The Federal Tax Authority has issued Decision No. 4 of 2026 (issued 2 June 2026, effective 30 July 2026), setting the rules and requirements for maintaining the information contained in accounting records and commercial books under the Tax Procedures Law. Its practical message is welcome: businesses may keep their tax records as Electronic Copies or Photocopies — the paperless office is officially sanctioned — but only where the copies meet prescribed standards of completeness, legibility, and accessibility. And buried in the accessibility rules is the clause that deserves every IT department’s attention: where records are encrypted or password-protected, the encryption keys and passwords must be provided to the FTA on request.
Effective date: The Decision took effect on 30 July 2026. It supplements — it does not replace — the record-keeping and retention obligations in the Tax Procedures Law and its Executive Regulation, so retention periods and the list of records to keep are unchanged; this Decision governs the form and quality in which they are kept.
The three rules (Article 2)
Records and commercial books must be: complete and identical to the originals; clear and easily legible; and accessible to the Authority on request — including access to the system in which they are saved. That last phrase is broader than handing over PDFs: it contemplates the FTA reaching the accounting system, DMS, or archive platform itself.
The standards in detail (Article 3)
Completeness
An Electronic Copy or Photocopy must be an identical copy of the original, including all pages in the original order, and partial scanning of any part of a document is expressly not accepted. The habit of scanning only the signature page of a contract, or the first page of a multi-page invoice, now fails the standard outright.
Legibility and durability
Copies must be of sufficient quality and resolution to be clear and easily legible on a computer screen. For physical photocopies, ink and paper must not fade over the retention period — thermal-paper copies that blank out in three years are a compliance failure, not bad luck. Helpfully, a black-and-white copy of a coloured original is acceptable, provided everything remains clearly legible.
Accessibility
Where electronic records or the systems holding them are protected by encryption or passwords, the keys and passwords must be provided to enable FTA access; and physical photocopies must be accessible including their storage locations. Businesses using strong encryption or offshore cloud archiving should confirm now that access can actually be produced on demand — “our provider can’t extract it” will not be an answer. The same access logic sits behind the FTA’s broader audit and information-request powers, so businesses should read this Decision alongside their audit-readiness position rather than in isolation.
Outsourcing is fine — liability is not transferable (Article 4)
A Person may engage a third party — an accounting firm, a document-management provider, a cloud archive — to maintain the records. But the Person remains legally responsible for the records’ maintenance and safety. The practical consequence: outsourcing contracts should carry service levels on retrieval times, format, retention alignment with tax law, and cooperation on FTA access — because the penalties for a provider’s failure land on the taxpayer.
What this means in practice
Three quiet shifts are worth naming. First, originals can go: a business that scans to the Article 3 standard can, as a matter of tax law, run digital-first archives — though other laws (commercial, customs, contractual) may still require certain originals, so destruction policies should be cross-checked beyond tax. Second, scan quality is now a legal standard, not an admin preference: batch-scanning processes need a completeness check (all pages, right order) and a resolution floor. Third, system access is part of the record: password vaults, key escrow, and leaver processes (what happens when the finance manager who held the archive password resigns?) are now tax-compliance controls.
Action points
Businesses should: audit a sample of archived records against the completeness and legibility standards — especially multi-page contracts and older thermal-paper documents; set a scanning SOP (full document, original order, minimum resolution, screen-legibility check); document how FTA access would be provided — including who holds passwords and encryption keys, with escrow for key-person risk; review outsourcing and cloud contracts for retrieval, retention, and access-cooperation clauses; and align the digital archive with the statutory retention periods, which this Decision leaves untouched.
How TSAC can help
TSAC assists businesses with record-keeping compliance reviews, digitisation policies that satisfy both the Tax Procedures framework and this Decision, and readiness for FTA information requests — work that often sits alongside our audit services and VAT compliance engagements. The cheapest time to discover your archive fails the standard is before the FTA asks for it.
This publication is for general information only and does not constitute tax advice. Based on the unofficial English translation of FTA Decision No. 4 of 2026; the Arabic text prevails. Please contact TSAC for advice specific to your circumstances.