How to Handle FTA and ZATCA Audits in the UAE and Saudi Arabia

Understanding how to handle FTA and ZATCA audits in the UAE and Saudi Arabia is key to ensuring accurate filings and avoiding penalties in both jurisdictions. 

As tax compliance frameworks mature across the Gulf, businesses operating in the UAE and Saudi Arabia are increasingly subject to scrutiny from the Federal Tax Authority (FTA) and the Zakat, Tax and Customs Authority (ZATCA). Both regulators have intensified their audit activities to ensure accurate VAT, corporate tax, and zakat filings, making it crucial for companies to understand the audit process and maintain proper documentation.

In this article, we explain how to handle FTA and ZATCA audits effectively, outlining key compliance practices, common red flags, and practical steps to prepare your business for potential tax reviews in both jurisdictions.

Audit triggers and selection criteria

Tax audits in both jurisdictions are primarily risk-driven. Authorities use data analytics and system cross-verification to identify irregularities in financial statements.

The FTA and ZATCA may initiate an audit when corporate tax returns show unexplained discrepancies with VAT filings or when reported profits fluctuate sharply without justification. They can also initiate audit for the following irregularities:

• Consistent loss reporting compared with sector peers;
• Large or unusual VAT refund claims;
• Frequent voluntary disclosures or amendments;
• High volumes of related-party transactions without supporting transfer pricing document;
• Delayed filings or payments;
• Mismatches between reported revenue and financial statements;
• Business links to entities under investigation; and
• Whistleblower reports.

Legal and procedural framework

FTA audit powers and procedures

Related Services

Manage Company Tax and Compliance across Multiple Jurisdictions. Speak With Our Tax Professionals on the Ground.

Using Federal Decree-Law No. 28 of 2022, the FTA gains authority to conduct audits to verify compliance with tax laws. Audits can occur at the FTA’s headquarters, at the taxpayer’s business premises, or at any location where records or inventory are stored.

The FTA may examine or seize accounting books, invoices, and other document. Audits may be conducted on-site or remotely.

Notice and access process:

• Standard notice: 10 business days before a tax audit;
• Routine on-site audits: minimum 5 business days’ notice; and
• No-notice audits: permitted for up to 72 hours with prior written consent from the Director-General in exceptional cases, such as suspected tax evasion.

In the case of no-notice audits, the FTA may temporarily close premises if access is denied or evidence could be destroyed but their entry into residential premises requires Public Prosecution approval.

Taxpayers too have certain rights:

• Representation by a tax agent or legal counsel during the audit;
• Right to be present or represented during field visits;
• Right to obtain copies of documents reviewed by auditors; and
• Right to request clarification or provide additional evidence when discrepancies arise.

ZATCA audit powers and process

ZATCA’s mandate extends to all taxable and zakat-paying entities. It may review financial records, contracts, bank statements, and e-invoicing data. Authorities can also investigate import-export records and examine sector-specific documents.

Audit process:

• Notification is issued through the ZATCA portal or by letter, specifying audit type, period under review, and required document;
• Taxpayers must submit the requested information within the prescribed timeframe. Late submission may be treated as non-compliance;
• Data is compared against returns and e-invoicing records;
• Examination phase may involve a desk audit or on-site review with staff interviews;
• ZATCA may issue formal requests for additional explanations or supporting data;
• Findings report outlines discrepancies, adjustments, and potential penalties;
• Taxpayers can contest findings or provide clarifications before a final assessment; and
• Final assessment is issued after review of taxpayer responses; includes any additional tax, zakat, or penalties.

Statute of limitations and lookback periods

Related Services

Build Your Middle East Business with Turnkey Market Entry and Cross-Regional Support

Time limits for tax assessments differ between the UAE and Saudi Arabia. In the UAE, the FTA generally has five years from the end of the tax period to issue or amend assessments. This extends to nine years if a dispute or ongoing audit exists and by an additional year if a voluntary disclosure has been filed. For real estate records under VAT, retention extends up to 15 years.

