When the FTA Comes Knocking: What the First Corporate Tax Audit Season Means for UAE Businesses

Published: July 19, 2026

The Education Phase Is Over

For three years, the UAE Federal Tax Authority operated in education mode. Registration deadlines were phased. Penalties were waived. Guidance was published in waves. The message to businesses was: get compliant, and we’ll help you get there.

That era ended on 14 April 2026.

The numbers tell the story. In 2024, the FTA conducted 93,000 inspection visits — a 135% increase over the previous year. In 2025, that number jumped to 176,000, an 89% year-on-year increase. Audits rose by 46% in 2025 alone, driving more than $1 billion in additional tax revenue. The FTA reviewed 1.7 million transactions during the year, 20% more than in 2024. AED 46 billion was collected from VAT and Excise Tax, up from AED 41 billion the year before.

And now, the first wave of Corporate Tax returns is landing. For businesses with a 31 December 2025 year-end, the filing deadline is 30 September 2026 — just 73 days away. Once those returns are filed, the FTA will have its first real dataset of corporate tax positions to audit. Every return filed this September is a potential audit target.

The question for UAE finance leaders is no longer whether the FTA will audit. It’s when — and whether the records behind your return can withstand scrutiny.

The New Legal Framework: Three Changes That Reshape Audit Exposure

Three legislative instruments reformed the UAE’s tax audit landscape between January and April 2026. Together, they extend the FTA’s reach, tighten deadlines, and restructure penalties in ways that every finance team needs to understand.

1. Federal Decree-Law No. 17 of 2025 — Extended Limitation Periods (Effective 1 January 2026)

The standard limitation period for tax audits and assessments remains five years from the end of the relevant tax period. But two critical exceptions now extend this dramatically:

Tax evasion: If the FTA determines that a taxpayer engaged in tax evasion, the limitation period extends to 15 years. This is not a theoretical provision. The FTA’s 2025 annual report explicitly states that its enforcement strategy is driven by AI-powered risk analytics that flag evasion patterns automatically.

Failure to register: If a business that should have registered for Corporate Tax failed to do so, the FTA may audit and assess within 15 years from the date the person should have registered. Given the phased registration deadlines throughout 2024 and 2025, and the fact that over 245,000 corporate tax registrations were completed in 2025 alone, this provision has real teeth.

The law also confirms that the right to claim a refund or credit balance lapses after five years — aligning VAT and Corporate Tax on the same timeline.

2. Cabinet Decision No. 17 of 2026 — Expanded Audit Powers (Effective 1 April 2026)

This decision amended the Executive Regulation of the Tax Procedures Law (Cabinet Decision No. 74 of 2023) with several operational changes:

• Document and asset seizure: The FTA’s power to seize and retain documents and assets during a tax audit was formalised and expanded under a new clause to Article 18. This means the FTA can physically take records, devices, and assets relevant to an audit — not merely request copies.
• Extended record retention: Where a taxpayer has submitted a refund application, records must be retained for an additional two years beyond the standard seven-year period. For businesses filing VAT refund claims, this means keeping records for up to nine years.
• Audit conduct clarified: The FTA may conduct desk-based audits (reviewing documents submitted electronically) or on-site audits (attending the business premises). Most audits begin as desk-based reviews and escalate if documents raise unresolved questions.

3. Cabinet Decision No. 129 of 2025 — Restructured Penalties (Effective 14 April 2026)

The penalty regime was overhauled with a clear philosophy: reward early self-correction, punish discovery.

If you self-correct via Voluntary Disclosure before the FTA notifies an audit:

• 1% per month on the tax difference, calculated from the original filing deadline
• No fixed penalty

If the FTA discovers the error during an audit:

• 15% fixed penalty on the unpaid tax
• 1% per month on the tax difference from the original due date until disclosure

Late payment penalties shift to a 14% annual non-compounding rate, replacing the previous escalating monthly structure.

The message is unambiguous: correcting an error before the FTA finds it caps your exposure at a monthly 1% charge. Waiting until the auditor arrives triggers a 15% fixed penalty on top. The timing of your voluntary disclosure is now the single most important cost lever in UAE tax compliance.

How FTA Audit Selection Actually Works

The FTA does not publish its risk-scoring algorithms, but its 2023–2026 Strategy confirms that audit selection is risk-driven, not random. The FTA operates an ISO 31000-certified risk management framework and has invested heavily in AI and data analytics to identify non-compliance patterns.

Based on enforcement patterns and published guidance, the most common audit triggers include:

VAT–Corporate Tax mismatches. This is the single most visible red flag. If your VAT returns report AED 120 million in taxable supplies but your Corporate Tax return shows AED 100 million in revenue, the FTA’s systems flag the discrepancy automatically. The introduction of Corporate Tax means the FTA can now cross-reference two separate data sets for every business.

Frequent or large VAT refund claims. Exporters and zero-rated suppliers who regularly claim input tax refunds face higher audit probability. The FTA verifies that refund claims are supported by valid tax invoices, export documentation, and customs records.

Late or amended filings. Multiple voluntary disclosures, repeated late filings, or significant amendments signal compliance weaknesses. The FTA treats patterns of correction as indicators that underlying systems are unreliable.

Industry-specific risk profiles. Real estate, trading, hospitality, and construction businesses face higher baseline audit rates because of transaction volume, VAT treatment complexity, and the prevalence of related-party transactions.

Failure to register. Businesses that should have registered but did not are identified through customs data, trade licence records, banking information, and the FTA’s cross-referencing systems — and face the 15-year extended limitation period once found.

