White-Collar Crime 2022 Comparisons

The UAE's Federal Penal Code is set out in Federal Law No 31 of 2021 (the Penal Code). The Penal Code came into force from 2 January 2022 and has replaced Federal Law No 3 of 1987.

Article 27 of the Penal Code provides three categories of offences: felonies, misdemeanours and contraventions (also known as violations). Each crime has a material and a mental element.

The material element of a crime consists of a criminal act committed or omitted in violation of a law forbidding or requiring it. The moral element of the crime consists of the intention or the error.

Intention exists when the offender’s will is to commit or omit an act which is legally considered a crime. The intention must be aimed at producing a direct effect, or any other effect, which the law deems criminal and which the offender expected to occur.

A person may also be held liable for attempting to commit an offence. An attempt is considered to mean an effort or endeavour to accomplish a crime, which has been prevented or has fallen short of the intended action, due to reasons beyond the offender’s will. It is the commission of an act which is deemed, in itself, a constituent part of the basic material element of the crime, or which entails such an element immediately and directly.

However, neither the intention to commit a crime, nor the preparation or planning for it, shall be considered an attempt unless the law stipulates otherwise.

Limitation periods in the UAE, the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) are contained in a variety of different laws and vary depending on the cause of action brought. 

Federal Law No 35 of 1992 (the Criminal Procedural Law), provides that, for criminal cases, the limitation period for felonies is 20 years, misdemeanours is five years and contraventions is one year starting from the date on which the crime was committed (Article 20).

There is no specific statute of limitations dealing with concealed and/or continuing offences. The Penal Code explicitly states that no time limitations shall apply to:

• crimes against the interests or security of the UAE (Articles 227 and 270 of the Penal Code); or
• crimes related to positions held in public office (ie, bribery) (Article 286), nor shall there be a time limit on any related civil action.

In general, a criminal offence will only occur in the UAE where it took place within the jurisdiction. However, in some cases there are specific provisions within the relevant legislation that enable the courts to exercise extraterritorial jurisdiction.

Offences with extraterritorial effect under the Penal Code include the following.

• Per Article 21 of the Penal Code:
1. crimes committed against the internal or external security of the State, or against its constitutional regime or its stocks and bonds issued under legal licence, or in connection with its stamps, or crimes of falsification or counterfeiting of its official documents or seals;
2. crimes of falsifications, counterfeiting or forgery of the State’s money, or putting such money into circulation or the possession thereof with the intention of putting it into circulation, no matter whether such acts are committed in or out of the State;
3. crimes of falsification, counterfeiting or forgery of coined or paper money which is legally in circulation in the State, or crimes of putting such coined or paper money into circulation in the State or the possession thereof with the intention of putting it into circulation; or
4. a deliberate murder committed against one of the citizens of the State.
• Per Article 22 of the Penal Code, whether committed as a perpetrator or an accomplice:
1. a crime involving the destruction or interruption of international means of communications;
2. drugs or human trafficking;
3. international piracy and terrorism; or
4. money laundering crimes.

The provisions of the Penal Code shall also apply outside of the UAE, to any person who commits a bribery offence if either the offender or victim is a UAE citizen, if the crime is committed by an employee in the UAE public or private sector or if it involves public property (Article 285).

Article 21 of Federal Law 2 of 2015 (the Companies Law) states that upon incorporation, a company shall “acquire a corporate personality”. Therefore, there is a corporate veil between the company and its shareholders and managers (although this can be pierced in certain situations).

Article 66 of the UAE Penal Code sets out the basis for corporate criminal liability in the UAE.

“Except for government bodies and official departments and public authorities and establishments, juristic persons shall be held criminally liable for the crimes committed by their representatives, directors, or agents acting on their behalf or in their names…”.

The effect of Article 66 of the Penal Code is that a company can be found guilty of any offence prescribed under the Penal Code committed by one of their representatives acting in favour or on behalf of them. However, the Dubai Court of Cassation has held that a company may not be held criminally responsible for its employee's actions if the employee in question was merely negligent, acted without intent or was not acting in the name of the company.