In Saudi Arabia, the standard limitation is three years from the end of the calendar year in which the filing deadline falls. It extends to ten years in cases of non-filing, suspected tax evasion, or if the taxpayer provides written consent. Taxpayers may request refunds of overpaid zakat or tax within three years of the same period.

Documents and record-keeping

UAE requirements

Under Article 56 of the Corporate Tax Law, taxable and exempt persons must maintain:

• Accounting records and financial statements;
• Sales, purchase, income, and expenditure records for each tax period;
• Asset registers with acquisition and disposal details;
• Loan and liability records;
• Shareholder and equity records;
• Tax returns, supporting schedules, and reconciliations;
• Bank statements and contracts; and
• Transfer pricing document, including master and local files.

Records must be retained for seven years for corporate tax purposes, and five years under general tax procedure laws. Extensions apply for ongoing audits or voluntary disclosures. Records may be kept in English or Arabic and in digital or physical form, but must be accessible upon FTA request.

Saudi Arabia requirements

ZATCA requires businesses to maintain:

• Audited financial statements (where applicable);
• VAT and zakat filings;
• Compliant tax invoices and credit notes;
• Contracts and agreements;
• Bank reconciliations and zakat working papers;
• Transfer pricing document (Master File, Local File, CbCR);
• Electronic invoicing records under the FATOORA system; and
• Documents supporting exemptions or special treatment.

E-invoicing data and related document must be archived for at least six years.

Audit types and process

UAE audit types

Audits under the FTA follow three main formats, desk, field, and hybrid reviews, depending on the perceived risk profile of the taxpayer.

Desk audits are remote assessments conducted through the FTA’s digital platforms. The authority requests financial statements, invoices, or reconciliation reports to verify specific discrepancies. These reviews are common for minor calculation issues or clarification of isolated transactions.

Taxpayers respond electronically through the EmaraTax portal or via email submission.

Field audits involve on-site visits to company premises. FTA officers examine accounting systems, contracts, and operational data, and may interview finance staff. These audits are usually for high-risk transactions, repeated compliance breaches, or inconsistencies between returns and supporting records. Businesses are usually notified five to ten business days in advance.

Hybrid audits combine desk-based reviews with targeted field inspections. The FTA may initially evaluate electronic submissions and then perform selective on-site verifications if material risks are detected.

Saudi Arabia audit types

ZATCA conducts audits through a similar tiered system.

Desk audits are off-site reviews where the authority requests VAT returns, invoices, and reconciliation reports through the FATOORA e-invoicing system. These checks are triggered by minor inconsistencies or unusual patterns in declared data.

Field audits are more comprehensive and involve physical inspection of accounting systems, contracts, and supporting document. ZATCA officers may interview staff to validate compliance. These reviews generally focus on large or foreign-owned firms or those in high-risk industries such as oil, technology, or finance.

Electronic audits operate through continuous data analysis of e-invoicing submissions. The FATOORA platform allows automated detection of irregularities between invoices and tax declarations. Companies that maintain compliant and integrated systems face lower exposure to audit interventions.

Penalties and financial exposure

UAE penalties

Audit outcomes may lead to penalties for delayed payments or record-keeping violations.

VAT penalties apply as follows:

• Immediate fine of 2 percent on unpaid tax when deadlines are missed’;
• Additional 4 percent after seven days (total becomes 6 percent); and
• 1 percent daily penalty after 30 days, capped at 300 percent of the unpaid amount.

Corporate tax penalties are:

• AED 500 (US$136.1) per month for late filing during the first year, increasing to AED 1,000 (US$272.2) per month thereafter;
• 14 percent annual interest on unpaid amounts, calculated monthly; and
• AED 10,000 (US$2,722.9) for first-time record-keeping failures, rising to AED 20,000 (US$5,445.8) if repeated within two years.

