UAE KYS Rules: Safeguarding Input VAT Recovery from October 2026

Introduction

UAE businesses must prepare for a significant shift in Value Added Tax (VAT) regulations coming into effect on October 1, 2026. The Federal Tax Authority (FTA) will gain explicit power to deny input VAT recovery if a transaction within a business's supply chain is found to be linked to tax evasion, particularly if the business "should have been aware" of such a risk. This pivotal change introduces a new, explicit due diligence responsibility for companies regarding their suppliers, making proactive compliance essential to avoid financial penalties and ensure continued smooth operations.

This article details the impending changes, outlines the new "Know Your Supplier" (KYS) requirements, and provides actionable guidance for UAE businesses to implement robust compliance frameworks well before the October 2026 deadline. Understanding these updated regulations is crucial for safeguarding input tax recovery and maintaining good standing with the FTA.

What are the new UAE KYS rules and when do they take effect?

The core of the upcoming change is FTA Decision No. 13 of 2026, which empowers the Federal Tax Authority to reject input VAT claims. This decision applies specifically when any transaction in the supply chain is connected to tax evasion and the taxpayer should have been aware of this connection. These rules become legally enforceable from October 1, 2026.

The primary objective of this decision is to combat sophisticated forms of VAT fraud, most notably "missing trader fraud." In such schemes, a fraudulent supplier charges VAT to their customers but subsequently disappears without remitting the collected tax to the FTA. This leaves businesses further down the supply chain at risk, as their input VAT claims against such a supplier could be denied.

The phrase "should have been aware" is particularly critical. It establishes an expectation that businesses will conduct a reasonable level of due diligence on their suppliers. This is not about proving direct involvement in fraud, but rather about demonstrating that a business exercised prudence. If a business fails to identify red flags that a reasonably diligent operator would have noticed, the FTA can deny their input VAT credit, even if the business itself was not directly complicit in the evasion. This represents a significant shift from a largely transactional compliance model to one requiring active risk management within the supply chain.

Who must comply with these new KYS rules?

All VAT-registered businesses operating in the UAE are impacted by these new regulations. The responsibility for implementing robust Know Your Supplier (KYS) procedures falls broadly, but the intensity and scope of due diligence will vary based on a business's specific risk profile.

The onus of establishing and maintaining effective KYS frameworks will be particularly significant for companies that exhibit certain characteristics or operate in higher-risk environments. This includes businesses with:

• Extensive or Complex Supply Chains: Multiple tiers of suppliers, international components, or rapidly changing supplier relationships increase exposure to fraud risks.
• High-Value or Frequent Transactions: Suppliers involved in a significant volume or value of transactions naturally warrant closer scrutiny due to the potential financial impact of a denied input VAT claim.
• Suppliers in High-Risk Sectors: Certain industries are historically more susceptible to VAT fraud schemes. These can include sectors dealing with high-value, easily movable goods (e.g., electronics, precious metals) or services with opaque value chains.
• New or Unestablished Suppliers: Businesses engaging with newly formed entities, those with limited operating history, or suppliers lacking a demonstrable physical presence may require enhanced vetting.
• Transactions Involving Cash or Unusual Payment Methods: Any deviations from standard banking practices or established payment flows can signal elevated risk.

While the FTA has not yet detailed specific thresholds for heightened supplier checks, businesses should anticipate that their due diligence efforts must be proportionate to the assessed risk of each supplier and transaction. This means a one-size-fits-all approach will likely be insufficient.

What are the specific requirements for KYS compliance?

The new regulations introduce explicit compliance requirements designed to foster greater transparency and verifiability within the supply chain. To meet these obligations, UAE businesses will need to implement a structured approach to supplier management. The core requirements focus on ongoing verification, policy development, and dedicated oversight.

1. Conduct Ongoing Verification and Transaction Checks

KYS extends beyond initial onboarding. Businesses must regularly verify key supplier details and scrutinise transactions for unusual patterns that could indicate fraud. This continuous monitoring involves:

• Regular Supplier Data Verification: Annually, or at other predefined intervals, businesses should re-verify essential supplier details. This includes checking the supplier's active VAT registration status with the FTA, validating their trade license, confirming their physical business address, verifying bank account details match the registered entity, and performing checks on key personnel like directors or ultimate beneficial owners (UBOs).
• Transaction Monitoring for Red Flags: Businesses must establish processes to identify suspicious transaction characteristics. These can include unusually low pricing that suggests a non-commercial motive, sudden and unexplained changes in payment methods or bank accounts, lack of proper documentation, vague descriptions of goods or services, or an unwillingness of the supplier to provide necessary verification.
• Documentation: All verification checks, communications, and risk assessments must be thoroughly documented to demonstrate due diligence to the FTA if required.