Managers of a company generally have a statutory duty of care. In the event that a manager does not fulfil their duty of care, the courts may hold the manager personally liable. For example, managers have been held liable for their actions if it is established that their acts resulted in a harm, they acted in breach of their obligations or their actions can be classified as gross misconduct or negligence. This can also include the abuse of a right or any other breach of the law, such as fraud. 

Previously, managers have been held personally liable for bounced cheques due to insufficient funds, which was considered a crime under Article 401 of Federal Law No 3 of 1987. However, the new Penal Code decriminalised the issuance of cheques with insufficient funds, barring a few noted exceptions. The beneficiary of a bounced cheque still has the right to pursue a civil claim, including the right to seize assets in the name of the drawer.

A victim of a crime may request that a claim for compensation be annexed to the criminal charges and considered by the Criminal Court, which would be determined when criminal liability has been established.

In practice, the Criminal Court will transfer the civil claim to the Civil Court upon conviction and sentence in accordance with Article 26 of the Criminal Procedural Law in order for the Civil Court to decide the quantum of damages (as the fact of the conviction allows the Civil Court to assume that liability has been established).

There is no class-action regime in the UAE. However, multiple victims could seek to have their claim for compensation heard by the Criminal Court, as noted above.

Alternatively, a victim of a white-collar offence can claim compensation for any loss though the Civil Courts. A claim for compensation for harm (which is similar to tort) would need to show three factors: that the act has been committed, damage has been sustained and there is causation between the act and the damage sustained.

A victim of a crime may request that a claim for compensation be annexed to the criminal charges and considered by the Criminal Court, which would be determined when criminal liability has been established.

In practice, the Criminal Court will transfer the civil claim to the Civil Court upon conviction and sentence in accordance with Article 26 of the Criminal Procedural Law in order for the Civil Court to decide the quantum of damages (as the fact of the conviction allows the Civil Court to assume that liability has been established).

There is no class-action regime in the UAE. However, multiple victims could seek to have their claim for compensation heard by the Criminal Court, as noted above.

Alternatively, a victim of a white-collar offence can claim compensation for any loss though the Civil Courts. A claim for compensation for harm (which is similar to tort) would need to show three factors:

• that the act has been committed;
• that damage has been sustained; and
• that there is causation between the act and the damage sustained.

In August 2022, it was announced that a subsidiary of Wise, the listed money transfer business, was fined USD360,000 by the financial services regulatory authority of the ADGM after a finding that Wise “did not establish and maintain adequate systems and controls to ensure full compliance” with anti-money laundering requirements. Breaches made by Wise Nuqud, a wholly-owned Abu Dhabi arm of the fintech firm, included the failure to:

• identify and verify the source of funds or wealth held by some customers it had identified as high risk before carrying out transactions on their behalf; and
• the failure to consider customer nationality as part of its risk-based assessment of its customers.

This sanction comes after Wise's billionaire co-founder and chief executive was put on a list of “deliberate tax defaulters”, and he is currently being investigated by the UK’s Financial Conduct Authority.

The process of prosecuting a company for a white-collar criminal offence is governed by the Criminal Procedural Law, as is the case for any other criminal prosecution in the UAE.

Article 7 of the Criminal Procedural Law gives the Public Prosecutor exclusive jurisdiction to initiate and oversee criminal proceedings.

The process is as follows.

• A complaint is either filed at the police station in the emirate where the crime is alleged to have occurred, or the Public Prosecutor uses its exclusive jurisdiction to file a criminal offence of its own motion.
• If the complaint has been filed with the police, the police will conduct an investigation into the alleged offence. The police have the power to interview the complainant and the accused and take statements from them both. The police can also interview and take a statement from other witnesses. All of the evidence is compiled into a matter file.
• The matter file is then referred to the Public Prosecutor, who will conduct an investigation, and may request the assistance of the Judicial Police (or investigating officers) to assist with gathering evidence in the investigation. For more serious offences, the Public Prosecutor's office may conduct the investigation itself.
• Following the investigation, the Public Prosecutor makes a decision on whether to refer the complaint to the competent court or to dismiss the complaint.
• The Public Prosecutor will consider all of the evidence in the matter file before deciding whether to issue an indictment order against the accused and refer the matter to court or to dismiss the complaint.
• The judicial police have the power to collect the necessary information and evidence for investigation and indictment of a criminal offence. In collecting evidence, the judicial police also have the power to interview the complainants, victims and accused and take statements. The judicial police can further engage the assistance of experts.

