Cabinet Decision No. 106 of 2025 establishes the complete administrative penalty framework for violations of the UAE Electronic Invoicing System. The decision applies from the mandatory go-live date for each phase — 1 January 2027 for Phase 1 businesses and 1 July 2027 for Phase 2 businesses. From those dates, six categories of violation carry specific, quantified penalties. The numbers are clear, and the accumulation logic matters as much as the per-incident amounts.
The Six Violation Categories and Their Penalties
Article 3 of CD 106 of 2025 gives effect to the penalty schedule through the annexed table. The six violations cover the full lifecycle of e-invoicing obligations — from the initial obligation to appoint an ASP through to the ongoing operational obligations around issuance, notification, and data maintenance.
Violation 1 — Failure to Implement or Appoint an ASP Within the Deadline
The penalty for failing to implement the Electronic Invoicing System — including failure to appoint an Accredited Service Provider within the timeline prescribed by the Minister — is AED 5,000 for each month or part thereof. This is a continuous penalty that accumulates monthly for as long as the violation persists. A Phase 1 business that has not appointed an ASP by 30 October 2026 faces AED 5,000 for November 2026, a further AED 5,000 for December 2026, and a further AED 5,000 for January 2027 — AED 15,000 before the mandatory go-live date has even passed, and continuing monthly thereafter until the ASP is appointed.
Violation 2 — Failure to Transmit an Electronic Invoice Within the Timeline
The penalty for failing to issue and transmit an Electronic Invoice to the Recipient through the Electronic Invoicing System within the prescribed timeline is AED 100 per Electronic Invoice, subject to a maximum of AED 5,000 per calendar month. The AED 100 per invoice is a per-document penalty. For a business issuing thousands of invoices per month, the AED 5,000 monthly cap provides a ceiling, but that ceiling is reached at just 50 invoices in breach per month. The cap applies per calendar month — a business systematically missing the 14-day window faces AED 60,000 per year in this penalty stream alone.
Violation 3 — Failure to Transmit an Electronic Credit Note Within the Timeline
The same penalty structure — AED 100 per Electronic Credit Note, maximum AED 5,000 per calendar month — applies to credit notes issued and transmitted outside the prescribed timeline. Credit notes are a separate document stream from invoices, and the two monthly caps operate independently.
Violation 4 — Failure to Notify the FTA of a System Failure Within 2 Business Days
This is the penalty provision with the most acute daily accumulation risk. Article 12 of MD 243 requires every Issuer and Recipient to notify the FTA of a System Failure within 2 Business Days from the date of occurrence. CD 106 sets the penalty for the Issuer's failure to comply at AED 1,000 for each day of delay or part thereof. A system failure that goes unreported for 10 days generates an AED 10,000 penalty. Unreported for 30 days: AED 30,000. There is no monthly cap on this penalty stream.
The definition of a System Failure under MD 243 is any technical malfunction, disruption, or unavailability of the Electronic Invoicing System that prevents the Issuer or Recipient from complying with their obligations. This encompasses outages on the ASP side as well as failures in the business's own integration with the ASP. The notification obligation runs regardless of where the failure originates — the business must notify the FTA through the Authority's designated mechanism within the 2 Business Day window.
Violation 5 — Failure by the Recipient to Notify the FTA of a System Failure
The same AED 1,000 per day penalty applies to the Recipient's failure to notify the FTA of a System Failure within 2 Business Days. This is a separate penalty stream from the Issuer's obligation. In a bilateral business transaction, both the supplier and the customer have independent system failure notification obligations and face independent penalties for failure.
Violation 6 — Failure to Notify the ASP of Changes to Registered Data
Article 5(3) of MD 243 requires the Issuer and Recipient to notify their appointed ASP in writing of any change to data registered with the FTA within 5 Business Days of receiving confirmation of the amendment from the Authority. CD 106 imposes a penalty of AED 1,000 per day of delay. Changes to registered data include legal entity name changes, TIN amendments, address updates, and trade license renewals — all the data points the FTA holds against the business's EmaraTax registration.
What CD 106 Does Not Cover
Article 2(2) of CD 106 explicitly excludes from the penalty framework any Person who issues, transmits, shares, exchanges, or reports Electronic Invoices and Electronic Credit Notes on a voluntary basis. This means the administrative penalties apply only from the mandatory implementation date. Businesses that voluntarily implement before their mandatory date — which has been possible since 1 July 2026 — are protected from penalties during the voluntary period, even if they make technical errors in that period.
This is a significant incentive for voluntary early implementation. A Phase 1 business that onboards with an ASP and begins live electronic invoicing before 1 January 2027 can learn from errors, fix integration issues, and establish operational processes without penalty exposure. The same errors made on or after 1 January 2027 attract the CD 106 penalty schedule.
The Penalty Accumulation Arithmetic
The multiple independent penalty streams in CD 106 can accumulate simultaneously. A Phase 1 business that misses the ASP appointment deadline, then misses the 14-day issuance obligation on a portion of invoices and credit notes, and fails to notify the FTA of a system failure, faces three independent penalty streams running in parallel. The total exposure is the sum of all applicable penalties — there is no overall annual cap or aggregation mechanism that limits combined exposure.
Practitioner Insight: The AED 5,000 monthly caps on the per-invoice and per-credit-note penalties create a misleading impression of bounded risk. They cap the per-document penalty streams, but the system failure notification penalty is uncapped, the ASP appointment delay penalty accumulates monthly without a ceiling, and all streams run independently. A business that experiences a 2-week system outage post-go-live, fails to notify the FTA within 2 Business Days, and has an outstanding ASP appointment delay can face AED 50,000 or more in a single month from those two streams alone.
Interest Under the VAT Decree-Law
CD 106 addresses administrative penalties. Separately, Article 69 of the VAT Decree-Law applies to errors in VAT reporting — including where incorrect tax amounts appear on invoices due to exchange rate errors or other calculation failures. Interest accrues at the Central Bank of the UAE's current rate on underpaid VAT. For multi-currency businesses that fail to implement the BTAE-04 Central Bank exchange rate field correctly, resulting in AED-equivalent amounts that misstate the VAT position, Article 69 interest is a separate exposure layered on top of the CD 106 administrative penalties.
Planning Compliance Against the Penalty Framework
The penalty framework is not the motivation for compliance — that motivation comes from operational necessity and legal obligation. But for programme sponsors seeking board-level approval for e-invoicing investment, the penalty arithmetic provides a quantified risk baseline. The cost of non-compliance, modelled against a business's transaction volumes and likely delay scenarios, typically dwarfs the cost of structured compliance programme delivery.
For GCC, UK, EU, and Indian multinationals with UAE operations, the penalty exposure sits at the UAE entity level. The parent company's e-invoicing compliance in its home jurisdiction does not transfer to UAE entities. Each UAE entity in Phase 1 faces the CD 106 penalty framework independently from its mandatory go-live date, and each entity's compliance programme must be resourced and managed accordingly.