promptly is cheap and one delayed for years is not.
The notification cliff. The decisive distinction is whether the disclosure is made before or after the FTA notifies the taxpayer of an audit. A taxpayer who discloses before notification pays the monthly 1% charge. A taxpayer who has not disclosed by the time the audit notice arrives faces a fixed 15% penalty on the tax difference plus a 1% monthly charge. The notification is a cliff edge: on one side the error is a self-corrected slip priced by the clock, on the other it is an undisclosed understatement priced by a fixed penalty. The entire architecture pushes the taxpayer to find and fix errors before the FTA does.
The no-difference simplification. From 1 April 2026, Cabinet Decision No. 17 of 2026 removed the requirement to file a voluntary disclosure where the correction makes no difference to the tax due. Where an error in a return does not change the tax payable, it can be corrected without a formal disclosure, which removes an administrative burden that previously applied even to neutral corrections.
Why this matters with e-invoicing. The voluntary-disclosure window is most valuable in the period before the FTA's visibility increases. As e-invoicing transmits transactional data to the FTA in near real time, the gap between an error occurring and the FTA being able to see it narrows. The practical consequence, which the major firms have flagged, is that businesses should run internal reviews and correct historic positions now, while the disclosures are made on the taxpayer's initiative rather than in response to an audit notice. The voluntary disclosure is cheapest before the data arrives, not after.
The administrative penalty schedule under Cabinet Decision No. 129 of 2025 reset the price of non-compliance from 14 April 2026, and the direction of travel is reduction and simplification, with one important exception.
Reduced post-audit assessment penalties. The penalty applied where the FTA raises an assessment after a tax audit was reduced. The previous regime imposed a 50% penalty on the amount of the error plus a 4% monthly charge where the taxpayer had not disclosed before being notified of the audit. The new regime imposes a fixed 15% penalty on the tax difference plus a 1% monthly charge. The reduction is real, but it does not change the underlying logic: the assessment penalty is still materially higher than the voluntary-disclosure penalty, so disclosure before audit remains the cheaper path.
Late payment. The late-payment penalty was restructured to a monthly charge of 14% per annum on the unsettled tax, accruing from the day after the due date. The change replaces the previous structure of a 2% immediate penalty followed by 4% monthly charges capped at 300%.
Record-keeping and procedural penalties. Failure to keep the required records carries a penalty of AED 10,000, rising to AED 20,000 for a repeat violation within 24 months. Failure to submit records in Arabic when the FTA requests them was reduced to AED 5,000. Submitting an incorrect tax return carries a reduced fixed penalty, waived where the taxpayer corrects the return within the filing deadline or files a neutral voluntary disclosure.
Alignment with Corporate Tax penalties. The reissued schedule aligns the general procedural penalties with the Corporate Tax penalty schedule under Cabinet Decision No. 10 of 2024, producing one coherent penalty framework across VAT and Corporate Tax. For a founder operating both registrations, the penalty exposure is now read from a single, aligned schedule rather than two divergent ones.
The penalty regime, read as a whole, sharpens the incentive that runs through the entire framework. The cheapest outcome is no error. The next cheapest is an error corrected by voluntary disclosure before an audit notice, priced by the monthly clock. The most expensive is an error found by the auditor, priced by the fixed assessment penalty. The schedule is engineered to make early self-correction the rational choice.
Where the FTA raises an assessment the taxpayer disagrees with, the challenge runs through a defined chain on strict deadlines, and the deadlines are unforgiving.
Reconsideration by the FTA. The first step is a request for reconsideration to the FTA, asking it to review its own decision. The request must be filed within 40 business days of being notified of the decision, and it must set out the grounds. The FTA reviews and issues its decision within 40 business days, and notifies the taxpayer within 5 business days of the decision. The reconsideration is a precondition for the later stages; a taxpayer cannot skip it.
The Tax Disputes Resolution Committee. Where the reconsideration does not resolve the dispute, the taxpayer objects to the Tax Disputes Resolution Committee, a body established under the tax legislation and chaired within the Ministry of Justice framework. The objection must be filed within 40 business days of the reconsideration decision, and it is generally a precondition that the tax assessed has been paid, so the dispute chain is, in substantial part, pay first and argue after. The Committee reviews the objection and issues a decision.
The Federal Court. Where the Committee's decision is disputed, the taxpayer appeals to the competent Federal Court, again within 40 business days, and the matter proceeds through the court system. The court stage is the final route, and it is slow and public.
