UAE Tax Audit Process: Penalties, Deadlines And How To Respond

The FTA conducted 93,000 inspection visits in 2024 and its audit powers expanded significantly from January 2026

Most UAE businesses treat FTA audits as something that happens to other people. That assumption is becoming expensive. The Federal Tax Authority conducted 93,000 inspection visits in 2024, a 135% increase over the previous year, and its enforcement infrastructure now covers VAT, corporate tax, and excise tax through a single risk-driven analytics system. The FTA's 2023-2026 Strategy confirms that audit selection is based on risk indicators, not random sampling. Businesses with data inconsistencies, frequent refund claims, or mismatches between VAT and corporate tax filings are at the front of the queue.

• Federal Decree-Law No. 28 of 2022 on Tax Procedures (as amended by Federal Decree-Law No. 17 of 2025, effective 1 January 2026) governs how the FTA conducts audits, issues assessments, and imposes penalties. The Executive Regulation (Cabinet Decision No. 74 of 2023) sets out the operational detail.
• The FTA's standard audit limitation period is five years from the end of the relevant tax period. In cases of tax evasion, the limitation extends to 15 years. In cases where the taxpayer failed to register, the FTA may audit or assess within 15 years from the date the person should have registered.
• Cabinet Decision No. 129 of 2025, effective 14 April 2026, introduces a restructured penalty framework. Late payment penalties shift to a 14% annual non-compounding rate. Fixed penalties for FTA-discovered errors reduce to 15% of the unpaid tax. Voluntary disclosure penalties drop to 1% per month of the underpaid amount, calculated from the original filing deadline. The changes reward businesses that self-correct before the FTA arrives.
• The burden of proving a tax return's accuracy lies with the taxpayer, not the FTA. If the FTA challenges a position, the business must produce the records, calculations, and supporting documents that justify what was filed. Businesses that cannot do this during the audit lose the argument by default.
• Businesses must retain tax records for a minimum of seven years. Records can be physical or digital but must be clear, complete, and accessible on demand. Failure to maintain records attracts penalties starting at AED 10,000 for the first offence.

Who this applies to

This article is for every VAT-registered and corporate-tax-registered business in the UAE. It is also relevant to financial services firms that manage tax compliance for clients, to CFOs preparing for their first corporate tax filing cycle, and to any business that has received or expects to receive an FTA audit notification.

If you have already received an audit notice, the timeline for response is fixed by statute and cannot be extended without FTA agreement. Read the section on audit notification and rights before doing anything else.

What triggers an FTA audit

The FTA does not publish its risk scoring criteria, but its ISO 31000-certified risk management framework and public statements confirm that audit selection is data-driven. The most common triggers, based on enforcement patterns and published FTA guidance, include the following.

Mismatches between VAT returns and corporate tax filings. If VAT returns report AED 120 million in taxable supplies but the corporate tax return shows AED 100 million in revenue, the FTA will flag the discrepancy. The introduction of corporate tax means the FTA can now cross-reference two separate data sets for every business, and inconsistencies between them are the single most visible red flag.

Frequent or large VAT refund claims. Businesses that regularly claim input tax refunds, particularly exporters and zero-rated suppliers, face higher audit probability. The FTA verifies that the refund claims are supported by valid tax invoices, export documentation, and customs records.

Late or amended filings. Multiple voluntary disclosures, repeated late filings, or significant amendments to previously submitted returns signal compliance weaknesses. The FTA treats patterns of correction as indicators that the underlying systems are unreliable.

Industry-specific risk profiles. The FTA applies sector-based risk models. Real estate, trading, hospitality, and construction businesses face higher baseline audit rates because of the volume of transactions, the complexity of VAT treatment (exempt vs standard-rated supplies), and the prevalence of related-party transactions in these sectors.

Failure to register. Businesses that should have registered for VAT or corporate tax but did not are subject to the 15-year extended limitation period. The FTA identifies unregistered businesses through customs data, trade licence records, and banking information.

