UAE

In the United Arab Emirates (the “UAE”), the laws relating to anti-corruption, bribery and money laundering are established in a variety of, sometimes overlapping, federal and individual Emirate laws.

At a federal level, the UAE ratified the United Nations Convention against Corruption pursuant to Federal Decree No. 8 2006.  More recently, the UAE introduced the New UAE Federal Penal Code (Federal Law No 31 of 2021, as amended by Federal Decree-Law No. 36 of 2022) (the “Penal Code”), which amended the previous laws to cover bribery of foreign officials and officials of public international organizations. In this regard, bribery is a crime in the UAE pursuant to Articles 275 to 287 of the Penal Code.

There are also laws specifically addressing anti-corruption, such as (Federal Decree-Law No. 11 of 2008 (the "Human Resources Law") as amended by Federal Decree-Law No. 17 of 2016), which applies to public sector employees working at federal authorities or corporations and/or earning their salaries from the federal budget and is designed to combat bribery.

Money laundering offences are governed by Federal Decree-Law No. 20 of 2018 (the "Anti-Money Laundering Law", as amended by Federal Decree-Law Nos. 1 of 2020 and 26 of 2021). The Anti-Money Laundering Law sets out monitoring and due diligence measures to be undertaken by licensed financial institutions, banks, insurance companies and so-called "designated non-financial businesses and professions" ("DNFBPs") (which are businesses that are more likely to encounter money-laundering, such as real estate agents, dealers in precious metals and stones, and legal practitioners).

Federal laws are supplemented by laws and authorities in individual Emirates.  For example, in Dubai the Dubai Financial Fraud Law (No. 37 of 2009) legislates the recovery of illegally obtained public and private funds.  Similarly, an anti-corruption unit (the Abu Dhabi Accountability Authority, or ADAA) was established in Abu Dhabi in 2015, tasked with combatting corruption in public sector bodies.

a) Employee representative bodies, such as a works council or union.

b) Data protection officer or data privacy authority.

c) Other local authorities.

What are the consequences of non-compliance?

The UAE has not introduced any laws or regulations governing internal investigations in the private sector. Therefore, there is no specific requirement for employees or representative bodies to be informed of, or participate in, internal investigations. The Human Resources Law and its Executive Regulations (issued by Cabinet Resolution No. 1 of 2018) prescribe some rules for internal investigations in relation to governmental employees, which could be used as a guide for the private sector.

At the time of writing, the UAE Data Office, which will act as the UAE's data protection regulatory authority, is in the process of being established.  As such, there is presently no requirement to inform the Data Office that an internal investigation will commence and/or to enable its participation.  Instead, the question of whether other local authorities must be informed of the investigation is dependent upon the nature of the acts giving rise to the investigation.  For example:

• Under Article 323 of the Penal Code, every individual is under a duty to inform the authorities of a crime of which they are aware.  Failure to do so can result in imprisonment of up to a year or a fine.  Exemptions apply for spouses and immediate family.
• The above requirement is reinforced by Article 94 of Executive Regulations for the Human Resources (which applies in the public sector only), pursuant to which the public prosecutor must be notified if the violation committed by an employee amounts to a criminal act.
• Licensed financial institutions must report any transactions they consider suspicious without delay to the UAE Financial Intelligence Unit, regardless of the amount in question.
• Under Dubai Law No. 4 of 2016 on Financial Crimes, the Dubai Centre for Economic Security must also be notified if the violation committed is considered a financial crime.

There is no legal obligation under UAE law for employees to support internal investigations.

However, Article 39 of Federal Decree-Law No. 33 of 2021 (the "Labor Law") provides that the employer or its representative may impose disciplinary sanctions on an employee who violates the provisions of the Labor Law and the employment agreement. Therefore, if the requirement to support internal investigations is contained within the employment contract, the employer will have the right to take disciplinary action for a refusal to cooperate.  It is important that an employer follows disciplinary procedures properly before imposing any disciplinary action.  This includes notifying the employee about the nature of the disciplinary penalty and the reasons for imposing the same, hearing any defence raised by the employee, and adhering strictly to the time limits set out in the Labor Law.

Article 24 of the Labor Law’s Executive Regulations issued by Cabinet Decision No. 1 of 2022 (the "Labor Law Regulations") provides that the extent of any such disciplinary sanction should be based on the following criteria:

1. The extent of breach of confidentiality of data and information related to work;
2. The impact of the violation on the health and safety of employees;
3. The financial impact of the violation;
4. The effect of the violation on the reputation of the employer and its employees as a result of committing the violation;
5. The exploitation of authority entrusted to the employee;
6. Whether the violation is repetitive; and
7. The existence of a criminal or moral part in the committed violation.

