Most business owners in the UAE already know what KYC means. Your bank asked for it when you opened an account. Your real estate agent asked for it when you bought or leased a property. It has been part of doing business here for years, and everyone has learned to live with it.
Now a new rule has quietly moved that same idea to a place nobody really expected — the supplier side of a VAT invoice. Federal Tax Authority Decision No. 13 of 2026 tells every taxable person that before claiming input VAT, they must actually know who they are buying from and what they are buying, in a way that looks a lot like the due diligence banks and Designated Non-Financial Businesses and Professions (“DNFBPs”) have followed for years.
This blog breaks down what the law actually says, places it next to the anti-money laundering rules DNFBPs already live under, and looks at why the UAE is doing this now — and where it seems to be heading.
The starting point is Article 54(bis) of the VAT Law, Federal Decree-Law No. 8 of 2017. It was inserted by Federal Decree-Law No. 16 of 2025, issued on 1 October 2025 — but issued is not the same as effective. The article itself only came into force on 1 January 2026. Mixing up an issue date and an effective date is an easy mistake, but it can throw off an entire compliance timeline.
Article 54(bis), Federal Decree-Law No. 8 of 2017 on Value Added Tax, as inserted by Federal Decree-Law No. 16 of 2025, in force from 1 January 2026:
“1. The Authority shall reject the deduction of the Recoverable Input Tax if it is established to the Authority that the supply subject to the deduction was part of a supply or a chain of supplies related to Tax Evasion, and the Taxable Person was aware of this relation upon deducting the Recoverable Input Tax. 2. The Authority may reject the deduction of the Recoverable Input Tax if it is established to the Authority that the supply subject to the deduction was part of a supply or a chain of supplies related to Tax Evasion, and the Taxable Person should, based on circumstances of the supply, have been aware of this relation. 3. For the purposes of applying the provisions of Clause 2 of this Article, the Taxable Person shall be considered to have been required to be aware that the supply was part of a supply or a chain of supplies related to Tax Evasion, if he did not verify the validity and integrity of the supplies he receives before deduction of Input Tax, in accordance with the measures, procedures and conditions determined by the Authority in this regard.”
Read Clause 3 slowly. It does not say the FTA only catches you if you actually knew your supply chain had tax evasion in it. It says you are treated as if you should have known, the moment you fail to verify your supplies the way the FTA prescribes. No verification, no defence.
For about a year, this article sat on the books without any detail on what “verifying the validity and integrity of supplies” actually meant. On 22 July 2026, approved at the FTA Board’s 45th meeting held on 23 June 2026, the FTA finally filled that gap with Decision No. 13 of 2026, which takes effect on 1 October 2026.
The date FTA Decision No. 13 of 2026 takes effect. Article 54(bis) itself has already been in force since 1 January 2026.
Supplies below this value, exclusive of VAT, are exempt from full verification — but the exemption has a limit.
12-month spend from a single supplier above this figure cancels the AED 10,000 small-supply exemption entirely.
12-month supplier spend that triggers mandatory bank account confirmation and public reputation checks.
The decision splits the job into two exercises: know your supplier, and know your supply. Both need to happen before that input tax figure goes anywhere near your VAT return.
Article 3(1), FTA Decision No. 13 of 2026, verification of the supplier’s identity:
“Where the supplier is a natural person, the Taxable Person must obtain a copy of a valid proof of identity, including an Emirates ID or a passport, and meet the supplier, whether in person or virtually, before making the supply. Where the supplier is a legal person, the Taxable Person must verify the supplier’s incorporation through official databases or a certificate of incorporation, and verify the identity of the director, agent or employee authorised to represent the supplier.”
This should sound familiar to anyone who has opened a bank account or registered with a DNFBP in the UAE. The only thing that has changed is who is doing the checking — it used to be a bank or a real estate agent checking their customer. Now it is every business checking its supplier.
Article 3(2) and 3(3), FTA Decision No. 13 of 2026, verification of address and risk:
“Verify the existence of an actual place of business using appropriate electronic means or a field visit, and ensure it is compatible with the nature of the activities carried out. Ensure none of the following risk indicators applies: the supplier has changed its address more than twice over the previous 12 months; changed its key employees more than twice over the previous 12 months; or undertaken commercial transactions disproportionate or unexpected compared to the size and history of the supplier’s business.”
A field visit to check a supplier’s premises is not something most finance teams have ever had to budget for. But this is exactly the kind of physical verification DNFBPs like real estate brokers are already expected to perform when a customer’s risk profile calls for it.
