UAE VAT Supplier Due Diligence From 1 October 2026: You Must Now Verify Your Suppliers or Risk Losing Input Tax Recovery

UAE VAT supplier due diligence is the set of checks a VAT-registered business must run on a supplier, and on each supply, before it recovers input tax, introduced by Federal Tax Authority Decision No. 13 of 2026, which sets verification measures, thresholds, records and a written policy requirement for every taxable person. The Decision was issued on 22 July 2026 and published on 20 August 2026. It comes into force on 1 October 2026. One line sums up the change. From that date, a valid tax invoice is no longer enough on its own.

Does a valid tax invoice still cover you after 1 October 2026?

Start with what did not happen, because most of the panic online is about the wrong thing. No VAT rate changed. No new tax was introduced. The rate, the return and your registration are all unchanged. Nothing in FTA Decision No. 13 of 2026 touches any of that.

What changed is the evidence you keep. Until now the practical test for input tax recovery was documentary. You held a valid tax invoice, the supply was for your business, and you claimed the credit. From 1 October 2026 the invoice is still required, but it is no longer the whole answer. You must also show that you looked at the supplier, and at the supply, before you paid. The invoice proves what was bought. The new file proves who you bought it from.

One more thing, because search results mix the two dates. There is another well-known UAE deadline in the second half of 2026, and it belongs to the mandatory e-invoicing timeline, not to this Decision. They are separate instruments. Meeting one does not meet the other.

The two levels of UAE VAT supplier due diligence, and how often each one runs

There are two levels, and people keep collapsing them into one. Article 3 looks at the supplier. Article 4 looks at the supply. They ask different questions and they run on different clocks.

The three risk indicators in Article 3(3)(a) are worth naming, because no summary elsewhere lists them. They are: the supplier's address changed more than twice in 12 months, the supplier's key employees changed more than twice in 12 months, and the transactions are disproportionate to the size and history of the business.

A risk indicator is not a stop sign. Article 3(3)(b) lets you go ahead. What it does not let you do is go ahead quietly. You must keep a clear justified written explanation and produce it to the Federal Tax Authority on request.

Article 4(2)(b) is the point most small businesses will feel first. Electronic payment is the default. Cash is not banned, but it needs a documented commercial reason, it must sit within the thresholds set in legislation, and it must be easily verifiable.

The three thresholds, and which one cancels the other

Three numbers appear in the Decision. Reading them in the wrong order is the single most common mistake in the coverage so far.

Now the prose version, because the table alone will mislead you.

Article 6(1) says the measures do not apply where the value of the supply is less than AED 10,000 excluding VAT. Note the wording. A supply of exactly AED 10,000 is caught, not excused. This is not a rounding technicality, it is a common invoice value.

Article 6(2) then takes that relief away. The de minimis does not apply where the value of supplies from that supplier exceeds AED 100,000 over the previous 12 months, or is expected to exceed AED 100,000 over the next 12 months. Both limbs count. The second one is the limb almost everyone drops, and it is the limb that decides most real cases. If you have already agreed a contract, a retainer or a repeat order that will take you past AED 100,000, you are past it now. You do not get to wait for the invoices to arrive.

Article 3(4) works the same way at a higher number. Where the value exceeds AED 375,000 over the previous 12 months, or is expected to exceed AED 375,000 over the next 12 months, two extra checks kick in. You need a written confirmation of the supplier's bank account from an authorised bank in the State. Usefully, that confirmation does not have to be issued to you. You also need a review of publicly available reviews and media coverage of the supplier.

The AED 375,000 in Article 3(4) is not the VAT registration threshold. The two numbers are the same figure and nothing else. One decides whether you must register for VAT, and we cover that in the guide to the AED 375,000 VAT registration threshold. This one decides how deeply you check a supplier before you deduct. Confusing them will send you down the wrong compliance path.

A worked example: the month your AED 10,000 exemption disappears

Numbers make this concrete. Take a small Dubai agency that buys print work from one supplier at AED 9,500 excluding VAT per month. Every single invoice is below AED 10,000. On the face of Article 6(1), every one of them is exempt from the checks.

Scenario A: ad hoc orders, no contract. The agency orders when it needs to. There is nothing to expect, so only the backward-looking limb of Article 6(2) is live. Ten invoices at AED 9,500 come to AED 95,000, still under the line. The eleventh invoice takes the rolling 12-month total to AED 104,500. That figure exceeds AED 100,000. From that supply on, the de minimis in Article 6(1) is switched off for this supplier, and the Article 3 checks apply to a AED 9,500 invoice.

If the first invoice lands in October 2026, the eleventh lands in August 2027. That is the month the exemption disappears.

Scenario B: the same numbers, but with a retainer. The agency signs a 12-month print retainer in October 2026 at AED 9,500 per month. Twelve months at AED 9,500 is AED 114,000. The agency now expects to exceed AED 100,000 over the next 12 months. The forward-looking limb of Article 6(2) bites immediately. The de minimis never applies at all, not even to the first invoice.

