An FTA audit is not a lottery. The Federal Tax Authority weighs four stated criteria before it opens a file, and the decision is entirely its own. What follows is a practical tax audit UAE 2026 checklist for free zone companies: how the FTA picks its targets, how much warning you get, what an auditor may do once inside, which records you must hold and for how long, and what the clock looks like afterwards.
Start with the number that should shape your calendar. Correct a wrong return through a Voluntary Disclosure before the FTA notifies you of an audit and you pay 1% per month on the tax difference. Wait until the notice arrives and a fixed 15% of that same difference is added on top. This is general information rather than advice on your own position; a registered tax agent should confirm how it applies to your company.
The FTA weighs four things before it opens an audit
Article 15(1) of Cabinet Decision No. 74 of 2023, the Executive Regulation of Federal Decree-Law No. 28 of 2022 on Tax Procedures, sets out what the Authority considers:
- Whether the audit is necessary to protect the integrity of the tax system.
- Your responsibility to comply, or that of any person associated with you.
- The tax revenue it expects to collect.
- The compliance and administrative burden the audit places on both sides.
Two things follow. Under Article 15(3) the decision sits at the FTA’s sole discretion and cannot be objected to or challenged. And a clean audit is not a permanent clearance: Article 15(2) lets the Authority re-audit by weighing the previous result against new information, and Article 19 of the Tax Procedures Law confirms it may revisit a matter already audited when new information surfaces.
You get ten business days of notice, and the exceptions are narrow
Article 16(2) requires at least 10 business days’ notice, and Article 16(1) of the Executive Regulation adds that the notice must spell out the consequences of obstructing the auditor. Article 16(4) carves out three situations in which an auditor may enter with no notice and temporarily close the premises for up to 72 hours:
- The Authority has serious grounds to believe the person is involved in tax evasion.
- It believes that giving notice would hinder the audit.
- Someone already notified tries to stop the auditor entering.
Even then the auditor needs the FTA Director General’s prior written consent under Article 16(5), plus a Public Prosecution permit if the place is a residence. Under Article 16(6) a closed premises reopens automatically after 72 hours unless the Authority obtains a permit to extend by a similar period before that window expires.
An auditor can inspect your accounting system, not just your files
Article 16(3) allows the audit to run at the FTA’s premises, at your place of business, or anywhere else you conduct business, store goods or keep records. Article 18 confines audits to official working hours unless the Director General decides otherwise.
The powers are broader than most finance teams expect. Article 17(1) of the Executive Regulation extends inspection to the premises and its assets, to records held electronically, and to the accounting systems you use. Article 17 of the Tax Procedures Law lets the auditor take original records or copies and sample goods, devices and other assets. Where documents or assets are seized, Article 18 obliges the Authority to give you a record within 10 business days stating why the item was taken, what it is, where and how it is stored, and how long it expects to hold it.
Cooperation is not optional. Article 20 requires you, your Tax Agent and your Legal Representative to facilitate the auditor, and failing to do so carries an AED 20,000 penalty payable from the personal funds of whoever obstructed.
You keep four specific rights while the audit runs
Article 21 gives a person subject to audit the right to:
- Ask the Tax Auditor to show their job identification card.
- Obtain a copy of the audit notification.
- Attend an audit conducted outside the FTA’s premises.
- Obtain copies of any original paper or digital documents seized during the audit.
Article 22 adds that you may view or obtain the documents and data on which the Authority based its assessment of tax due and penalties.
Your tax audit UAE 2026 readiness rests on the records you keep
Article 2 of Cabinet Decision No. 74 of 2023 lists what must exist: balance sheets and profit and loss accounts, wage and salary records, fixed asset records, inventory records and statements of quantities and values at each Tax Period end with the related stock-count records, and every document supporting those entries. Article 2(2) lets the Authority request anything else it needs to verify your obligations, including whether you should have registered at all.
Article 4 gives you a choice of method: keep the original supporting documents, or keep a record of the information they contain, provided it is identical to the original, held as a photocopy or electronic copy that can be reproduced readably on request, and stored so the FTA can verify your obligations from it.