The administrative fines are AED 20,000 for late VAT registration and AED 1,000 per delayed VAT return. Taxpayers who settle penalties within 15 days may receive a 5 percent discount. Installment arrangements are available for large penalty amounts over 12 or 24 months at 1 percent annual interest.

Saudi Arabia penalties

ZATCA imposes fines covering non-registration, inaccurate filings, and tax evasion.

• Failure to register for VAT incurs SAR 10,000 (US$2,666.3);
• Delayed return submission attracts fines ranging from 5 to 25 percent of undeclared tax;
• Failure to pay VAT incurs 5 percent monthly penalty, up to 25 percent;
• Issuing tax invoices as a non-registered person can be penalized up to SAR 100,000 (US$26,663.5);
• Record-keeping failures can invite up to SAR 50,000 (US$13,331.7); and
• Incorrect return filings can result in 50 percent of the tax difference.

E-invoicing violations attract penalties between SAR 5,000 and SAR 100,000, depending on severity. Tax evasion cases can result in fines of up to three times the evaded amount, and severe or repeated offenses may lead to imprisonment. Delayed payments attract a 1 percent monthly penalty on unpaid taxes, capped at 25 percent.

Appeal and objection procedures

UAE appeal process

The UAE follows a multi-stage system for dispute resolution:

• Tax assessment review: Taxpayers may request a reassessment within 40 business days of receiving an FTA notice. This stage allows correction of factual discrepancies.
• Reconsideration request: If the initial review remains unsatisfactory, taxpayers can file a reconsideration with supporting evidence within 40 business days.
• Tax Dispute Resolution Committee (TDRC): Disputes that remain unresolved may be escalated to the TDRC within 20 business days. Tax and penalties must be settled before submission, and documents must be provided in Arabic: Dubai TDRC covers Dubai-based entities; Abu Dhabi TDRC oversees Abu Dhabi and foreign entities; and Sharjah TDRC covers Sharjah and the northern emirates.
• Judicial appeal: Either party may appeal to the UAE courts within 40 business days of the TDRC’s decision, generally reserved for complex or high-value cases.

Saudi Arabia appeal process

In Saudi Arabia, the appeal process allows both administrative and judicial remedies.

After receiving an audit report, taxpayers may respond within a defined period by providing documents or explanations. Disputed assessments are first reviewed internally by ZATCA committees.

If disagreement continues, taxpayers can pursue legal settlement procedures by admitting the violation and submitting supporting document. Early settlements often result in reduced fines and avoidance of criminal prosecution.

For further escalation, cases may be referred to the Tax Appellate Committee, which reviews disputes involving statute limitations or assessment procedures.

Preparing for audits

Internal health checks

Companies should conduct mock audits to identify weaknesses in their reporting systems. Accounting ledgers should reconcile with tax returns, and outstanding discrepancies should be resolved before an audit notice is received.

Document organization

Records should follow a “Completeness, Defensibility, and Consistency” principle:

• Completeness: All documents required under corporate tax and VAT laws must be available;
• Defensibility: Records should substantiate tax positions and business decisions; and
• Consistency: Figures must align across financial statements, tax filings, and supporting schedules.

Designating an audit liaison ensures consistent communication with FTA or ZATCA officials and prevents delays caused by miscommunication.

Proactive compliance:
Businesses should maintain continuous audit readiness rather than respond reactively. Please ensure e-invoicing systems are properly integrated with ZATCA’s FATOORA.

Responding during an audit

Audit response strategy should balance transparency with caution. Entities must cooperate with auditors while avoiding submission of irrelevant data. Timely, well-documented responses supported by evidence reduce risks of non-compliance penalties.

Finance teams should remain available for clarification requests, and all auditor communications should be logged. Providing access to original invoices, contracts, and accounting systems when requested ensures credibility and expedites the process.

Professional representation by tax agents or legal counsel is advisable, especially when audits involve technical areas like transfer pricing.

(US$1 = AED 3.67 = SAR 3.75)

• Previous Article Qatar Revises Work Permit and Labour Service Fees: What Employers Need to Know
• Next Article