Seven questions to answer before UAE input VAT verification changes

On 1 October 2026, new supplier and supply verification requirements take effect under FTA Decision No. 13 of 2026. Before you read anything else about the Decision, answer these questions.

1. Which of your top 20 suppliers have you formally verified in the last 12 months? And can you produce the evidence today?
2. If the FTA denied AED 400,000 input VAT tomorrow because a supplier or supply chain was connected with tax invasion and your verification was inadequate, which clause in that supplier’s contract allows you to recover the resulting loss?
3. Can your finance system identify suppliers whose spend exceeded AED 100,000 or AED 375,000 over the previous 12 months – and those expected to cross those thresholds over the next 12 months?
4. Who, by name, is responsible for supplier verification in your organisation? Is their responsibility formally documented?
5. Where will the Emirates ID and passport copies obtained through the verification process be stored, who can access them, and how long will they be retained?
6. How many of your suppliers act as intermediaries, and can you document the commercial rationale for their role on the supply chain?
7. Which suppliers have changed address or key personnel more than twice in the last 12 months, and do you have a documented explanation?

If you cannot answer three of these, the issue is no longer simply whether your accounts payable team holds a valid tax invoice. It extends into procurement, governance, contracts, systems and data protection.

Our full analysis covers what has changed, where the exposure sits, the contractual protections supplier agreements may now need, the data protection implications of collecting identity documents on a scale, and what businesses can realistically achieve before 1 October.

What changed, in three sentences

Article 54(bis) of the UAE VAT Law introduced a specific restriction on input VAT recovery where a supply forms part of a supply or supply chain connected with tax evasion and the taxable person knew, or should have known, of that connection. FTA Decision No. 13 of 2026 prescribes the supplier and supply verification measures relevant to determining whether a taxable person should have been aware of that connection and applies from 1 October 2026.

A valid tax invoice therefore remains necessary, but in affected cases it may no longer be sufficient: businesses also need contemporaneous evidence that the prescribed verification of suppliers and supplies has been carried out.

Where the exposure actually sits

• Contract silence. Read your standard supply agreement and purchase order terms. Most contain provisions dealing with VAT, invoicing and which party bears a tax charge. Far fewer address what happens where input VAT is denied because of the supplier’s conduct, inaccurate information, tax non-compliance or failure to cooperate with verification requirements. Without appropriate contractual protection, recovering that economic loss from the supplier may be difficult.
• The threshold problem The Decision contains more than one threshold. A taxable supply below AED 10,000 excluding VAT may generally fall outside the verification requirements. However, that exception is unavailable where aggregate supplies received from the same supplier exceed AED 100,000 over the preceding 12 months or are expected to exceed that amount over the following 12 months.

There is a second threshold at AED 375,000. Above that level, calculated by reference to the preceding or expected following 12 months, additional supplier checks apply, including obtaining written confirmation from an authorised UAE bank that the supplier has a bank account and reviewing publicly available reviews and media coverage from reliable sources.

Businesses therefore need visibility not only over individual invoice values but also aggregate and anticipated supplier spend.

• Intermediary chains. Where a supplier acts as an intermediary. The Decision requires a clear and justifiable commercial explanation for its role in the supply process. Businesses operating through traders, brokers or other intermediaries should therefore be able to document why that entity sits in the chain and what commercial function it performs.
• Payment patterns. The payment method and conditions must be commercially justifiable. Third-party involvement in making or receiving payment, or payment to a bank account outside the supplier’s country of incorporation, requires a reasonable commercial explanation consistent with the information available to the taxpayer. Cash payments require a documented commercial reason and must satisfy the applicable tax-law thresholds and be readily verifiable.
• Supplier changes and unusual activity. The Decision identifies specific risk indicators, including a supplier changing address more than twice in the preceding 12 months, changing key personnel more than twice during that period, or entering into transactions disproportionate or unexpected relative to the size and history of its business. Where an indicator exists, the taxpayer must retain a clear and justified explanation.

The contractual response

The Decision does not prescribe the terms that must appear in supplier contracts. However, businesses should consider whether their supplier agreements and standard purchase terms give them the information, cooperation and remedies needed to operate the new verification framework effectively.