Article 3(4), FTA Decision No. 13 of 2026, bank account and reputation checks:
“Where the value of supplies received from the supplier exceeds AED 375,000 over the previous 12-month period, or is expected to exceed AED 375,000 over the next 12 months, the Taxable Person shall obtain from the supplier a written confirmation issued by an authorised bank in the State confirming that the supplier has a bank account, and review and assess publicly available reviews and media coverage related to the supplier, ensuring there are no indicators of suspected Tax Evasion.”
AED 375,000 is not a small number for a small supplier, but it is a very ordinary annual turnover figure for a mid-sized one. This threshold pulls in a large share of everyday business relationships, not just the exotic or unusual ones.
Article 4, FTA Decision No. 13 of 2026, verification of supplies (extract):
“Ensure that the supplier’s engagement in the transaction is based on genuine commercial reasons. The payment method and conditions must be justifiable for commercial reasons — where a third party is involved in payment, or payment is made to a bank account outside the supplier’s country of incorporation, there must be a reasonable commercial explanation. The Consideration for the supply shall be paid by electronic means; where paid in cash, it must be based on a documented commercial reason and be easily verifiable. Verify that prices or profit margins are not commercially unjustifiable, and that the goods or services received do not fall outside the supplier’s licensed activity.”
Notice the push toward electronic payment. Cash is not banned, but it now needs a documented reason and it must be easily verifiable — the same nudge the UAE has been giving its economy for years, and it lines up neatly with the electronic invoicing rollout below.
Emirates ID or passport for individuals; official database or certificate checks plus authorised-representative ID for companies, before the first supply.
Confirm a real place of business — electronically or via a field visit — and screen for repeated address changes, staff turnover, or oversized transactions.
Above AED 375,000 in 12-month spend: written bank confirmation from the supplier, plus a review of public reputation and media coverage.
Pricing, payment method and origin of goods must all make genuine commercial sense — cash needs a documented reason and must be verifiable.
Article 5 requires these checks on first dealing with a supplier, whenever 12 months have passed since the last verification, and on every single taxable supply received. A written, documented policy naming who does the checking, who reviews it, and who supervises it is also mandatory.
Article 6 gives some breathing room — but the exemption has a limit.
Article 6, FTA Decision No. 13 of 2026, exceptions:
“1. A Taxable Person may disregard taking the measures and meeting the conditions stipulated in this Decision on the Taxable Supplies received where the Consideration, exclusive of Value Added Tax, is less than AED 10,000. 2. The exception stipulated in Clause 1 of this Article shall not apply where the total value of supplies received from the supplier exceeds AED 100,000 over the previous 12 months, or is expected to exceed this amount over the next 12 months.”
In practice, many regular, recurring small suppliers — the office cleaning company, the stationery supplier, the small logistics partner — will still fall inside full scope once the relationship matures. This decision comes into effect on 1 October 2026, under Article 7.

Know your customer started with banks and financial institutions under the original anti-money laundering law, Federal Decree-Law No. 20 of 2018. A few years later, the UAE widened the net to certain non-financial businesses, calling them Designated Non-Financial Businesses and Professions, or DNFBPs.
That framework has since been completely rebuilt. The old 2018 law was repealed by Federal Decree-Law No. 10 of 2025, issued on 30 September 2025 and in force from 14 October 2025. Its Executive Regulation, Cabinet Resolution No. 134 of 2025, entered into force on 14 December 2025 and now names six DNFBP categories.
Article 3, Cabinet Resolution No. 134 of 2025 on the Executive Regulations of Federal Decree-Law No. 10 of 2025:
“Designated Non-Financial Businesses and Professions (DNFBPs) shall include any person who carries out one or more of the following commercial or professional activities or businesses: 1. Commercial Gaming Operators, including Commercial Gaming conducted on board vessels or marine craft, when conducting a single financial transaction or several transactions that appear to be linked and whose value equals or exceeds eleven thousand dirhams (AED 11,000). A financial transaction shall not include a transaction that solely involves gaming chips or gaming instruments. 2. Real estate brokers and agents, when concluding transactions or settlements on behalf of their customers in relation to the purchase or sale of real estate. 3. Dealers in precious metals and precious stones, in carrying out any single monetary transaction or several transactions that appear to be interrelated or equal to more than AED 55,000. 4. Lawyers, notaries and other independent legal professionals and independent accountants, when preparing, conducting or executing financial transactions for their customers. 5. Providers of corporate services and trusts, upon performing or executing a transaction on behalf of their customers. 6. Any other businesses or professions may be determined by a resolution issued by the Supervisory Authority, in coordination with the National Committee.”
