Financial Record Keeping UAE: Retention Periods and FTA Penalties

Every UAE business has to keep its accounting records, tax returns and supporting documents for at least 7 years from the end of the relevant tax period, with longer periods for capital assets (10 years) and real estate (15 years). Failing to maintain those records carries an FTA penalty starting at AED 10,000 per violation. Keeping accurate financial records is a legal obligation set by the UAE Tax Procedures Law and the Corporate Tax Law. When VAT launched in 2018 and corporate tax followed in 2023, plenty of SME owners treated record keeping as a filing formality. By 2026, with FTA inspection volumes climbing and the e-invoicing mandate close, that approach no longer holds. Financial record keeping in the UAE is now a full compliance discipline, and the penalties for getting it wrong stack up fast and are increasingly hard to dispute.

This guide covers what records you have to keep, how long to keep financial records in the UAE, what format the FTA expects, how the 2026 penalty framework applies, and how to build a system that keeps your business audit-ready every month. If your books have already fallen behind, our accounting and bookkeeping services in the UAE rebuild the record trail before it turns into an FTA problem.

What financial record keeping actually means here

Financial record keeping is the structured capture, organisation and retention of every document that evidences a business’s financial transactions and tax positions. Under UAE law, the obligation catches every taxable person — VAT-registered businesses, corporate tax registrants, excise-registered importers — regardless of size.

The legal framework comes from:

• Federal Decree-Law No. 47 of 2022 (Corporate Tax Law) — imposes 7-year retention for most records
• Federal Decree-Law No. 8 of 2017 (VAT Law) — sets minimum 5-year retention for VAT documents
• Federal Decree-Law No. 28 of 2022 (Tax Procedures Law, as amended) — governs format, accessibility and penalties
• AML-CFT regulations (Central Bank of the UAE) — require 5-year retention of customer due-diligence records for DNFBPs

The FTA does not distinguish between a startup with ten transactions a month and a trading company moving AED 50 million in inventory. The obligations apply equally, and the inspection apparatus has the tools to enforce them.

Which laws actually set the retention clock

Record-keeping in the UAE is not governed by a single law. It runs across five federal decrees, two cabinet decisions, and a layer of sector-specific guidance from the FTA, the Ministry of Finance and the Central Bank. SMEs that read only the Corporate Tax Law will miss obligations under the Companies Law or the AML-CFT framework. And the retention clock itself can reset depending on which statute applies to the document in front of you.

The table below maps the active 2026 framework. Where two statutes set different retention periods for the same document, the longer one wins.

So what counts as a record?

The FTA’s definition of a “record” is wider than the documents most SMEs keep in their accounting folder. A complete UAE record set spans 15+ categories: anything that evidences a transaction, supports a tax position, or proves corporate substance. Behind all of them sits a ledger built on the golden rules of accounting — if the underlying debits and credits are wrong, no amount of document retention will make the records defensible. During an audit, the inspector asks for each one by name, and a category you’ve never set up is still a category you can fail on.

Core accounting records:

• General ledger and all subsidiary ledgers (AR, AP, inventory, fixed assets)
• Journal entries and supporting narratives
• Trial balance for each reporting period
• Sales invoices and purchase invoices (tax invoices issued and received)
• Bank statements with monthly reconciliations
• Credit notes and debit notes
• Customs declarations and bayan documents (for importers)
• Payroll records, WPS files, end-of-service computations
• Fixed asset register with depreciation schedules
• Stock and inventory records with valuation workpapers

Corporate and legal records:

• Contracts and agreements (sales, supply, lease, service)
• Bank guarantees, loan documents, and facility agreements
• Board resolutions and corporate registers
• Shareholders’ agreements and UBO declarations
• Trade licence and licence amendments

Tax records and workpapers:

• VAT-201 returns and supporting calculations
• Corporate tax returns and tax computation workpapers
• Voluntary disclosure forms (VAT-211 / CT equivalents)
• FTA correspondence, assessment notices, and clearance letters
• Transfer pricing local file, master file, and CbCR submissions
• Excise tax returns (where applicable)

If a category exists in your business but you cannot produce it on inspection, the FTA can treat the gap as a “failure to maintain proper records”, even when your day-to-day bookkeeping is clean. Audit readiness is about completeness across every category, not depth in two or three.

