Income Tax Audit UAE 2026: FTA Tax Audit Triggers, Process & Defence

The phrase income tax audit UAE is one of the more common search terms accounting teams type into Google when an FTA letter arrives — and one of the more misleading. The UAE has no personal income tax and no separate federal income tax law for businesses. What you are facing is almost certainly an FTA corporate tax audit under Federal Decree-Law 47/2022 or a VAT audit under FDL 8/2017 — both running on the procedural rails of FDL 28/2022 on Tax Procedures.

This guide walks through what an income tax audit really means in UAE practice, what triggers FTA scrutiny, the document requests you should expect, the timeline that governs your response, the penalty exposure you face, and the defence strategy that turns an audit into a paperwork exercise rather than a six-figure liability.

What an Income Tax Audit Really Means in the UAE

There is no UAE income tax law. The closest equivalent for businesses is corporate tax under FDL 47/2022, which took effect for tax periods starting on or after 1 June 2023. For individuals, no income tax exists at federal level or in any of the seven emirates.

When a UAE business searches for income tax audit, the actual scenario is almost always one of three things:

1. Corporate tax audit — the FTA reviewing a corporate tax return filed under FDL 47/2022.
2. VAT audit — the FTA reviewing VAT-201 returns under FDL 8/2017.
3. Excise tax audit — the FTA reviewing excise filings under FDL 7/2017 (rare outside specific sectors).

All three operate under the same procedural framework: Federal Decree-Law 28/2022 on Tax Procedures, supported by Cabinet Decision 74/2023 (the Executive Regulation) and Cabinet Decision 49/2021 (Administrative Penalties). Understanding this procedural layer matters more than which substantive tax is being audited — the audit notice, document request, response window and appeal route are the same regardless.

Velmont Crest is a DED-licensed UAE accounting firm with eight-plus years of practice experience supporting SMEs through FTA audit preparation and corporate tax compliance.

The Five-Year Window — and the 15-Year Exception

Article 46 of FDL 28/2022 sets the statute of limitations for FTA audits at five years from the end of the relevant tax period. That window has three extensions worth knowing:

• Seven years — where the taxable person submits a voluntary disclosure in the fifth year, the limitation extends by one more year for the FTA to assess.
• 15 years — where the FTA suspects tax evasion or non-registration, the limitation extends to fifteen years.
• Suspension — the clock pauses during any active audit or objection, and resumes once the matter is closed.

For corporate tax, the practical effect is that a first-year filer (tax period ending December 2024, return due September 2025) remains exposed to FTA scrutiny of that period until at least 2030. For VAT, the same five-year reach applies to every quarterly VAT-201 already filed.

What Triggers an FTA Tax Audit

The FTA does not publish a trigger list, but the patterns visible in our audit-defence engagements are clear. The most common triggers are:

1. Revenue-line mismatch between VAT-201 and the corporate tax return for the same period.
2. Repeated VAT refund claims — particularly where input tax consistently exceeds output tax beyond a sectoral norm.
3. Aggressive free-zone qualifying-income claims — businesses claiming 0 percent corporate tax under Article 18 of FDL 47/2022 without proper substance or Qualifying Activity documentation.
4. Related-party transactions without transfer-pricing memos — particularly intercompany management fees, royalties and loans.
5. Persistent late filings or payments — the FTA’s risk-scoring algorithm flags chronic non-compliance.
6. Sector-wide reviews — periodic deep dives into specific sectors (e-commerce, real estate, restaurants) typically pull dozens of taxpayers into audit in parallel.
7. Third-party data — customs declarations, bank reporting under economic substance rules, and informant tip-offs all feed the FTA’s risk engine.

What is not a trigger, despite popular fear: filing a voluntary disclosure does not by itself prompt an audit — in our experience the FTA generally treats voluntary disclosures as cooperation and applies reduced penalties (Article 24 of Cabinet Decision 49/2021).

The Audit Notification and 10-Day Clock

Article 17 of FDL 28/2022 requires the FTA to give at least five business days’ written notification before commencing an audit — except where notification would prejudice the audit (typically suspected evasion).

