UAE Supplier Verification: Your Bookkeeping App Can't Do It

Last month, a trading-company owner in Sharjah showed us his bookkeeping app like it was a shield. Every supplier invoice scanned, coded, and filed — immaculate. "Our VAT is fully automated," he said. "The software handles everything." Then we asked him one question: which of his suppliers had he actually verified? Silence. Not a single one. He had spent six months building a perfect digital archive of purchases the FTA could now refuse to believe.

He is not careless. He is early — or rather, the market moved while he was looking at his dashboard. Since 1 October 2026, a valid tax invoice is no longer enough to protect your input VAT. The Federal Tax Authority's Decision No. 13 of 2026 — the Know Your Supplier (KYS) rules — make supplier verification a legal obligation: businesses must verify their suppliers and document the checks before claiming input tax. Skip the checks, and the FTA can treat you as if you "should have known" your supply chain had a problem. Your app recorded the invoice. It never asked whether the supplier was real.

This is the uncomfortable line this post draws: your bookkeeping app records. Your bookkeeper defends. And under the new rules, only the second one keeps your input VAT alive.

The trend that's about to meet a wall

Businesses are hunting for cheaper ways to keep the books right now. A Google Trends live read this morning shows searches for "small business bookkeeping app" up +4,700% over the past 30 days worldwide, with "outsourced bookkeeping" flagged as a Breakout query — and in the UAE, "bookkeeping services Dubai" keeps trending upward. The motivation is obvious: margins are tight, software is cheap, and every founder wants the books off their desk.

Nothing wrong with that — until the thing being automated quietly changes. From 1 October, input VAT recovery in the UAE has a second gate. The old gate was paperwork: a valid tax invoice, correct TRN, recorded in the books. Most apps clear that gate beautifully. The new gate is judgement: did you verify the supplier's identity against official records? Did the deal make genuine commercial sense? Was the price commercially justifiable? Did the goods fall within the supplier's licensed activity? Software can remind you to ask these questions. It cannot answer them.

The legal engine behind this is Article 54 bis of the VAT Law, which lets the FTA reject an input-tax deduction where a supply — or its supply chain — is connected with tax evasion and the taxable person knew or should have known. Decision 13/2026, issued 22 July 2026 and effective 1 October (Gulf News analysis), spells out what "should have known" means in practice: a business that fails to carry out the required checks may simply be treated as having known. The checks are no longer good practice. They are the boundary between a deductible purchase and a disallowed one.

Supplier verification: what the FTA actually wants a human to check

The Decision runs on two layers, and both require judgement calls no algorithm makes on your behalf.

Layer 1: the supplier

First time you deal with a supplier — and at least every 12 months after — you must verify who they are: check identity documentation against official databases, confirm who is authorised to act for them, and confirm the business genuinely operates from where it claims to. Then you watch three prescribed risk indicators: changes of address, changes of key personnel, and transactions disproportionate to the size and history of the business. Two address changes in a year? A supplier suddenly ordering ten times its usual volume? The rules expect someone to notice and ask why.

For bigger relationships — annual supplies above AED 375,000 with one supplier — the bar rises further: written confirmation from a UAE-authorised bank that the supplier holds an account there, plus a review of public reviews and media coverage. That's someone reading about your supplier's reputation in the press. Your app does not read the news.

Layer 2: the supply

Every individual supply gets its own check: does the supplier's participation rest on genuine commercial reasons? Is the pricing not commercially unjustifiable? Do the goods or services fall within the supplier's licensed activities? Is the title and origin of the goods sound? If an intermediary is involved, is its role commercially explicable? And payment must be electronic — cash requires a documented commercial reason.

Then the paperwork: a written policy setting out who performs these checks, who reviews them, and who supervises them — plus an in-house compliance officer. These aren't suggestions. They are the documents the FTA will ask for when it questions a claim.

If your books currently run on "invoice in, VAT out," your VAT filing position is now built on an assumption the rules no longer support.

What software can do — and where supplier verification stops

To be fair to the apps: they are excellent at the first half of compliance. Automated invoice capture, clean VAT coding, real-time ledgers, error-free returns — a good platform plus a disciplined process produces books most SMEs couldn't have imagined five years ago. We've written before about choosing the right accounting system — the right stack genuinely matters.

But the KYS rules drew a line through the workflow at precisely the point where the software's competence ends. Consider what a "check" actually requires:

• "Pricing is not commercially unjustifiable." That's a market judgement. Is AED 95,000 a reasonable price for this consignment from this supplier in this quarter? An app sees a number. A bookkeeper who knows the market sees an anomaly.
• "Goods fall within the supplier's licensed activity." Cross-referencing a purchase order against a trade licence requires reading the licence — and knowing what to do when they don't match.
• "Genuine commercial reasons." Why does this supplier exist in your chain? Why is an intermediary taking a cut? These are narrative questions about business logic. Software doesn't do narrative.
• Risk indicators. The supplier changed address twice in twelve months. An app updates the address field. A person asks why.

