An insurance company licensed onshore in the UAE is audited under a layered regime: annual financial statements under IFRS reviewed by an external auditor approved by the Central Bank of the UAE (CBUAE), a separate audit trail over anti-money-laundering controls, actuarial and internal-audit reporting — and, from revenue above AED 50 million, audited financial statements are a corporate tax requirement too.
TL;DR
- Federal Decree-Law No. 6 of 2025 — the Central Bank law — has governed onshore insurers since 16 September 2025.
- External auditors must be approved by the CBUAE; the auditor also reports on AML controls by 30 April each year.
- Insurance brokers must file audited financial statements within 90 days of financial year end.
- Insurers with revenue above AED 50 million must maintain audited financial statements for corporate tax.
- DIFC and ADGM insurers sit under the DFSA and FSRA, not the CBUAE regime.
Audit services for insurance companies in the UAE: what the 2026 rules require
Since 16 September 2025, the governing instrument is Federal Decree-Law No. 6 of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. It repealed the earlier Federal Decree-Law No. 48 of 2023 Regulating Insurance Activities (CBUAE Rulebook) and does not apply to the financial free zones — DIFC and ADGM insurers are regulated by the DFSA and FSRA respectively (CBUAE Rulebook, Article 2). Regulations and circulars issued under the earlier insurance laws continue in force until the CBUAE replaces them.
For an onshore insurer, the audit obligation is not one engagement but a set of them:
- Annual financial statements under IFRS, presented to the CBUAE together with the reports and e-forms the CBUAE's regulatory-reporting guide requires — the guide anchors these submissions to the provisions of Federal Law No. 6 of 2007 as amended and the regulations under it (CBUAE, Regulatory Reporting Guide).
- An external auditor approved by the CBUAE, whose work extends beyond the financial statements: for insurance-related professions and brokers the rulebook requires annual audits of financial statements and of systems and controls (CBUAE Rulebook, Article 11).
- An AML/CFT audit report: the external auditor's report on the effectiveness of internal controls against money laundering and terrorism financing is filed when the audited annual financial statements are submitted, and companies are asked to have auditors prepare and file the AML-compliance report to the regulator by 30 April of the following year (CBUAE, Regulatory Reporting Guide, Sixth section).
- Internal audit reporting: the annual internal audit report is submitted alongside the annual financial statements, in the CBUAE's e-form, covering scope, findings and recommendations (CBUAE, Regulatory Reporting Guide, Fifth section).
For insurance brokers specifically, the timing is fixed: audited final annual financial reports, accompanied by the external auditor's report, are due within ninety (90) days of the end of the financial year (CBUAE Rulebook, Insurance Brokers' Regulation, Article 13).
Step 1 — Appoint a CBUAE-approved external auditor
The auditor must be approved by the CBUAE, and approval matters for more than sign-off: an unapproved auditor's opinion can be rejected at submission, forcing a re-audit inside the filing window. Confirm the approval status at engagement letter stage, not in December.
- Verify the firm's CBUAE approval and the named signing partner's standing.
- Scope the engagement to the regulator's requirements, not only IFRS — the audit must support the regulatory submissions described above.
- Agree the timeline backwards from the submission deadline, leaving room for actuarial figures to close.
Step 2 — Understand what an insurance audit actually covers
An insurer's audit goes past the usual income-statement checks into the numbers that make insurance accounting different:
- Technical provisions and reserves — unearned premium and claims provisions are the balance sheet's core; auditors test the methods, data and reconciliation to the actuarial work.
- Premium adequacy and reinsurance — ceded reinsurance recoverables and the completeness of reinsurance agreements are tested against the contract file.
- Revenue recognition by product line — life versus non-life, takaful versus conventional, each with its own measurement model.
- AML/CFT controls — the separate auditor report covers suspicious transaction reporting, customer due diligence, record keeping and training, against Cabinet Resolution No. 10 of 2019 on the Executive Regulations of Federal Law No. 20 of 2018 (CBUAE, Regulatory Reporting Guide).