How long each category has to survive
| Record type | Base retention period | When it extends |
|---|---|---|
| Taxable Person records: balance sheets, profit and loss, payroll, fixed assets, inventory | 5 years following the Tax Period they relate to | Plus 4 years for an ongoing audit, a dispute, or an audit notice received before the base period expired; plus 1 year for a Voluntary Disclosure filed in year five |
| Documents held by persons other than a Taxable Person | 5 years from the end of the calendar year of creation | Same extensions where a dispute or audit is in progress |
| Real estate records | 7 years from the end of the calendar year of creation | Same extensions where a dispute or audit is in progress |
| Books held by a Legal Representative | 1 year from the date the representation expires | The periods above still apply to the person represented |
The extensions in Article 3(2) matter more than the base periods. The moment the FTA says it intends to audit, your retention obligation on that period stretches by four more years, and a dispute runs until it is finally settled if that is later. Destroying files on a five-year rota without checking for an open notice is how a records penalty happens.
The pre-audit document checklist
- Balance sheets and profit and loss accounts for every open Tax Period.
- Wage and salary records.
- The fixed asset register, with additions, disposals and depreciation.
- Inventory records and stock-count sheets with end-of-period quantities and values.
- Invoices, correspondence, trade licences and contracts supporting the entries.
- Documents showing the basis or method of any election, assessment or calculation you made, including how you split qualifying from non-qualifying revenue.
On language, Article 5 of the Tax Procedures Law states the general rule that submissions are made in Arabic, while Article 5 of the Executive Regulation confirms the Authority may accept English and may require an approved Arabic translation within a period it specifies. English books are workable. Being unable to produce that translation on request is a AED 5,000 penalty.
Free zone status adds a second layer of assurance
A Qualifying Free Zone Person pays 0% corporate tax on Qualifying Income and 9% on non-qualifying income, and it does not get the AED 375,000 zero-rate band ordinary businesses receive: 9% applies to its entire non-qualifying taxable income. The de minimis test caps non-qualifying revenue at the lower of AED 5,000,000 or 5% of total revenue. Breach any QFZP condition and you lose the status for that Tax Period and the four that follow, five in total. Our guide to the QFZP regime covers those conditions; the Qualifying and Excluded Activities list sits in Ministerial Decision No. 229 of 2025.
Ministerial Decision No. 84 of 2025 changed the assurance picture for tax periods starting on or after 1 January 2025. Audited financial statements are required from a taxable person outside a tax group with revenue above AED 50 million, and from a QFZP with no revenue threshold at all. A small free zone company that would never meet the AED 50 million test still needs an audit to hold the 0% rate. Earlier periods stay under Ministerial Decision No. 82 of 2023, which decision 84 repeals.
FTA Decision No. 6 of 2026, issued 2 June 2026 and applying to tax periods from 1 January 2026, adds a requirement for one group. A QFZP carrying on the Qualifying Activity of distribution in or from a Designated Zone must obtain an ISRS 4400 agreed-upon procedures report, a separate engagement on top of the annual audit, and file it within 30 days after the corporate tax return deadline. The sample is drawn from the highest-value transactions at a 10% margin of error. Miss it and the conditions are treated as not met, putting the status itself at risk rather than triggering a fine.
Two adjacent files are worth pulling before an auditor asks: related-party documentation that satisfies the free zone transfer pricing rules, and any older exposure under the Economic Substance Regulations.
The penalties are mostly arithmetic, and one of them is a cliff
| Violation | Penalty |
|---|---|
| Late corporate tax registration application | AED 10,000 |
| Failure to keep the required records | AED 10,000; AED 20,000 for a repeat within 24 months |
| Failure to submit requested records in Arabic | AED 5,000 |
| Late tax return or Declaration | AED 500 per month for the first 12 months, then AED 1,000 per month |
| Incorrect tax return | AED 500, unless corrected before the return deadline expires |
| Voluntary Disclosure filed before an audit notice | 1% per month on the tax difference until it is filed |
| Failure to file a Voluntary Disclosure before the audit notice | A fixed 15% of the tax difference, plus 1% per month |
| Failure to facilitate the Tax Auditor | AED 20,000, from the personal funds of the person, tax agent or legal representative |
| Failure to settle payable tax | 14% per annum, charged monthly on the unsettled amount |
| Late deregistration application | AED 1,000 monthly, capped at AED 10,000 |
These sit in Cabinet Decision No. 75 of 2023 and its amendments, in force since 1 August 2023, with the registration penalty added by Cabinet Decision No. 10 of 2024 from 1 March 2024. Timing matters for the 14% charge: after a Voluntary Disclosure the tax falls due 20 business days from submission, and after a Tax Assessment 20 business days from receipt.