This is why the bank confirmation, the press review, the documented commercial reason for a cash payment, and the named compliance officer all point in one direction: the FTA designed these rules for people, not platforms. The app is a ledger with opinions about nothing. The Decision demands opinions — recorded, dated, and signed.

There's a broader pattern here. The UAE's compliance regime keeps moving the scarce resource from recording to defending: corporate tax filings backed by seven-year records, e-invoicing where the ASP validates what your systems send, and now supplier verification where documented judgement decides whether your input VAT survives. Each layer asks less "did you record it?" and more "can you justify it?" The full compliance picture for UAE SMEs now has KYS sitting squarely inside it.

"There's no fine" — which is exactly why it's dangerous

Here's the part that lulls businesses to sleep: Decision 13/2026 does not create a standalone, automatic fine for every gap in a verification file. Legal analysis from Farahat & Co is explicit — the consequences are tied to Article 54 bis, and they become most significant where a supply chain is actually connected with tax evasion.

Don't mistake "no automatic fine" for "no cost." The mechanism is worse for your cash flow: the FTA disallows the input-tax claim, which raises the net VAT payable for the period. The shortfall then attracts the standard late-payment penalties — 14% per annum — calculated from the original due date, not from the day the FTA caught it. One unverified high-value supplier across several filing periods compounds into a multi-period reassessment. They don't fine you for skipping the check. They erase the claim — and charge you for the months in between.

The late-payment math is unforgiving in exactly the scenario the rule targets: a business that kept clean invoices, filed on time, and never imagined its supplier was the problem. Being compliant on paper and exposed in practice is the new normal, and "the app handled it" is not a defence the Decision recognises.

Supplier verification: the AED 8,300-a-month trap hiding in the exemption

There is a de-minimis exemption, and most businesses will read it as comfort. Supplies below AED 10,000 (excluding VAT) are exempt from the checks — but the exemption disappears entirely once your total supplies from one supplier exceed AED 100,000 over the previous 12 months, or are expected to exceed that over the next 12. As legal analysis in Khaleej Times noted, that works out to roughly AED 8,300 a month — a level most recurring supplier relationships cross without any red flag at all.

Your regular stationery vendor, your IT maintenance contractor, your cleaning company, your packaging supplier — each one you pay monthly will likely cross the line within a year. The exemption, in practice, offers limited relief. And crossing the threshold isn't an event your software announces: it's a rolling 12-month total, per supplier, measured both backwards and forwards. Tracking it is exactly the kind of boring, relentless bookkeeping work that separates a compliant monthly close from an expensive one.

What a defensible monthly close looks like now

So what does "the bookkeeper defends" mean, concretely? If your monthly close doesn't already include these, it belongs to the old rules:

1. A supplier verification log. Every supplier verified at onboarding and re-verified at least annually, with the evidence recorded — ID checks against official sources, authorised representative, place of business confirmed. Dated, filed, retrievable.
2. A rolling 12-month watchlist. Total spend per supplier tracked continuously against the AED 100,000 threshold — so the de-minimis exemption never dies silently. Same discipline, and the enhanced-checks trigger, for the AED 375,000 line.
3. TRN validity built into invoice coding. Not a quarterly sample — a control inside the coding workflow. The invoice that arrives without a valid, verifiable supplier identity is flagged before it's ever booked as a recoverable claim.
4. A written KYS policy with named people. Who performs the checks, who reviews them, who supervises — and an appointed in-house compliance officer. Signed, current, and known to the finance team, not sitting in a drawer.
5. Transaction-level notes where they matter. The unusual price, the cash payment, the intermediary, the supplier outside your normal category — each with a documented commercial reason at the time, not reconstructed when the FTA asks.
6. Catch-up on history. The rules are in force now, and historical claims rest on historical checks. Unverified legacy suppliers are a backlog, not a shrug — and fixing them is catch-up bookkeeping with a VAT defence attached.

None of these is a software feature. All of them are a bookkeeper's week.

The bottom line

The market is splitting into two kinds of businesses: the ones whose books record and the ones whose books defend. Decision 13/2026 just made the distinction expensive. Your app will code a thousand invoices flawlessly — and quietly build you a thousand unverified claims, each one disallowable, each one carrying 14% per annum from the original due date.

The founder I opened with didn't ditch his software. He kept the app — and put a person between it and the FTA. An outsourced monthly close with TRN controls, a verification log, a written policy, and a compliance officer who actually reads the file. The software got cheaper. The judgement got serious.

Your app records. Your bookkeeper defends. Make sure you have both.

Not sure your suppliers would survive a KYS review? Our team runs a free VAT compliance health check for UAE businesses — we'll review your supplier verification position, check your 12-month thresholds, and hand you the fix list. Book it on our website.