Paper vs digital, and what the FTA will accept

The FTA accepts electronic records under Article 56 of Federal Decree-Law No. 47/2022 and Article 78 of the VAT Executive Regulation. The 2024 update to the Executive Regulation cleared the residual ambiguity that had pushed some businesses to keep paper backups. Electronic-only is now fully compliant, provided the system meets three conditions.

Records have to be legible — clearly readable on demand. PDF copies, scans, XML files, JSON exports and accounting software ledger views all qualify. Encrypted blobs or proprietary formats that cannot be opened without specific software the FTA does not run are not legible records. They also have to be retrievable within the audit window the FTA sets, typically 5 to 20 working days. A shared drive that takes three days to search through 6,000 PDFs may technically hold the data but fails the standard. And they have to keep their integrity, which means protection against unauthorised alteration through version control, access logs and timestamps. Cloud accounting software handles this automatically. A shared Excel file does not.

Cloud storage is accepted — Microsoft 365, Google Workspace, Zoho WorkDrive, Dropbox Business, AWS S3 — but data-residency considerations apply under the UAE PDPL (Federal Decree-Law No. 45/2021). If your records contain personal data of UAE residents, you should be able to identify where the data is physically stored and how cross-border transfers are governed.

Email archives count as records too. A purchase order confirmed by email, a supplier discount agreed in a thread, a customer scope variation — all of them are records the FTA can request during an audit of the underlying invoice. Auto-deletion policies that purge email after 90 days create gaps you cannot close.

Building a retention system that actually holds up

The “build a system” advice in most UAE accounting guides ends at “use cloud software”. Necessary, not sufficient. What follows is the retention architecture we deploy when reconstructing records during a backlog accounting engagement, and the same structure protects ongoing clients from audit pressure.

Start with a folder structure organised per entity, per year, per record type. Even with cloud accounting software, you need a parallel document folder structure, because not every record fits inside accounting software. The standard structure is [Entity Name] > [Financial Year] > [Record Category] with sub-folders for 01-Sales-Invoices, 02-Purchase-Invoices, 03-Bank-Statements, 04-VAT-Returns, 05-CT-Returns, 06-Contracts, 07-Payroll, 08-Fixed-Assets, 09-FTA-Correspondence. Build it in month one. Migrating folder structures retroactively across three years of data is the most painful task in any record-cleanup engagement.

Then get bank reconciliation on a monthly rhythm, closed by the 10th. Reconciliation is the spine of every audit. If we had to name the single most common record-keeping failure we see during FTA inspections, it’s unreconciled months, and it’s almost always the easiest one to have prevented. Lock the close calendar so every bank account is reconciled by the 10th of the following month, no exceptions. Carry-forward differences get investigated and resolved, not parked on a “to-be-cleared” line that never clears.

Attach source documents inside the accounting software itself — Zoho Books, QuickBooks Online and Xero all support this natively at the line-item level. The attachment is the record; the journal entry is the index. During an audit, the inspector clicks the transaction, sees the invoice instantly, and moves on. Without the attachment, you are searching folders while the inspector waits.

Back everything up in two directions: cloud plus offline, offsite plus onsite. Cloud accounting platforms handle the primary backup, but you still need a secondary — monthly exports (CSV + PDF) to an offline drive held offsite. Cloud accounts can be locked, accidentally deleted by an admin, or compromised. A 12-month offline export library is the cheapest insurance you will buy.

Lock down access controls and the audit trail. The accounting software has to log who edited what and when. Restrict chart-of-accounts and journal-entry permissions to senior staff only, and route junior bookkeepers through controlled forms (sales invoices, purchase bills) rather than raw journal entries. The audit trail itself is a record the FTA can request.

Once a year, review the retention horizon. Each financial year-end, run a retention audit: confirm 2021 records are still complete and accessible (the 5-year wall coming for VAT records), confirm 2019 capital asset records are still complete (10-year wall for capital assets), confirm 2011 real estate records are still complete (15-year wall). Map the calendar one year ahead so nothing gets destroyed prematurely.

Finally, dispose of records past the retention window using PDPL-compliant destruction. Records that have aged past their longest applicable retention period can be destroyed, but destruction itself is a regulated act under the PDPL where personal data is involved. Use a documented destruction process — a log of what was destroyed, when, by whom, and how (shredding, secure cloud deletion, drive-wiping certificate). For high-volume disposal, engage a certified data destruction provider and keep the destruction certificate as a record in its own right.

