UAE KYS Rules Take Effect: FTA Decision 13 Starts 1 October

From 1 October 2026 the UAE Federal Tax Authority's Decision No. 13 of 2026 takes full effect. A valid tax invoice on its own is no longer enough to safely claim input VAT — businesses now have to run and document a Know Your Supplier (KYS) check on both the counterparty and the supply. The thresholds are AED 10,000 for an individual supply, AED 100,000 for annual aggregate per supplier, and AED 375,000 as the trigger for enhanced due diligence with a UAE bank confirmation. Here is who is affected, what to verify, and what to put in place over the next few weeks.

What changed on 1 October 2026

Decision No. 13 of 2026 — on the measures, procedures and conditions required from taxable persons for verification of the validity and integrity of supplies — was approved by the FTA Board on 23 June 2026, issued on 22 July 2026, and takes effect on 1 October 2026. From that date UAE VAT law incorporates a formal Know Your Supplier (KYS) process that applies to every VAT-registered business claiming input VAT.

The underlying shift is simple. Until 1 October 2026, a correct tax invoice from a VAT-registered supplier was sufficient to claim input VAT. From 1 October the FTA can deny the recovery if the taxable person has not carried out and documented a verification of the supplier and the supply — even where the invoice itself is spotless. The logic tracks the "should have known" doctrine familiar from European VAT case law: if a reasonable check would have surfaced the problem, formal paperwork alone will not protect the deduction.

This is a standalone FTA instrument. It is distinct from the recent Cabinet Decision No. 149 of 2026 amending the VAT Executive Regulation, which covers substantive rules rather than verification procedures.

Thresholds: when KYS applies, and when it goes enhanced

Decision 13 sets up a three-tier scale:

• Up to AED 10,000 per individual supply (excluding VAT) and up to AED 100,000 aggregate per supplier over 12 months — no KYS required. This carves out routine small purchases (stationery, one-off services, minor procurement) from the administrative burden.
• Above AED 10,000 per supply or above AED 100,000 aggregate per supplier — full KYS applies (see below).
• Above AED 375,000 over 12 months from one supplier — enhanced due diligence kicks in. On top of standard KYS, the business must obtain a written confirmation from a UAE-licensed bank that the supplier holds a live account, plus a reputation screening using public sources, media and reviews.

The AED 375,000 threshold is not coincidental: it mirrors the UAE's mandatory VAT registration threshold, which we unpack separately in our note on UAE VAT 5% for entrepreneurs and when registration pays off.

Verification is due at first engagement with the supplier and refreshed at least every 12 months — not per invoice. Each refresh goes into the supplier file.

What exactly to verify

The procedure splits into two layers.

1) Supplier verification. You need to confirm the counterparty exists, is legally registered and is genuinely trading:

• trade licence and registration (corporate identity);
• authorised representatives — who can sign documents on behalf of the supplier;
• confirmation of the actual place of business (not just a PO box);
• risk indicators — frequent address or personnel changes, operations inconsistent with the stated size of the business.

2) Supply verification. For each transaction you need to confirm that:

• the deal has commercial substance and fits the supplier's operating model;
• the goods or services sit inside the activities permitted by the supplier's licence;
• pricing is reasonable and consistent with the market;
• origin of the goods is traceable where physical delivery is involved;
• payment goes through the banking system; any cash settlement is justified in writing.

For the enhanced tier (above AED 375,000) you add an unqualified written confirmation from a UAE-licensed bank that the supplier holds an account there, and a review of public reputation — reviews, media coverage, regulatory warnings if any.

Documentation and ownership

A procedural check on its own is not enough: Decision 13 requires it to be documented and embedded in the control environment.

• Written KYS policy. A short internal document that sets out the criteria, thresholds, frequency and ownership. It has to be approved — not a working draft.
• Named compliance owner. There must be a designated person inside the business accountable for KYS. In SMEs this is typically the finance director, chief accountant or an external tax advisor engaged under contract. Larger businesses carve out a compliance function.
• Records of all checks. For each supplier above the lower threshold — a dossier: trade licence, address confirmation, representative IDs, bank letter and screening material where required, with the date of the check.
• Electronic payments as default. Non-cash settlement is the baseline; cash transactions require documented business justification.

Businesses already preparing for UAE e-invoicing can usefully fold KYS into the same programme: supplier master data, status and supporting documents are easier to maintain in one place — it simplifies both electronic invoicing and the annual KYS refresh.

What breaks if you skip KYS

The headline sanction is FTA denial of input VAT recovery on the supplies that failed verification. If the taxable person cannot show a documented check of the supplier and the supply, the Authority can disallow the deduction even where the tax invoice is formally correct.

The more serious scenario is when the verification would have exposed the counterparty's involvement in tax evasion. In that case the denial is no longer discretionary — it is mandatory, in line with the FTA's "should have known" principle: a reasonable check would have surfaced the issue, and the business was required to run it.

Additional consequences:

• VAT reassessment and interest under the standard UAE rules;
• penalties under the existing VAT compliance regime;
• reputational drag in audits and tenders — a missing KYS policy reads as weak compliance.

For businesses already running the UAE corporate tax regime, KYS is a second compliance front to close in parallel with the corporate tax return cycle.

A plan for October – November

Practical actions worth taking over the next few weeks:

1. Build a 12-month supplier register and segment it against the thresholds: below AED 100,000 — out of scope; AED 100,000 – 375,000 — standard tier; above AED 375,000 — enhanced tier.
2. For every supplier above the lower threshold, collect and file: current trade licence, address confirmation, ID of authorised representatives, operating profile.
3. For counterparties above AED 375,000 — request a bank letter from a UAE-licensed bank confirming the account, run a reputation screen, and store the output.
4. Adopt a short KYS policy (one to two pages — criteria, thresholds, frequency, owner) and formally designate a compliance owner.
5. Embed verification into the monthly close: new supplier — dossier opened before the first payment; recurring suppliers — refreshed at least every 12 months.
6. Review cash settlements: where feasible, convert them to bank transfers; where retained, document the business rationale.

Businesses on outsourced accounting should ask the provider where exactly KYS sits inside their process, who owns it, and how the output lands in the tax file. For SMEs and freelancers VAT-registered on turnover, the minimum baseline is a supplier register segmented by threshold and a set of trade licences on file — without that, even mechanically correct returns will be exposed on audit.

This note is informational and not tax advice. The full text of Decision No. 13 of 2026 and official guidance are published by the UAE Federal Tax Authority at tax.gov.ae; for implementation in a specific business, a tailored review by a tax advisor with reference to the supplier mix, volumes and sector is recommended.