For the most common filing errors that attract FTA scrutiny, see our article on corporate tax filing mistakes.

How the audit process works

Notification

The FTA notifies the taxpayer of the audit initiation, specifying the tax periods under review. The notification is delivered through the EmaraTax portal and may also be sent by email or registered mail. The Executive Regulation prescribes the timeframe within which the FTA must notify the taxpayer before commencing the audit. The notification identifies the taxes being audited (VAT, corporate tax, excise, or a combination) and the scope of the review.

There is no requirement for the FTA to explain why the business was selected. The taxpayer receives the notification and must respond within the timeframe specified.

Scope and conduct

The FTA may conduct desk-based audits (reviewing documents submitted electronically) or on-site audits (attending the business premises). In practice, most audits begin as desk-based reviews and escalate to on-site visits if the documents raise questions the FTA cannot resolve remotely.

During an audit, the FTA may request financial records, accounting systems access, tax invoices (both issued and received), bank statements, contracts, payroll records, customs documentation, and any other records relevant to the tax position under review. The FTA auditor may interview senior management, the finance team, and any person involved in the business's tax affairs.

The FTA expects records to trace from source documents (invoices, contracts, bank statements) through to the tax return line by line. If the audit trail breaks at any point, the FTA will treat the unsupported position as incorrect and adjust accordingly.

Duration

The Tax Procedures Law does not prescribe a maximum duration for an audit. Straightforward desk-based reviews of a single tax period may conclude within weeks. Complex audits covering multiple entities, multiple tax types, and several years of filings can take months. The FTA may extend its review if additional information is required or if the audit reveals issues that expand its scope.

Taxpayer rights during the audit

Article 21 of the Tax Procedures Law sets out the rights of persons subject to audit. The taxpayer has the right to be informed of the audit scope and the tax periods under review. The taxpayer may appoint a tax agent or legal representative to interact with the FTA on its behalf. The taxpayer may view and obtain copies of the documents and data on which the FTA bases its findings.

The taxpayer is not required to answer questions that would amount to self-incrimination in a criminal tax evasion case, but in practice the distinction between administrative and criminal proceedings is narrow. Businesses that suspect an audit may escalate to a criminal investigation should seek legal advice before responding.

What happens after the audit

Tax assessment

If the FTA concludes that tax was underpaid, incorrectly calculated, or not paid at all, it issues a Tax Assessment under Article 23 of the Tax Procedures Law. The assessment specifies the additional tax due and any administrative penalties. The taxpayer is notified of the assessment through the EmaraTax portal.

The FTA may issue a Tax Assessment in the following circumstances: the taxpayer failed to submit a tax return within the deadline; the taxpayer submitted an incorrect return; the taxpayer failed to calculate tax on behalf of another person when required to do so (such as under the reverse charge mechanism); the payable tax is incomplete as a result of tax evasion; or the FTA determines that a voluntary disclosure was incorrect or incomplete.

Administrative penalties

The penalty framework changes on 14 April 2026 under Cabinet Decision No. 129 of 2025. The key penalties that apply to audit outcomes include the following.

Errors discovered by the FTA attract a fixed penalty of 15% of the unpaid tax amount. This replaces the previous tiered penalty structure and applies across VAT, corporate tax, and excise tax.

Late payment penalties accrue at 14% per annum on a non-compounding basis, replacing the previous structure of 2% on the due date plus 4% monthly up to 300%. The new rate is lower and more predictable.

Failure to maintain records attracts AED 10,000 for the first offence and AED 20,000 for repeat violations.

Failure to cooperate with the FTA during an audit, including failing to provide requested documents or obstructing auditors, exposes the business to additional penalties and may result in the FTA estimating the tax position based on available information.

Voluntary disclosure: correcting errors before the FTA finds them

A voluntary disclosure is a formal notification to the FTA that a previously filed tax return contained an error or omission. Under Article 10 of the Tax Procedures Law, taxpayers are required to submit a voluntary disclosure even where the error does not result in additional tax being due.