The newest addition is commercial gaming operators, brought in as the UAE built out its regulated gaming sector. So over roughly seven years, the DNFBP list has grown from five categories to six, each with its own trigger threshold. Now look at where FTA Decision No. 13 of 2026 sits — it does not name a sector at all. It applies to every taxable person, dealing with any supplier, in any sector. That is the real jump: from five sectors, to six sectors, to everyone.
Put the DNFBP due diligence rules and FTA Decision No. 13 of 2026 side by side, and the family resemblance is obvious.
Guidelines for Designated Non-Financial Businesses and Professions, Ministry of Economy and Tourism:
“A comprehensive CDD program must include the following key elements, in accordance with the UAE AML/CFT Law and Decision, and in line with FATF Recommendations: Customer and Beneficial Owner identification and verification, Customer risk profiling and risk rating, Customer acceptance procedures, Understanding the purpose and intended nature of the business relationship, Ongoing monitoring of the business relationship, Investigation and escalation of unusual transactions, Record-keeping and documentation.”
Swap the word customer for supplier, and swap the word DNFBP for taxable person, and the two frameworks read like close cousins. There is a real difference too, and it is worth being honest about it.
Suspicious transaction reports flow to the Financial Intelligence Unit via goAML, with CBUAE and Financial Centre authorities supervising the sector.
No FIU filing, no CBUAE oversight. The only authority involved is the FTA, and the only consequence is a rejected input tax deduction — a direct, automatic hit to cash flow.

The timing lines up closely with another major shift already underway: mandatory electronic invoicing. Under the Ministry of Finance’s phased rollout, a voluntary pilot programme begins on 1 July 2026, mandatory implementation for larger businesses with annual revenue of AED 50 million or more starts from 1 January 2027, it extends to all other businesses by 1 July 2027, with government entities following from 1 October 2027.
The Ministry of Finance frames the purpose of electronic invoicing plainly: maximising compliance, tackling the shadow economy, and shrinking the tax gap, while giving the government access to relevant data in near real time. Once every invoice is validated and reported to the FTA almost as it happens, the FTA stops depending only on a taxpayer’s self-reported VAT return — it gets to see the transaction itself.
Put these two moves together and a pattern emerges. FTA Decision No. 13 of 2026 asks businesses to build the discipline and paper trail around who they buy from and why. Electronic invoicing, arriving right on its heels, gives the FTA the real-time visibility to test that discipline against actual transaction data. One creates the responsibility. The other creates the means to check it.
If the direction of travel continues, the next logical step is for input VAT control itself to move from a business’s own internal checks to something the FTA verifies electronically, transaction by transaction, once e-invoicing is fully in place. A business would no longer need to prove it did its homework only when audited — the FTA’s own systems could flag a mismatched or suspicious supplier relationship almost as the invoice is issued.
That would be a genuinely different world for VAT compliance in the UAE, and it places a serious responsibility on every business today to build the supplier verification habit properly, well before the systems around it get sharper.

FTA Decision No. 13 of 2026 is not really a new idea in UAE regulation. It borrows heavily from a due diligence discipline that banks and DNFBPs have followed for years, and simply extends it to the supplier relationships of every VAT-registered business. What makes it significant is scale — this is no longer five or six sectors, it is every business, buying from every other business, with real money at stake if the homework is not done.
01.Fix Your Article 54(bis) Compliance Date
Effective 1 January 2026, not 1 October 2025. Decision No. 13 of 2026 itself takes effect 1 October 2026.
02.Build a Written Verification Policy
Article 5 requires a documented policy naming who checks, who reviews, and who supervises supplier verification.
03.Verify Every New Supplier Up Front
Check identity and incorporation on first dealing, and refresh it if 12 months pass without a repeat check.
04.Track Both Thresholds
Watch the AED 375,000 bank/reputation-check trigger and the AED 100,000 line that cancels the AED 10,000 small-supply exemption.
05.Document the Commercial Logic
Keep a written explanation for unusual pricing, cash payments, third-party payments, or any intermediary role — before claiming input VAT.
06.Start Preparing for E-Invoicing Early
Even below the AED 50 million trigger for January 2027, the July 2027 deadline is closer than it looks.
Getting this right early is not just about avoiding a denied input tax claim. It is about building the kind of supplier discipline the UAE’s tax system is clearly moving toward, before it becomes something the FTA checks for you automatically.
Sources
test