Planes rerouted after Iran's missile attack on Israel
Ten tax points to be aware of in 2026
1. Domestic VAT refund amendments: request your refund within five years
If a business does not apply for the refund on time, they lose their credit.
2. E-invoicing in the UAE
Businesses should continue preparing for the implementation of e-invoicing in the UAE, with 2026 a preparation and transition period ahead of phased mandatory adoption.
3. More tax audits
Tax authorities are increasingly using data already available across multiple filings to identify audit risks.
4. More beneficial VAT and excise tax penalty regime
Tax disputes are expected to become more frequent and more structured, with clearer administrative objection and appeal processes. The UAE has adopted a new penalty regime for VAT and excise disputes, which now mirrors the penalty regime for corporate tax.
5. Greater emphasis on statutory audit
There is a greater need for the accuracy of financial statements. The International Financial Reporting Standards standards need to be strictly adhered to and, as a result, the quality of the audits will need to increase.
6. Further transfer pricing enforcement
Transfer pricing enforcement, which refers to the practice of establishing prices for internal transactions between related entities, is expected to broaden in scope. The UAE will shortly open the possibility to negotiate advance pricing agreements, or essentially rulings for transfer pricing purposes.
7. Limited time periods for audits
Recent amendments also introduce a default five-year limitation period for tax audits and assessments, subject to specific statutory exceptions. While the standard audit and assessment period is five years, this may be extended to up to 15 years in cases involving fraud or tax evasion.
8. Pillar 2 implementation
Many multinational groups will begin to feel the practical effect of the Domestic Minimum Top-Up Tax (DMTT), the UAE's implementation of the OECD’s global minimum tax under Pillar 2. While the rules apply for financial years starting on or after January 1, 2025, it is 2026 that marks the transition to an operational phase.
9. Reduced compliance obligations for imported goods and services
Businesses that apply the reverse-charge mechanism for VAT purposes in the UAE may benefit from reduced compliance obligations.
10. Substance and CbC reporting focus
Tax authorities are expected to continue strengthening the enforcement of economic substance and Country-by-Country (CbC) reporting frameworks. In the UAE, these regimes are increasingly being used as risk-assessment tools, providing tax authorities with a comprehensive view of multinational groups’ global footprints and enabling them to assess whether profits are aligned with real economic activity.
Contributed by Thomas Vanhee and Hend Rashwan, Aurifer
SEMI-FINAL
Monterrey 1Â
Funes Mori (14)
Liverpool 2
Keita (11), Firmino (90 1)
The specs
Engine: 2.0-litre 4cyl turbo
Power: 261hp at 5,500rpm
Torque: 405Nm at 1,750-3,500rpm
Transmission: 9-speed auto
Fuel consumption: 6.9L/100km
On sale: Now
Price: From Dh117,059
Transgender report
Know your cyber adversaries
Cryptojacking: Compromises a device or network to mine cryptocurrencies without an organisation's knowledge.
Distributed denial-of-service: Floods systems, servers or networks with information, effectively blocking them.
Man-in-the-middle attack: Intercepts two-way communication to obtain information, spy on participants or alter the outcome.
Malware: Installs itself in a network when a user clicks on a compromised link or email attachment.
Phishing: Aims to secure personal information, such as passwords and credit card numbers.
Ransomware: Encrypts user data, denying access and demands a payment to decrypt it.
Spyware: Collects information without the user's knowledge, which is then passed on to bad actors.
Trojans: Create a backdoor into systems, which becomes a point of entry for an attack.
Viruses: Infect applications in a system and replicate themselves as they go, just like their biological counterparts.
Worms: Send copies of themselves to other users or contacts. They don't attack the system, but they overload it.
Zero-day exploit: Exploits a vulnerability in software before a fix is found.