No.

a) Conducting interviews?

b) Reviewing emails?

c) Collecting (electronic) documents and/or other information?

d) Analyzing accounting and/or other mere business databases?

The UAE Federal Decree-Law No. 45 of 2021 (the "Data Protection Law"), regarding personal data protection, applies to all kinds of personal data (being information that relates to an identifiable person, either directly or indirectly), that is processed or subject to operations using any electronic means, including collection, storage, recording, circulation, use and disclosure.  As the investigative actions set out above are all likely to involve personal data, the requirements of Data Protection Law should be carefully considered before an investigation is commenced.

As with data protection legislation in other jurisdictions, the data subject (i.e. the employee) must generally consent to their personal data being processed by the data processor (i.e. their employer) and such processing must only be for a legitimate purpose.  There are, however, some exemptions that will be relevant to the conduct of an investigation, such as for the protection of the public interest and/or if the processing is necessary for the employer to carry out their legal obligations.   The same exemptions apply in the case of the cross-border transfer of data, which is also permitted for the implementation of a procedure relating to international judicial cooperation.

At present, whistle-blower protection is not expressly adopted in UAE Federal Laws, although this may be an area for legislative development given the critical role whistleblowing can play in eliminating bribery, corruption and money-laundering practices.  There are, however, protections at an Emirate level and in specific free-zones.

Under Dubai Law No. 4 of 2016 on Financial Crimes (the “Law on Financial Crimes”), whistle-blower protection may apply if the information disclosed is true, relates to an activity that may affect the economic security of Dubai, and has been disclosed to the Dubai Centre for Economic Security (the "DESC").  

In these cases, the divulgence of such information shall not be treated as a violation.  Pursuant to Article 19 of the Law on Financial Crimes, the DESC shall provide the necessary protections for the informer, which includes protection at his/her place of residence and workplace, and not disclosing any information related to the informer’s identity or whereabouts.

In April 2022, in the Dubai International Financial Centre (the “DIFC”)  the Dubai Financial Services Authority (the “DFSA”) published its Whistleblowing Regime. This requires a DIFC-registered auditor, a DFSA Authorised Person (being an entity licensed to undertake financial services in the DIFC) or a Designated Non-Financial Business or Profession (including real estate developers, dealers in precious metals, law firms, accounting firms, company service providers or a single family office) to establish procedures for the reporting of regulatory concerns. Amendments to the DIFC Regulatory Law 2004 have provided protections to whistle-blowers when the good faith disclosure relates to a reasonable suspicion that the organisation has contravened any law or is engaged in a financial crime.

On 31 May 2025, the ADGM’s Whistleblower Protections Regulations came into effect.  The Regulations apply to all ADGM entities and require them to implement “appropriate and effective arrangements” to facilitate the making of a report and to protect the whistleblower’s identity.  The Regulations do not prescribe precisely what arrangements should be implemented and/or how but require them to be “proportionate to the size and complexity of its business and operations” and, in most cases, set out in written policies and procedures.  As a matter of practically, ADGM entities should ensure that they implement and maintain a clear and concise whistleblowing policy, which emphasises confidentiality for reports and non-retaliation for reporting.  Such policy should be well-communicated throughout the business, so it may need to be disseminated in several languages (for example, Arabic and English), and for larger entities, training on the policy may be appropriate.

Similarly, Article 284 of the Penal Code appears to provide complete protection for bribery offences if the whistle-blower makes a report to the relevant judicial or administrative authorities before the crime is discovered.

1. Receive written instructions?
   
   Yes, in accordance with Article 24(3) of the Labor Law Regulations.
2. Be informed that he/she must not make statements that would mean any kind of self-incrimination?
   
   There is no specific requirement in UAE law.
3. Be informed that the lawyer attending the interview is the lawyer for the company and not the lawyer for the interviewee (so-called Upjohn warning)?
   
   There is no specific requirement in UAE law.
4. Be informed that they have the right to have their lawyer attend?
   
   There is no specific requirement in UAE law.
5. Be informed that they have the right to have a representative from the works council (or other employee representative body) attend?
   
   There is no specific requirement in UAE law.
6. Be informed that data may be transferred across borders (in particular to the United States of America)?
   
   Yes, in accordance with the Data Protection Law (noting that consent should be issued in writing).
7. Sign a data privacy waiver?
   
   Yes, pursuant to the Data Protection Law , consent is required for processing personal data, which may include emails including the employee's name, their ID card number, their employee number, or their image on CCTV.  Such consent should be made by a written statement or electronically (if possible), and should be clear, simple, unambiguous, and easily accessible.
8. Be informed that the information gathered might be passed on to third parties, including local or foreign authorities?
   
   There is no specific requirement in UAE law.
9. Be informed that written notes will be taken?
   
