New UAE VAT Rules 2026: VAT Is Not Merely a Filing Issue

The clear diagnosis: in the UAE, VAT begins before filing.

The invoice remains necessary. From October 1, 2026, it is not the entire defense file.

Picture a UAE VAT-registered company days before its return is approved for filing. The service has been delivered, the invoice posted, and the payment made. The expected input-tax recovery is already reflected in the liquidity plan. Only during final review does the team discover that the supplier representative's authority is not properly documented and the third-party payment path has no clear commercial explanation.

That does not prove tax evasion, nor does it automatically eliminate input-tax recovery. It does change the decision. The CFO can no longer release the claim on the strength of a correct invoice alone. The CFO must now decide whether to release the claim, defer it, or escalate the issue to a qualified UAE tax advisor. Until that decision is supportable, liquidity may remain tied up while several teams reconstruct a transaction the business had already treated as complete.

This is where the new VAT reality begins: not with fear of a theoretical penalty, but with a practical question. Can an input-tax amount the business has already planned around actually be released when the decision must be made?

VAT remains a filing matter in the United Arab Emirates. VAT-registered businesses must still prepare, submit, and support their returns correctly. The decisive shift occurs earlier: the defensibility of input-tax recovery is created through supplier and supply verification, commercial rationale, the payment path, and contemporaneous documentation.

Since January 1, 2026, Article 54bis of the UAE VAT Decree-Law has contained an express anti-evasion mechanism. If the Federal Tax Authority establishes that a supply or supply chain was connected to tax evasion and the taxable person knew that when deducting input tax, the Authority must reject the deduction. If the taxable person should have known, the Authority may reject it.

From October 1, 2026, FTA Decision No. 13 of 2026 specifies the verification measures to be applied before input-tax deduction. They extend from supplier identity and actual place of business to pricing, licensed activity, goods origin and right to dispose, intermediaries, third-party payments, and accounts outside the supplier's country of incorporation.

This turns a fragmented process into a leadership question. Procurement holds part of the supplier file. The business sponsor knows the commercial reason. Accounts payable sees the invoice. Treasury controls the payment. Tax prepares the return. If no one connects those elements before the deduction, a numerically correct return can still contain a vulnerable claim.

The new equation is therefore not simply: correct invoice plus accurate ledger entry equals secure input tax. It is: substantive recovery right plus applicable supplier and supply verification plus a coherent payment path plus documented evidence equals a defensible claim.

Filing is the endpoint. The quality of the input-tax claim is built upstream.

Two decisions, three clocks—and none should be collapsed into the others.

Article 54bis, FTA Decision 13, and Cabinet Decision 149 serve different legal functions.

Article 54bis is the statutory anchor and has applied since January 1, 2026. It works in two stages. First, the supply or supply chain must be connected to tax evasion. Second, the recipient's actual or constructive awareness is assessed. For the second category, the taxable person is treated as required to have known if the applicable FTA-prescribed verification was not performed before deduction.

That boundary matters. A single documentation defect does not automatically prove the tax-evasion connection. Decision 13 is also not a general AML statute, a universal UBO mandate, or a broad corporate KYC regime. It is a defined verification rule for Taxable Persons before input-tax recovery.

FTA Decision 13 was issued on July 22, 2026 and becomes effective on October 1, 2026. Cabinet Decision 149 was issued on September 1, 2026 and generally amends the VAT Executive Regulation from October 1 as well. The operational supplier and supply verification regime, however, comes from Article 54bis and Decision 13—not from Cabinet Decision 149.

A separate clock applies to input-tax apportionment. The amended paragraphs 6, 7, and 19 of Article 55 apply only from the first Tax Year commencing after October 1, 2027. For a calendar Tax Year, that generally points to January 1, 2028. A different Tax Year requires an entity-specific determination.

This separation prevents two mistakes: rebuilding the apportionment configuration too early and implementing supplier and supply controls too late. The first requires early modeling. The second must operate by October 1, 2026.

“The Authority continues to advance its efforts to enhance tax awareness and ensure the smooth and efficient implementation of tax legislation and procedures.”