Same supplier. Same monthly figure. Same paperwork. Ten months of difference in when the obligation starts, decided entirely by whether a contract exists.

Scenario C: the relationship grows. The agency adds media placement from the same supplier at AED 25,000 per month. Combined, that is AED 34,500 per month, or AED 414,000 over twelve months. That exceeds AED 375,000, so Article 3(4) now applies too. The agency needs a written bank confirmation from an authorised bank in the State, and a review of public reviews and media coverage of that supplier, on top of everything already required.

The lesson is not the numbers. Thresholds are tested per supplier, on a rolling basis, and forwards as well as backwards. A business that only looks at the invoice in front of it gets all three answers wrong.

The written policy you must be able to produce

Article 5(4) is the requirement most businesses have not noticed, and it is the easiest one for the Federal Tax Authority to test. You must have a written policy for these checks. Not a habit, not a shared understanding, a document.

The Decision is specific about what the document has to contain. It must name the persons in charge of implementing the verification measures, the persons in charge of reviewing them, and the persons in charge of supervising them. It must also set out their powers and their responsibilities. And it must be retained at the designated document location.

Read that list again. It separates three roles. In a small company one person often does all three, which is exactly what the Decision is written to surface. If that is you, say so in the policy and set out the powers involved. Silence is the risk, not the small headcount.

Around the policy sit two more record duties. Article 5(3) requires the checks to be documented and retained. Article 3(3)(b) requires a clear justified written explanation whenever a risk indicator fired and you proceeded anyway.

None of this is exotic. It is the same discipline that keeps your VAT filing defensible. Our walkthrough of filing your UAE VAT return in EmaraTax shows where these records are needed.

What happens if you skip the checks?

This is where most of the current coverage is simply wrong, so read it carefully.

Decision No. 13 of 2026 contains no penalty at all. It sets measures. It does not deny anything. The denial lives somewhere else, in Article 54 bis of the Federal Decree-Law on Value Added Tax, and it works as a ladder of three steps.

1. Article 54 bis(1). The Authority shall reject the input tax where the supply was part of a chain related to Tax Evasion and the taxable person was aware of it. This step is mandatory, and it needs actual knowledge.
2. Article 54 bis(2). The Authority may reject the input tax where the person should have been aware. This step is discretionary. The Authority can, not must.
3. Article 54 bis(3). The deeming rule. A person is considered required to have been aware if he did not verify in line with the Authority's measures. Those measures are what Decision No. 13 of 2026 sets out.

Put the three steps together and the real consequence appears. Skipping the checks does not by itself cost you the deduction. What it does is remove your defence. You can no longer say you could not have known, because step three treats you as someone who should have known. You are then exposed to a discretionary rejection under step two.

And the whole ladder still needs one more thing to be true: the supply has to sit in a chain related to Tax Evasion, which is a defined legal term in the Decision, not a loose description of untidy bookkeeping. A missing supplier check on an ordinary, honest transaction is a compliance failure. It is not an automatic loss of input tax recovery.

Two words to strike from your reading. Nothing in either text says the denial is permanent, and nothing makes it automatic. Both are circulating widely and neither appears in the primary sources. Read the commentary with care too: the PwC Middle East tax and legal news service tracks these instruments as they are published.

A rejected credit is not the only clock running. Our guide to claiming input VAT before the five-year limit explains the deadline behind all of this.

Your checklist before 1 October 2026

Seven things to do, in this order. None needs software, and none needs an adviser to start.

1. List every supplier you paid in the last 12 months, with a total per supplier. This one table answers most of the questions below. Sort it high to low.
2. Mark every supplier above AED 100,000, backwards or forwards. Use both limbs of Article 6(2): what you actually paid over the previous 12 months, and what you expect to pay over the next 12. For anyone on this list, the AED 10,000 de minimis does not help you.
3. Mark every supplier above AED 375,000 on the same two-limb test. These need the extra Article 3(4) pair: a written bank confirmation from an authorised bank in the State, and a review of publicly available reviews and media coverage.
4. Identify which suppliers are natural persons and book the meeting. Article 3(1)(a)(2) requires you to meet them in person or virtually before the supply. A scheduled video call is enough, and a note of it belongs in the file.
5. Move supplier payments to electronic means. Article 4(2)(b) makes that the default. Where cash is genuinely necessary, write down the commercial reason, keep it inside the legislated thresholds, and make sure it is easily verifiable.
6. Run the three risk indicators over your top suppliers. Address changed more than twice in 12 months, key employees changed more than twice in 12 months, transactions disproportionate to the size and history of the business. If one fires and you still want to trade, write the justified explanation now, not when it is asked for.
7. Write the policy. Name who implements, who reviews and who supervises, set out their powers and responsibilities, and keep it at your designated document location. This is Article 5(4) and it is the fastest item on this list to fail.

Work down that list once and most of the ongoing burden becomes a diary entry, because Article 5(1) only asks you to re-verify a supplier you have not checked in the previous 12 months.