There are specialist departments within the police and Public Prosecutor’s office that deal with certain types of crime, such as financial crime, including bribery, money laundering, abuse of power, embezzlement and the misuse of funds and cybercrimes.

The Public Prosecutor can decide to conduct an investigation independently and will generally do so for more serious offences. There are no rules regarding the initiation of investigations that are specific to white-collar offences.

Article 70 of the Criminal Procedural Law provides that criminal investigations should be conducted in Arabic. The Public Prosecutor can order for translators to be present at all interviews and other relevant parts of an investigation.

If the Public Prosecutor determines that a crime has been committed, it can issue a summons, an arrest warrant and an order for arraignment of the accused (Article 101).

If the Public Prosecutor dismisses the allegation, the complainant can appeal the Public Prosecutor's decision within ten days of the Public Prosecutor's decision (Articles 133-134).

The Court of Appeal will hear the appeal and can conduct a complementary investigation. If the Court of Appeal finds there are sufficient grounds for the matter to be pursued, it will send the matter file back to the Public Prosecutor and order to refer it to the competent Criminal Court (Article 137).

The Public Prosecutor has broad powers when conducting a criminal investigation. These powers include the ability to carry out the following.

• Enter a place to determine the status of the persons, places and objects related to the crime. They may, in this respect, search any place and seize any papers, arms and anything which may be likely to be used in the perpetration of the crime or to result therefrom, as well as anything that may help in revealing the truth. It is common practice for electronic media to be seized.
• With the permission of the Chief Prosecutor, seize all correspondence, letters, papers, printed materials, parcels belonging to the accused at the post office and for all seized papers to be included in the matter file, which will ultimately be seen by the court.
• The Public Prosecutor can also record wire and wireless conversations, with the permission of the Chief Prosecutor, if they deem it to be required for the investigation.

Additionally, the Public Prosecutor can order the accused to surrender anything that the Public Prosecutor deems is in the possession of the accused and should be seized.

In the course of an investigation, the Public Prosecutor can interview witnesses that the accused and any other interested party ask to be heard.

The Public Prosecutor can also appoint an expert to consider the issues and prepare a report. This is common in complex or fact-intensive matters. The expert's report is very often determinative of the outcome in relation to the matters covered by the expert's report.

Following the investigation, if the Public Prosecutor finds there is sufficient evidence against the accused, it shall refer the case for examination to the competent Criminal Court.

UAE law does not require internal investigations. However, the UAE AML Law requires financial institutions and designated non-financial businesses and professions to set forth policies, controls and internal procedures approved by senior management to enable such entities to manage and limit risks, and to review and continuously update them (and to apply the same procedures to all branches and affiliates in which they own a majority shareholding) (Article 16(d)).

Similarly, the ADGM Regulations and the Dubai Financial Services Authority (DFSA) Rulebook require all relevant persons (or authorised persons) to establish and maintain policies, procedures, systems and controls in order to prevent financial crime as well as to monitor and detect suspicious activity or transactions in relation to potential money laundering or terrorist financing.

Regulated entities may therefore conduct internal investigations as part of their internal procedures or in any event in response to an incident. Regulators may expect to see the outcome of such investigations in order to assess a firm’s compliance with its internal policies and procedures, to assist in determining the facts pertaining to an incident and/or in deciding upon sanctions.

The UAE Federal Law No 39 of 2006 on Mutual Judicial Co-operation in Criminal Matters sets out a modern framework for processing extradition requests received by the UAE from other countries. Any request for extradition needs to comply with all the necessary requirements set out in the Federal Law. Failure to do so will lead to refusal of the request by the UAE courts.

