UAE Supplier Due Diligence: New VAT Rules Raise the Importance of Third-Party Verification

Businesses operating in the UAE are facing new requirements to verify suppliers and the legitimacy of supplies before recovering input VAT.

The Federal Tax Authority has published Decision No. 13 of 2026, setting out measures taxable businesses must take to verify the validity and integrity of supplies. The rules are due to take effect on 1 October 2026.

Although the rules are tax-focused, they also reinforce a broader commercial point: businesses need to understand who they are dealing with, whether a supplier is genuine and whether a transaction makes commercial sense.

That makes supplier due diligence increasingly important not only for regulatory compliance, but also for reducing exposure to fraud, false counterparties and wider third-party risk.

What Are the New UAE Supplier Verification Requirements?

According to reporting on the new rules, businesses will be required to carry out checks at both supplier and supply level.

Supplier verification is expected to include checking identity documentation against official databases, confirming the authority of the individual representing the supplier and establishing that the supplier has a genuine place of business consistent with its stated activities.

Businesses are also required to consider specified risk indicators, including:

• Changes to a supplier's address.
• Changes in key personnel.
• Transactions that appear disproportionate to the size or history of the business.

For suppliers where annual supplies exceed AED 375,000, additional checks may include obtaining written confirmation from a UAE-authorised bank that the supplier holds an account and reviewing publicly available information about the business.

The rules demonstrate that basic supplier information alone may no longer be sufficient where indicators of potential risk are present.

Why Supplier Verification Matters Beyond VAT

A business can appear legitimate on paper while presenting very different risks when examined more closely.

Trade licences, registration details and supplied documentation are important starting points, but they do not necessarily explain who ultimately controls a company, whether its operating history is credible or whether the proposed transaction is consistent with its normal business activities.

A more complete due diligence process can help businesses establish:

• Whether the counterparty exists and is actively trading.
• Whether the stated directors, managers or representatives are credible.
• Whether ownership or management has recently changed.
• Whether the physical or operational footprint matches the company's claims.
• Whether adverse information exists in reliable public sources.
• Whether the proposed transaction appears commercially consistent with the supplier's profile.

These questions become particularly important when entering new relationships, dealing with unfamiliar counterparties or conducting high-value transactions.

Conflict Advisory Group's Due Diligence Services support organisations seeking to better understand counterparties, corporate structures and potential risks before making significant commercial decisions.

Changes in Key Personnel Can Be an Important Risk Indicator

One particularly notable aspect of the new requirements is the emphasis on changes in key personnel.

Changes in directors, managers, authorised signatories or other individuals connected to a company are not necessarily suspicious. Businesses regularly restructure and appoint new leadership.

However, sudden or unexplained changes may warrant closer examination when they occur alongside other risk factors.

For example, a supplier may have recently changed management while also changing its registered address or dramatically increasing the value of its transactions.

Individually, these events may have legitimate explanations. Together, they can justify additional verification.

Corporate due diligence can help establish when those changes occurred, who the individuals involved are and whether there are connections to other businesses or entities relevant to the proposed transaction.

Does the Supplier's Business Profile Match the Transaction?

Another important risk indicator identified by the new rules is whether transaction values are disproportionate to the size and history of the supplier.

This is a useful question well beyond tax compliance.

A recently incorporated or relatively small company suddenly handling very large transactions may be perfectly legitimate. However, the discrepancy should still be understood.

Businesses may need to examine factors such as the supplier's operating history, known commercial activity, management background, corporate structure and wider market presence.

Where the available information does not align with the proposed transaction, further enquiries may be appropriate before funds are committed or a commercial relationship progresses.

This is particularly relevant in complex international supply chains, where counterparties, intermediaries and payment arrangements can span multiple jurisdictions.

Public-Source Checks Should Be More Than a Search Engine Review

The new requirements also highlight the role of publicly available information.

Online searches can identify useful information about a supplier, but effective due diligence should go further than simply reviewing the first page of search results.

Corporate records, regulatory information, litigation history, sanctions exposure, media reporting and connections between companies or individuals may all contribute to a more complete picture.

The reliability of the source also matters.

An absence of negative information should not automatically be treated as evidence that a counterparty is low risk, particularly where a business has a limited online presence or operates across multiple jurisdictions.

Similarly, adverse reporting should be assessed carefully rather than accepted without context.

The objective is to develop a proportionate, evidence-based understanding of the counterparty.

Supplier Due Diligence Should Be Risk-Based

Not every commercial relationship requires the same level of scrutiny.

A low-value transaction with an established supplier presents a different level of risk from a high-value transaction with a newly formed company operating through unfamiliar intermediaries.

A proportionate supplier due diligence process can take account of factors such as:

• Transaction value.
• Jurisdictional exposure.
• Ownership complexity.
• Length of the commercial relationship.
• Changes in management or corporate structure.
• Unusual payment arrangements.
• Adverse media or regulatory concerns.
• Discrepancies between the company's stated activities and the proposed transaction.

Where risk indicators are identified, enhanced due diligence may be appropriate.

The objective is not simply to accumulate documents. It is to establish whether the available information is consistent, credible and sufficient to support the commercial decision.

A Stronger Approach to Third-Party Risk in the UAE

The introduction of more explicit supplier-verification requirements reflects a wider direction of travel for businesses operating in the UAE.

Organisations are increasingly expected to demonstrate that they understand their counterparties and can evidence the checks undertaken before entering potentially higher-risk transactions.

That is relevant to tax compliance, but it also supports wider fraud prevention, corporate governance and risk management.

For companies working across international markets, the ability to identify inconsistencies early can prevent significantly more complicated problems later.

Conflict Advisory Group provides corporate intelligence, due diligence and risk advisory support to businesses, legal teams and investors operating in the UAE and internationally.

If you require deeper verification of a supplier, business partner or other commercial counterparty, contact Conflict Advisory Group for a confidential consultation.