A Valid TRN Used to End the Vendor Check. From 1 October, It Starts It.

Reviewed by Atul Bhargava, Chartered Accountant (ICAI). Accurate as of 11 October 2026.

In short. FTA Decision No. 13 of 2026, issued on 22 July and in force from 1 October 2026, sets the checks a UAE business must run on each supplier and each supply before deducting input VAT [3]. A valid TRN and tax invoice are still required, but no longer enough. If the checks are not done and documented, the business is treated as having known about any tax evasion in the supply chain, which removes its main defence if the FTA rejects the deduction [2][3].

• Three tiers: supplies under AED 10,000 can be skipped unless the supplier passes AED 100,000 a year; suppliers above AED 375,000 need a UAE bank confirmation and a media review.
• Two homes: supplier checks belong in the vendor master; supply checks belong in procure-to-pay.
• Do first: clear the backlog of suppliers not verified in the last 12 months, highest spend first.

Vendor onboarding before Decision 13

In the shared service I ran, we had around 4,000 vendors on the master. Five to seven hundred of them carried the volume, and even that group turned over faster than anyone liked. Every new vendor meant the same pack: a trade licence, bank details on a signed letterhead, a TRN. The real work started after the pack arrived. Is this licence genuine? Is this letter real? Did this email actually come from the vendor?

That last question is the one that hurt us.

A supplier's email asked us to change its bank account. The request came from the supplier's authorised address, with a signed letter attached. The user department, which dealt with the supplier every week, forwarded it to Accounts Payable with its recommendation. AP saw two confirmations: the supplier's email with the signed letter, and the business endorsing it. They updated the IBAN in the ERP. The next payment batch picked up the new details straight from the vendor master, the bank's bulk payment channel did not check the IBAN against the beneficiary name, and the payment went out.

The supplier's mailbox had been compromised. Every control we had was a person trusting another person's email.

We had looked at fixes for the TRN side too: bank APIs, and an RPA bot to check TRNs against the Federal Tax Authority's (FTA) public lookup. None of it was documented with an audit trail we could hand to anyone. That was a hard problem when the stake was fraud. From 1 October 2026, under FTA Decision No. 13 of 2026, the stake includes the input VAT itself.

What changed: Article 54 (bis) and FTA Decision 13

Since 1 January 2026, Article 54 (bis) of the VAT Decree-Law lets the FTA reject input tax where the supply was part of a chain linked to tax evasion and the business knew, or should have known, of the link [2]. A business is treated as having known if it did not verify the validity and integrity of the supplies before deducting the tax [1][2]. FTA Decision No. 13 of 2026, issued 22 July 2026 and effective 1 October 2026, sets out what that verification must include [3].

The Decision never mentions the TRN. A valid tax invoice is still a condition for recovery under Article 55 of the Decree-Law [2], and it must show the supplier's TRN under Article 59 of the Executive Regulation [5]. Both are still necessary. Neither is sufficient. The Decision asks you to verify the supplier's incorporation, the identity of the person representing it, a real place of business that fits its activity, and the commercial sense of each supply [3]. The "chain" in Article 54 (bis) is also wider than your direct supplier; the FTA's clarification says it covers any person in the supply chain linked to the evasion [2].

Decision 13 thresholds: AED 10,000, 100,000 and 375,000

Decision 13 sets three numbers that decide how much checking stands behind each input VAT claim, and together they work as a risk model [3]:

• Out of scope: supplies under AED 10,000 excluding VAT, as long as total supplies from that supplier stay under AED 100,000 over the past 12 months and are not expected to exceed it over the next 12.
• Standard file: everything above that. Identity, incorporation, place of business, risk indicators, and supply-level checks.
• Enhanced file: suppliers above AED 375,000 over the past or next 12 months. Add a written confirmation from a UAE bank that the supplier holds an account, with no reservations or conditions attached [7], and a review of public reviews and media coverage. AED 375,000 is the same figure as the mandatory VAT registration threshold [4].

Mapped onto my old supplier base, the five to seven hundred high-volume vendors are almost all enhanced. The long tail is the trap. Many small vendors will sit under the exception, but nobody should assume it until each one's spend has been tested against AED 100,000. Because both thresholds look forward as well as back, the tier is a live field on the vendor record, not a label set once at onboarding.

Supplier and supply verification: two homes in the process

Decision 13 has two halves. Article 3 verifies the supplier. Article 4 verifies each supply [3]. It is tempting to run them as one checklist. Operationally, they belong in different places.

In the vendor master (owned by the vendor master team, with senior review for the enhanced tier):

• Supplier identity, incorporation and place of business (Art. 3): registry check, representative's ID, premises check and a dated conclusion, captured at onboarding.
• Individual suppliers (Art. 3): a copy of the Emirates ID or passport, and a meeting in person or by video before the supply, logged with date and attendee [7]. Freelancers and sole traders in the long tail sit here.
• Risk indicators (Art. 3): a count of address and key-contact changes over 12 months on the change log, with a written explanation when one is triggered.
• Bank confirmation and reputation review (Art. 3(4)): the bank letter and a screening note for every enhanced-tier supplier.
• 12-month refresh and policy (Art. 5): a next refresh date and a named reviewer per vendor; the policy itself owned by the head of finance.