“

Audit-ready is not a year-end project. It is a monthly discipline: bank reconciliation by the 10th, source documents attached at posting, retention horizon reviewed every December. Businesses that follow this rhythm almost never fail an FTA audit.

The five slip-ups we see on almost every clean-up engagement

Five mistakes account for most record-keeping failures we see during FTA inspections of UAE SMEs. Each is fixable with a small process change. Left alone, each generates penalties that escalate with the audit period.

The first is treating WhatsApp invoices as “informal”. A supplier sends you a JPEG invoice on WhatsApp, the amount lands on the bank statement, you post the entry, and the JPEG stays in your phone. From the FTA’s perspective, that is not a record — it’s an unindexed file on a private device. WhatsApp invoices need to be downloaded, named, dated, attached to the journal entry, and archived in the folder structure exactly as a PDF invoice would be. The medium of delivery does not change the record obligation.

The second is having no fixed asset register. The FTA will ask for one during 8 out of 10 corporate tax audits. SMEs that never built one when the business was small now have a 4-year gap that takes weeks to reconstruct. The register is required from the first capital asset purchase, not from the year you hit AED 3 million in revenue.

Third: cash transactions without supporting documents. Cash purchases of office supplies, fuel, or small-vendor payments often happen without invoices, and without a receipt the FTA denies the input tax claim and disallows the expense for corporate tax. A simple petty cash log, signed by the recipient and supported by even a handwritten receipt, is the minimum acceptable standard.

Fourth, relying on email chains instead of formal records. A scope change agreed in a Gmail thread is not a contract amendment. If your underlying agreement says all variations have to be in writing on a signed document, the FTA can disallow the related revenue or expense recognition. Convert email-agreed variations to short formal amendments — a one-page signed addendum is enough.

And fifth, closing the year without indexed workpapers. Year-end accounts produced without supporting workpapers (depreciation schedule, prepayments, accruals, deferred revenue, intercompany reconciliations) are not audit-ready. The first auditor query is “show me the workpaper”. Build the workpaper at the time of the entry, not retroactively when the auditor calls.

What the 2026 penalty schedule looks like

The “derived assessment” line is the most expensive. When records are inadequate, the FTA can compute the tax position from bank deposits, sector benchmarks or comparable businesses, almost always producing a higher liability than your actual figures would have. A 25% penalty is then added on top. For a trading SME with AED 5 million in annual revenue, a derived assessment for a 2-year period can exceed AED 400,000. Multiples of what fixing the records would have cost.

For the wider penalty context across VAT, corporate tax and excise, see our guide to UAE tax penalties in 2026. For voluntary-disclosure mechanics, see the VAT return filing UAE guide.

Which records do you actually have to keep?

The scope is wider than most business owners assume. A compliant record-keeping system reaches across six categories.

Accounting records come first — general ledger, journal entries, chart of accounts, trial balance, and all subsidiary ledgers. These have to reflect every financial transaction on an accrual basis unless a formal exemption applies. Sitting on top of those are the financial statements: statement of profit or loss, statement of financial position, cash flow statement, and notes to accounts, prepared under International Financial Reporting Standards (IFRS) or IFRS for SMEs, as most UAE businesses must.

Then there are the supporting documents. Every accounting entry has to be backed by an original — sales invoices, purchase invoices, credit notes, delivery notes, contracts, purchase orders, bank statements, payment vouchers, payroll records. One thing to flag here: proforma invoices do NOT belong in this category. They sit outside the VAT framework and should not be posted to the sales or purchase ledger. Only the matching tax invoice creates a recordable transaction, and without supporting tax invoices your books are incomplete in the eyes of the FTA.

Tax records are the fourth layer — VAT returns, corporate tax returns, excise returns where applicable, tax registration certificates, FTA correspondence, voluntary disclosure submissions, and any assessment notices received. The workpapers behind your corporate tax filings belong here too, and well-maintained tax records are the first line of defence during an FTA tax audit. Asset records cover every capital item in a fixed asset register: purchase date, cost, depreciation method, rate, accumulated depreciation, net book value, with real estate carrying a 15-year retention period. And if your business transacts with related parties — especially across a free zone structure — transfer pricing documentation showing arm’s length pricing rounds out the set. See our guide to transfer pricing in the UAE for what that means in practice.