In practice, the audit begins with an electronic notification through your EmaraTax account, followed by a document request specifying:

• The tax periods under review (typically two to five years).
• The list of records required (see next section).
• The production deadline — typically 10 business days from the date of the request.
• The contact details of the FTA officer assigned.
• Whether the audit is desk-based or on-site.

Extensions are available but must be requested in writing before the original deadline expires. Late requests are routinely declined, and silence is interpreted as non-cooperation — accelerating the FTA’s move to a tax assessment based on best judgement, which is invariably worse than the actual position.

“

The 10-business-day window is short — but every business that responds inside it lands in a fundamentally better negotiating position than one that asks for a third extension.

Documents the FTA Will Request

The standard document list across both corporate tax and VAT audits is broad. Expect requests for:

The FTA can also request read-only access to your accounting system — Tally, Zoho Books, QuickBooks, Xero or SAP. Preparing read-only export files in advance is far stronger than scrambling for screenshots once the audit is live.

Penalty Exposure Under FDL 28/2022

Penalty exposure is governed by Cabinet Decision 49/2021 on Administrative Penalties (as amended). The headline figures most relevant to an audit:

• Failure to keep required records — AED 10,000 first offence; AED 20,000 repeat offence (per Article 1).
• Failure to submit return on time — AED 500 per month for the first twelve months; AED 1,000 per month thereafter.
• Failure to submit voluntary disclosure — AED 1,000 first offence; AED 2,000 repeat offence.
• Late-payment penalty — 2 percent of unpaid tax immediately on the day following the due date, plus 4 percent monthly thereafter, capped at 300 percent of the tax due.
• Voluntary disclosure penalty — tiered: 5 percent if disclosed within one year, 10 percent in year two, 20 percent in year three, 30 percent in year four, 40 percent in year five.
• Tax-evasion penalty — up to five times the unpaid tax under Article 25 of FDL 28/2022, plus criminal exposure.

Stacked across multiple periods, a single audit can comfortably exceed AED 200,000 in penalties before the assessed tax itself is added. Use our corporate tax calculator to model the tax exposure side of any assessment scenario.

The Defence Strategy: What Works at Audit

The strongest audit defence is built before the audit notification arrives. The five components that separate clean audit closures from six-figure assessments:

1. Monthly close discipline. Books closed by the 5th of the following month, reconciliations papered up, VAT-201 cross-referenced to the management P&L. Most audit problems begin with a reconciliation gap nobody investigated at the time.
2. A transfer-pricing memo for every related-party flow. Intercompany management fees, royalties, loans and shared-services arrangements all require contemporaneous documentation under Article 34 of FDL 47/2022 once the AED 50 million revenue threshold is crossed — and the FTA expects it earlier in audit selection.
3. Free-zone substance file. If you claim Qualifying Free Zone Person status under Article 18, keep a live folder containing the Qualifying Activity evidence, employee headcount, premises proof and expenditure analysis. Substance is what survives audit, not the licence alone.
4. A single named contact. One partner-level point of contact handles all FTA correspondence. Multiple voices to the FTA officer create inconsistency, and inconsistency creates further questions.
5. An annual mock audit. Pick a closed period and pull every document the FTA would request. Fix the gaps. Re-shelve. Repeat next year. The cost is modest; the readiness it builds is decisive.

Appeal Routes Under FDL 28/2022

If the FTA issues an assessment you disagree with, there is a structured three-stage appeal route:

1. Reconsideration — submit to the FTA within 40 business days of the assessment (Article 27 of FDL 28/2022). The FTA has 40 business days to respond.
2. Tax Disputes Resolution Committee (TDRC) — file within 40 business days of the reconsideration decision. Tax generally must be paid before objection unless a deferment is granted.
3. Federal Courts — escalate to the Federal Court of First Instance, then the Court of Appeal, then the Federal Supreme Court if needed.

Most disputes resolve at the reconsideration stage with proper documentation. Courtroom appeals are rare and resource-intensive — plan to settle at TDRC or below.

Frequently Asked Questions

The accordion below addresses the questions we hear most often from UAE business owners preparing for or responding to an FTA audit. For tailored audit preparation support, book a consultation with our team.