A label such as ‘the new VAT rules’ is not a substitute for an effective-date matrix.

The supplier moves from a master-data record to a verifiable input-tax factor.

Identity, authority, business location, change history, and scale belong in a defensible file.

For a natural-person supplier, Decision 13 requires a copy of a valid Emirates ID or passport and an in-person or virtual meeting before the supply. For a legal person, incorporation must be verified through official databases or a copy of a valid certificate obtained. The data must be valid and consistent with the entity's name, address, employees, and other available information. The authorized director, agent, or employee must also be identified through a valid identity-document copy.

The actual place of business must be verified electronically or through a field visit and must be compatible with the activities performed. This is not a blanket physical-office requirement. A mobile or digital provider may have a genuine model. The issue is whether location, activity, capacity, and transaction form a coherent commercial account.

Decision 13 identifies three risk indicators: more than two address changes during the previous 12 months; more than two changes in key employees or contacts; and a transaction whose volume, value, or nature is disproportionate or unexpected relative to the supplier's size and history. An indicator is not an automatic disqualification. It requires a clear explanation consistent with known evidence and available to the FTA on request.

The timing is also defined. A supplier is verified at first dealing and again in a recurring relationship if no verification occurred during the previous 12 months. A business therefore needs more than a document folder. It needs a reliable verification date and refresh trigger in the vendor master.

For family offices and groups, this creates a second control chain: tax evidence and privacy must work at the same time. First determine which regime applies—the federal UAE PDPL, DIFC, ADGM, or a sector-specific rule. Identity records then need a valid legal basis and transparent purpose, data minimization, controlled and logged access, processor and transfer controls, and a coordinated retention, deletion, and incident process. Tax-retention obligations may prevent early deletion. Which fields must be retained in full and whether any redaction is permissible requires legal review for the specific data and tax path; the evidence required by Decision 13 cannot be impaired.

This is a high-level privacy-routing checklist, not a definitive statement on any one data-protection regime. Legal basis, transfers, retention, and the access model should be validated for the particular data path by qualified UAE, DIFC, or ADGM counsel.

A supplier is not risky merely because it is unusual. The risk rises when the unusual cannot be explained and evidenced.

Three thresholds, every covered supply, and an explainable payment path.

AED 10,000, AED 100,000, and AED 375,000 route different verification layers—none is the cash threshold.

For a taxable supply with consideration of less than AED 10,000 excluding VAT, the Decision 13 measures may be disregarded. That exception is unavailable if supplies from the same supplier exceeded AED 100,000 during the previous 12 months or are expected to exceed that amount during the following 12 months. Twenty AED 9,000 invoices do not become twenty safe exceptions when annual supplier spend is expected to reach AED 180,000.

When actual or expected supplier volume exceeds AED 375,000, an additional layer applies: written confirmation from a UAE-authorized bank that the supplier maintains a bank account, without relevant reservations or conditions. The confirmation need not be addressed to the recipient. Available public reviews and media reports from reliable sources must also be examined.

This AED 375,000 figure is not the VAT registration threshold, even though the number is familiar. Here it measures supplies received or expected from the particular supplier. A voluntarily registered business can therefore also fall within scope when claiming input tax.

Decision 13 also requires verification of each covered taxable supply. The tests include the commercial rationale, commercially justifiable pricing and margin, consistency with the supplier's ordinary or licensed activity, and—where goods are involved—authenticity, origin, ownership, or the right to dispose. An intermediary needs a clear commercial reason. As an NBF control standard, a reliable delivery, performance, or acceptance record should also be retained; the Decision does not prescribe that specific document type verbatim.

Electronic payment is the prescribed norm. A third-party payer or payee, or an account outside the supplier's country of incorporation, requires a reasonable commercial explanation consistent with the available evidence. Cash is not generally prohibited. It requires a documented commercial reason, easy verifiability, and compliance with applicable tax thresholds.

Procurement wants to release a follow-on order that afternoon. The latest vendor report shows that the order may push expected supplier volume into the enhanced verification layer for the first time. It is still unclear whether the required bank confirmation will arrive on time and in the prescribed form. The owner now faces a limited, real decision: release the order, hold it until the evidence is complete, or obtain a qualified view on the threshold and timing before the claim. The supplier is not presumed suspect. What remains unresolved is whether this particular input-tax path is ready for release.