Who has to comply?

There is no general exemption from financial record-keeping obligations in the UAE. The rules apply to:

• All VAT-registered businesses (mandatory from AED 375,000 annual taxable turnover)
• All corporate tax registrants (mandatory for most juridical persons with UAE operations)
• Excise-registered importers and producers
• DNFBPs (designated non-financial businesses and professions) under AML regulations — accountants, real estate brokers, precious metals dealers, corporate service providers

The only meaningful concession is the UAE Small Business Relief election under the Corporate Tax Law, which exempts qualifying businesses with revenue below AED 3 million from corporate tax liability for periods ending before 31 December 2026. Important caveat: this does not exempt them from record-keeping or registration obligations. It exempts the taxable income, not the compliance structure.

Seven steps to a clean record-keeping system

Here is how to build a structured system that keeps your business compliant and accurate records available on demand.

Step 1: Choose a cloud accounting platform

Pick software that supports UAE VAT (tax-compliant invoicing, return preparation), generates audit trails automatically, and stores records digitally with automatic backups. Zoho Books, QuickBooks Online, Xero and Sage Business Cloud all have UAE-localised VAT modules. Check that the platform supports multi-currency if you deal internationally. A properly configured platform is the foundation of any sound UAE record-keeping setup.

Step 2: Set up a structured chart of accounts

Your chart of accounts has to reflect the nature of the business and align with IFRS requirements. Revenue, cost of sales, operating expenses, assets, liabilities and equity all clearly categorised. A clean chart makes every subsequent step (VAT filing, corporate tax computation, management reporting) significantly easier. Businesses with a muddled chart of accounts almost always have muddled records.

Step 3: Record every transaction on the day it occurs

Do not let transactions accumulate. Every sale, purchase, payment, receipt, bank transfer and journal entry posted on the transaction date. Daily entry is the single most important discipline in UAE record keeping. It kills end-of-month backlogs, reduces errors, and means your books are current the moment the FTA calls.

Step 4: Attach source documents to every entry

Every transaction in the system should have the original invoice, contract or bank statement attached digitally. That creates the audit trail the FTA requires and turns an inspection from chaos into something manageable. For purchase invoices, also verify the supplier is VAT-registered before claiming input tax — see our guide to VAT penalties in the UAE for what happens when claims are unsupported.

Step 5: Reconcile bank accounts every month

Bank reconciliation is the backbone of compliant bookkeeping. Every month, your accounting records have to agree with your bank statements to the dirham. Unexplained differences are investigated and cleared before the month closes, not carried forward indefinitely. Our bookkeeping services in Dubai include monthly reconciliation as standard.

Step 6: Maintain a fixed asset register from day one

Every capital asset — furniture, equipment, vehicles, computers, machinery — tracked in a dedicated register showing purchase date, cost, supplier, depreciation method, useful life and current net book value. Update it whenever an asset is acquired, disposed of or impaired.

Step 7: Run a quarterly internal review

Each quarter, reconcile VAT returns against your accounting records, check the corporate tax position, confirm input tax claims are supported by valid invoices, and confirm nothing is missing. Quarterly reviews spread the compliance work across the year and keep the business audit-ready, instead of producing a year-end crisis.

When the retention clock actually starts

The question of how long to keep financial records UAE businesses generate has no single answer, because the retention periods are not uniform — and the most common mistake is measuring the retention clock from the wrong start date.

The 7-year period under the UAE Corporate Tax Law begins at the end of the relevant tax period, not the date of the underlying transaction. A sales invoice dated 15 March 2026 for a business with a 31 December year-end falls within the 2026 corporate tax period, which ends 31 December 2026. The 7-year clock starts there. The invoice has to be kept until 31 December 2033, not until 15 March 2033. The difference is small here, but for a business with many transactions and a March year-end, the gap compounds across thousands of documents.

For VAT, the Tax Procedures Law sets a minimum 5-year period from the end of each tax period. Because the Corporate Tax Law imposes 7 years on the same underlying documents, most businesses should default to 7 years for everything and avoid the gap.

Format rules — physical, digital, Arabic on request

The FTA accepts both physical and digital records, but the conditions for each are strict.

