Most UAE enterprises will end 2026 with one new entry in the tax risk register that is larger than anything already on it — and structurally unlike the entries around it. How that entry is framed, and which committee sees it, will quietly determine whether FTA Decision No. 13 of 2026 gets governed or gets filed.
Why This Risk Doesn't Fit the Register You Have
Conventional tax risks are internal-process risks: a position taken, a calculation made, a filing due. The exposure Article 54 bis creates is different in four respects, and each one breaks an assumption the annual review cycle relies on.
The risk driver is a counterparty. The trigger is a fact about a supplier — or about an entity further up a chain the business never dealt with — not about anything the business itself did.
The control owner sits outside tax. The acts that mitigate the risk happen in procurement, accounts payable and treasury. The function accountable for the outcome does not perform the controls.
The trigger is unobservable. No enterprise can see today which supplier a future enquiry will reach. The risk cannot be monitored by watching for the event — only by maintaining the condition that protects against it.
The exposure accrues continuously. Every unverified in-scope supply adds to the population at risk. Nothing crystallises at a filing date; the exposure simply grows through periods in which everything appears fine.
A risk with those features cannot live on an annual review cadence. It needs a named owner, a monitoring metric, a reporting rhythm measured in months, and a defined escalation trigger.
The Metric That Works: Coverage
Because the trigger cannot be observed, the only variable the enterprise controls is coverage of the in-scope population — and that is precisely the variable that determines whether the Article 54 bis deeming rule is ever available against it. Coverage is therefore both the operating metric and the risk metric, which is a rare and convenient alignment.
Framed as appetite, the board question becomes specific: what proportion of in-scope suppliers, and of in-scope supply value, may remain unverified at any time — and who approves the exceptions? An answer like "98% of in-scope vendors verified within the last twelve months, the remaining 2% listed by name, value and reason, each with an owner and a remediation date" is a governable position. "We have a supplier verification process" is not a position at all.
Register It in the Right Place
Recording this purely as a tax compliance risk understates it and puts it in front of the wrong committee. The more accurate placement is as a third-party risk with a tax loss channel — cross-referenced from the tax risk register to whichever forum owns supplier and counterparty risk. The reframing is not cosmetic. It reflects the true driver, and it gives the head of tax a route to funding and to procurement's cooperation that a tax-only framing never provides. A board asked to fund "VAT compliance" hears cost; a board asked to govern counterparty integrity across an AED-hundreds-of-millions procurement base hears risk.
What the Board Pack Should Show
The reporting that lets a board discharge its oversight is short: the in-scope population and how it was derived; coverage against it, with the residual named; input tax value sitting in the unverified set; exceptions raised, approved and outstanding; risk indicators triggered and their resolution; any deductions declined as a considered outcome; and the status of the twelve-month refresh cycle. Producible monthly, readable in minutes — and every line of it depends on data and process foundations that exist only if the programme was designed to produce them. Reporting is the last mile of a design, not a substitute for one.
How Contiqa Can Help
Contiqa Systems builds the governance layer around Decision 13: the risk register entry and appetite statement, the coverage metric and the reporting pack, wired to a programme that can actually produce the numbers. If your audit committee will ask about Decision 13 this year — and it will — contact Contiqa Systems to have an answer worth presenting.
Track how UAE businesses are responding to this Decision as it takes effect — visit the Decision 13 Tracker on this site.
This article is general commentary on published legislation (working from the unofficial English translation) and does not constitute tax or legal advice. Obtain advice on your specific circumstances before acting.