Buried at the end of the procedures article of FTA Decision No. 13 of 2026 is a requirement that will, in practice, be among the first things tested when the Authority reviews a Taxable Person's compliance — and the one most likely to be missing.
Article 5(4) requires every Taxable Person to maintain a documented policy identifying the persons in charge of implementing, reviewing and supervising the verification procedures, indicating their powers and responsibilities in a clear manner and form, retained at the designated location for keeping required documents.
Why This Provision Will Be Tested First
Think about it from a reviewer's perspective. Testing whether supplier verification was properly performed across a vendor base takes sampling, document requests and time. Testing whether the Article 5(4) policy exists takes one request. It is the deliverable most readily assessed in a single ask — and the one whose absence is unarguable. There is no partial credit for a policy that does not exist, and no way to explain the gap that improves the position.
It is also the natural opening question because the policy reveals everything else. A policy that names real people, real decision rights and a real escalation route tells a reviewer the obligation was owned. A policy that names nobody — or does not exist — predicts what the rest of the file will look like.
What the Policy Has to Do
Staying with what the text requires: the policy must identify who implements the verification procedures, who reviews them, and who supervises them, with powers and responsibilities stated clearly. Implicit in that structure are the questions every business must answer for itself, and they are harder than they look:
Who actually performs each measure? The acts Decision 13 requires sit in vendor onboarding, procurement, accounts payable and payment execution. A policy that assigns everything to "the tax department" describes an arrangement that cannot work at any realistic volume, and a reviewer will recognise that as quickly as an operator would.
Who decides on exceptions? A supplier that cannot be verified, a risk indicator that fires, a document a counterparty declines to provide — someone with appropriate seniority has to own those calls, and the policy is where that authority is stated.
Who supervises the cycle? Verification refreshes on a twelve-month rhythm that decays silently — nothing visibly breaks when a supplier's verification lapses. Supervision is what keeps the second year as good as the first.
A Statutory Document, Not a Template Exercise
The temptation will be to download a template, insert the company name, and file it. That instinct misreads what the document is for. The policy is the governance layer of the verification programme made visible — and it is only credible if the allocation it describes matches how the business actually operates. Names and roles that do not know they have been assigned responsibilities, decision rights that do not correspond to any real forum, a supervision cadence nobody runs: each of these converts the policy from evidence of control into evidence of its absence.
Done properly, the policy is also where several of the Decision's open interpretive questions get anchored — how the business has read the requirements that published guidance has not yet addressed, who approved those readings, and from when. A dated, versioned policy carrying that record is worth a great deal more than its page count suggests.
For a small business, none of this requires a department. An owner-managed company can satisfy Article 5(4) in two well-drafted pages naming the owner and the accountant. What matters is that it exists, reflects reality, carries an effective date, and is followed.
How Contiqa Can Help
Contiqa Systems drafts Article 5(4) policies that reflect how your business actually runs — grounded in a genuine allocation of responsibilities across procurement, finance and tax, with decision rights and escalation routes that will stand up to review, sized appropriately whether you are a group or an owner-managed company. Contact Contiqa Systems to put the statutory governance document in place before 1 October 2026.
Track how UAE businesses are responding to this Decision as it takes effect — visit the Decision 13 Tracker on this site.
This article is general commentary on published legislation (working from the unofficial English translation) and does not constitute tax or legal advice. Obtain advice on your specific circumstances before acting.