The incentive structure under the new penalty regime (from 14 April 2026) makes voluntary disclosure significantly cheaper than waiting for the FTA to find the error. Voluntary disclosures attract a penalty of 1% per month of the underpaid amount, calculated from the original filing deadline to the date of disclosure. For a business that identifies an AED 100,000 underpayment six months after the filing deadline, the voluntary disclosure penalty is AED 6,000. If the FTA discovers the same error during an audit, the penalty is AED 15,000 (15% of the underpaid amount), plus late payment interest.

Voluntary disclosures must be submitted within five years from the end of the relevant tax period. A voluntary disclosure submitted after the FTA has initiated an audit for the same period will not receive the reduced penalty treatment. The timing matters: once an audit notification is received, the voluntary disclosure window for those tax periods closes.

Businesses should conduct internal reviews of their VAT and corporate tax filings before the FTA does. The cost of engaging a tax adviser to review historical filings and submit voluntary disclosures where necessary is a fraction of the cost of the same corrections being identified during an FTA audit.

Challenging an FTA assessment: the five-stage dispute resolution process

If the FTA issues a tax assessment that the taxpayer disagrees with, the Tax Procedures Law provides a structured dispute resolution pathway. Each stage has a mandatory timeframe, and missing a deadline forecloses the next stage.

Stage 1: Tax Assessment Review Request

A taxpayer who believes the FTA made a technical error in applying the tax law, a calculation error, or a procedural error in the audit can submit a Tax Assessment Review Request. This must be filed within 40 business days of receiving the assessment notification. The FTA reviews the request and issues a decision within 40 business days. This is an internal review, not an independent hearing.

The Review Request and the Reconsideration Request (Stage 2) are mutually exclusive. A taxpayer cannot submit both simultaneously. If a Review Request has been filed, the taxpayer must wait for the FTA's decision before filing a Reconsideration Request.

Stage 2: Reconsideration Request

A Reconsideration Request is the primary internal appeal mechanism. It must be filed within 40 business days of receiving the assessment (or, if a Review Request was filed, within 40 business days of the FTA's decision on that request). The request must be reasoned and supported by documentation. The FTA must decide within 40 business days and notify the taxpayer within five business days of the decision.

The Reconsideration Request is submitted through the EmaraTax portal and may be filed by the taxpayer, its legal representative, or a registered tax agent. Tax advisers who are not registered with the FTA as tax agents are not permitted to file reconsideration requests on behalf of clients.

Stage 3: Tax Disputes Resolution Committee (TDRC)

If the taxpayer disagrees with the FTA's reconsideration decision, or if the FTA fails to issue a decision within the prescribed timeframe, the taxpayer may file an objection with the Tax Disputes Resolution Committee. The TDRC operates under the Ministry of Justice, independent of the FTA.

The objection must be filed within 40 business days of the FTA's reconsideration decision. The taxpayer must pay the full disputed tax and penalties before the TDRC will accept the objection. The TDRC reviews the objection and issues a decision within 20 business days, notifying both parties within five business days.

For disputes where the combined tax and penalty amount is below AED 100,000, the TDRC's decision is final and binding. Neither party can appeal to the courts.

Stage 4: Federal Court appeal

For disputes exceeding AED 100,000, either party may appeal the TDRC's decision to the competent federal court within 40 business days of notification. The court reviews the case on its merits, including the factual record and the application of the tax law. The court may uphold, modify, or overturn the TDRC's decision.

Stage 5: Appellate and Cassation courts

The losing party may appeal through the appellate court system. Federal Supreme Court (Cassation) review is available on points of law.

Settlement

At any stage before judicial proceedings, the taxpayer and the FTA may reach a settlement. For criminal tax evasion cases, the Tax Procedures Law and its Executive Regulation set out reconciliation amounts: full payment of the payable tax and penalties, plus an additional percentage of the evaded tax (50% after investigation, 75% after conviction). The public prosecution may approve reconciliation after seeking the FTA's opinion.

