UAE Corporate Tax Audits Are Here: Voluntary Disclosure Before the FTA Knocks

The Federal Tax Authority's risk-based corporate tax audit programme is active. For taxable persons who have under-reported, the difference between voluntary disclosure and an FTA-initiated correction is the difference between a 1–4% monthly penalty and a 15% fixed penalty — plus potential criminal exposure under AML law.

The Legal Framework: Federal Decree-Law 47/2022 and the Penalty Architecture

Corporate tax in the UAE is governed by Federal Decree-Law No. 47 of 2022 on the Taxation of Corporations and Businesses (the CT Law), which came into force for financial years beginning on or after 1 June 2023. The CT Law imposes a standard rate of 9% on taxable income exceeding AED 375,000, with a 0% rate for Qualifying Free Zone Persons on Qualifying Income, subject to the substance and non-qualifying revenue conditions in Articles 18–19 of the CT Law and the relevant Cabinet Decisions.

The penalty architecture that makes voluntary disclosure strategically urgent is set out in Cabinet Decision No. 129 of 2025 on Administrative Penalties for Violations Related to the Application of Federal Decree-Law No. 47 of 2022. Cabinet Decision 129/2025 replaced the earlier penalty framework and introduced a critical structural divide: where a taxable person self-corrects through a voluntary disclosure before the FTA opens an audit or investigation, penalties on the underpaid tax are charged at 1% per month for the first 12 months, 2% per month for months 13–24, 3% per month for months 25–36, and 4% per month thereafter. By contrast, where the FTA identifies the error first — through audit, third-party data, or automatic exchange — the fixed administrative penalty is 15% of the unpaid or underpaid tax, in addition to the underlying tax liability and separate fixed penalties for non-filing or record-keeping failures.

The distinction is not merely financial. An FTA-initiated assessment signals a formal enforcement posture, triggers document-preservation obligations, and — for amounts exceeding the criminal thresholds discussed below — may be referred to the Public Prosecution. Voluntary disclosure, by contrast, is expressly provided for under Article 75 of the CT Law, which permits a taxable person to submit an amended tax return or a standalone voluntary disclosure where it becomes aware that a submitted return contains an error or omission. The FTA's published guidance confirms that a voluntary disclosure must be submitted within 20 business days of the person becoming aware of the error, although practitioners should note that late voluntary disclosures remain available and still attract the lower monthly penalty scale rather than the 15% audit-trigger rate — timing affects the total accrued monthly penalty, not the rate applicable.

Separately, Article 76 of the CT Law empowers the FTA to conduct tax audits at any time and to extend the audit period. The standard assessment window is five years from the end of the relevant tax period, extendable to seven years where the FTA suspects intentional non-compliance. Understanding this limitation period is material to the disclosure strategy: errors in the first corporate tax returns filed for periods ending in 2024 are already within that five-year window and will remain auditable until at least 2029.

The FTA Audit Landscape: How Risk-Based Selection Works in Practice

The FTA's audit selection methodology draws on multiple data streams that taxable persons frequently underestimate. The Authority has access to VAT return history, customs declarations, ESR notifications, economic substance reports filed with licensing authorities, UBO registers maintained under Cabinet Decision No. 109 of 2023 (the 25% beneficial ownership test), and — critically — the Common Reporting Standard and Country-by-Country Report data exchanged under the UAE's bilateral and multilateral tax information agreements. For groups with foreign parents or subsidiaries, CbCR data submitted in other jurisdictions may flag UAE-entity-level inconsistencies before the FTA's own audit programme identifies them domestically.

Risk triggers that practitioners observe in practice include: Qualifying Free Zone Persons reporting very high proportions of Qualifying Income without demonstrable substance; related-party transactions priced outside arm's-length parameters that are inconsistent with transfer pricing documentation; interest deduction claims approaching but not exceeding the General Interest Limitation Rule (GILR) cap under Article 30 of the CT Law in a pattern that suggests mechanical calibration; and misclassification of UAE-sourced income as exempt under the participation exemption in Article 23 or the foreign permanent establishment exemption in Article 24. Free zone entities that derive income from mainland UAE group members without properly characterising it as non-Qualifying Income are a recurring audit focus.

