The short version. Every provider in the accredited table has, on paper, met Articles 5, 8 and 10 of Decision 168: an ISO 22301 business-continuity certificate, an ISO/IEC 27001 certificate for the product, professional indemnity insurance of AED 2,500,000, crime insurance of AED 5,000,000 and cyber fraud insurance of AED 5,000,000. Asking for copies is not suspicion; it is checking something that already exists.
What the text requires exactly
| Requirement | Detail | Article |
|---|---|---|
| Business continuity | ISO 22301 certification; if not held at application, submitted within 3 months of the financial year end | 5 |
| Capital and accounts | Paid-up capital of at least AED 50,000, and audited financial statements for the latest year | 5 |
| Product security | Multi-factor authentication for users, encryption in transit and at rest, regular security monitoring, a valid ISO/IEC 27001 certificate for the product, and compliance with data hosting and residency requirements | 8 |
| Insurance | Professional indemnity ≥ AED 2.5 million · crime ≥ AED 5 million · cyber fraud ≥ AED 5 million, all with insurers operating in the UAE | 10 |
| At renewal | Proof that insurance continues and ISO 27001 is valid, and notice of any change to the product or business environment | 15 |
What to ask for, and how to read it
- The ISO 27001 certificate in the product's name. The text says "for the PSP Product", not for a parent company in another country. Read the scope on the certificate and the expiry date. In our directory, some providers cite ISO 27001 for the parent entity only; ask about scope.
- The ISO 22301 certificate. Same: name, scope and date.
- The three insurance certificates. Ask for the certificate of insurance, not the full policy; it names the insured, the aggregate limit and the expiry. Check the limits are "aggregate" at the figures above and the insurer operates in the UAE.
- Where is my data stored? Article 8 binds the provider to hosting and residency requirements without naming a country. Ask for the actual location of the data centres; some providers publish UAE hosting, visible in the "certifications" field on their directory page.
- Multi-factor authentication. Ask whether it is mandatory for every user or optional.
Why it matters even if you are not a large company
Your e-invoice carries your tax number, your customers' data and your amounts, passes through the provider's system and is stored there. Crime and cyber fraud insurance is what compensates you if someone breaches the provider's system and sends invoices in your name or changes a bank account on an invoice. The AED 5 million minimum for each is shared across all the provider's customers, so ask how many customers it has.
Read next
Accreditation expires after two yearsWhat happens to your invoices
Storage and retention rulesHow many years, and where
15 questions before you signThe quick list
Sources: Ministerial Decision No. 168 of 2026, Articles 5, 8, 10 and 15 (text on mof.gov.ae); the certification fields in the provider directory as read from providers' sites in October 2026.
This content is general information, not legal or insurance advice.