The business cost of weak supplier verification: a practical guide for UAE finance and compliance teams

Ask a finance team to produce everything they hold on a supplier they have been paying for two years, and the answer is rarely a file. It is a search. The trade licence is in somebody's inbox, the bank letter is in a shared folder nobody has tidied since the last audit, the ownership question was settled on a call, and the person who settled it has left.

None of that is unusual, and none of it means the work was not done. It means the work cannot be shown. For UAE businesses deducting input tax, and for the accountants, auditors, tax advisers and corporate-service providers who support them, that distinction has become the expensive one.

See how UMNIII Verify keeps supplier requests and their evidence in one record

---

How a supplier file comes apart

Fragmentation is not a decision anybody makes. It is what happens when a process with several participants runs through tools that were never meant to hold it:

• Documents arrive wherever the supplier finds easiest. A trade licence photographed and sent on WhatsApp, a bank letter attached to an email thread with eleven other messages in it, a signed form scanned sideways.
• The request itself is improvised. One buyer asks for four things, another asks for six, and the difference is invisible until somebody compares two files.
• Approvals live in conversation. Finance accepts a supplier on a call with procurement, and what was agreed survives only in the memory of whoever was on it.
• The evidence is separated from the decision it supported. The documents sit in a drive, the conclusion sits in a spreadsheet, and nothing connects the two.
• Spreadsheets drift. A supplier master list is accurate on the day it is built and degrades quietly from then on, because nothing forces it to be updated when a supplier changes address or the person you deal with leaves.
• Nobody owns the record. Procurement thinks finance holds it, finance thinks procurement does, and both are partly right.

The cost of this is usually described as inefficiency, which understates it. The real cost appears later, and it falls into two broad areas: the work of reconstructing evidence after the fact, and the operational and commercial drag of running the process this way. They are worth keeping apart because they have different remedies.

---

What the decision actually asks you to keep

Federal Tax Authority Decision No. 13 of 2026 applies to taxable persons in relation to the supplies they receive, before input tax is deducted. The checks themselves are set out at length in our separate article; what matters here is the part that is about records rather than checks.

Article 5 of the decision sets out the procedures a taxable person must carry out. Alongside verifying the supplier and verifying each supply, it requires that you document the verification steps taken and retain the supporting documents and records, in a way that enables the Authority to verify that they were carried out correctly. It also requires a documented policy identifying the people responsible for implementing, reviewing and supervising the verification procedures, setting out their powers and responsibilities clearly, and kept where the other required documents are kept.

Read that carefully, because it is doing two things. It asks for the work. Then it asks, separately, for the work to be demonstrable to somebody who was not there. A verification that happened but cannot be evidenced satisfies the first and not the second.

What the decision does not do is attach a stated consequence to falling short. It sets out measures, procedures and conditions; it does not publish a penalty, and it does not say that a given failure results in a deduction being refused. Anyone telling you otherwise is adding something the text does not contain. What can be said plainly is narrower and still significant: if the steps were not documented and the records were not retained, you are not in a position to show the Authority what you did, and whether anything follows from that is a matter for the Authority and for your own tax adviser rather than for an article.

---

The audit and evidence cost

This is the cost that lands on the firms supporting the business as much as on the business itself. An auditor or adviser asked to look at supplier due diligence needs to see what was asked, what came back, who looked at it and when. Where that is scattered, the engagement absorbs the reconstruction:

• Time is spent assembling a file rather than reviewing one, and the assembly is billed to somebody.
• Sampling becomes unreliable, because the sample that is easy to evidence is not a random sample.
• The absence of a record is indistinguishable from the absence of the work. A reviewer cannot tell a check that was done and not written down from one that was never done.
• Dates become approximate. Article 5 turns on when a supplier was last verified, and a file that cannot say when cannot answer the question.
• Findings repeat. The same gap is raised each year because nothing structural changed between reviews.

For an accounting or audit firm this is the clearest commercial argument for fixing the underlying process at the client: the work you are absorbing is not audit work, and it recurs.

---

The operational and commercial cost

The second area is the one the business feels every week, long before anybody asks to see a file:

• Onboarding takes longer than it should, because the same supplier is asked for the same document twice by two different people.
• Payments are held while somebody looks for a licence copy that exists but cannot be found.
• Suppliers form a view of the business from how it asks. An inconsistent, repetitive request reads as disorganisation, and the supplier remembers it.
• Staff turnover becomes a data loss event, because the file was partly in somebody's head.
• Nobody can answer "which of our suppliers is due to be looked at again" without a manual exercise, so the answer is produced once a year rather than known continuously.