The dispute resolution timeline

Criminal tax evasion

The Tax Procedures Law draws a clear line between administrative non-compliance and criminal tax evasion. Administrative penalties (late filing, incorrect returns, failure to maintain records) are handled through the assessment and appeal process described above. Criminal tax evasion is a separate matter.

Under Article 25 of the Tax Procedures Law, tax evasion includes deliberately providing false information to reduce tax liability, deliberately failing to submit tax returns to avoid payment, and deliberately concealing information that should have been disclosed. Tax evasion is a criminal offence punishable by imprisonment and fines.

Where the FTA suspects tax evasion, it may refer the case to the public prosecution. The 15-year limitation period applies to audits and assessments in evasion cases, compared to five years for standard non-compliance. Businesses that discover deliberate errors in historical filings should seek legal advice before submitting voluntary disclosures, because the disclosure itself may create a record that the FTA or prosecution can use.

Practical steps before, during, and after an audit

Before the audit arrives

Reconcile VAT returns against corporate tax filings for every tax period since June 2023. Any discrepancy between reported supplies and reported revenue should be identified and explained before the FTA asks. Conduct an internal review of input VAT recovery. Verify that every input tax claim is supported by a valid tax invoice from a registered supplier, that the expense relates to taxable supplies, and that the apportionment methodology (if the business makes both taxable and exempt supplies) is documented and defensible.

Ensure transfer pricing documentation is in place for related-party transactions. The FTA's cross-referencing of corporate tax returns with VAT data means intercompany transactions will be visible. For details on preparing transfer pricing documentation, see our guide.

Test the seven-year record retention requirement. If records from 2018 (the first year of VAT) are stored in systems that have since been replaced, verify that they can still be retrieved in a format the FTA will accept.

During the audit

Appoint a single point of contact to manage all FTA communications. Do not allow multiple employees to respond to auditor queries independently. Responses should be reviewed for accuracy and consistency before submission.

Provide only what is requested. The FTA's document requests are specific. Volunteering additional information beyond what is asked creates risk without benefit. If the FTA requests documents that do not exist or cannot be produced, explain why in writing rather than producing approximations.

Keep a log of every document submitted, every question asked, and every response given. If the audit leads to an assessment, this log becomes the factual record for any subsequent challenge.

After the audit

If the FTA issues an assessment, review it against the audit log immediately. The 40-business-day deadline for filing a Review Request or Reconsideration Request begins from the date of notification, not the date the assessment is reviewed internally. Delays in internal decision-making consume the statutory timeline.

If the assessment is correct, pay the tax and penalties promptly. Late payment interest accrues from the original due date, not from the assessment date, and continuing to delay payment after the assessment increases the total cost.

If the assessment is incorrect, prepare the Reconsideration Request with detailed reasoning and supporting documents. The quality of the written submission determines the outcome. A well-documented reconsideration supported by contemporaneous records is more effective than a verbal explanation after the fact.

How should UAE businesses prepare for FTA audits in 2026

The FTA's audit capacity has grown faster than most businesses' compliance infrastructure. The 93,000 inspections in 2024 were conducted under the pre-amendment Tax Procedures Law. From 2026, the FTA operates under expanded powers and a restructured penalty framework that simultaneously increases the cost of non-compliance and reduces the cost of self-correction. The gap between the two is the voluntary disclosure window.

Businesses that have not reconciled their VAT and corporate tax positions, that have not tested their record retention, or that have not documented their transfer pricing should treat these tasks as urgent. The cost of an internal compliance review is a known, controllable expense. The cost of an FTA audit that finds errors the business could have corrected is not.

For businesses facing an FTA audit or needing to submit voluntary disclosures, reconsideration requests, or TDRC objections, our tax disputes team represents clients through every stage of the process, from initial audit response to federal court appeal.

‍