UAE e-invoicing deadline creates data residency compliance layer for banks

UAE businesses with annual revenue of Dh50 million or more must appoint an Accredited Service Provider for e-invoicing by October 30, 2026, under the Ministry of Finance programme, with go-live set for January 1, 2027. The Ministry's accreditation criteria require providers to hold Peppol certification, ISO 27001 and ISO 22301 certification, encrypt data at rest and in transit, and demonstrate at least two years of e-invoicing system operation experience.

Accreditation leaves residency verification with client#

The Ministry's accreditation framework requires ASPs to meet each client's regulatory requirements on data hosting, storage, archiving and residency, but verification of compliance remains the client's responsibility. For banks and other regulated institutions, the Central Bank of the UAE's outsourcing regulation requires the master system of record, including confidential customer data, to be kept in the UAE, and customer data cannot be shared outside the country without Central Bank approval and the customer's written consent. Invoices carry customer names, tax registration numbers and transaction values, bringing them within the scope of those requirements.

Data flow extends beyond primary database location#

An invoice passes through an integration layer connected to the institution's ERP system, undergoes validation, routes through a Peppol access point to the customer's provider, and is reported to the Federal Tax Authority. Each step generates logs, backups, disaster recovery copies and support access events, each occurring at a location that may differ from the primary database. The Ministry's accreditation confirms a provider can operate securely within the UAE e-invoicing network but does not verify alignment with the Central Bank's data residency and outsourcing requirements.

Regulated institutions carry verification obligation#

Banks subject to Central Bank of the UAE, DFSA, FSRA or VARA oversight must verify that their appointed ASP's data handling, backup locations, disaster recovery site jurisdiction and support engineer access points align with their regulator's requirements. The October 30 appointment deadline requires institutions to complete that verification within the remaining period, documenting where invoice data is processed, backed up, monitored and accessed, and confirming that each location and access point meets the applicable regulatory standard.