There are multilateral and bilateral treaties that the UAE courts are bound to apply. This includes the Riyadh Arab Convention on Judicial Co-operation, which was signed by most Arab countries, including Algeria, Bahrain, Iraq, Jordan, Kuwait, Lebanon, Libya, Morocco, Oman, Qatar, Saudi Arabia and Tunisia. The Riyadh Convention applies to civil, commercial and administrative matters. Furthermore, Article 38 of the Riyadh Arab Convention provides that each of the contracting parties undertakes to extradite the persons existing in its territory and against whom an accusation is brought by the competent authorities or a judgment is issued by the legal authorities of any other contracting parties.

Examples of some of the bilateral treaties signed and ratified by the UAE for judicial co-operation include agreements with Australia, China, Egypt, France, India, Iran, Kyrgyz Republic, Nigeria, Pakistan, Spain and the United Kingdom. The bilateral treaties signed with China, Egypt, France, Iran and UK apply to both criminal and civil matters. The treaties signed with Australia, and Spain apply only to criminal matters and the treaties signed with India, Kyrgyz Republic, Nigeria and Pakistan only apply to civil and commercial matters.

An extradition request can be rejected if there is a conflict in jurisdiction. Furthermore, an individual will only be extradited if their actions constitute an offence in both the requesting and the requested states.

See 2.1 Enforcement Authorities.

Although not an example of deferred prosecution, it is possible for a claimant and a defendant to enter into reconciliation or an amicable settlement prior to trial in certain circumstances. In practical terms, this is more likely to result in criminal charges not being pursued where the amicable settlement is reached at the investigation stage, ie, before the complaint is referred to court.

Article 236 of the Penal Code provides a list of crimes for which the public prosecutor may accept conciliation in return for the defendant's payment of an amount between AED50,000 and AED500,000. These include cases of defamation against the State, dissemination of false or malicious news and public assembly which threatens state security.

Plea-bargain agreements are not available in the UAE.

The Penal Code sets out a number of criminal offences which are applicable to companies in the UAE. See 1.4 Corporate Liability and Personal Liability for details of corporate liability under Article 66 of the Penal Code.

Sentences that can be imposed on legal persons under Article 66 include fines, forfeiture and criminal measures provided for the crime under the Penal Code. If the Penal Code provides a principal penalty for a crime which is other than a fine, the penalty will be limited to a fine not exceeding AED500,000. The corporate liability of legal persons, however, does not prevent the punishment of the offender with penalties prescribed under the Penal Code.

Corporate Fraud

Under Article 451 of the Penal Code, a company that uses fraudulent practice to do any of the following whenever it is intended to deceive a victim and cause them to surrender a legal right will be punished by a fine of AED500,000. Such conduct can include:

• assuming a false name or quality;
• taking possession for themselves or for others of any movable property or written instrument;
• obtaining any signature upon that instrument; or
• cancelling, destroying or amending the instrument.

A company will also be punished by the same penalty if its representatives, directors or agents acting in favour or on behalf of it alienate any real or movable property in the following circumstances:

• being fully aware that it is not owned by the company;
• being fully aware that they have no right to dispose of it;
• after having previously disposed of it where the act injures others; or
• having concluded any agreement to dispose of it.

Bribery of public officials (and foreign public officials), as well as between private parties, is criminalised in the UAE under the Penal Code. The provisions of the Penal Code apply to domestic and foreign persons in the UAE where their actions were committed either in or outside the UAE, but the results of such actions have effect or were intended to have effect in the UAE.

Bribery in the Public Sector

The Penal Code prohibits a person or company from directly or indirectly promising, offering or granting a bribe to a public servant, a person assigned to a public service, a foreign public servant or an employee of an international organisation for the following purposes:

• in return for performing or not performing an act which falls within the duties of their job or is in violation of the duties of their job;
• to incite any such person to use their actual or assumed power for the purpose of obtaining an undeserved advantage in favour of the principal inciter or in favour of any other person in a public department or authority; or
• to use their actual or assumed power for the purpose of obtaining an undeserved advantage from a public department or authority.

Bribery in the Private Sector

It is a criminal offence for a manager of an entity or establishment of the private sector, or for someone who works in any capacity, to solicit or accept, directly or indirectly, for themselves or for another person, a bribe in return for the following:

• the performance or refraining from the performance of an act of their duties; or
• defaulting on the duties of their job (even if they do not intend to effect the act or to refrain from it, or if the demand or acceptance or promise comes after the performance of the act or the refraining from its performance).

