Validating a UAE WPS SIF File Before the Bank Does

The cost of a structural error changed on 1 June 2026. As the compliance changelog records it, “Ministerial Resolution No. 340 of 2026 came into force on 1 June 2026, repealing Ministerial Resolution No. 598 of 2022; wages for the preceding Gregorian month are due on the 1st and at least 85% of total wages must clear through WPS.” The dataset row behind that entry states the same rule in the operational form that matters here: “Wages due on the 1st of the following month; at least 85% of total wages must clear through WPS; the former 15-day grace period is abolished.”

With no grace period, there is no window in which a rejected file is merely an inconvenience. A file that bounces on the 1st and is corrected on the 3rd is a wage that cleared late, and the UAE penalties row describes enforcement that starts immediately: “escalating enforcement from day 1 (monitoring) to day 21 (asset attachment, travel bans, Public Prosecutor referral); work-permit suspension from day 5.”

That is the whole argument for validating locally. Both entries, with their authorities and verification dates, are on the compliance changelog; the underlying rows are in the wage-protection table. For the classes of failure that are not structural — wage-basis mismatches, timing errors, bank-side validation — see our taxonomy of WPS file rejections.

A SIF is a comma-separated text file with no header row, saved with a .sif extension. Three record types appear in it, one per line, and every line starts with its type (record-type).

EDR — one line per employee

The Employee Detail Record carries ten fields: the employee ID, the agent (employee's bank or exchange house) routing code, the account, the pay start and pay end dates, the days in the period, the fixed amount, the variable amount, and a tenth field. The employee ID is read two incompatible ways, because the guides do: Dubai Islamic Bank allows alphanumeric, 14 to 35 characters (edr-employee-id), while Emirates Islamic, Zoho and NOW Money describe a 14-digit zero-padded MOHRE person number (edr-employee-id-14-digits). Both are warnings, and both fire independently, so a 13-character id is reported twice. The account is checked as a 23-character UAE IBAN — AE followed by 21 digits (edr-iban-shape). Two further checks on the dates and day counts come from Dubai Islamic Bank alone and are warnings: the pay end date falls strictly after the pay start date (edr-end-after-start), and neither day count runs past four digits (edr-days-max-4).

EVP — optional, and it follows its EDR

The Employee Variable Pay record is optional. Where it appears it has ten fields — EVP, the employee ID, the routing code, then seven allowance amounts: housing, conveyance, medical, annual passage, overtime, other allowances and leave encashment (evp-field-count). It directly follows the EDR it belongs to (evp-follows-edr) and repeats that EDR's employee ID and routing code (evp-matches-edr). Only the two bank guides document the record at all — Zoho, HR Chronicle and NOW Money never mention it — so every EVP check rests on one source and reports as a warning. That includes the check behind Emirates Islamic's statement that the record is “mandatory only if variable amount is provided in the EDR”, which is why an EDR with a variable amount above zero and no EVP after it raises a warning rather than an error (evp-required-for-variable).

SCR — one summary record, on the last line

The Salary Control Record appears exactly once (scr-exactly-one). Four of the five guides read place it on the last line: Emirates Islamic, HR Chronicle and NOW Money state it — the first of them calls it the “mandatory summary record as the last line” — and Dubai Islamic Bank's sample file shows it there without stating a position. It carries the employer ID, the employer-bank routing code, the file creation date (YYYY-MM-DD), the creation time (HHMM, 24-hour), the salary month (MMYYYY), the record count, the total, the currency AED, and an optional tenth field — a free-text employer reference of at most 35 characters (scr-reference-length). Two cross-checks live here: the count equals the number of EDR lines, with EVP lines excluded (scr-count-equals-edrs), and the total equals the sum of all EDR fixed plus variable amounts, to the fils (scr-total-equals-sum).

The 25-character file name

The file name is a 13-digit employer ID followed by YYMMDD and hhmmss — 25 characters before the extension, which is matched case-insensitively (file-name-shape). It is not decoration: the name is cross-checked against the same values inside the SCR (file-name-matches-scr), so a file renamed by hand after generation trips that rule on its own. The cross-check is a warning, because one guide states it and states only half of it — Zoho's “The date and time in the filename must match the values inside the SCR record” — while the employer-ID half is derived from the naming convention rather than stated anywhere.

Each rule below cites the public guides it was read from, and the citation count sets the severity: a rule two or more opened sources state is eligible to be an error, a rule one source states — or one the sources contradict — is a warning, and a rule no opened source states does not exist in the package at all. Twenty are errors and sixteen are warnings. Each rule also carries the verbatim sentence or table cell behind every guide it cites, so any row here traces back to the text it was read from.

The warnings are the interesting column. They mark every place where the public record is thin or split — a fixed ID width that one bank guide contradicts, an SCR position that one vendor guide reverses, an EVP record three of the five guides never mention, day and date limits only Dubai Islamic Bank states. A warning means “your bank may or may not care about this”, and it is deliberately not an error.

Five public guides were opened for this work: two bank guides (Dubai Islamic Bank's WPS File Format Reference Guide v1.1 and the Emirates Islamic businessONLINE Salary WPS File Creation User Guide) and three vendor guides (Zoho Payroll Academy, HR Chronicle and NOW Money). They do not agree on four points.