The cost of a missed deadline. Each stage carries a strict business-day deadline, and missing it forfeits the right to advance. A taxpayer who lets the 40-business-day reconsideration window lapse loses the ability to challenge the assessment through the formal chain, whatever the merits. This is why the dispute is, in practice, decided by procedure and timing as much as by substance: the strongest technical argument is worthless if the deadline to make it has passed. The defence has to be organised, documented, and filed on the clock.
The dispute chain confirms the theme. By the time a taxpayer is disputing an assessment, the records are fixed, the positions are taken, the penalties are running, and the only variables left are whether the documentation supports the position and whether the deadlines are met. The audit is not won in the dispute. It is won in the file that existed before the audit began.
Five patterns recur in corridor structures as the FTA's audit capability matures through 2026.
Trap 1: building the audit file after the notice arrives. The most common error is to treat audit defence as something that begins when the notice lands. By then the records are what they are. The transfer-pricing documentation, the Qualifying Free Zone Person substance file, the related-party benchmarking, and the board records either exist contemporaneously or they do not. The architectural answer is to build the file when the position is taken, because the audit reads the file that already exists.
Trap 2: waiting to be caught rather than disclosing. A taxpayer who identifies a historic error and waits, hoping it will not surface, gambles against an FTA whose visibility is rising with e-invoicing. The penalty regime prices that gamble explicitly: a voluntary disclosure before audit notice costs the monthly 1% charge, while the same error found by the auditor costs a fixed 15% penalty plus the monthly charge. The architectural answer is a regular internal review cycle that finds and discloses errors before the notice, not after.
Trap 3: treating the five-year period as a safe harbour. A founder who assumes that an exposure closes at five years misreads the law. Tax evasion and failure to register extend the period to fifteen years, and a late voluntary disclosure extends the FTA's reach on the disclosed matter. The architectural answer is to retain records and rationale to the longest applicable period and to treat a serious or aggressive position as exposed well beyond five years.
Trap 4: inconsistency across VAT, Corporate Tax, and the e-invoicing feed. The FTA reads VAT returns, Corporate Tax returns, and transactional data on one platform, and the mismatch between them is a primary audit trigger. A management fee deducted for Corporate Tax that does not appear consistently in the VAT and e-invoicing records, or a related-party charge treated differently across filings, is the kind of discrepancy the data surfaces. The architectural answer is reconciliation across all the FTA's data sources before filing, not after the query.
Trap 5: missing the dispute deadlines. A taxpayer who receives an assessment and spends the reconsideration window building arguments rather than filing forfeits the challenge. The 40-business-day deadlines are strict and unforgiving. The architectural answer is to treat an assessment as starting an immediate clock, to file the reconsideration on time with the grounds and evidence already assembled, and to budget for paying the disputed tax before objecting to the Committee.
The common feature of the five traps is the belief that audit defence is reactive. It is not. The audit reads a file written earlier, prices an error by how early it was disclosed, and forecloses a challenge that misses a deadline. Everything that determines the outcome happens before the audit, except the deadlines, which happen on a clock the taxpayer does not control.
The FTA audit is where every other position in a corridor structure is tested, which is why it connects to the rest of the compliance stack.
The transfer-pricing position. The intercompany charges between a UAE company and a UK company, analysed in the transfer-pricing and DEMPE analysis, are a primary audit focus. The arm's length documentation, the functional analysis, and the benchmarking are precisely what the auditor asks for, and the absence of them is the easiest adjustment to raise. The audit is the moment the transfer-pricing file is read.
The Free Zone position. A Qualifying Free Zone Person's 0% status depends on the conditions analysed in the Qualifying Free Zone Person analysis, including the arm's length requirement and the substance to support qualifying income. An audit tests whether those conditions were met in fact, and a position that looked sound on paper but lacks the supporting evidence fails when examined.
The exchange-of-information overlay. The records the FTA examines on audit are the same records it can be required to provide to a foreign tax authority under the exchange-of-information framework. An audit finding does not stay within the UAE; the information can flow to the UK or another treaty partner on request, so an inconsistency surfaced by the FTA can become an inconsistency seen by HMRC.
The integrated reading is that the audit is the convergence point of the corridor structure. The transfer-pricing file, the Free Zone substance, the record retention, and the consistency across VAT, Corporate Tax, and the e-invoicing feed are all tested at once, by an authority whose visibility is increasing and whose reach now extends to fifteen years in serious cases. A structure built to be examined survives the audit. One built to be filed and forgotten does not.
