Statutory Audit Requirements UAE: Which Companies Must Audit and When

The mandatory audit requirements for companies in the UAE come from three separate rulebooks, and one company can be caught by any of them. The Commercial Companies Law requires joint stock companies and LLCs to be audited yearly; each free zone authority sets its own conditions; and corporate tax adds audited-accounts triggers for larger businesses, every qualifying free zone person and every tax group.

The phrase “statutory audit requirements UAE” gets typed into search bars by two very different people: a founder who has just received a licence-renewal notice asking for audited financial statements, and a finance manager whose company has crossed a corporate tax threshold and now needs an auditor for the first time. Both are asking the same underlying question — do we actually have to do this, and if so, who, what and when?

The honest answer is that UAE audit obligations are scattered across three separate rulebooks — the Commercial Companies Law, individual free zone regulations, and the corporate tax regime — and a company can be caught by any one of them. This guide pulls those threads together, cites the article behind each requirement, and draws the line between a statutory audit and the internal audit it is so often confused with. It also sets out the UAE audit requirements for 2026 — the thresholds, the deadlines and the free-zone-by-free-zone rules.

Read it as one question rather than three. The UAE audit requirements that bind your company are whichever of the three rulebooks sets the stricter standard, and that is rarely the one you were expecting.

The three rulebooks that make an audit mandatory in the UAE

Before anything else, it helps to see the map. These are the three sources of obligation, and they operate independently — satisfying one tells you nothing about the other two.

Rows verified against the primary texts and checked on 4 August 2026. The practical instruction that follows is unglamorous but genuinely useful: answer the three questions separately, in writing, once a year. Most of the businesses that discover a statutory audit obligation late did so because they checked only the rulebook they already knew about.

There is one more reason to run all three checks rather than one. A statutory audit requirement in UAE company law does not switch off because a free zone has waived its own filing condition, and a free zone deadline does not move because the FTA has not asked for anything. The obligations stack. A statutory audit in Dubai for a mainland LLC that also sits inside a tax group is answering to the Commercial Companies Law and to FTA Decision No. 7 of 2025 at the same time, on two different timetables.

What a statutory audit actually is

A statutory audit is an independent examination of a company’s financial statements, carried out by an external auditor, that ends in a signed report on whether those accounts give a fair view. The word “statutory” is doing real work: it means a law or regulation compels the audit, as opposed to a voluntary review a company commissions for its own comfort.

Article 247(2) of the Commercial Companies Law is unusually direct about what the report has to say. It must state whether the accounts have been prepared in accordance with the Decree-Law and whether they give a fair view of the financial position of the company. Article 247(1) adds that the auditor states their own name on the report and signs it — a personal signature, not a firm stamp alone.

The defining feature is the audience. A statutory audit exists to give third parties — shareholders who are not involved in day-to-day management, banks deciding whether to lend, free zone registrars checking compliance, and increasingly the Federal Tax Authority — a reason to trust the numbers. Audit is the one branch of accounting you cannot perform on your own numbers, and our guide to where audit sits among the types of accounting shows how it differs from the financial, management and tax work that produced the statements being examined.

Contrast that with an internal audit, and the difference becomes clear. Internal audit is a management function — it examines controls, processes and risk from the inside, and its findings stay with leadership. A statutory audit is external, independent, and its output is a formal report addressed beyond the boardroom. Confusing the two leads companies to assume an internal review satisfies a licence or tax requirement. It does not.

The mainland rulebook: the Commercial Companies Law

The foundation of UAE audit law for mainland companies is Federal Decree-Law No. 32 of 2021 on Commercial Companies. Most articles that matter here sit close together, and they are short enough to read directly rather than through a summary.

Every row read in the primary text published by the Ministry of Economy and Tourism and checked on 4 August 2026. Two points are worth pulling out of that table. Article 27(1) makes the obligation follow the legal form rather than the size of the business — an LLC with modest revenue is inside it from year one. And Article 102 makes the auditor an annual appointment by the partners, which means the appointment is a decision to be minuted each year, not a standing arrangement that renews itself quietly.

