Income Tax Audit UAE 2026: What an FTA Tax Audit Really Means

There is no income tax audit in the UAE, because the UAE levies no personal income tax. What businesses mean by an income tax audit is an FTA corporate tax audit under Federal Decree-Law 47/2022 or a VAT audit under Federal Decree-Law 8/2017, both run under the Tax Procedures Law.

Income tax audit UAE is one of the most-typed searches when an FTA letter lands, and it’s also one of the most misleading. The UAE has no personal income tax and no separate federal income tax law for businesses. What you’re actually facing is an FTA corporate tax audit under Federal Decree-Law 47/2022 or a VAT audit under FDL 8/2017. Both run on the procedural rails of FDL 28/2022 on Tax Procedures.

Below: what an “income tax audit” actually is in UAE practice, what triggers FTA scrutiny, what documents to expect, the timeline that governs your response, the penalty exposure, and the defence playbook that turns an audit into paperwork instead of a six-figure liability.

Does the UAE have income tax — and if not, what is being audited?

No, the UAE does not have an income tax in the sense most owners mean it. There is no UAE income tax law, and there is no personal income tax on salaries or individual earnings in any of the seven emirates. That is settled at source: the UAE Government portal states plainly that the country “does not levy income tax on individuals”. Employees whose home country still taxes them — Indian nationals in particular — should read our guide to tax in Dubai on salary for Indian expatriates, because the exposure there sits in India, not in the UAE.

The closest equivalent for businesses is corporate tax under FDL 47/2022, which took effect for tax periods starting on or after 1 June 2023. So an income tax audit in the UAE is really a corporate tax or VAT audit under a different name.

When a UAE business searches for income tax audit, the actual scenario is almost always one of three things:

1. Corporate tax audit — the FTA reviewing a corporate tax return filed under FDL 47/2022.
2. VAT audit — the FTA reviewing VAT-201 returns under FDL 8/2017.
3. Excise tax audit — the FTA reviewing excise filings under FDL 7/2017 (rare outside specific sectors).

All three operate under the same procedural framework: Federal Decree-Law 28/2022 on Tax Procedures, supported by Cabinet Decision 74/2023 (the Executive Regulation) and, from 14 April 2026, the unified administrative-penalty regime in Cabinet Decision 129/2025 (with Cabinet Decision 75/2023 governing corporate tax penalties). The procedural layer matters more than which substantive tax is being audited. The audit notice, document request, response window and appeal route are the same regardless.

Velmont Crest is a DED-licensed UAE accounting firm supporting SMEs through FTA audit preparation and corporate tax compliance.

Income tax audit UAE: the dated facts table

Every row below was checked against the primary source linked beside it on 4 August 2026. Anything we could not confirm against the FTA, the Ministry of Finance or the UAE Government portal is not in this table.

Read that table in one breath and the whole search term explains itself. There is nothing called income tax to audit, so an audit letter is always about one of three registered taxes — and the ten-business-day notice is the only part of the process you cannot buy back once it starts running.

How far back the FTA can reach

Article 46 of FDL 28/2022 sets the statute of limitations for FTA audits at five years from the end of the relevant tax period. That window runs to fifteen years where tax evasion is involved (Article 46(7)) or where a business that should have registered never did (Article 46(8)). Those were clauses 46(6) and 46(7) before Federal Decree-Law 17/2025 inserted a new clause 4 on refund applications, shifting everything below it down one from 1 January 2026.

Five years is the headline, not the whole rule. On the text of FDL 28/2022 as published by the FTA, Article 46(2) lets the FTA finish an audit it opened inside the five years for up to four more years from the date of the audit notification, and Article 46(3) gives it one further year where the audit relates to a voluntary disclosure filed in the fifth year. Notify late in year five and the practical reach is closer to nine.

The direction of travel is more FTA reach, not less. Federal Decree-Law 17/2025 amended the Tax Procedures Law with effect from 1 January 2026, and the Ministry of Finance describes the change as expanding the limitation provisions, “granting the Authority the power to conduct tax audits or issue tax assessments after the expiry of the limitation period in certain cases, such as refund requests submitted in the final year of the limitation period.” The same decree-law caps credit-balance refund requests at five years from the end of the relevant tax period. Because Article 46 was amended, check the consolidated text before relying on a specific clause number in correspondence with the FTA.

For corporate tax, the practical effect is that a first-year filer (tax period ending December 2024, return due September 2025) remains exposed to FTA scrutiny of that period until the end of 2029 — later still if the FTA opens an audit before that date. For VAT, the same five-year reach applies to every quarterly VAT-201 already filed.

What the FTA’s risk engine actually flags

The FTA does not publish a trigger list, but the patterns from our audit-defence engagements are clear. The most common triggers:

1. Revenue-line mismatch between VAT-201 and the corporate tax return for the same period.

2. Repeated VAT refund claims — particularly where input tax consistently exceeds output tax beyond a sectoral norm.

3. Aggressive free-zone qualifying-income claims — businesses claiming 0 percent corporate tax under Article 18 of FDL 47/2022 without proper substance or Qualifying Activity documentation.