Step 3 — Build the reporting calendar around the audit
| Obligation | When | Source |
|---|---|---|
| Appoint CBUAE-approved external auditor | At the start of each financial year | CBUAE Rulebook, insurance framework |
| Audited annual financial statements (insurance brokers) | Within 90 days of financial year end | CBUAE Rulebook, Article 13 |
| Annual financial statements + internal audit report (insurers) | With the annual regulatory reporting cycle | CBUAE Regulatory Reporting Guide |
| External auditor AML/CFT report | With annual statements; file to regulator by 30 April of next year | Cabinet Resolution No. 10 of 2019 framework |
| Quarterly interim statements | Each quarter, per regulator-set periods | CBUAE Regulatory Reporting Guide |
| Corporate tax return | Within 9 months of financial year end | FTA, 2 September 2026 |
Step 4 — Keep the corporate tax audit requirement in view
Insurance companies are taxable persons under Federal Decree-Law No. 47 of 2022 like any other resident juridical person: registration, a Tax Return within nine months of financial year end, and records kept at least seven years (FTA, 2 September 2026; FTA, 27 August 2025). One threshold bites hardest here: a taxable person with revenue exceeding AED 50 million in the tax period must maintain audited financial statements, audited by a UAE-registered auditor (FTA — Determination of Taxable Income guide). Most licensed insurers will exceed AED 50 million in revenue, which makes the annual audit a corporate tax obligation as well as a regulatory one.
Common mistakes insurers make with audits
- Engaging an auditor without confirming CBUAE approval, then re-running the audit when the submission is queried.
- Treating the AML audit report as the internal audit team's job — it is the external auditor's report, and it has its own deadline.
- Leaving actuarial input to the last month; provisions work drives every other number in the statements.
- Filing DIFC- or ADGM-licensed entities under the CBUAE regime; the free-zone regulators' rules apply instead.
- Missing the corporate tax return because the regulatory audit ran late — the nine-month deadline does not shift.
Frequently asked questions
Which law governs insurance audits in the UAE in 2026?
Federal Decree-Law No. 6 of 2025, the Central Bank law, has governed onshore insurers since 16 September 2025. It repealed Federal Decree-Law No. 48 of 2023, and regulations issued under the earlier insurance laws remain in force until the CBUAE replaces them. DIFC and ADGM insurers are outside its scope.
Who can audit an insurance company in the UAE?
An external auditor approved by the Central Bank of the UAE. Approval is required for the audit to support the regulator's reporting, and the same auditor typically prepares the separate AML/CFT controls report.
When are audited financial statements due?
For insurance brokers, audited final annual financial reports with the external auditor's report are due within 90 days of the end of the financial year. Insurers file their annual financial statements and internal audit reports as part of the CBUAE's annual regulatory reporting cycle.
Does an insurer's auditor have AML responsibilities?
Yes. The external auditor reports on the effectiveness of internal controls against money laundering and terrorism financing, and companies are expected to have that report prepared and filed to the regulator by 30 April of the following year, alongside annual AML self-assessments.
Do insurance companies need audited financial statements for corporate tax?
Taxable persons with revenue exceeding AED 50 million in the tax period must maintain audited financial statements audited by a UAE-registered auditor. All corporate tax persons file within nine months of financial year end and keep records for seven years.
Do the same rules apply to DIFC and ADGM insurers?
No. Federal Decree-Law No. 6 of 2025 does not apply to the financial free zones; DFSA in Dubai and FSRA in Abu Dhabi regulate insurers there under their own audit and reporting frameworks.
One last thing
The audit calendar for an insurer fails at its dependency, not at its deadline: the actuarial figures close after the audit fieldwork has planned its samples. Lock the actuary's timetable in the same engagement letter as the auditor's, or the 90-day and annual cycles collide in the same quarter.