The FTA is also increasingly cross-referencing corporate tax positions with VAT returns. Where revenue declared for VAT purposes materially exceeds revenue in the corporate tax return — adjusted for exempt supplies — the divergence generates an automatic flag. Businesses that have made VAT adjustments, credit notes, or zero-rating claims that were not properly mirrored in the corporate tax computation are particularly exposed. Boards and GCs should not assume that because VAT compliance was clean, corporate tax positions are sheltered; the two regimes use different taxable bases, and the FTA treats them as complementary audit tools.

Practically, an FTA audit is initiated by formal written notification specifying the period under review and the documents required. From that point, the privilege and disclosure dynamic changes materially: legal professional privilege over pre-audit advice is preserved under UAE law, but without pre-existing privileged documentation of the decision-making process, reconstructing a reasonable-care defence is significantly harder. This is one reason experienced counsel recommend commissioning a privileged internal tax health-check before any audit notice arrives.

Voluntary Disclosure: Procedure, Timing, and the 20-Business-Day Rule

A corporate tax voluntary disclosure is submitted through the FTA's EmaraTax portal. The submission must identify the relevant tax period, the nature of the error or omission, the corrected taxable income figure, and the resulting additional tax liability. The taxable person is required to pay the corrected tax and the applicable monthly penalties at the time of submission or within the period specified in the FTA's acknowledgment. Failure to pay contemporaneously does not invalidate the disclosure, but penalties continue to accrue on unpaid amounts at the applicable monthly rate until settlement.

Article 75 of the CT Law sets the 20-business-day window from the date the taxable person becomes aware of the error. In practice, "becomes aware" is a facts-and-circumstances determination. If an error is identified during an internal audit, board meeting, or external due diligence exercise, that event will typically fix the awareness date. Taxable persons who delay submission after internal identification risk the FTA taking the position that the disclosure was made outside the 20-business-day window — which does not disqualify the disclosure or switch the penalty rate to 15%, but it does add a separate fixed administrative penalty for late voluntary disclosure under Cabinet Decision 129/2025. Prompt action after identification is therefore important both legally and commercially.

Where the error is identified by an external adviser during a due diligence or restructuring exercise — as commonly occurs in M&A transactions — particular care is needed. The acquiring entity will typically require resolution of open tax exposures as a condition of closing, and the voluntary disclosure process must be timed against the transaction timetable. Sellers should not assume that an indemnity in the sale and purchase agreement fully protects the target company from FTA enforcement action post-closing: the FTA is not bound by private contractual allocation of tax risk, and the target entity remains the assessed party.

Groups with multiple UAE entities should consider whether errors in one entity have knock-on effects on related entities — for example, where a pricing adjustment in a related-party transaction affects the taxable income of both the payor and the recipient. A coordinated multi-entity voluntary disclosure, filed simultaneously for all affected entities, is generally preferable to sequential filings that may prompt the FTA to audit non-disclosing group members before they have corrected their own positions.

Quantifying the Exposure: Penalty Calculation and the 1–4% vs 15% Gap in Numbers

The financial significance of the penalty differential compounds rapidly. Consider a taxable person that understated taxable income by AED 10 million for its first corporate tax period (year ending 31 December 2023), resulting in AED 900,000 of underpaid tax (9% on AED 10m). If that person files a voluntary disclosure in January 2026 — approximately 25 months after the period end — the monthly penalty calculation runs at 1% for months 1–12 (AED 9,000 per month × 12 = AED 108,000) and at 2% for months 13–25 (AED 18,000 per month × 13 = AED 234,000), producing a total penalty of approximately AED 342,000 on top of the AED 900,000 tax. Total cost of self-correction: approximately AED 1.242 million.

If the FTA identifies the same error in an audit commenced in January 2026, the 15% fixed penalty applies immediately: AED 135,000. However, this is not the full picture. The 15% penalty under Cabinet Decision 129/2025 is levied on the amount of tax that was not paid, and it applies in addition to — not instead of — the monthly late-payment penalty, which continues to accrue from the original due date. In the same scenario, the combined 15% fixed penalty plus accrued monthly late-payment penalties on AED 900,000 over 25 months produces a materially higher total liability than the voluntary disclosure path, and the calculation worsens as time passes. The economic case for voluntary disclosure is strong in virtually all scenarios where the error is material and discovery risk is real.