4. Related-party transactions without transfer-pricing memos — particularly intercompany management fees, royalties and loans.

5. Persistent late filings or payments — the FTA’s risk-scoring algorithm flags chronic non-compliance.

6. Sector-wide reviews — periodic deep dives into specific sectors (e-commerce, real estate, restaurants) typically pull dozens of taxpayers into audit in parallel.

7. Third-party data — customs declarations, bank and financial-institution reporting, and informant tip-offs all feed the FTA’s risk engine.

One thing that is not a trigger, despite the fear around it: filing a voluntary disclosure does not by itself pull you into an audit. In our experience the FTA treats a voluntary disclosure as cooperation: under the regime in force from 14 April 2026 (Cabinet Decision 129/2025), a disclosure made before an audit notice carries a far lower penalty — 1 percent per month — than an error the FTA uncovers itself. If you’ve found an error, disclosing it is usually the cheaper road.

When the letter lands, the clock is 10 days

Article 16(2) of FDL 28/2022 requires the FTA to give at least 10 business days’ written notification before commencing an audit. The exception is Article 16(4): where the FTA has serious grounds to believe evasion is involved, or that notice would hinder the audit, an auditor may enter without notification and temporarily close the premises for up to 72 hours — extendable only with a Public Prosecution permit.

In practice, the audit begins with an electronic notification through your EmaraTax account, followed by a document request specifying:

• The tax periods under review (typically two to five years).
• The list of records required (see next section).
• The production deadline — typically 10 business days from the date of the request.
• The contact details of the FTA officer assigned.
• Whether the audit is desk-based or on-site.

Extensions are available but must be requested in writing before the original deadline expires. Late requests are routinely declined, and silence is interpreted as non-cooperation — accelerating the FTA’s move to a tax assessment based on best judgement, which is invariably worse than the actual position.

“

The 10-business-day window is short — but every business that responds inside it lands in a fundamentally better negotiating position than one that asks for a third extension.

The document pack the FTA expects

The standard document list across both corporate tax and VAT audits is broad. Expect requests for:

The payroll row is the one most finance teams under-prepare. Employment contracts and WPS files are usually available; the end-of-service computation behind the accrual often is not, and reproducing it under audit conditions is exactly when the divisor disputes described in our guide to gratuity as per UAE labour law surface.

The FTA can also request read-only access to your accounting system — Tally, Zoho Books, QuickBooks, Xero or SAP. Preparing read-only export files in advance is far stronger than scrambling for screenshots once the audit is live.

Two things the officer looks for inside that system are the audit trail and the period-lock. Software that lets a user delete a posted invoice without leaving a trace creates a problem of its own: nobody can then demonstrate that the ledger you handed over is the ledger you filed from. Lock each period once it is closed, leave the change log switched on, and export that log alongside the trial balance.

It also helps to know what comes out the other end. There is no signed tax audit report at the close of an FTA corporate tax audit in the way a statutory audit produces one — the FTA notifies you of the audit results in writing, and where it proposes adjustments, issues a tax assessment. The statutory audit report your external auditor signs sits under a separate regime entirely. Owners find it useful to keep the different kinds of audit straight: the FTA tax audit covered here, the statutory external audit required by your licence or free zone, and the internal audit you commission yourself.

How long you have to keep the file

The document pack only exists if the records still exist. Retention is set in three places, and the longest period wins for any given document.

Cabinet Decision 74/2023, the Executive Regulation of the Tax Procedures Law, sets the base periods in Article 3(1). Then Article 3(2) bolts on extensions that most businesses never budget for — and every one of them is triggered by exactly the situation this article is about.

Two rows deserve a second read. The seven years for real estate records is the general Tax Procedures figure, and Article 3(1) applies it only “unless the Tax Law states otherwise” — for VAT purposes the Tax Law does say otherwise, and real estate records run to fifteen years under Article 71(2) of the VAT Executive Regulation, re-enacted by Cabinet Decision No. 100 of 2024. A VAT-registered property business should plan around fifteen. And the moment an FTA notification of intent to audit lands, Article 3(2)(c) adds four years to whatever period was already running, so a purge scheduled for next quarter has to be cancelled the day the letter arrives.

In practice we tell clients to run a single retention rule of ten years across the whole ledger rather than trying to sort documents into five-, seven- and ten-year buckets. Cloud storage is cheap; reconstructing a destroyed 2024 fixed-asset register under audit conditions is not.

What the penalties really stack up to

Two separate penalty schedules apply, and mixing them up is the most common error we see in advice circulating online. Corporate tax penalties sit in Cabinet Decision 75/2023, as amended by Cabinet Decision 10/2024. VAT and excise penalties sit in Cabinet Decision 40/2017, as amended by Cabinet Decision 129/2025 with effect from 14 April 2026 — and that decision defines “Tax Law” as the Excise Tax Law and the VAT Law only, so it does not reach corporate tax at all.