Providing a bribe in the private sector is addressed under Article 280 of the Penal Code.

A bribery conviction will lead to a fine equivalent to what has been demanded or offered or accepted (provided that the fine is not less than AED500,000, in which case a fine of AED500,000 shall apply). A person convicted of bribery will be imprisoned for a maximum period of five years.

The bribe itself will also be subject to confiscation.

There is no general obligation to prevent bribery in the UAE, nor is there an obligation to maintain a compliance programme. However, under Article 282, any person who acts as an intermediary between the briber or the bribe-taker can also be imprisoned for a maximum period of five years.

In the DIFC, the DFSA General Module Rule Book rule 5.3.20 requires DIFC entities to establish and maintain systems and controls that ensure, as far as reasonably practical, that the DIFC entity and its employees do not engage in conduct, or facilitate others to engage in conduct, which may constitute a financial crime under any applicable UAE laws. There is a similar requirement under rule 3.3.20 of the ADGM General Rulebook.

Insider dealing is criminalised in the UAE under Federal Law No 4 of 2000 Concerning the Emirates Securities and Commodities Authority and Market (the Securities Law).

Article 37 of the Securities Law prohibits the exploitation of undeclared information which may affect the prices of securities to gain a personal benefit. Article 39 also prohibits an individual from dealing in securities according to undeclared or non-disclosed information which they may know by virtue of their office. The chairperson, directors and employees of a company are also prohibited from doing the following:

• exploiting the internal information they have regarding that company in purchasing or selling shares; and
• trading in securities of that company or any of its subsidiaries or sister companies, either themselves or through others during the 15-day period prior to disclosure of that company’s financial statements if they have access to insider information.

Market Manipulation

Article 36 of the Securities Law prohibits the submission of any untrue details, statements or information which affect the market value of securities or investment decisions.

The penalties for violating these provisions include imprisonment for a maximum period of three years and/or a maximum fine of AED1 million. In addition, a person found guilty of insider trading in the UAE, or the equivalent in any other jurisdiction, may not act as a director in the UAE at any time. Any dealing carried out by any person contrary to these prohibitions under the Securities Law will be deemed null and void.

DIFC and ADGM Law

The DIFC Law No 1 of 2012 (the Markets Law) also provides restrictions on the disclosure and manipulation of insider information in the DIFC and outside the DIFC if the conduct affects the DIFC markets or users of the DIFC markets. It therefore governs entities listed on NASDAQ Dubai. The consequences for violating these provisions are civil in nature.

Article 58 of the Markets Law restricts insiders, in the DIFC or elsewhere, from dealing, directly or indirectly, or attempting to deal in an investment (ie, securities or derivatives, but excluding commodity derivatives) on the basis of insider information. A person is deemed to be an “insider” if they have inside information as a result of the following:

• their membership of the board of directors, or the governing body of the relevant listed entity;
• their holding of capital in the relevant entity;
• having access to the information through the exercise of their employment, profession or duties;
• their criminal activities; or
• other means, and they know, or could reasonably be expected to know, the information is inside information.

Article 59 of the Markets Law prohibits the disclosure of insider information by restricting insiders from, other than in the necessary course of business, disclosing inside information to another person. An insider is also prohibited from inducing or encouraging another person by direct or indirect means to deal in the investments in which the insider has inside information.

Market abuse is also prohibited under the Markets Law – the making of misleading statements and impressions is prohibited. Persons are also prohibited from engaging and participating in conduct that:

• results in or contributes to, or may result in or contribute to, a false or misleading impression as to the supply of, demand for or price of one or more investments;
• creates or is likely to create an artificial price for one or more investments; or
• perpetrates a fraud on any person.

The DFSA may impose the following sanctions in respect of the contravention of the Markets Law on such terms as it may direct by way of penalty:

• a fine;
• censure;
• direct restitution or compensation of any other person;
• direct the cessation from such activity consisting or connected to the contravention;
• direct the doing of an act or thing by way of remedy; or
• prohibit the person from holding office in or being an employee of any DIFC entity.

The insider-dealing and market-abuse regime in the ADGM is similar to that of the DIFC.