In procure-to-pay:

• PO approval (Art. 4): the requisition states the commercial reason, and the purchase matches the supplier's licensed activity. Owned by the requester and approver.
• Goods receipt and three-way match (Art. 4): the GRN supports origin and title of goods; the price variance check supports market pricing. Owned by stores and AP.
• Payment release (Art. 4): payment by electronic means, and a written reason for cash, third-party payments, or accounts outside the supplier's country of incorporation. Owned by treasury.

The vendor master needs fields most ERPs don't carry by default: tier, verification date, reviewer, conclusion, risk-flag explanation, bank confirmation date and next refresh date. Once those exist, the ERP can do the enforcing. A vendor with an overdue refresh gets blocked from posting or payment, and the exception report goes to a named person rather than into an inbox.

Watch the payment row closely. The Executive Regulation now also bars input tax recovery on supplies paid, or intended to be paid, in cash above an amount the Minister will set (Article 54(3), added by Cabinet Decision No. 149 of 2026) [6]. That amount had not been published at the time of writing. Until it is, treat every cash-paid supplier invoice as a recovery risk and route it for review before the VAT return.

Borrow the AML playbook for supplier due diligence

Designated Non-Financial Businesses and Professions (DNFBPs) in the UAE already run risk-based customer due diligence: verify identity, check the registry, monitor for changes, keep the file ready for inspection. Decision 13 points the same discipline at the supply side.

What carries over well:

• Identity and document checks on the representative. KYC verification platforms check IDs and documents for tampering, which a person comparing a PDF by eye will not reliably catch. Finline uses Shufti Pro for this on the AML side; the same check works for a supplier's authorised signatory.
• Registry checks for incorporation. Pull the record from the source rather than accepting a copy.
• Ongoing monitoring triggers. Decision 13 names its own red flags: address changed more than twice in 12 months, key contacts changed more than twice, or transactions out of proportion to the supplier's size and history [3]. Build these as alerts on the vendor master change log.
• A call-back rule for bank changes. Any change to bank details is confirmed by phone to a contact already on file, never to a number in the request. This one control would have stopped the payment in my story.

Technology has limits. An RPA bot reading a public lookup that sits behind a verification code is fragile. And the bank confirmation letter for enhanced-tier suppliers is required by the Decision whatever tools you run [3]. Automation should carry the volume. Judgement stays with a named reviewer.

Existing vendors: clearing the verification backlog

Article 5(1) requires verification on first dealing and again if a supplier has not been verified in the previous 12 months [3]. Read with no transition rule, that pulls every unverified existing supplier into scope before its next deduction. On that reading, the backlog is the immediate job.

Work it in spend order. Enhanced-tier suppliers first, because that is where the input tax sits. Then the standard tier. Then confirm the tail really is under AED 100,000 before you rely on the exception.

If you are already cleaning the vendor master for e-invoicing, run both projects on the same records. The e-invoicing cleanse covers the identity basics, but it will not capture what Decision 13 also asks for: the supplier's licensed activity, the commercial reason for using it, and how and where it gets paid. One project, two sets of fields.

What the FTA will ask for: the supplier verification file

Article 5 requires a documented policy naming who implements, reviews and supervises the checks, with their powers stated [3]. Good practice that lives in people's heads does not meet that. Below the policy, each vendor needs a dated conclusion with a named reviewer, and an explanation for any red flag. Each supply needs its evidence sitting on the procure-to-pay record, where it was produced.

When the FTA tests a deduction, it will ask for the file: a dated conclusion, a named reviewer, and the supply evidence on the procure-to-pay record. If the FTA rejects the deduction, the input VAT becomes payable, and the business carries the cost of tax it already paid its supplier.

Sources

1. Federal Decree-Law No. 16 of 2025 amending Federal Decree-Law No. 8 of 2017 on VAT: Ministry of Finance (issued 25 November 2025, effective 1 January 2026). https://tax.gov.ae/en/legislation/federal.decree-law.no.8.of.2017.on.value.added.tax.aspx

2. VAT Public Clarification VATP046, Amendments to the VAT Decree-Law: Federal Tax Authority (2026). https://tax.gov.ae/en/taxes/vat/guides.references.aspx

3. FTA Decision No. 13 of 2026 on Measures, Procedures and Conditions required by Taxable Persons for the Verification of the Validity and Integrity of Supplies before Deduction of Input Tax: Federal Tax Authority (issued 22 July 2026, effective 1 October 2026). https://tax.gov.ae/Datafolder/Files/Legislation/2026/FTA%20Decision%20No.%2013%20of%202026%20on%20Measures%2018%2008%202026.pdf

4. Registration for VAT: Federal Tax Authority (accessed 11 October 2026). https://tax.gov.ae/en/taxes/vat/vat.topics/registration.for.vat.aspx

5. Cabinet Decision No. 52 of 2017 on the Executive Regulation of the VAT Decree-Law, as amended, Article 59: Federal Tax Authority. https://tax.gov.ae/en/legislation/federal.decree-law.no.8.of.2017.on.value.added.tax.aspx

6. Ministry of Finance Announces Amendments to the VAT Executive Regulation (Cabinet Decision No. 149 of 2026): Ministry of Finance (8 September 2026). https://mof.gov.ae/en/news/ministry-of-finance-announces-amendments-to-the-vat-executive-regulation/

7. United Arab Emirates: FTA Introduces New Input Tax Obligations: Baker McKenzie (3 September 2026). https://www.bakermckenzie.com/en/insight/publications/2026/09/united-arab-emirates-fta-introduces-new-input-tax-obligations