Knowing that you need an audit is only half the problem; the other half is which auditing companies can sign your accounts, because free zones run approved-auditor lists on top of the federal licence. The practical takeaway for a mainland LLC is that keeping proper accounting and bookkeeping records is not optional housekeeping — it is the first half of a legal obligation whose second half is the audit itself.

The free zone layer: audit set by your own authority

The UAE’s free zones each operate under their own authority with their own company regulations, and a great many of them require audited accounts. This is where a lot of SME founders get surprised. A company can be small, profitable and perfectly well run, and still be obliged to produce a full audited set every year simply because its free zone regulations demand it.

Because the requirement flows from the free zone authority rather than a single national rule, the details genuinely vary — the deadline, the approved-auditor list, the dormancy treatment and the filing mechanics are all set zone by zone. DMCC gives a useful worked example of how detailed those rules are, and it is the one we have read in the primary text for this guide.

Read from the DMCCA Company Regulations, issue date 10 October 2024, and checked on 4 August 2026. We have not verified the current rules of every other UAE free zone in this pass, and we are not going to summarise them from secondary sources — read your own authority’s regulations for the current licence year, because the deadlines above are DMCC’s and nobody else’s.

The upshot is that “we’re a free zone company, so we don’t have to worry about mainland rules” is a dangerous half-truth. The free zone frees you from certain mainland requirements, but it imposes an audit requirement of its own that is every bit as binding.

The corporate tax layer: Ministerial Decision No. 84 of 2025

Corporate tax is the most recent addition to the audit map, and for many companies it is the trigger they least expect. It is also the area where out-of-date articles do the most damage, because the governing instrument changed. Ministerial Decision No. 84 of 2025 repealed Ministerial Decision No. 82 of 2023, though MD 82 continues to apply to tax periods that commenced before 1 January 2025.

Rows read from the decision published by the Ministry of Finance and checked on 4 August 2026. The two details most often stated wrongly are both in Article 2(1). The AED 50 million test applies to a taxable person that is not a tax group — it is not a general threshold that a group can measure itself against. And a qualifying free zone person needs audited financial statements regardless of revenue, because the requirement is attached to the status rather than to the size.

If you are still working out which engagement you are actually obliged to buy, our guide to audit services in the UAE sets the statutory audit alongside internal audit, tax reviews and due diligence. A company’s corporate tax position and its audit obligation now feed each other: the audited accounts support the tax return, and the tax status can be what makes the audit mandatory in the first place.

Tax groups: audited special purpose financial statements

A tax group is treated differently enough to deserve its own section, because the instinct — “we consolidate, so the consolidated accounts will do” — is wrong on both counts. FTA Decision No. 7 of 2025, issued 16 July 2025 and applying to tax periods commencing on or after 1 January 2025, sets out what is actually required.

Every row read in the FTA’s published text and checked on 4 August 2026. The line that matters most for planning is Article 3(4)(d): members of a tax group still need standalone financial statements. Aggregation is performed from them, so a group that stopped preparing entity-level accounts on the assumption that grouping removed the need has made more work for itself, not less. Note also that aggregation is not consolidation — Article 3(3) specifically strips out the IFRS 3 and IFRS 10 business-combination effects that a consolidated set would carry.

“

A statutory audit is never a maths problem discovered in the fieldwork window — it is the sum of twelve monthly closes done properly. Fix the close, and the audit fixes itself.

Who can sign an audit report in the UAE

One point is absolute, and it is now backed by criminal penalties rather than administrative ones. Federal Decree-Law No. 41 of 2023 on the Regulation of the Accounting and Auditing Profession was issued on 28 September 2023, published in the Official Gazette the following day, and came into force six months after publication under Article 40. Article 39(1) repealed Federal Law No. 12 of 2014 on the Regulation of the Auditors’ Profession outright.

