An FTA audit is a documentary exercise. The auditor arrives with a question and decides their next question based on the evidence the taxpayer produces. A firm that can produce the right document inside ten minutes has a fundamentally different conversation from a firm that has to assemble the evidence over three weeks.
This listicle covers the nine document categories every UAE firm - and every UAE-resident client - should retain in an audit-ready format, with the relevant retention periods and a note on practical storage. Federal Decree-Law No. 28 of 2022 on Tax Procedures sets the broad framework; the regime-specific decree-laws layer in additional detail.
1. Tax invoices issued and received
Tax invoices are the foundation of any VAT audit. The retention requirement is five years from the end of the tax period to which they relate, extended to fifteen years for invoices relating to real estate. The format should preserve the original - a scanned PDF is acceptable, a thermal-receipt photo that fades in six months is not.
Both issued and received invoices need to be available. The received side is often the weaker file in client systems, because invoices arrive by email, by paper, and through portals, and the consolidation discipline is rarely as tight as on the sales side.
2. Customs declarations and import documentation
For any business that imports goods, the customs declarations are the documentary backbone for box 6 of the VAT 201 and for the corresponding reverse-charge entries. The retention period is five years. Keep the full pack - customs declaration, supplier invoice, bill of lading or airway bill, and proof of payment - together rather than scattered across separate folders.
In an FTA query, the auditor will pull a sample of imports and ask for the full pack. The speed of response is a strong signal of the firm's control environment.
3. Bank statements and payment evidence
Bank statements support the substance of every transaction in the ledger. They evidence when payments were made, who they were made to, and whether the amount on the invoice matches the amount that actually moved. Retain monthly statements for all business accounts for five years, with the supporting payment instructions where these are available.
For larger transactions, retain the SWIFT confirmations or local equivalents - the auditor may want to verify that funds reached a counterparty in a specific jurisdiction, which the bank statement alone may not show.
4. Contracts, engagement letters, and commercial agreements
The commercial agreement behind a transaction is often the determinant of its tax treatment - whether a supply is goods or services, where the place of supply is, whether zero-rating applies, whether a related-party arrangement is at arm's length. Retain all material contracts for at least five years after the end of the contract term, and for related-party agreements, keep the originals indefinitely.
Email exchanges that confirm or vary commercial terms should be retained as part of the contract file. The auditor will treat a chain of emails altering the scope or pricing as part of the contract for evidential purposes.
5. Transfer pricing documentation
Under the UAE Corporate Tax regime, related-party transactions are subject to the arm's length principle. Larger groups must maintain a Local File and Master File; all groups with related-party transactions must complete the disclosure form. The supporting analysis - benchmarking studies, comparability analyses, methodology selection - should be retained for the full Corporate Tax record-keeping period of seven years.
For owner-managed groups below the formal documentation thresholds, a transfer pricing memo per group, refreshed annually, is sufficient and provides a defensible position if the FTA asks how related-party prices were set.
6. Statutory and management accounts
Audited or independently-prepared statutory accounts, together with the supporting trial balance, journals, and reconciliations, form the basis of the Corporate Tax computation. Retain for seven years from the end of the tax period under the Tax Procedures Law.
Management accounts are not statutorily required at the FTA level, but they are routinely useful in an audit - they show the in-year picture and help reconcile timing differences between the financial accounts and the tax return.
7. AML/CFT and KYC records
For DNFBPs (designated non-financial businesses and professions, including accountants and lawyers), AML and KYC records on every client must be retained for five years after the end of the business relationship under Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019. The pack includes the customer due diligence file, the risk assessment, the source-of-funds evidence, and any suspicious activity reports filed through goAML.
The records support both AML inspections and FTA inquiries that touch on client identification. Retention should be in an immutable format that proves the document existed at the date it was first held.
8. ESR notifications and substance evidence
Where the entity has filed an ESR notification or economic substance return, retain the submission and the supporting evidence pack - CIGA records, employee headcount, operating expenditure in the UAE, premises evidence, board minutes evidencing decisions taken in the UAE. The Ministry of Finance can audit the substance position for a period after filing, and the evidence pack is what the regulator will ask for.
For holding companies subject to the reduced substance test, the evidence is lighter but still required. Do not assume a reduced test means no retention obligation.
9. UBO register and supporting evidence
The Real Beneficiaries Register, Partners/Shareholders Register, and (where applicable) Nominee Directors Register must be maintained throughout the entity's existence and for at least five years after de-registration. The supporting evidence - share certificates, declarations from corporate shareholders, identity documents for the natural persons - should be retained alongside.
The UBO file is one of the first things requested in an AML inspection by the relevant supervisory authority and one of the first things checked by the licensing authority at renewal. Keep it current and complete.
Storage format and access
Retention is not just about whether the document exists - it is also about whether it can be produced quickly. The FTA's Tax Procedures Law accepts electronic storage provided the records are accessible, legible, and capable of being reproduced. Practical tests for a good storage approach are:
- Documents are indexed by client, year, and category
- A specific document can be located inside five minutes
- Access is restricted to authorised staff and logged
- Backups exist and are tested at least annually
- The storage format does not degrade - no thermal paper, no obsolete file formats
How Accupe helps
Accupe is the practice-management layer that gives UAE firms a single workspace for all nine document categories per client - indexed, searchable, attached against the client and engagement record, with access controlled by role. The Compliance Radar surfaces missing or expiring documents per category, and the AI document analysis surfaces the contents of uploaded contracts and ledgers with source citation. Accupe is not the FTA submission tool - the firm files through EmaraTax - but it is the audit-readiness layer that makes the difference between a ten-minute response and a three-week scramble.
Closing
An audit-ready firm and an audit-unready firm look identical until the day the FTA arrives. The nine document categories above are the working list. Get them indexed, retained, and accessible inside ten minutes, and the firm has the operational footing to handle whatever the auditor asks next.