The less linear the transaction, the stronger its commercial explanation must be.

Cabinet Decision 149 changes more than supplier controls—but not everything changes at once.

Composite supplies, employee benefits, cash, capital assets, and apportionment affect different transaction populations.

These changes do not belong in one generic ‘VAT update.’ They require different owners, data, and effective dates. The decision matrix after this section separates the five transaction populations and the leadership question attached to each.

A steering committee is asked to approve a single project plan labeled ‘VAT update.’ The legal summary is complete, but the external threshold for the open cash rule is still missing; at the same time, the later apportionment change already requires credible comparative data. The CFO cannot switch everything on now, and cannot defer everything either. The controls that can be finalized for October 1 must move forward, cash must remain a monitored dependency, and apportionment needs a parallel workstream. The right decision here is not more speed. It is disciplined separation.

An amendment list explains the law. Decision architecture shows which transaction, owner, and evidence file must change.

The issue is not the wealth profile—it is which Taxable Person claims input tax.

Private asset holding alone creates no special VAT duty. Operating entities that recover input tax are the decision perimeter.

The statutory term is broader than the editorial core audience of this analysis. Decision 13 applies to a Taxable Person—a person registered or required to register—in relation to verification of received supplies before input-tax deduction. The Taxable Person may be an individual or a legal entity. This article focuses primarily on operating UAE entities that claim input tax.

Operational exposure is particularly high with recurring suppliers issuing many small invoices, cross-border group and third-party payments, intermediaries, multi-stage goods chains, unusual margins, employee accommodation, major capital assets, and mixed taxable and exempt activities.

For a family office, the typical gap may sit between the legal entity and operating habit. The principal pays an invoice personally and is later reimbursed. A management company pays for a property SPV. Group treasury centralizes payments. A property manager or advisor uses an intermediary. Those paths can be commercially valid, but they create more points where recipient, supply, invoice, payment, and input-tax claim can diverge.

Assume group treasury has already paid a service provider's invoice for a property SPV. Shortly before the return, the SPV must explain why payer, service recipient, and input-tax claimant are different. The structure may be commercially plausible; that does not make the claim ready for release without review. Until the explanation is documented, the family structure itself is not on trial. The immediate decision is whether to release the claim, defer it, or obtain a qualified view—and then correct the payment path for the next period.

The effect can still become personal for the principal. A property SPV has already included the expected input-tax recovery in the liquidity available for an upcoming closing, and the claim is placed on hold. That does not automatically end the transaction. It can change the reserve requirement, timing, and negotiating position. The decision then is whether to provide additional liquidity, delay the next commitment, or obtain a qualified determination of the open VAT position before closing.

If you control several UAE entities or centralized payment routes, a group-level statement that ‘Finance has it covered’ is not enough. You must be able to identify the Taxable Person carrying the claim and the evidence assigned to that specific entity.

The owner-level question is not whether the family personally follows Decision 13. It is: Which UAE entities actually claim input tax? What amount is exposed by entity and supplier? Who owns hold and release authority? Which exceptions reach the CFO or board? How is sensitive identity evidence protected?

A mature business may already satisfy much of the new framework. An integrated vendor master, electronic payments, documented acceptance, and strong procurement controls can reduce the incremental build. A formal gap review still matters: representative ID, business-location evidence, 12-month refreshes, rolling thresholds, bank confirmation, and transaction evidence may sit in separate systems.

A person that does not claim input tax is not automatically at the center of this article. Lack of registration, however, is not itself a scope exclusion if a registration obligation already exists. A complete verification file also does not guarantee recovery if another substantive VAT condition is absent. The framework supports the defense of the claim; it does not replace transaction-specific legal analysis.

Ownership status creates no special VAT rule. It does determine whether multiple entities and payment paths must be coordinated.

The VAT Decision Chain: who decides before Tax prepares the return?

Decision 13 requires verification, documentation, and assigned functions. The business must design the operating architecture.