Federal Decree-Law No. 17 of 2025 amended the UAE Tax Procedures Law (Federal Decree-Law No. 28 of 2022) with effect from 1 January 2026. The key changes are an extension of the audit and assessment limitation period from the general five years to up to fifteen years in cases of tax evasion or failure to register for tax; a five-year limit on claiming a refund of a credit balance, replacing the previous indefinite carry-forward; and a new power for the FTA to issue binding directives on how the tax laws apply, binding on both the FTA and taxpayers. Transitional rules allow older credit balances to be claimed within one year of the effective date.
In the ordinary case, the FTA may conduct a tax audit or issue an assessment within five years of the end of the relevant tax period. Federal Decree-Law No. 17 of 2025 confirmed that this extends to fifteen years where there has been tax evasion or a failure to register for tax. A voluntary disclosure made late in the five-year window also extends the FTA's period to examine the disclosed matter. The practical effect is that a serious or aggressive position is exposed well beyond five years, and records and rationale must be retained accordingly.
The Executive Regulation requires the FTA to give prior written notice of a tax audit, typically at least 10 business days, setting out the scope and timing. The FTA may conduct an audit without prior notice in defined circumstances, such as where it suspects that giving notice would prejudice the audit, including suspected tax evasion. The audit may take place at the FTA's premises or at the place of business or wherever the person keeps records.
A voluntary disclosure is a formal correction of an error in a tax return, assessment, or refund application that affected the tax due. The standard window to file is 20 business days from becoming aware of the error. Filing it before the FTA notifies an audit caps the penalty at a monthly 1% of the tax difference under Cabinet Decision No. 129 of 2025; failing to disclose before the audit notice triggers a fixed 15% penalty plus the 1% monthly charge. From 1 April 2026 a voluntary disclosure is no longer required where the correction makes no difference to the tax due.
Cabinet Decision No. 129 of 2025, effective 14 April 2026, reissued the administrative penalty schedule. The voluntary-disclosure penalty became a monthly 1% on the tax difference, replacing the previous tiered 5%, 10%, 20%, and 30% bands by year. The penalty on an assessment raised after an audit was reduced to a fixed 15% plus 1% monthly, from the previous 50% plus 4% monthly. Late payment became a 14% per annum monthly charge. Many procedural penalties were reduced and aligned with the Corporate Tax penalty schedule under Cabinet Decision No. 10 of 2024.
Corporate Tax records must be kept for seven years under Article 56 of Federal Decree-Law No. 47 of 2022. The Tax Procedures framework sets retention periods for records generally, extended by two years under Cabinet Decision No. 17 of 2026 where a refund application is pending, and longer for specific categories such as real estate. Because the audit can reach any record within its limitation window and the burden of producing it sits on the taxpayer, the prudent standard is a single retention policy set at the longest applicable period, covering accounting records, contracts, transfer-pricing documentation, and substance evidence.
The dispute runs through a defined chain. First, a request for reconsideration to the FTA within 40 business days of the decision, which the FTA decides within 40 business days. If unresolved, an objection to the Tax Disputes Resolution Committee within 40 business days, generally conditional on having paid the assessed tax. If still unresolved, an appeal to the competent Federal Court within 40 business days. Each deadline is strict, and missing one forfeits the right to advance, so the dispute must be organised and filed on the clock with the supporting evidence already assembled.
The UAE e-invoicing system will transmit transactional data to the FTA in near real time, which narrows the gap between an error occurring and the FTA being able to see it. This makes audit selection more data-driven and reduces the window in which a taxpayer can correct a historic position on his own initiative rather than in response to a notice. The practical consequence is to run internal reviews and file any necessary voluntary disclosures before e-invoicing goes live, while the disclosures are still made before the FTA's visibility increases.
The audit is the moment the file is read, not the moment the risk arrives. A corridor structure built with contemporaneous records, arm's length documentation, and consistent filings is examined and stands. One built for the filing deadline and not for the examination is discovered, priced by a penalty clock that rewards everyone who corrected earlier, and reached, in the serious cases, for fifteen years.
Yes, a UAE free zone company can pay 0% corporate tax in 2026. But the 0% rate is not automatic, and it does not come with the licence. It belongs to a Qualifying Free Zone Person that meets five conditions every year, and one wrong transaction can move the whole company to 9% for five years.
Read AnalysisFrom 6 April 2027, most unused pension funds and death benefits fall within the IHT estate under Finance Act 2026. For a UAE-resident former UK resident, scheme situs is decisive: a UK-established pension stays in the IHT net even after long-term resident status lapses.
Read Analysis