What happens after the auditor leaves
Article 19(1) of the Executive Regulation requires the FTA to notify you of the results within 10 business days of the audit ending. You then have 20 business days to apply for the documents and data the assessment was based on, and the Authority supplies them within 10 business days of your application.
Where the audit finds a failure to register, a late or incorrect return, unpaid tax or a shortfall from evasion, Article 23(1) has the FTA issue a Tax Assessment and notify you within 10 business days of issuing it. If it cannot establish the actual tax due, Article 23(2) allows an estimated assessment, which it may amend later if new information appears.
Disagreeing runs on a fixed sequence. Article 28 gives you 40 business days from notification to request a review; the FTA decides within 40 business days and tells you within 5. Article 29 gives another 40 business days to file a Request for Reconsideration, on the same timetable. Only then can you object to the Tax Disputes Resolution Committee, and Article 32 refuses the objection unless a reconsideration request came first and the tax has been paid in full. Budget for that pay-first rule before planning to litigate.
The five-year window has four exits
Article 46 bars the FTA from auditing or assessing more than 5 years after the end of the relevant Tax Period, then lists where it is not barred:
- If it notified you that audit procedures commenced before the 5 years expired, it has 4 years from that notification to finish.
- If you filed a Voluntary Disclosure in the fifth year, it has 1 year from the submission date.
- In cases of tax evasion, 15 years from the end of the Tax Period in which it occurred.
- Where you failed to register, 15 years from the date you should have registered.
Two related limits are easy to miss. Article 46(5) blocks any Voluntary Disclosure filed more than 5 years after the end of the relevant Tax Period, so self-correction closes on the same clock. And under Article 47, tax and penalties you have already been notified of never lapse.
Frequently Asked Questions
How much notice does the FTA give before a tax audit?
At least 10 business days under Article 16(2) of Federal Decree-Law No. 28 of 2022, and the notice must state the consequences of obstructing the auditor. The Article 16(4) exceptions are suspected tax evasion, a belief that notice would hinder the audit, or an attempt to block an auditor after notice was given.
What is the penalty for not keeping proper records in the UAE?
AED 10,000 per violation under Cabinet Decision No. 75 of 2023, rising to AED 20,000 for a repeat within 24 months of the last one. That is separate from any tax and interest the FTA assesses because the records were not there to support your return.
Can a free zone company keep its books in English?
Yes. Article 5 of Cabinet Decision No. 74 of 2023 lets the FTA accept records in English while reserving the discretion to require an approved Arabic translation within a period it specifies. The risk is not the language of the books but being unable to produce that translation, which carries an AED 5,000 penalty.
Why must a Voluntary Disclosure come before the audit notice?
Because timing decides whether the 15% applies. File before the FTA notifies you of an audit and the penalty is 1% per month on the tax difference. Fail to file before that notice and a fixed 15% of the difference is added on top of the same monthly charge.
Do all free zone companies need audited financial statements?
Every Qualifying Free Zone Person does, with no revenue threshold, under Ministerial Decision No. 84 of 2025 for tax periods starting on or after 1 January 2025. A taxable person outside a tax group needs them once revenue exceeds AED 50 million.
What happens if a QFZP breaches one of its conditions?
It loses Qualifying Free Zone Person status for that Tax Period and the four following ones, five in total. Exceeding the de minimis limit is one route there: non-qualifying revenue must stay below the lower of AED 5,000,000 or 5% of total revenue.
None of the tax audit UAE 2026 deadlines above move, and most of the penalties are arithmetic on a number you already know. The work that reduces exposure is unglamorous: keep supporting documents in a form you can hand over, check for an open audit notice before retiring any file, get the audit and any agreed-upon procedures report done on time, and correct known errors while a Voluntary Disclosure still costs 1% a month rather than 15% plus 1%.
Explore UAE Freezone options today →
Image: Jebel Ali Port oil depots, JAFZA, Dubai, by Bjoertvedt, CC BY-SA 3.0, via Wikimedia Commons.