   Yes, pursuant to Article 24(3) of the Labor Law Regulations.

Disclosure or discovery is not a standard procedure in legal proceedings in the UAE.  Therefore document-retention notices are not issued as a matter of common practice and there are no mandatory requirements for such notices.

Pursuant to the Advocates Law (issued by Federal Decree-Law No. 23 of 1991), and the Code of Ethics and Professional Conduct of the Legal Profession (issued by the Ministry of Justice Ministerial Resolution No. 666 of 2015), attorney-client privilege shall cover all communications made in furtherance of professional representation of a client, and cannot be disclosed unless there is written consent, a court order, or the attorney was accused of a criminal charge, a civil claim, negligence, or professional malpractice. Court orders compelling such disclosure are unlikely in practice.

There is no distinction between different types of information communicated by the client or a third party, which includes findings of internal investigations.  

All lawyers are bound by attorney-client privilege, including in-house counsel.

1. To insurance companies (D&O insurance, etc.) to avoid losing insurance coverage.
   
   There is no specific law or regulation requiring notification to insurers. In this regard, any notification requirements will be set out in the specific insurance agreement.
2. To business partners (e.g., banks and creditors).
   
   There is no specific law or regulation requiring notification to business partners.
3. To shareholders.
   
   There is no specific law or regulation requiring notification to shareholders.
4. To authorities.
   
   

   As set out above, if the investigation involves a potential crime, the police in the relevant Emirate should be notified.  If the individual concerned is a public sector employee, a report should also be made to the public prosecutor.  

   Similarly, licensed financial institutions should report any suspicious transactions to the UAE Financial Intelligence Unit.  Any financial crimes occurring in Dubai should be notified to the DESC.

N/A

Licensed financial institutions, banks, insurance companies and DNFBPs are under an obligation to self-report suspicious transactions to the UAE Financial Intelligence Unit.  Employers operating in these sectors should therefore pay particular attention to the requirements of the Anti-Money Laundering Law.  

For businesses operating in other sectors, there is no general duty to self-report in the UAE.  However, Article 66 of the Penal Code provides that companies are responsible for any criminal act committed on their account or in their name by their representatives, directors, agents, and employees. Self-reporting the misconduct may help to avoid or reduce the liability of the company (as for example, in the case of bribery offences).  

This does not happen in practice and is unlikely, unless the investigation is related to a criminal matter.

In order to carry out a dawn raid, the police in the UAE would typically need to obtain a search warrant from the local court, evidencing a potential crime. This is ordinarily obtained in coordination with officials at the local Emirate authority – for example the economic department or other department that has issued the company in question its trade licence. It is possible for a search to be carried out without a warrant in place if there is strong evidence that the suspected crime is continuing and that relevant material is on the premises. 

As above, self-disclosure can in certain instances help avoid or mitigate liability – for example in the case of bribery offences. In order to benefit from this protection, the self-disclosure must occur before the crime is discovered by the authorities.

There is nothing specific in UAE law. However, the UAE Criminal Procedure Law allows the victim and the accused to settle a criminal case, and this is allowed at any stage of the criminal case or investigation.

Additionally, the prosecutor may offer the parties the chance to settle their case, and grant them 15 days to reach a settlement before referring the case to the criminal court to proceed with the criminal charge. The prosecutor may extend the grace period once, if needed.

Article 66 of the Penal Code stipulates that companies are responsible for any criminal act committed on their account or in their name by their representatives, directors, agents, and employees, and should be sanctioned with the appropriate penalties. The company may, therefore, be liable for a fine  not exceeding AED 5 million and/or confiscation of relevant goods or materials. A penalty being imposed on the company does not prevent personal prosecution of any individuals involved, or prohibit the harmed or injured party from making a civil claim.

These factors would be considered as mitigating circumstances when determining what level of penalty to impose, but do not provide an automatic reduction or suspension of the potential penalty. 

Over the last few years, the UAE has been making a concerted effort to demonstrate to the international community that it takes financial crime seriously, and that it is taking active steps to create a robust environment.  In March 2022, the UAE was placed on the Financial Action Task Force’s (the “FATF”) ‘grey’ list due to concerns over the effectiveness of its anti-money laundering and counter-terrorism financing regimes. The European Union also added the UAE to its watchlist in late 2022. 

As a result, the UAE is subject to greater monitoring from the FATF and is required to take steps to improve the robustness of its anti-money laundering measures, identification of suspicious transactions and management of financial risk. Consequently, the UAE continues to strive to demonstrate that it is taking financial crime seriously, and in particular to investigate and prosecute relevant offences.  It can therefore be expected that there may be an increase in high-value and high-profile cases of this type in the coming years as the UAE continues to improve its monitoring and enforcement activity.