2. Maintain an Internal KYS Policy

Every impacted company must develop and formally document a clear internal policy outlining its specific KYS procedures. This policy serves as the operational blueprint for compliance and should be tailored to the business's unique risk profile, industry, and operational scale. A robust KYS policy should:

• Define Scope and Responsibility: Clearly delineate which suppliers are subject to KYS, the level of due diligence required for different risk categories, and assign specific responsibilities to departments and individuals.
• Outline Due Diligence Procedures: Detail the types of checks to be performed (e.g., documentary, third-party verification, site visits), the frequency of these checks, and the sources of information to be used.
• Establish Risk Assessment Methodology: Provide a framework for identifying, assessing, and mitigating supplier-related VAT fraud risks.
• Detail Handling of Red Flags: Specify procedures for investigating potential risks, escalating concerns, and making decisions regarding engaging with or disengaging from suppliers.
• Address Record-Keeping: Mandate how KYS records will be maintained, stored, and made accessible for internal and external audits.

3. Appoint a Compliance Officer

A dedicated individual must be appointed to oversee the KYS framework. This can be a newly created role or an expansion of an existing compliance, finance, or legal function. The KYS Compliance Officer will hold critical responsibilities, including:

• Implementation and Enforcement: Ensuring the KYS policy is effectively implemented across all relevant departments and that all staff understand their obligations.
• Training and Awareness: Providing ongoing training to procurement, finance, legal, and other relevant teams on KYS requirements, how to identify and report suspicious activities, and the importance of due diligence.
• Monitoring and Reporting: Continuously monitoring compliance with the KYS policy, conducting internal reviews, and reporting on KYS-related matters, risks, and compliance status to senior management and, where appropriate, the board.
• Liaison with Authorities: Acting as the primary point of contact for the FTA on KYS-related inquiries and audits.
• Record Management: Ensuring all KYS records are accurately maintained and readily available.

What are the risks of non-compliance?

Failing to establish and maintain an effective KYS framework carries substantial and multifaceted risks for UAE businesses. The consequences extend beyond direct financial penalties, impacting operational continuity and reputation.

Denial of Input VAT Recovery

This is the most immediate and significant financial consequence. If a business's input VAT claims are linked to a fraudulent transaction and due diligence shortcomings are identified, the FTA can deny the recovery. This effectively increases the cost of goods or services purchased, directly impacting profitability and cash flow. For businesses with high input VAT, this could represent a substantial and unexpected expense.

Financial Penalties

The FTA can impose administrative penalties for non-compliance with tax legislation. These penalties can apply not only to the denied input VAT amount but also for failing to maintain adequate records or implement required compliance procedures, significantly increasing the financial burden.

Reputational Damage

Being linked, even inadvertently, to tax evasion can severely damage a company's standing. This can erode trust among customers, business partners, investors, and the wider public. Reputational harm can lead to loss of contracts, difficulty in attracting new business, and a negative perception in the market, which can be far more costly to repair than any direct financial penalty.

Operational Disruptions

Disputed VAT claims often trigger detailed FTA audits, which can be time-consuming and resource-intensive. These audits can lead to delays in VAT refunds, increased administrative burden on finance and legal teams, and diversions of internal resources from core business activities.

Legal Implications

In severe cases, a persistent lack of due diligence, or clear negligence in implementing KYS procedures, could expose a business to broader legal scrutiny. While the primary focus is on VAT recovery, actions or omissions perceived as aiding and abetting tax evasion could potentially lead to more serious legal and criminal implications for the company and its responsible officers, especially if a pattern of disregard for regulatory obligations is established.

How can UAE businesses prepare for October 2026?

Proactive preparation is crucial to ensure a smooth transition and full compliance with the new KYS rules. Businesses should begin taking these steps immediately, viewing the October 2026 deadline as a critical milestone.

