UAE tightens VAT record-keeping rules with mandatory electronic access for tax audits
New rules require businesses to provide the UAE tax authority with full electronic accounting records, system access and even passwords from 30 July 2026.
Under Federal Tax Authority (FTA) Decision No. 4 of 2026, businesses must now ensure that accounting records are not only preserved accurately, but are also electronically accessible to the tax authority on demand. The measures took effect on 30 July 2026.
Electronic bookkeeping comes under greater scrutiny
The most significant change is the explicit focus on electronic bookkeeping systems. Where accounting records are stored digitally, taxpayers must provide the FTA with:
- access to the electronic system holding the records;
- any passwords or encryption keys needed to access protected data; and
- records in a format that is complete, readable and identical to the original.
This goes beyond traditional document retention rules. The FTA now expects businesses to demonstrate that their accounting platforms themselves can support a tax audit.
For multinational groups using ERP systems, cloud accounting software or outsourced finance platforms, access rights and retrieval processes should now form part of VAT compliance governance.
Outsourcing does not remove responsibility
Many businesses rely on external accountants, document management providers or cloud archiving services to maintain accounting records.
The FTA makes clear that this does not transfer legal responsibility.
The taxpayer remains fully liable for maintaining records, ensuring their security and making them available during an audit.
What this means for VAT payers
The Decision reflects a broader international trend towards digitally enabled VAT audits, where tax authorities increasingly expect direct access to accounting systems rather than simply requesting PDF copies of invoices.
Businesses operating in the UAE should review:
- whether electronic bookkeeping systems can provide complete historical VAT records;
- procedures for granting controlled access to the FTA;
- document scanning policies to ensure full-page capture; and
- governance around encryption keys, passwords and outsourced record management.