The following sequence is an NBF implementation model, not an FTA-prescribed organization chart. Vendor onboarding verifies identity, authority, and place of business. Tax operations routes the legal thresholds. The business sponsor evidences the commercial rationale and supply. Accounts payable checks invoice and beneficiary. Treasury reviews the payment path. The tax controller decides from the complete file whether to claim, defer, or escalate the input tax.

The legal minimum is that applicable verification occurs and is documented before input-tax deduction. The NBF control design translates that into an earlier claim gate. Missing or contradictory evidence is not replaced by an assumption during return preparation. Under the NBF control model, the amount remains in suspense or is not claimed until a qualified technical position is documented. Not every gap can be cured after the fact: a measure that Decision 13 requires before the supply should not be treated as routinely repairable later. Whether a missed step can still be corrected, and with what effect, requires qualified UAE tax advice.

Six if/then rules are enough for the first redesign. If a supplier is new or has not been checked during the previous 12 months, verify it before deduction. If the small-supply exception is lost because of supplier aggregation, apply the full path. If AED 375,000 is exceeded, add the enhanced layer. If transaction or payment is unusual, explain and review it. If evidence contradicts the explanation, keep the claim on hold. If legal interpretation is required, the filing team does not decide it—a qualified UAE tax or legal advisor does.

The documented process must identify implementation, review, and supervision functions and their powers and responsibilities. Decision 13 does not prescribe job titles such as Procurement, Treasury, or Tax Controller, nor does it mandate a particular four-eyes design. Management should therefore avoid confusing its chosen operating model with the statutory wording.

Three real trade-offs remain. Speed reduces onboarding time but can destroy evidence. Discretion protects sensitive family and identity data but cannot remove required records. Flexible payment and intermediary structures preserve options but increase the explanation burden. The answer is not the heaviest process for every vendor; it is the statutory baseline plus proportionate internal control.

“The accountant can prepare the return. The accountant cannot recreate missing commercial evidence after the fact.”

What must work by October 1—and what remains on the watchlist.

The minimum operating control is urgent. Open legal questions must not be filled with invented certainty.

Before October 1, the affected Taxable Persons and input-tax processes should be scoped, an accountable owner and implementation, review, and supervision functions named, and suppliers prioritized by deductible VAT exposure, threshold status, and exception risk. New, high-exposure, and nonstandard cases need at least a manual input-tax hold with documented release authority.

During the first 30 to 60 days after go-live, the vendor master and workflows should capture verification date, representative, business location, threshold status, and review triggers. Supply-level evidence belongs in the purchase-order, contract, invoice, and acceptance process. Third-party, foreign-account, and cash payments need a controlled exception route. Backlogs should be prioritized by VAT exposure and risk, not spend alone.

By day 90, testing should run backward from the input-tax amount to supplier, supply, and payment. The 12-month refresh and rolling thresholds must operate reliably. Employee benefits, accommodation, and capital assets need dedicated reviews. Mixed-activity entities should model the future apportionment method long before their first affected Tax Year begins.

Ten business days before October 1, the ERP owner reports that the automated refresh trigger will not be ready. The CFO has a list of exposed suppliers but no system-enforced stop. A documented fallback decision is now required: route the affected population manually with named release authority, hold selected claims, or escalate the incomplete path for qualified review. The system dependency is not minimized. For the transition period, it receives an owner, an end date, and a testable compensating control.

Open questions include the transition for supplies received before October 1 but deducted later; the precise point at which a forecast threshold crossing removes the exception; bank confirmation for foreign suppliers without a UAE account; VAT-group and branch aggregation; complex group-treasury and payment-agent paths; and whether a verification not performed on time can later be cured.

The ministerial cash threshold and the FTA cases for employee benefits required by contract or documented policy also remained open at the source cutoff. These issues belong in an exception register with an owner, source date, and review trigger. Immediately before implementation and publication, the business should check whether a new ministerial decision, FTA guidance, or binding interpretation has appeared. The official FTA and Ministry of Finance indexes were last checked for this candidate on September 12, 2026; no published ministerial cash threshold was identified in that review.

Open guidance is not permission to be certain. It is a trigger for controlled professional judgment.