1. Assess Your Current Processes

Start by reviewing your existing supplier onboarding, management, and payment procedures.

• Identify Gaps: Pinpoint where current due diligence efforts fall short of the upcoming KYS requirements.
• Data Audit: Examine the quality and completeness of your existing supplier master data. Do you have all necessary verification documents on file?
• Risk Mapping: Understand the current risk profile of your supply chain, identifying key dependencies and potential vulnerabilities.

2. Develop a Tailored KYS Policy

Create a comprehensive, documented KYS policy that aligns precisely with your business operations, industry, and risk profile.

• Structure: Ensure it covers initial vetting, ongoing monitoring, risk assessment methodologies, and clear mitigation strategies.
• Practicality: The policy must be implementable and understood by all relevant staff.
• Documentation: Explicitly state all required documentation for each supplier category and transaction type.

3. Define Supplier Risk Thresholds

Based on your business's risk appetite and operational realities, establish clear criteria for identifying high-risk suppliers or transactions that require enhanced due diligence.

• Factors: Consider criteria such as annual transaction volume, value of individual transactions, supplier tenure, industry sector, country of origin (for international suppliers), and perceived financial stability.
• Tiered Approach: Implement a tiered due diligence approach, where basic checks are applied to all suppliers, and enhanced checks are reserved for those meeting specific risk thresholds.

4. Appoint and Train a Compliance Officer

Designate a KYS Compliance Officer, ensuring they have the necessary authority, resources, and training to fulfill their responsibilities effectively.

• Authority: The officer must have direct access to senior management and the power to enforce KYS policies across departments.
• Resources: Provide the necessary budget, tools, and support staff to manage the KYS framework.
• Training: Ensure comprehensive training on VAT legislation, fraud detection, and due diligence best practices.

5. Implement Staff Training

Educate procurement, finance, legal, sales, and other relevant teams on the new KYS requirements.

• Roles & Responsibilities: Clearly define each department's role in the KYS process.
• Red Flag Recognition: Train staff on how to identify suspicious activities or characteristics in supplier interactions and transactions.
• Reporting Mechanisms: Establish clear internal channels for reporting potential KYS non-compliance or fraud concerns.

6. Use Technology

Consider implementing technological solutions for supplier due diligence, data management, and continuous monitoring.

• Automation: Tools can automate checks against public registries (like FTA VAT registration database, commercial registries).
• Data Analytics: Use data analytics to identify unusual transaction patterns or anomalies.
• Centralized Records: Implement systems for maintaining accurate, accessible, and tamper-proof KYS records.

7. Regular Review and Update

The KYS framework should not be a static document. It must be a living system, subject to regular reviews and updates.

• Adaptation: Periodically reassess your KYS policy and procedures to adapt to evolving risks, new FTA guidance, and changes in your business operations or supply chain.
• Effectiveness Checks: Conduct internal audits to ensure the KYS framework remains effective in mitigating risks and compliant with regulations.

Conclusion

The introduction of new "Know Your Supplier" rules from October 1, 2026, marks a significant evolution in the UAE's VAT compliance landscape. Businesses can no longer assume their input VAT recovery is secure without demonstrating proactive due diligence on their entire supply chain. The FTA's new powers, stemming from FTA Decision No. 13 of 2026, place a clear burden on businesses to actively identify and mitigate the risk of tax evasion linked to their transactions.

Adopting a robust KYS framework is not merely a regulatory obligation; it is a strategic imperative. It protects financial interests by safeguarding input tax recovery, mitigates the risk of hefty penalties, and preserves invaluable corporate reputation. By investing in comprehensive KYS policies, ongoing supplier verification, and dedicated compliance oversight, businesses can transform a potential compliance challenge into an opportunity for stronger operational resilience and enhanced governance.

As the October 2026 deadline approaches, businesses that act decisively will be best positioned to navigate these changes successfully. Engaging with experienced advisory firms like AURNE can provide the tailored guidance and practical support needed to develop, implement, and maintain an effective KYS framework, ensuring your business is not only compliant but also resilient against emerging tax fraud risks.

Source & References

• gulfnews.com

---

This article is for general information only and does not constitute professional, legal, tax, or financial advice. Speak to AURNE for guidance specific to your situation.