Large UAE businesses with annual revenues of AED 50 million or more have until 30 October 2026 to appoint an Accredited Service Provider (ASP), and e-invoicing officially goes live for them on 1 January 2027. For banks, insurers, fintechs and other regulated firms, choosing a provider raises a question most businesses do not ask: UAE data sovereignty.
Accreditation is a baseline, not a sign-off
An ASP is: Peppol-certified, holds ISO 27001 and ISO 22301, encrypts data, and has at least two years of e-invoicing experience. It is crucial to note that accreditation is granted to the provider, it is not assessed against your obligations to the Central Bank of the UAE (CBUAE), the DFSA, the FSRA or VARA. The Ministry's own criteria say ASPs must meet each client's regulatory requirements on hosting, storage, archiving and residency. Checking that they do is your job.
For banks, the CBUAE's Outsourcing Regulation is explicit. The Master System of Record, including all Confidential Data, must be kept in the UAE, and customer data can't leave the country without Central Bank approval and the customer's written consent (Articles 6.1 and 6.3). Invoices carry customer names, TRNs and transaction values, so “they are accredited” will not satisfy a supervisor.
Data residency vs data sovereignty: what is the difference?
Data residency is where data is stored. An ASP with its main database in a UAE cloud region can honestly say your data is hosted in the UAE. Data sovereignty covers everywhere the data travels and everyone who can reach it.
Follow a single invoice. It leaves your ERP through an integration layer, gets validated, goes out through a Peppol access point and is reported to the Federal Tax Authority. Along the way it is logged, backed up, copied to a disaster recovery site and sometimes viewed by a support engineer. Each of those steps happens somewhere, and not always in the UAE.
7 questions to ask any e-invoicing ASP
Put these questions to any provider you are considering, or the one you have already appointed, and ask for the answers in writing. You will need them if your regulator asks.
1. Where does data go between our ERP and your platform?
Ask where integration services run, where data is mapped and where failed invoices wait to be retried. A retry queue in another region is still your data in another region.
2. Who runs your Peppol access point (AP) and Service Metadata Publisher (SMP), and where?
Accredited ASPs must be Peppol-certified, but the access point ( AP ) and Service Meta Publisher ( SMP ) can be run by a partner or hosted elsewhere. Ask where messages, logs and private keys are held.
3. Where are your backups and disaster recovery site?
Every accredited ASP holds ISO 22301, so there's a continuity plan. The question is where it points. Production in the UAE with backups or DR abroad is a common set-up.
4. Who can access production systems and logs, and from where?
Support teams are often spread across several countries. Ask who has access, from where, and whether it's approved and recorded. Logs can hold invoice details and TRNs too.
5. Who controls the encryption keys?
Ask where keys are stored and in which region, who can administer them.
6. Who are your subprocessors?
Ask for the full register, covering cloud, monitoring, backup, Peppol infrastructure and any OCR or AI tools that read invoice data, with what each one sees and where it's hosted.
7. Where is our archive, and how do we get it back?
E-invoices must be kept for the statutory retention period. Ask where the archive lives and what happens to your data if you switch provider.
Ask for evidence, not assurances
From a third-party risk management point of view, regulators expect you to show you have assessed critical providers yourself. A “UAE-hosted” line in a sales deck will not carry much weight. Ask for:
- Architecture diagrams and data flow maps
- Production, backup and disaster recovery locations
- The subprocessor register
- Access and support access controls
- ISO 27001 and ISO 22301 certificates whose scope covers the service you're buying
A good ASP will share these without fuss. One that hesitates is telling you something.
The bottom line
An accredited ASP is a requirement, not the whole answer. If you have already signed, ask these questions anyway. There is still time before 1 January 2027 to close gaps and, if needed, seek the Central Bank's non-objection. What matters is being able to show your regulator where your e-invoicing data goes, who can see it and how it's protected.
Frequently asked questions (FAQs)
What is data sovereignty in UAE e-invoicing?
It is where your e-invoicing data is processed, stored, backed up and accessed, by whom, and under which country's laws. Data residency only covers where it's stored.
Does Ministry of Finance accreditation mean an ASP meets CBUAE requirements?
Not on its own. Accreditation is not assessed against your CBUAE, DFSA, FSRA or VARA obligations, so regulated firms still need their own due diligence.
Do UAE banks need an e-invoicing ASP?
In most cases, yes. Exempt and zero-rated financial services are excluded from the mandate, but VAT-able fees and incoming supplier invoices aren't. Businesses with revenue of AED 50 million or more must appoint an ASP by 30 October 2026.