1. Where the SCR goes

Emirates Islamic, HR Chronicle and NOW Money state that the SCR is the last line of the file; Dubai Islamic Bank's sample file places it last, though its guide never says so. Zoho's guide states that “the first line is always the SCR”, and ships a generator that emits the file that way. Four of the five guides read, including both bank guides, place the SCR last, so the validator treats last as correct — but it reports the position as a warning (scr-last) rather than failing the file, because the guide that disagrees is one a lot of payroll teams read and no regulator document could be opened to settle it.

2. The tenth SCR field

Dubai Islamic Bank calls the tenth SCR field a “Documentary Field” with a maximum size of 35; Emirates Islamic and NOW Money call it an optional reference, for employers that keep their own file identifier; Zoho lists no tenth field at all. No guide restricts the value. HR Chronicle's worked example ends the SCR with the literal string SAL, which is one possible reference rather than a payment type any guide requires. So the only check the sources support is the length cap — an optional free-text employer reference of at most 35 characters (scr-reference-length).

3. The tenth EDR field

Both bank guides say field 10 of the EDR is the number of days the employee spent on leave without pay in the period, written as 0 when there are none. Zoho describes the same position as “leave / reference, free text”. NOW Money names “days on leave” among the EDR contents, but its column walkthrough stops at column I and gives no format for the field. The validator follows the two bank guides and checks a whole number, 0 when there is no unpaid leave (edr-leave-days); the four-digit ceiling on that count comes from Dubai Islamic Bank alone, as a separate warning (edr-days-max-4). A text value in that position is the single most likely silent difference between a file that a generator produced and a file a bank expects.

4. The delimiter

Three guides name the comma: Emirates Islamic instructs you to save as “CSV (comma delimited)” and then rename to .SIF, Zoho calls the SIF “a comma-separated text file”, and HR Chronicle says “each field should be comma separated”. Dubai Islamic Bank's sample file is comma-separated but its guide never names the delimiter, and NOW Money never names it either. A search-result snippet claiming pipe-delimited files was never opened and is therefore not treated as a source. The validator defaults to commas, and offers a --pipe option for files a generator has already written that way; the rule is a warning (delimiter-comma), since it fires only where the delimiter has been overridden on purpose.

And a caveat that covers all four: how old these guides are

No source dated later than 2022 was available for the record layout itself. Dubai Islamic Bank's guide cites a 2015 Ministry of Labour corporate responsibility guide and its sample records are dated 2016; Emirates Islamic's worked examples are dated 2009 and 2016; HR Chronicle's example records are dated 2022. Zoho's page is dated 2026 but does not say which version of the layout it describes, and NOW Money states no vintage at all. The three regulator and bank pages that might have settled the question could not be opened on 13 September 2026: the MOHRE page redirected to a 404, the Central Bank of the UAE returned a 403, and Mashreq's host did not resolve. Read the layout here as the best public reading available, and confirm it with your own bank before a 2026 filing.

What an HR team should actually do

Ask your own bank. The bank's upload portal is the system that accepts or rejects the file, and where two public guides disagree, the only authority that resolves the disagreement for your file is the institution receiving it. Send them a sample file and ask three questions: does the SCR go first or last, what do you expect in the tenth EDR field, and do you require an EVP record whenever an EDR carries a variable amount. Record the answers next to your payroll runbook, because they determine which of the sixteen warnings above matter to you.

The rules above are implemented in an MIT-licensed Node package — the open-source validator linked from our UAE WPS payroll software page. It reads a local file and writes findings to standard output; it makes no network calls and sends the file nowhere.

The command

npx wps-sif-validate payroll.sif

For a file a generator has written with pipe separators:

npx wps-sif-validate export.sif --pipe

Reading the output

Output is one line per finding, then a one-line summary. Each finding names the line, the field, the rule id and what was found, so the fix is unambiguous:

ERROR line 2 field 4 [edr-iban-shape] IBAN "AE07033123456789012345" is not AE followed by 21 digits (22 characters)
ERROR line 4 field 8 [scr-total-equals-sum] SCR total is 17000.00 but EDR fixed + variable amounts sum to 17500.00

The exit status is 1 when there are errors, 0 otherwise, and 2 for a usage or read problem — which is what makes it usable as a gate in a payroll pipeline rather than only at a terminal. A summary line reports the counts: errors, warnings, EDR and EVP record counts, the SCR count and total, and the EDR sum.

Three classes of failure are invisible to any local validator, and it is worth being blunt about them because a clean run can otherwise read as a guarantee it is not.

Bank acceptance

Routing codes and identifiers are validated against the WPS master database on the bank side, and each bank's upload portal applies its own additional checks. A file that satisfies all 36 rules can still be rejected there. Nothing on this page changes that.

MOHRE registration status

Whether the establishment is registered, whether a given employee's labour card is active, and whether the employer is currently permitted to submit are facts held by MOHRE, not facts present in the file. A structurally perfect SIF for an employee who is not registered is still a rejected SIF.

The routing-code registry

The validator checks that a routing code is nine digits. It cannot check that those nine digits belong to a registered agent, because no public registry of routing codes was found to check against — so a well-formed code for an institution that is not a WPS agent passes the format check and fails at the bank.

And one disclaimer that is not boilerplate

The package is not affiliated with, endorsed by, or maintained on behalf of MOHRE, the Central Bank of the UAE, or any bank. Every rule cites the public guides it was read from, and those guides are dated; none of it is legal advice, and none of it substitutes for what your bank tells you. NeuralHR.AI generates the Salary Information File natively as part of the payroll run, which removes the hand-editing step where most structural errors are introduced — but the same three limits above apply to any generator.