On 22 July 2026 the UAE Federal Tax Authority (FTA) issued Decision No. 13 of 2026 — the detailed Know Your Supplier (KYS) rulebook for input VAT recovery. It takes effect on 1 October 2026. From that date a valid tax invoice is no longer enough for input VAT credit: the business must document supplier verification — identity, physical premises, commercial substance and payment terms. Thresholds are transactions under AED 10,000 with annual spend below AED 100,000 per supplier (outside KYS); annual spend above AED 375,000 triggers enhanced due diligence.
What Decision 13/2026 introduces and on what legal basis
The decision was approved by the FTA Board of Directors on 23 June 2026, issued on 22 July 2026 and takes effect on 1 October 2026. The legal basis is Article 54(bis) of the VAT Law, added by Federal Decree-Law No. 16 of 2025 as part of anti-evasion amendments to Federal Decree-Law No. 8 of 2017 on Value Added Tax. From 1 January 2026 the FTA has already had the power under Article 54(bis) to reject input VAT recovery where a transaction or a chain of supplies is linked to tax evasion. Decision 13/2026 is the executive rulebook: it spells out exactly which checks a taxable person must run and document to prove they knew their supplier.
Historically, a formally valid tax invoice was enough for input VAT credit. Now it is not — the business must keep a verification file and update it per supplier on first dealing and at least once every 12 months. The logic sits in the same family as Know Your Customer in banking: the FTA is shifting part of the compliance burden onto the buyer to squeeze fake-invoice patterns out of VAT chains.
Thresholds: when KYS is mandatory
The rulebook builds a three-tier matrix — by single-supply size and by 12-month spend per supplier.
Individual supplies below AED 10,000 excluding VAT with cumulative annual spend below AED 100,000 per supplier — no KYS checks. That is the sensible shortcut for petty operating costs: one-off stationery, couriers, coworking. The moment 12-month cumulative spend with a single supplier crosses AED 100,000, the AED 10,000 shortcut is switched off — every invoice from that supplier falls under full KYS.
Above AED 100,000 annual spend per supplier — basic KYS: identity, physical premises, representative, commercial substance, payment terms. Performed on first dealing and repeated when more than 12 months have elapsed since the last check.
Above AED 375,000 annual spend per supplier (rolling 12 months) — enhanced due diligence: a bank confirmation letter from the supplier plus reputational/media screening on top of basic KYS. The AED 375,000 mark is deliberate — it is the same threshold at which VAT registration becomes mandatory in the UAE, and the FTA is aligning the two.
What to check on the supplier and on each supply
The rulebook splits verification into two blocks — on the supplier (Article 3) and on each supply (Article 4).
On the supplier: identification documents (Emirates ID or passport for individuals; commercial licence and incorporation documents for entities); a real place of business consistent with the declared activity (no PO boxes, no map flags); identification of the representative signing contracts; risk indicators — no more than two address or key-personnel changes in the past 12 months; transaction volumes proportionate to the supplier’s size (a small company with millions in invoices is a red flag).
On each supply: a genuine commercial rationale (what you are buying and why); commercially reasonable payment terms; a preference for electronic payments — large cash requires separate justification and documentation; market-aligned pricing; and goods or services that match the supplier’s licensed activity. If the licence says “consulting” and you are buying electronics worth a million dirhams from the same entity, that is not a KYS pass.
The wider logic is the same one that already runs the base VAT regime: input tax is recoverable only for costs genuinely tied to the taxable activity of the business. The base is set out in UAE 5% VAT for entrepreneurs. KYS does not replace it — it adds a mandatory second layer of evidence: not only what you bought but from whom, and how you checked.
Enhanced due diligence: above AED 375,000 a year
What is layered on top of basic KYS once annual spend per supplier crosses AED 375,000:
Bank confirmation letter from the supplier — confirmation that the bank account you are paying is real. It knocks out the “invoice on entity A, payment to the account of entity B” pattern where fake-VAT chains typically surface.
Reputational / media screening — a check against open sources: press, regulatory lists, court databases, upcoming enforcement actions. The goal is to catch red flags before the FTA finds the evasion in the chain and denies your credit after the fact.
In essence, enhanced due diligence pulls tax compliance closer to the AML/CFT playbook that banks already run — the same check-list mid-sized and larger UAE finance functions apply to counterparties under central-bank requirements.
Written KYS policy and named responsible officers
Article 5 requires the taxable person to hold a written KYS policy with named responsible officers (a compliance officer or a designated person in accounting/finance) and to retain all verification evidence — ID documents, verification screenshots, bank letter, media report, next-review date — in a form that can be pulled up in an FTA tax audit. The best place for that file is the vendor master in ERP or a linked compliance repository, not scattered folders.
The same operational loop connects to mandatory e-invoicing, which the UAE is rolling out through 2026–2027: invoice metadata flows to the FTA automatically, while the KYS file stays on the business side as proof of “I checked who I bought from”. The moving parts of the e-invoicing transition and how it interlocks with the VAT cycle are covered in E-Invoicing in the UAE: what businesses need to know in 2026.
What happens when you don’t comply
Decision 13/2026 itself does not levy direct fines — the sanction sits in the parent Article 54(bis) of the VAT Law. Under it, the FTA can reject input VAT credit where a transaction or a chain of supplies is linked to tax evasion and the recipient knew or should have known. “Should have known” is precisely the gap KYS closes: without a documented supplier check on AED 500,000 of annual spend, the “we honestly didn’t know” argument no longer holds — the FTA’s view is that you should have known.
The practical exposure is a claw-back of previously deducted input VAT for prior periods plus interest, and where conduct qualifies as evasion, administrative penalties under the Tax Procedures Law. For a VAT-registered SME turning over AED 5–10 million a year, a single problematic supplier can quickly translate into a six-figure adjustment.
What businesses should do before 1 October 2026
Step one — pull a supplier list for the past 12 months and split it into three buckets: below AED 100,000 a year (mostly petty spend, KYS not required), AED 100,000 to AED 375,000 (basic KYS), above AED 375,000 (enhanced). Build the list by cumulative amount, not by invoice count — the risk sits with the supplier who quietly ran up a large spend, not with the one with many small invoices.
Step two — draft the written KYS policy: thresholds, check-lists for basic and enhanced verification, responsible officer, re-verification cadence (at least once every 12 months) and document-retention rules. A template is easy to get from a tax advisor — what matters is that it is signed by the managing officer and dated before 1 October 2026.
Step three — for every supplier in the “above AED 100,000” bucket, collect the pack: licence/incorporation copy, address and operations confirmation (office photo, lease), representative details. For the “above AED 375,000” bucket add a bank confirmation letter and media screening. It takes time — starting now is the point.
Step four — align the process with accounting and legal: no contract with a “large” supplier is signed before KYS is complete, and input VAT is claimed only on invoices for which the KYS file is assembled and dated. For older 2026 deals where checks were skipped, running retroactive KYS now — before the decision goes live — locks in a compliance position instead of scrambling for one after a tax audit lands.