That repeal is worth holding onto, because the older law is still cited in circulation — and, at the time of writing, still appears in some official guidance material. Where you meet that conflict, the position is straightforward: Federal Decree-Law No. 41 of 2023 is the governing legislation, and Article 39(2) keeps the regulations and decisions issued under the 2014 law alive only until replacements consistent with the new Decree-Law are issued.

Rows read from the Official Gazette text hosted by the Ministry of Economy and Tourism and checked on 4 August 2026. On conviction under either article the court may order the professional licence cancelled or the accounting firm closed.

So when someone asks who can sign audit reports in the UAE, the answer is narrower than most founders expect. It is not the firm that prepared the accounts, and it is not whoever holds the most senior finance title in the business. Article 6(2) allows a Chartered Accountant to practise only through their own firm or while working at a licensed accounting firm or the branch of a foreign accounting firm. Government departments and government-owned companies sit outside this regime altogether — Article 3(2) excludes government audit works — and who audits government entities instead is a separate question.

This matters for how an SME should structure its finance support. There is a clean and deliberate division of labour. A firm can prepare the financial statements, assemble the schedules, reconcile the balances and manage the whole relationship with the auditor — but the independent report has to come from a separately licensed practitioner, which is why knowing how to choose an approved auditor in the UAE matters as much as getting the books clean.

At Velmont Crest we sit firmly on the preparation-and-support side of that line. We provide statutory audit assistance — getting the books audit-ready, building the working papers the auditor will ask for, and acting as the bridge between the business and its licensed auditor — while the audit report itself is signed by the licensed audit firm. Understanding this split saves founders from two common mistakes: expecting their bookkeeper to sign an audit, or expecting their auditor to also keep their books.

Audit requirements for startups in the UAE

Founders ask this constantly, usually in the belief that a young company with modest revenue is somehow outside the net. It is not, because none of the three rulebooks tests age or size at the point of entry — they test legal form, licence conditions and tax status.

Take the three questions in order. If your startup is incorporated as a mainland LLC, Article 27(1) of Federal Decree-Law No. 32 of 2021 requires an auditor from the first financial year, whether you billed AED 4 million or AED 40,000. Article 28(1) lets that first fiscal year run anywhere from six to eighteen months, so the first audit can arrive earlier or later than a founder expects depending on how the statute was drafted at incorporation.

If the company sits in a free zone, the audit obligation depends entirely on that authority’s company regulations. And if the startup holds a free zone licence and intends to claim the 0% qualifying free zone person rate on qualifying income, Article 2(1)(b) of Ministerial Decision No. 84 of 2025 requires audited financial statements at any revenue level — so the audit arrives attached to the tax benefit rather than to the size of the business.

Two things do genuinely change with size. The AED 50 million revenue test will not touch an early-stage company, and a startup with a clean, short ledger is a fast, inexpensive audit rather than a heavy one. That is the practical argument for setting the bookkeeping up properly in year one instead of after the first audit request arrives — the same argument our guide to bookkeeping for startups in Dubai makes from the records side.

Statutory audit versus internal audit, settled

Because the two terms get used interchangeably in conversation, it is worth setting the distinction out plainly. They are not two flavours of the same thing; they answer different questions for different audiences.

A company can need both at once — a statutory audit to satisfy the law and reassure outsiders, and an internal audit to tighten its own controls — but satisfying one does not satisfy the other. An internal review, however thorough, will never discharge a statutory audit obligation, and a statutory audit is not designed to give management the operational deep-dive that internal audit provides.

One nuance is worth flagging for UAE groups. Where an internal audit function already exists, a statutory audit may be able to lean on some of its work under the International Standards on Auditing, but the statutory audit opinion remains the external auditor’s alone and the responsibility cannot be shared. Budgeting for a statutory audit on the assumption that a strong internal audit function will shorten it is a plan that rarely survives the first fieldwork week.

