UAE e-invoicing provider accreditation: what the applicant must own
What UAE ASP accreditation requires, what third-party technology can cover, and why a connector or white-label agreement is not accreditation.
A working invoice connector and an accredited service provider are different things. One moves data from your business software. The other takes on the regulated provider role, with eligibility, testing and continuing responsibilities attached to a specific legal entity.
For a business buying software, the practical question is who holds that role. For a technology company considering its own application, the question is what it must own even when another company supplies the platform.
Rules checked: 30 September 2026. This is an informational explanation, not legal advice or an accreditation assessment. No Nesaku accreditation, applicant eligibility or tested provider product is claimed. Confirm your proposed arrangement with the Ministry of Finance (MoF), OpenPeppol and qualified advisers before committing.
Start with the amended rules
Ministerial Decision 64 of 2025, consolidated with Decision 56 of 2026, is the starting point. The amendment took effect on 1 May 2026. It permits third-party products and outsourcing, while retaining responsibility with the applicant.
The MoF service page still describes the older applicant-experience wording. Do not read that paragraph as overriding amended Articles 5 and 5(bis). Likewise, the applicant should not use the original 2025 decision alone.
Outsource technology, not applicant identity
Under amended Article 5, the applicant must itself be an active Peppol-certified service provider that has successfully completed OpenPeppol conformance tests. It may use a third-party-owned PSP Product and outsource development, operation, management or elements of its service. It remains fully responsible for eligibility and oversight. Source: amended Article 5.
Article 5(bis) requires the product through which services will be delivered to have operated for at least two years. Relevant operating or management experience can belong to the applicant or its third-party partner, supported by documents required by MoF. This is not simply a two-year minimum incorporation age for the applicant. Acceptance of the actual evidence remains MoF’s decision. Source: Article 5(bis).
That flexibility does not establish a right to borrow another provider’s accreditation. Article 14 requires the production PKI certificate issued to the service provider. Obtain written acceptance of the proposed applicant, member and certificate identities. A possible ministerial waiver under Article 5 is not an automatic exemption.
Build an evidence pack, not a slide deck
The following checklist summarises Articles 6–11 and Schedule 1. Keep an evidence owner and unresolved-question column beside it in your application worksheet.
| Area | Requirement to establish |
|---|---|
| Entity | UAE-incorporated juridical entity, or foreign juridical entity licensed to conduct business in the UAE |
| Capital | Paid-up capital equivalent to at least AED 50,000, with the prescribed evidence |
| Accounts | Most recent Financial Year’s audited statements where available; statutory fallback runs from that year’s end |
| Continuity | ISO 22301 certification, with the specified fallback if unavailable at application |
| Tax | Corporate Tax registration and VAT registration where mandatory |
| Product security | MFA, encryption in transit and at rest, regular monitoring and valid ISO/IEC 27001 certification for the PSP Product |
| Network and formats | Continuing Peppol status, interoperability-framework compliance, UAE authority-specific requirements and PINT AE or related specifications |
| Declaration | Prescribed self-declaration, authorised signatory evidence, confidentiality and other commitments |
The accounts fallback is six months following the end of the most recent Financial Year. The ISO 22301 fallback is three months following that year’s end. These are not general six- or three-month grace periods beginning on application. Resolve unavailable evidence and potentially expired fallback dates with MoF rather than assuming a fresh extension. Source: Article 6.
For ISO/IEC 27001, Article 9 refers to the PSP Product. Ask whether the certification scope covers the actual product and outsourced components. A group-company certificate for unrelated activity is not evidence of that coverage.
Article 9 also preserves end-user-specific hosting, storage, archival and residency requirements. Do not treat ASP eligibility as blanket approval for every customer’s deployment. The records and provider-exit guide explains the legislation-versus-guidance storage-location conflict and why the proposed arrangement needs written clarification.
Insurance amounts are coverage, not premiums
Article 11 requires policies issued by an insurer operating in the UAE, with these minimum total liability coverages:
| Category | Minimum coverage |
|---|---|
| Professional indemnity | AED 2,500,000 |
| Crime | AED 5,000,000 |
| Cyber fraud | AED 5,000,000 |
These are not quoted annual premiums, capital requirements or evidence that every customer loss or tax penalty is insured. Premiums, exclusions, deductibles and contractual liability need separate review.
Price the free entitlement accurately
Article 10 and Schedule 1 require a commitment to 100 free eInvoice exchange and reporting services per annum, commencing on signature of the End-User agreement.
Do not advertise that as unlimited free invoicing, free implementation or a free archive. Confirm how the agreement counts directions, credit notes and failed attempts, and what happens when the entitlement is used. The statutory commitment does not answer every commercial counting question.
Review is only one part of the process
Articles 12–16 describe several stages:
- MoF reviews the application and issues a decision or requests further information within 90 Business Days of receipt. A further-information request has a separate decision window after the information is received.
- Pre-approval testing covers invoice and credit-note interoperability and FTA end-user verification and onboarding.
- Production certificate and access steps include the OpenPeppol production PKI certificate, EmaraTax production end-user verification API and production trials.
- Pre-approval follows those stages. Remaining accreditation testing must be completed within MoF’s determined timeline.
- Final accreditation requires Tax Data reporting testing, OpenPeppol testing and a joint FTA production operational-readiness trial. MoF grants accreditation and publishes the provider’s details after successful completion.
Pre-approval is not final accreditation. Article 4 conditionally permits service under pre-approval, tied to obtaining accreditation within the specified timeline; it does not permit indefinite operation while assessment remains unfinished.
The MoF service page lists no fees and 90 working days. That does not make the statutory review window a guaranteed end-to-end launch date. Network membership, certification, audits, insurance and operational costs remain separate. Obtain a current sequencing plan from MoF rather than scheduling production solely from that service-page number.
Accreditation creates continuing work
Accreditation is valid for two years from grant. Renewal must be applied for no later than 70 Business Days before expiry, with evidence of continued eligibility, enforceable insurance, product security and relevant environment changes. MoF can request information during ongoing evaluation. Source: Articles 16–18.
Assign owners for renewal, certifications, policy renewals, product changes, outsourced-provider oversight and customer handover. Those duties continue after the announcement and sales launch.
What a customer should check
Check the exact contracting entity and current status in the MoF provider register. Its accredited and final-assessment sections are distinct. A Peppol badge, a reseller agreement or a connector demonstration does not establish final UAE ASP accreditation.
If an integrator supports another company’s accredited service, ask who the customer formally appoints and which party handles regulated exchange and reporting. Put integration, incident response and archive responsibilities in writing using the ASP contract questions.
Nesaku’s role in this article is systems judgment, not accreditation services. If you need to understand how a provider proposal fits your accounting software and operating responsibilities, discuss a systems review with us. The readiness guide is the starting point for business-side preparation.
Primary sources
Checked 30 September 2026. The FTA English consolidation is expressly an unofficial translation. Use authoritative text and qualified advice for legal reliance.
- FTA Decision 64 of 2025, consolidated with Decision 56 of 2026, Articles 3–18 and Schedule 1.
- MoF Decision 56 of 2026, amendment permitting third-party products and qualifying partner experience.
- MoF accreditation service, application materials, fee and stated service duration; experience wording must be read against the amendment.
- MoF accredited provider register, current legal-entity and status check.