Who can audit a bank, insurer or PJSC in the UAE?

Every audit firm in the UAE needs a professional licence from the Ministry of Economy under Federal Decree-Law No. 41 of 2023 on the Regulation of the Accounting and Auditing Profession, plus an economic licence from the emirate or free zone. For regulated and listed entities the law adds more gates:

1. Licence age. Article 15(2) says the firm appointed by banks, insurance companies, companies running investment funds for the benefit of third parties, and public joint stock companies to audit and review their financial statements must hold the Ministry licence, and must have held it for not less than five years.
2. SCA accreditation. Article 15(1) bars a firm from auditing or reviewing the financial statements of public joint stock companies and mutual funds unless it has Securities and Commodities Authority accreditation. SCA's board sets the accreditation conditions and charges.
3. Sector regulator approval. Article 246(5) of the Commercial Companies Law requires the auditor's name to be approved by the Central Bank for companies licensed by the Central Bank.

A firm can therefore be fully licensed for private company work and still be ineligible for a bank, insurer or listed client. Free zone approved lists are a separate question again; see approved auditors by free zone.

Article 245 of Federal Decree-Law No. 32 of 2021 sets the appointment process for a PJSC. The board nominates one or more auditors and the general assembly approves the appointment of an auditing company for one renewable year; the board cannot be delegated the appointment. The general assembly also fixes the fees, which must be shown in the accounts. On incorporation, the founders may appoint an SCA-approved firm to act until the first year's general assembly completes its work.

Article 246 lets SCA's board set the approval conditions, and lists minimum ones. The auditor must:

• be licensed to practise in the UAE with at least five years' experience auditing joint stock companies;
• be approved by SCA;
• not be a shareholder, board member or hold any technical, administrative or executive office in the company;
• not be a partner or agent of any founder or board member, or a relative of any of them up to the second degree;
• be approved by the Central Bank where the company is licensed by it;
• provide professional insurance to SCA when required.

If the general assembly fails to appoint an auditor at its annual meeting although the quorum is present, SCA may appoint one for a year and fix the fee (Article 194(2)).

Article 245(2) contains the UAE's statutory rotation rule for PJSCs:

• An auditing company may not audit the same PJSC for more than six consecutive financial years from when it took on the audit.
• The partner responsible for the audit must be changed after three financial years.
• The firm may be reappointed after at least two financial years have passed since its appointment ended.

Worked example: a firm first audits a PJSC for the year ended 31 December 2021. Its sixth consecutive year is 2026, so a different firm must audit 2027. The signing partner who handled 2021 to 2023 must hand over for 2024. The original firm could return for 2029 at the earliest, after 2027 and 2028 are audited by someone else.

Banks and finance companies also follow the Central Bank's own external audit rules in its rulebook, which include rotation provisions; we could not read the current rulebook text, so check it directly rather than assuming it matches Article 245. For background on rotation generally, see our audit firm rotation glossary entry.

For banks, the Central Bank is the gatekeeper. Article 246(5) requires its approval of the auditor's name for companies it licenses, and Article 15(2) of the profession law adds the five-year licence age. Insurance companies are covered by the same Article 15(2) rule. Oversight of the insurance sector moved to the Central Bank after its merger with the former Insurance Authority, and the current insurance law is Federal Decree-Law No. 48 of 2023, so insurers should expect the Central Bank approval step as well and check its rulebook for the detail.

Companies that run investment funds for third parties also fall within Article 15(2). Mutual funds additionally need an SCA-accredited auditor under Article 15(1).

Practical points when such an entity chooses an auditor:

1. Confirm the firm's Ministry licence date, not just that it is licensed today.
2. Confirm SCA accreditation where the entity is a PJSC or mutual fund.
3. Obtain the Central Bank approval before the appointment is finalised.
4. Check the independence restrictions in Article 17 of the profession law and Article 246 of the Companies Law.

A firm that does not meet every gate cannot sign the statutory report, however strong its private company practice.

Auditors of PJSCs carry duties beyond a private company audit. Under Article 251 of the Companies Law they must notify SCA within 10 days of detecting a violation of the law or a violation amounting to a crime; if they fail to, SCA can suspend them from PJSC audits for up to one year, cancel their accreditation or refer them to the Public Prosecution. Article 250 bars the auditor and its staff from trading the company's securities or advising anyone on them, on pain of dismissal. Article 252 requires the report to cover, among other things, related party transactions, any purchase of the company's own shares, and any violations and fines.

Listed companies also face SCA's internal control reporting rules, covered in our page on SCA internal control reports.

Under Article 21(5) of the profession law, SCA investigates its accredited firms for breaches while serving supervised companies and funds and may impose the law's disciplinary sanctions. These provisions were read from the Ministry of Economy's published texts; check uaelegislation.gov.ae and the Central Bank rulebook for later amendments.