Digital records have to be secure, easily retrievable, protected against unauthorised alteration, and available for inspection without delay. Loose, unsorted PDFs in a shared folder do not meet the standard. They have to sit inside a structured system — accounting software, an ERP, or a governed cloud filing structure — that lets any auditor trace a transaction from a return to its source document in minutes. Physical records, by contrast, have to be held at the business’s registered address or head office in the UAE, accessible on request and clearly readable across the full retention period. Paper degrades: ink fades, paper warps. That is why moving to digital-first record keeping is strongly advisable.

Language is the last piece. The FTA can request records in Arabic at any time. Your day-to-day books can be maintained in English, but you have to be able to produce Arabic translations of financial statements and key records when the FTA asks. The penalty for failure was reduced under the 2026 framework; the obligation itself stayed.

Retention and penalty tables at a glance

Retention requirements

[[chart:retention-periods]]

Penalty framework (Cabinet Decision No. 129 of 2025, effective 14 April 2026; e-invoicing penalties under Cabinet Decision No. 106 of 2025)

[[chart:penalty-amounts]]

What a record-keeping gap actually costs

A Dubai mainland trading company has a 31 December year-end. During a 2026 FTA inspection of its VAT returns for January–June 2024, the inspector identifies:

• 12 purchase invoices totalling AED 240,000 missing from the records (input tax of AED 12,000 was claimed)
• Bank reconciliation for March and April 2024 never completed
• Fixed asset register not updated since 2022

Penalty calculation:

In practice, the FTA may treat the missing invoices as separate violations per return period rather than per invoice, which can move this figure up or down depending on the inspector’s assessment. The point stands: a 3-item record-keeping gap — missing invoices, two incomplete reconciliations, an outdated asset register — generates AED 162,000 in direct cost before any interest on the denied input tax.

This is a realistic scenario for an SME that relied on year-end clean-ups rather than monthly discipline. The penalty regime is built to be cumulative.

E-invoicing is the next shift you’ll feel

The UAE is rolling out mandatory e-invoicing using a Decentralised Continuous Transaction Control and Exchange (DCTCE) model. The timeline:

Under e-invoicing, the FTA gets near real-time visibility into your transactions. Invoices have to be issued in structured digital formats (XML or JSON) and transmitted to the FTA’s platform. Businesses still on Word or Excel invoicing will need to upgrade their systems before their compliance deadline. For what is changing, see our guide to UAE e-invoicing 2026.

Mistakes we see again and again

Where this leaves you

The direction of UAE tax administration is clear: more data, more frequent checks, less tolerance for incomplete records. Businesses that treat bookkeeping as a year-end task rather than a daily discipline will keep accumulating exposure.

Four things to do now:

1. Audit your current retention policy. Check whether records from 2019 and 2020 — the early VAT years — are still accessible and complete. An FTA audit of a 2026 VAT refund claim can need documents going back to 2020.

2. Move to a cloud accounting platform with UAE VAT support if you have not already. The platform should generate compliant tax invoices in line with the UAE tax invoice format for 2026, keep an automatic audit trail, and let you attach source documents to every transaction. Quick utility for one-off invoices: our free UAE tax invoice generator produces a compliant PDF in under a minute.

3. Prepare for e-invoicing by checking whether your current system can generate structured digital invoices in XML or JSON format. If your revenue is approaching AED 50 million, the January 2027 deadline is close.

4. Map your group structure to your record obligations. Businesses operating multiple UAE entities under a corporate tax group face consolidated record-keeping rules. Each member entity still has to maintain its own books while the parent holds the consolidated workpapers and elimination schedules.

For businesses with incomplete records going back several years, a backlog accounting engagement can reconstruct the record trail before it becomes an FTA problem. For ongoing monthly support that keeps records current and audit-ready, Velmont Crest’s accounting and bookkeeping services cover the full compliance cycle. Where an external audit is imminent, our audit assistance service closes the gap between your internal books and the auditor’s workpaper expectations.

Ready to move from year-end clean-ups to audit-ready every month? Talk to Velmont Crest for a no-pressure review of your current record-keeping setup against the 2026 framework.

For UAE accounting, VAT and corporate tax support, see Velmont Crest’s accounting practice.

References

• Federal Tax Authority (FTA) — Official Portal
• UAE Ministry of Finance — Tax Legislation
• Central Bank of the UAE — AML-CFT Rulebook