The two schedules have converged on the big numbers without merging. Here are the items an audit actually turns on, read straight off both decisions:

Two things stand out. The 14 percent annual late-payment penalty is charged per month or part month on the unsettled amount from the day after the due date — and for a voluntary disclosure or a tax assessment, the clock starts 20 business days from submission or receipt, not from the original return date. And item 12 is the one nobody budgets for: AED 20,000 for failing to facilitate the tax auditor under Article 20 of FDL 28/2022, payable from the person’s, legal representative’s or tax agent’s own funds. Obstruction is a priced offence, not a tactic.

On top of the administrative schedule sits the criminal one. Tax evasion under FDL 28/2022 carries a fine of up to three times the evaded tax, plus possible imprisonment, and evasion is what extends the audit window from five years to fifteen.

What the stack actually looks like in AED

Take a trading company with a December year-end that under-declared taxable income of AED 1,400,000 in the 2024 tax period, filed its return on time, paid nothing extra, and is notified of an audit in September 2026 — 12 months after the 30 September 2025 payment due date.

The tax itself is AED 126,000. Everything above it — AED 61,660, or 49 percent on top — is avoidable. Had the same error been found internally and disclosed before the audit notice, the fixed 15 percent and the record-keeping penalty both fall away, and the exposure drops to roughly AED 158,760. That gap is the entire argument for a mock audit. Use our corporate tax calculator to model the tax line for your own numbers.

These figures are worked from the published penalty schedules for a single period and a single tax. Stacked across several periods, or across corporate tax and VAT together, a single audit runs well into six figures of AED before the assessed tax is added.

What we tell clients to fix before the letter ever arrives

The strongest audit defence is built before the notification ever arrives, and five things separate the clean closures from the six-figure assessments.

Start with monthly close discipline. Books closed by the 5th of the following month, reconciliations papered up, VAT-201 cross-referenced to the management P&L. Almost every audit problem we see traces back to a reconciliation gap nobody investigated at the time. The same close that makes a statutory audit painless makes an FTA audit painless, which is why our audit preparation checklist doubles as tax-audit readiness. Two specific reconciliations do most of the work: input VAT and output VAT in the UAE tied back to the ledger, and closing stock tied back to a counted quantity — the discipline set out in our inventory management best practices playbook.

Then keep a transfer-pricing memo for every related-party flow. Intercompany management fees, royalties, loans and shared-services arrangements all have to meet the arm’s-length principle in Article 34 of FDL 47/2022, and formal master- and local-file documentation becomes mandatory under Ministerial Decision 97/2023 once revenue reaches AED 200 million (or the group’s consolidated revenue reaches AED 3.15 billion). The FTA tends to expect supporting analysis well before those thresholds in audit selection.

If you claim Qualifying Free Zone Person status under Article 18, keep a live substance file: the Qualifying Activity evidence, employee headcount, premises proof and expenditure analysis. Substance is what survives an audit, not the licence on its own.

Route everything through a single named contact. One partner-level point of contact handles all FTA correspondence, because multiple voices to the officer create inconsistency and inconsistency creates further questions.

And run a mock audit once a year. Pick a closed period, pull every document the FTA would request, fix the gaps, re-shelve the file, repeat. The cost is modest and the readiness it buys is decisive.

If you disagree with the assessment

If the FTA issues an assessment you disagree with, FDL 28/2022 lays out a four-stage route with a statutory clock on every step. Missing one of these deadlines does not weaken your case — it ends it. Every figure below is quoted from the text of the Tax Procedures Law as published by the FTA, checked on 4 August 2026.

Three gates decide whether you even get heard. An objection is refused outright under Article 32(2) if no reconsideration request was filed first, if the tax in dispute has not been paid in full, or if it is late. At court level, Article 36(2) adds a further condition: the appeal is inadmissible unless you can prove settlement of the full tax and at least 50 percent of the administrative penalties determined by the committee.

There is also a value threshold worth knowing before you plan a strategy. Under Article 33(3) the committee’s decision is final where the total due tax and administrative penalties do not exceed AED 100,000 — below that figure, the committee is the end of the road, and its decision is directly enforceable through the execution judge. Above AED 100,000, either side has 40 business days to appeal before the decision becomes an executory instrument.

Article 35 allows the FTA or the committee to extend most of these periods, but a refusal of an extension is itself final and cannot be objected to or appealed. Plan on the deadlines as written.

Most disputes resolve at the review or reconsideration stage when the documentation is solid. Courtroom appeals are rare and resource-intensive — and the cash requirement to reach one, full tax plus half the penalties, is usually the reason.

FAQs

The accordion below addresses the questions we hear most often from UAE business owners preparing for or responding to an FTA audit. For tailored audit preparation support, book a consultation with our team.