Statutory reporting requirements and how long records must be kept

Retention is where statutory reporting requirements for businesses in the UAE most often come unstuck, because four different instruments each set a period and the longest one wins. Setting a single archive policy to the shortest of them is the mistake that turns a routine query into a problem.

Every row read in the primary text and checked on 4 August 2026. The last row surprises people: your auditor’s file on your company outlives your own statutory archive by five years, and where the work relates to a claim before the courts, the ten years runs from the final judgment instead of from the report date.

Getting audit-ready before the auditor arrives

The single biggest lever an SME has over its audit is preparation, and preparation is a monthly habit rather than a year-end sprint. The companies that finish audits quickly share a set of practices that make the auditor’s job a confirmation exercise instead of an investigation.

Do these things through the year and the audit becomes short, calm and predictable. Skip them and the auditor spends fieldwork rebuilding what should already exist — see how preparation moves the cost of an audit in the UAE and what drives it. The difference between a smooth audit and a painful one is almost never the auditor; it is the twelve months of bookkeeping that came before them.

Where this leaves your business

If there is one thing to take from all of this, it is that UAE statutory audit requirements do not come from a single source, so you cannot rule the audit out by checking only one. Ask three questions. Does the Commercial Companies Law catch you under Article 27(1)? Do your free zone authority’s company regulations require audited accounts, and by when? And does corporate tax pull you in through the AED 50 million test, a qualifying free zone person position, or membership of a tax group?

Where the company sits geographically changes almost nothing about the substance. Audit requirements in UAE mainland and free zone structures both trace back to the same three rulebooks, and an audit in mainland UAE runs under the same federal law wherever the office is. A statutory audit in Dubai is conducted under the same Commercial Companies Law as a statutory audit in Sharjah, Ajman or Ras Al Khaimah, and statutory audit reports carry the same content requirement under Article 247 in every emirate.

What does change is the practical shortlist. There are far more audit firms in Dubai than in the smaller emirates, and audit firms in Abu Dhabi tend to be weighted toward the sectors that dominate that market. Choose on licence status and relevant sector experience rather than on proximity, and check the auditor’s current standing before you appoint. Statutory audit in Dubai is a crowded market; statutory audit in a specialised sector is not.

The good news is that the work that makes an audit painless is the same work that keeps you compliant everywhere else: disciplined monthly accounting and bookkeeping, a clean close, and records kept in order for the longest period the law expects. Get that foundation right and the audit stops being a threat on the calendar and becomes the routine confirmation it is meant to be.

Velmont Crest is a DED-licensed UAE accounting firm providing advisory, preparation and audit assistance — getting your books audit-ready, building the working papers your approved auditor needs, and keeping your corporate tax position aligned with your audited accounts — for mainland and free zone SMEs. Read more on our insights hub or get in touch via our contact page.

Disclaimer: Velmont Crest is a DED-licensed accounting firm providing advisory, preparation and compliance support services. We are not a licensed statutory auditor, a law firm, or the Federal Tax Authority, and we do not sign audit reports. Audit requirements under the Commercial Companies Law, individual free zone regulations and the corporate tax regime change and vary by entity — verify your specific obligations with your free zone authority, your licensed auditor and current UAE law, and consult a licensed professional for advice specific to your circumstances.

References

• Federal Decree-Law No. 32 of 2021 on Commercial Companies (Ministry of Economy and Tourism)
• Federal Decree-Law No. 41 of 2023 on the Regulation of the Accounting and Auditing Profession (Ministry of Economy and Tourism)
• Ministerial Decision No. 84 of 2025 on Audited Financial Statements (Ministry of Finance)
• FTA Decision No. 7 of 2025 on Audited Special Purpose Financial Statements for a Tax Group
• Federal Decree-Law No. 47 of 2022 on the Taxation of Corporations and Businesses (Ministry of Finance)
• DMCCA Company Regulations