That review may include:

• Supplier warranties covering incorporation and licensing information, VAT registration details where relevant, authority of representatives, accuracy of information supplied for verification purposes and compliance with applicable tax obligations.
• Information and cooperation covenants, requiring suppliers to provide evidence reasonably required for verification and to notify relevant changes, particularly changes in address, key personnel, banking arrangements and authorised representatives.
• An appropriately scoped indemnity for irrecoverable input VAT, assessments, penalties and reasonable associated costs to the extent caused by the supplier’s breach of its warranties or verification obligations, inaccurate information, tax non-compliance, misrepresentation or failure to cooperate.
• Verification and audit rights, allowing the customer to request supporting evidence and, where reasonably required, conduct or facilitate additional verification of the supplier and its place of business.Termination and suspension rights where required verification cannot be completed or material concerns identified through the verification process cannot satisfactorily be resolved.
• Data processing terms governing the personal data collected through the verification process, including identity documents and information concerning authorised representatives.

The appropriate provisions will depend on the supplier’s bargaining position, the value and nature of the relationship and the customer’s own role in satisfying the statutory requirements. Contract drafting cannot transfer the taxpayer’s own compliance obligations to the supplier, but it can materially improve its ability to obtain evidence and allocate losses caused by supplier-side failures.

The data protection issue

The Decision can require businesses to collect significant amounts of personal information.

Where a supplier is a natural person, this includes valid identification such as an Emirates ID or passport and a physical or virtual meeting before the supply. Where the supplier is a legal person, the taxpayer must verify the identity of the director, agent or employee authorised to represent it, including by obtaining valid proof of identity.

For material suppliers above the AED 375,000 threshold, the verification process also extends to bank confirmation and review of publicly available reviews and media coverage.

For businesses with large vendor populations, this creates a potentially significant personal data processing operation.

The VAT requirement may provide a legal basis for processing information genuinely required to comply with the Decision. It does not remove the need to consider data minimisation, retention periods, access controls, security, processor arrangements and, where applicable, cross-border transfers under the UAE data protection framework.

The risk is therefore straightforward: a business can strengthen its VAT compliance while simultaneously creating unnecessary data protection exposure if thousands of identity documents are collected without an appropriate governance framework.

The part that is genuinely good news

A properly maintained verification file creates a strong contemporaneous evidentiary record if the FTA subsequently reviews a supplier or supply chain.

It also forces businesses to identify suppliers with unexplained changes, unusual transaction patterns, opaque intermediary roles or unusual payment arrangements before those issues emerge during an audit.

And it gives procurement and finance teams another reason to rationalise unnecessarily fragmented vendor populations. Each additional supplier potentially creates onboarding, verification, monitoring and data-retention requirements..

What is realistic before 1 October

This week. Identify the material supplier population and map existing and expected spend against the Decision’s relevant thresholds: the AED 10,000 per-supply exception, the AED 100,000 aggregate supplier threshold that can disapply that exception, and the AED 375,000 threshold that triggers additional supplier verification requirements. Prioritise suppliers by value and risk rather than attempting to remediate the entire vendor master simultaneously. Introduce an interim onboarding process so that new suppliers engaged after 1 October are subject to the required checks. Review supply agreements currently being negotiated or renewed and consider adding the necessary verification provisions before signature.

By year end. Complete remediation of the material supplier base. Put in place the documented internal policy required by the Decision, identifying the individuals responsible for implementing, reviewing and supervising verification procedures and clearly defining their authority and responsibilities. Establish an appropriate retention, access and security model for verification records

Structurally, into 2027. Build system-level monitoring capable of applying the AED 10,000 per-supply threshold alongside the AED 100,000 and AED 375,000 supplier-level thresholds, including both historical and expected spend where required by the Decision. Introduce periodic re-verification so that suppliers are reviewed where they have not been verified during the preceding 12 months. Integrate the Decision’s risk indicators into vendor-master and procurement controls rather than treating verification as an isolated annual exercise.

 

How Galadari can help

We are working with clients on four specific things:

• A contract audit of material supplier agreements and standard purchase terms, together with appropriate supplier verification and risk-allocation clauses.
• A verification policy establishing the accountabilities, procedures and controls required under the Decision. An onboarding pack designed to collect the information required for VAT purposes while managing associated data protection obligations.
• Audit-readiness review of the resulting verification framework and supporting evidence.

If you would like to work through the seven questions above against your own position, reply to this email and we will set up a short call. Twenty minutes is usually enough to identify where the real exposure sits.

 

	Asmae Bazaani Counsel, Tax [email protected]
	Raka Roy Partner and Head of IP & Data Protection [email protected]