None of these is dramatic on its own. Together they are a standing tax on the finance function, paid in hours.

---

What a structured supplier workflow looks like

The fix is not more diligence. Teams in this position are usually already diligent; what they lack is a shape that holds the diligence. Six things, in order:

• One record per supplier. Everything about that supplier belongs to it: what was asked, what arrived, what was concluded. If it is not on the record, it did not happen as far as any reviewer is concerned.
• Ask the same way every time. A standard request, composed once, so two suppliers onboarded by two people are asked for the same things in the same order. Variation should be a deliberate choice, not an artefact of who sent it.
• Collect the evidence against the request that asked for it. Not into a drive, not into an inbox. Against the request, so the document and the question it answers stay together.
• Record the review, not just the result. Who looked at it, when, and what they concluded. This is the part most often missing, and it is the part Article 5 is most directly about.
• Retain the outcome where it can be produced. A file that can be assembled on request, in one piece, without a search.
• Know when the next review is due. The twelve-month window in Article 5 runs from the dealing rather than from a fixed annual date, so the question is continuous and a once-a-year exercise answers it late.

Notice that none of this is about judgement. Whether to accept a supplier remains a decision for the business. The structure is about making that decision visible afterwards.

---

How UMNIII Verify helps

UMNIII Verify is built around the request: you choose the documents, questions and checks a supplier needs, send a single branded link, and everything comes back to one record your team can search, reopen and download from. Three things follow from that, and they address the problems above directly.

• Every supplier is asked the same way, and the evidence stays with the question. Ready-made question sets, your own custom forms, and forms published by the Verify community, plus document requests, all saved as reusable templates. Identity verification, AML screening and business verification are selected per request rather than applied to everyone. What comes back is attached to the request that asked for it rather than to an inbox.
• Ownership, progress and the next review are visible. Shared Workspaces with members, roles and shared credits, so the person who carried out the work and the person who reviewed it are both recorded against it. Progress on every request, so one that has stalled is visible rather than forgotten, and optional reminders follow up automatically while a request is still outstanding. Verification-date tracking shows when a supplier is approaching the point where it should be looked at again, with reverification managed from the same Workspace and the earlier evidence kept alongside the new request.
• The file can be produced, in one piece. One branded evidence pack per request, carrying its history, the available supporting evidence, the results and the submitted forms, with individual documents, form-response PDFs and AML reports available separately.

Getting an existing supplier base in is two different things. In a Workspace you can import a supplier list from a CSV file, matching your spreadsheet columns to the Verify supplier fields and reviewing the results before importing. Separately, data from SAP, Oracle, other ERP and procurement systems, middleware or structured supplier exports arrives through a configured integration, not a self-service connector: scoping it depends on your system and its version, cloud or on premise, any middleware or available APIs, and how your fields map to the Verify supplier model. Neither route starts anything on its own. Bringing suppliers in does not start checks, spend credits or email anyone, and your team still chooses who to verify and when.

The useful output is not a pass or a fail. It is an organised account of what was asked, what came back, who reviewed it and when, which is the thing a scattered process cannot produce at any price.

UMNIII Verify supports this work and evidences it. It does not make your tax, legal, compliance or supplier-acceptance decisions, and it does not file or submit anything to the Federal Tax Authority on your behalf.

---

Where to start

Start with one supplier file you would not want to be asked about. Not the worst one: a representative one. Try to assemble, from what you hold today, what was asked, what came back, who reviewed it and on what date. However long that takes is your current cost per file, and it is the number worth taking to whoever decides what the team spends its time on.

Then compose that same intake once, as a template, and send the next supplier through it rather than through an email.

See how UMNIII Verify handles supplier requests

For the requirements themselves, our article on FTA Decision No. 13 of 2026 sets out what the decision asks of taxable persons, and the UAE supplier verification page covers the decision and the workflow side by side, including reverification and evidence. For company checks specifically, the KYB and company verification page goes into more detail.

---

This article is general information for finance, procurement and compliance teams and the firms that advise them. Nothing here is legal or tax advice, and it does not state that any particular shortcoming leads to a penalty or to a deduction being refused. The English text the Federal Tax Authority publishes is captioned an unofficial translation and the Arabic governs. For the decision itself see the Federal Tax Authority decision page, and for how it applies to your business take advice from a qualified UAE tax adviser.