Beyond the direct penalty arithmetic, an audit outcome that includes a 15% penalty creates a public enforcement record that may affect the entity's relationship with UAE banks, free zone authorities, and counterparties conducting KYC reviews. For regulated entities — banks, insurers, and investment firms supervised by the CBUAE under CBUAE Law No. 6 of 2025 — an FTA enforcement outcome may also trigger supervisory notification obligations. The reputational and regulatory cascades from an audit that could have been pre-empted through voluntary disclosure are therefore not captured in the penalty arithmetic alone.

Where the quantum of underpaid tax is large — particularly where the circumstances suggest intentional under-reporting — the criminal dimension must be assessed. Tax evasion is a predicate offence for money laundering under Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing (in force 14 October 2025, repealing FDL 20/2018). FDL 10/2025 and its executive regulations under Cabinet Resolution No. 134 of 2025 expressly include tax evasion as a predicate, extend personal criminal liability to managers and directors, impose fines of up to AED 100 million, and remove any statute of limitations for money laundering offences. The intersection of corporate tax non-compliance and AML exposure is therefore a live risk for senior executives, not merely a theoretical one.

Criminal Exposure: When Tax Errors Become Tax Evasion

The CT Law itself distinguishes between administrative non-compliance and tax evasion. Article 78 of the CT Law defines tax evasion as including the deliberate provision of incorrect information, suppression or concealment of facts, and the use of fraudulent means to reduce a tax liability. Evasion is referred by the FTA to the Public Prosecution and is prosecuted under the UAE Penal Code, Federal Decree-Law No. 31 of 2021 (in force 2 January 2022, as amended by Federal Decree-Law No. 36 of 2022), as well as under the CT Law's own criminal penalty provisions, which provide for fines and — in serious cases — imprisonment.

Criminal proceedings in the UAE follow the Criminal Procedure Law, Federal Decree-Law No. 38 of 2022 (in force 1 March 2023, as amended by Federal Decree-Law No. 45 of 2023). Under this framework, the Public Prosecution has broad powers to freeze assets, restrict travel, and compel document production pending investigation. Asset freezes in the UAE context can now extend internationally: the DIFC Court Law No. 2 of 2025 and the ADGM Court's reasoning in A17 v B17 [2025] confirm that worldwide freezing orders may be granted in support of foreign proceedings without any requirement for UAE-based assets, a development that materially increases the enforcement reach of any criminal referral.

The AML dimension compounds the criminal exposure significantly. Under FDL 10/2025 and Cabinet Resolution 134/2025, any person who deals with, transfers, or conceals proceeds of tax evasion — including by routing funds through corporate structures — commits a money laundering offence, regardless of whether the underlying tax evasion has been separately prosecuted. Personal manager liability under FDL 10/2025 means that individual directors, CFOs, and senior executives can be charged without the prosecution being required to establish that the corporate entity itself was convicted of evasion. For individuals with significant UAE tax positions, this is an acute risk that must inform the voluntary disclosure analysis: a pre-audit disclosure, even where the underlying conduct could theoretically be characterised as evasion, typically resolves into an administrative matter; a post-audit referral does not.

Practitioners should also note that the UAE's extradition framework under Federal Law No. 39 of 2006 as amended by Federal Decree-Law No. 38 of 2023 is now more actively used in serious financial crime cases, particularly following the UAE's removal from the FATF grey list in February 2024 and the EU high-risk list in 2025. The UAE's 2026 FATF mutual evaluation will further incentivise prosecutorial activity in financial crime matters, including tax evasion. The enforcement environment is materially different from that of two years ago.

Strategic Considerations: Health-Check, Privilege, and Disclosure Sequencing

The starting point for any board or GC considering its corporate tax exposure should be a privileged tax health-check conducted by external legal counsel. The privilege point is not procedural pedantry: in the UAE, communications between a licensed legal practitioner and their client are protected from compelled disclosure in legal proceedings. A tax health-check commissioned through and supervised by external legal counsel — rather than through external auditors or tax consultants acting in an advisory (non-legal) capacity — attracts that protection. If the health-check identifies material errors, the remediation strategy and the decision whether and when to make a voluntary disclosure are protected from FTA compulsion. Tax advice from accountants and consultants not acting under legal instruction does not carry the same protection.