What the First Corporate Tax Audit Wave Will Target

The first wave of Corporate Tax audits — expected to begin in late 2026 and accelerate through 2027 — will focus on the accuracy of the first CT returns filed. Based on FTA guidance, enforcement patterns, and the structure of the CT Law, five areas are likely to dominate:

1. Transfer Pricing Documentation

For groups and connected parties, transfer pricing is the FTA’s primary tool to prevent profit shifting. The first CT returns require TP disclosures, and the FTA has been explicit that TP adjustments can trigger recalculation of QFZP status, DMTT positions, and even audit escalation. Contemporaneous TP documentation — not retrofitted narratives — is the defence. Files built after the audit notice arrives lose credibility by default.

2. Free Zone Qualifying Status (QFZP)

The FTA’s 15 published clarifications (covered in our July 17 article) make clear that substance is assessed by facts, not legal form. Free zone businesses claiming the 0% rate will need to demonstrate adequate substance: qualified employees, operating expenditure, and physical assets commensurate with their activities. For distributors, the new AUP report requirement under FTA Decision No. 6 of 2026 adds a layer of independent audit verification.

3. Revenue and Expense Reconciliation

The FTA will cross-reference VAT taxable supplies against Corporate Tax revenue. Businesses with exempt supplies, zero-rated exports, or complex group structures will face scrutiny on whether their revenue figures are consistently reported across both tax types. Expense deductions — particularly management fees, intercompany charges, and capitalised costs — will be tested for deductibility under Article 28 of the CT Law.

4. Small Business Relief Elections

Businesses that elected Small Business Relief under Ministerial Decision No. 73 of 2023 need to ensure they met the eligibility conditions: revenue below AED 3 million and compliance with the specific conditions for each tax period. The relief is an election, not a default — and the FTA will verify that the conditions were met at the time of election.

5. Permanent Establishment Assessments

For foreign companies with UAE operations, the FTA’s clarifications confirm that PE status depends on the facts of each case, not merely the existence of a trade licence. A fixed place through which core income-generating activities are carried out may constitute a PE. The FTA will assess aggregate presence, nature of activities, and whether operations go beyond preparatory or auxiliary functions.

The Audit Defence Timeline: What to Do Before the Notice Arrives

An FTA audit does not create the exposure. It discovers it. By the time the notice lands in your EmaraTax portal, the outcome is largely determined by the records you built — or didn’t build — when the transactions happened.

Here is the timeline for audit readiness:

Now (73 days to filing deadline):

• Reconcile VAT and Corporate Tax revenue figures line by line. Every discrepancy needs an explanation before you file, not after the FTA asks.
• Complete transfer pricing documentation for FY2025. If you haven’t started, this is the priority. Contemporaneous documentation is the strongest audit defence.
• Review QFZP eligibility against the FTA’s 15 clarifications. If your substance is thin, fix it before you file — not when the auditor arrives.

At Filing (September 2026):

• Ensure the CT return and supporting documentation are internally consistent. The return is a representation to the FTA; every figure must trace to a source document.
• File by 31 July 2026 if you want the AED 10,000 late-registration penalty waived (see our July 18 article).

After Filing (October 2026 onwards):

• Maintain the audit file: contracts, invoices, board minutes, TP studies, substance evidence, and reconciliation workings.
• Monitor for FTA notifications through EmaraTax. The FTA is not obligated to explain why you were selected.
• If you discover an error, file a Voluntary Disclosure immediately. The 1% monthly penalty under the new regime is far cheaper than the 15% fixed penalty the FTA will impose if it finds the error first.

The E-Invoicing Multiplier

The audit landscape is about to shift again. The UAE’s e-invoicing pilot launched on 1 July 2026, with mandatory implementation from 2027 for businesses with annual revenue of AED 50 million or above. Once fully operational, e-invoicing will feed transaction-level data to the FTA in near real time.

This changes the audit equation fundamentally. Instead of reviewing self-reported returns, the FTA will have independent transaction data to cross-reference. Mismatches between e-invoiced transactions and tax returns will be flagged automatically. The window for late corrections — and for voluntary disclosures — will narrow significantly.

Businesses that build their audit defence files now, while the data is still self-reported, have a closing window of advantage. Once e-invoicing is live, the FTA’s visibility into every transaction makes the audit less a test of your records and more a comparison of your records against its own.

The Bottom Line

The UAE’s tax system has moved from implementation to enforcement. The FTA’s 2025 numbers — 176,000 inspections, 46% more audits, $1 billion in additional revenue — are not a peak. They are a baseline. The first Corporate Tax returns filed in September 2026 will feed the next wave of audit selection, and the FTA’s AI systems will be watching.

The businesses that survive the first audit season will be the ones that treated compliance as a documentation exercise, not a filing exercise. The return is the claim. The records are the proof. And the proof must exist before the notice arrives — because by then, it is already too late to build it.

FSH Financial Consultants assists UAE businesses with Corporate Tax return preparation, transfer pricing documentation, QFZP compliance reviews, and FTA audit defence. Contact us to ensure your first CT return is audit-ready before 30 September 2026.

Sources: Federal Tax Authority 2025 Annual Report (tax.gov.ae, 29 June 2026); Federal Decree-Law No. 17 of 2025; Cabinet Decision No. 17 of 2026; Cabinet Decision No. 129 of 2025; Cabinet Decision No. 74 of 2023 (Executive Regulation, Tax Procedures Law); Federal Decree-Law No. 47 of 2022 (Corporate Tax Law); FTA Corporate Tax Clarifications (compiled through May 2026); AGBI (1 July 2026); Kayrouz & Associates; Boru Consulting; Alvarez & Marsal Middle East Tax Alert.