The sequencing of a voluntary disclosure relative to other corporate events requires careful management. In M&A transactions, target companies with open CT periods should conduct a pre-signing tax health-check; errors identified during vendor due diligence that are not disclosed to the FTA before signing may create warranty exposure and indemnity claims post-closing, in addition to the underlying FTA liability. In restructuring and group reorganisation, transfers of assets between UAE group entities may trigger transfer pricing implications that affect both the transferor's and the transferee's taxable income — all periods within the five-year window should be reviewed before restructuring is implemented. In insolvency situations, the interaction between corporate tax claims and the priority waterfall under Federal Decree-Law No. 51 of 2023 on Financial Restructuring and Bankruptcy (in force 1 May 2024) must be mapped; the FTA is a preferential creditor for tax debts, and voluntary disclosure before insolvency proceedings commence avoids the separate criminal exposure for tax-related fraudulent bankruptcy conduct under FDL 51/2023.

For Qualifying Free Zone Persons, the strategic stakes are particularly high. A determination by the FTA that an entity does not satisfy the Qualifying Free Zone Person conditions — whether because of inadequate substance, de minimis non-qualifying revenue exceeded, or failure to meet the arm's-length standard with related parties — retroactively taxes all income at 9% rather than 0%, potentially for multiple years. The quantum of exposure on a retroactive QFZP disqualification is typically orders of magnitude larger than the penalty for a voluntary disclosure of a specific computational error. Proactive assessment of QFZP status, and voluntary correction of any periods in which the conditions were not met, is materially preferable to allowing the FTA to make that determination on audit.

Practical Steps: From Error Identification to FTA Submission

Once a potential error is identified, the immediate priority is to stop the awareness clock from running without adequate legal cover. Instruct external legal counsel promptly; do not discuss the error in unprotected email communications or in management accounts that will be provided to third parties. Counsel will typically conduct a rapid scoping exercise to determine: (i) the nature and quantum of the error; (ii) whether it is isolated or systemic across multiple periods; (iii) whether related entities are affected; (iv) the applicable penalty calculation under Cabinet Decision 129/2025; and (v) whether the facts could support a characterisation of evasion (which affects the risk calculus even if voluntary disclosure is ultimately made).

If the decision to disclose is taken, counsel will prepare the amended return or standalone voluntary disclosure for submission through EmaraTax. The disclosure document should be precise, complete, and internally consistent — partial disclosures that prompt the FTA to audit adjacent items are a known risk. The accompanying payment of tax and penalties should be arranged through the entity's UAE bank in advance of submission, so that the payment reference can be included in the filing and the FTA's system registers a contemporaneous settlement. Where the quantum is large and cash flow requires time to arrange, counsel can liaise with the FTA's taxpayer services division regarding payment scheduling, though this extends the period over which monthly penalties accrue.

Following submission, the FTA typically acknowledges receipt and issues an amended assessment. Taxable persons should retain all working papers, calculations, and the legal opinion supporting the disclosure decision, as these may be relevant if the FTA subsequently audits an adjacent period or queries the methodology of the correction. The voluntary disclosure does not preclude the FTA from auditing the corrected period, but in practice a well-prepared disclosure with contemporaneous payment significantly reduces the likelihood of further inquiry into that period. The entity's tax compliance posture going forward — including transfer pricing documentation maintained contemporaneously under Article 55 of the CT Law and the relevant Ministerial Decisions — should be reviewed and strengthened as part of the post-disclosure remediation programme.

Practical checklist

• Commission a privileged tax health-check through external legal counsel before any audit notice arrives.
• Map all UAE entities: identify which hold QFZP status and verify conditions are met for each open period.
• Quantify underpaid tax and run the 1–4% monthly penalty calculation versus the 15% audit-trigger rate.
• Identify the awareness date for each error to assess the 20-business-day voluntary disclosure window under Article 75 CT Law.
• Coordinate multi-entity disclosures simultaneously to avoid the FTA auditing non-disclosing group members first.
• Arrange tax and penalty payment through your UAE bank before EmaraTax submission to evidence contemporaneous settlement.
• Assess AML exposure for senior executives under FDL 10/2025 where amounts are large or conduct could be characterised as intentional.
• Implement contemporaneous transfer pricing documentation under Article 55 CT Law to protect future periods.

Frequently asked questions

Related guides

• Can a Company Itself Be Prosecuted? Corporate Criminal Liability (Article 66)
• The Privilege Trap: Why Your UAE Internal Investigation May Not Be Protected
• From SCA to CMA: The UAE's New Market Abuse and Insider Trading Regime
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.