Tax evasion under Federal Law No 7 of 2017 on Tax Procedures (the Tax Procedures Law) is defined as the use of illegal means resulting in the reduction of the amount of the due tax, non-payment thereof or refund of a tax by a person without the right to refund that tax under any UAE tax law.

Under Article 26 of the Tax Procedures Law, a company that engages in the following fraudulent conduct in relation to tax will be liable to pay five times the amount of the evaded tax:

• deliberately abstains from settling any payable tax or administrative penalties;
• deliberately understates the actual value of the relevant business and abstains from adding any related business thereto with the purpose of not attaining the required registration limit;
• imposes and collects amounts from their clients as a tax without being registered;
• deliberately submits wrong information and incorrect data to the Federal Tax Authority (FTA);
• deliberately conceals or destroys documents or other materials that they are required to keep and submit to the FTA;
• steals, misuses or causes the destruction of documents or other materials in the possession of the FTA;
• prevents the FTA’s employees from performing their duties; and
• deliberately decreases the payable tax through tax evasion or complicity in tax evasion.

There are similar tax evasion offences under Federal Decree-Law No 7 of 2017 on excise tax.

There is no specific obligation to prevent tax evasion under Federal Law, save for the DFSA and ADGM requirements for the maintenance of systems and controls noted in 3.3 Anti-bribery Regulation.

Onshore companies in the UAE are subject to the requirements of the Companies Law.

Article 26 of the Companies Law requires companies to keep accounting records with details of their dealings in order to reveal, accurately and at any time, the company’s financial condition. The records are required to be maintained at the company’s main office for a period of no less than five years as of the date of the end of the company’s financial year. The accounts must also be provided to the Securities and Commodities Authority and any competent authority within seven days of holding the General Assembly at which the accounts were submitted.

The directors of a company are responsible for the preparation of the profit-and-loss account and annual report regarding the company’s activity and financial position. This must be presented to the shareholders by way of a General Assembly meeting within three months of the end of the financial year.

If a company fails to keep accounting registers of the company with details of its dealings, it may incur a criminal penalty in the form of a fine of up to AED500,000. Similarly, if a company fails to keep the accounting registers for the specified period, or deliberately abstains from providing documents or information for inspection, it may incur a criminal penalty in the form of a fine of up to AED100,000.

A taxable person under the Tax Procedures Law must maintain relevant records of the company for tax information purposes. Failure to do so may result in criminal sanctions, which include a fine of AED10,000 for the first offence and AED50,000 for repeated offences.

Companies in the DIFC are required by virtue of Article 122(1) of the Companies Law No 5 of 2018 (the DIFC Companies Law) to keep accounting records with details of their transactions in order to evidence the financial position of the company at any time with reasonable accuracy.

If Article 122 is not complied with, or if the following requirements are not met, the company will be liable to a fine of USD25,000.

The company’s accounting records must be:

• kept at such a place as the directors think fit, except where otherwise prescribed in the Regulations;
• preserved by the company for at least six years from the date upon which they were created; and
• open to inspection by an officer or auditor of the company at all reasonable times.

A company must file with the Registrar of Companies, within 30 days after the circulation to shareholders, a copy of the accounts, the auditor’s report, and in the case of a public company, a copy of the directors’ report. If a company fails to comply with these requirements in relation to accounts, it shall be subject to a fine of USD10,000.

Further, a company must not knowingly or recklessly omit to provide information to an auditor which the auditor reasonably requires or provide information which is false, misleading or deceptive. A company will be liable for a fine of USD5,000 for a failure to co-operate with the auditor’s reasonable request.

The provisions in relation to financial record keeping in the ADGM are similar to that of the DIFC.

Federal Law No 4 of 2012 on the Regulation of Competition (the Competition Law) provides penal sanctions upon violation of the restrictions contained therein. The Competition Law governs all establishments with regard to their economic activities in the UAE, exploitation of intellectual property rights inside and outside the UAE, as well as economic activities conducted outside the UAE which affect competition in the UAE.

Article 5 of the Competition Law prohibits establishments from entering into restrictive agreements the subject or aim of which is to violate, reduce or prevent competition.

Furthermore, Article 6 of the Competition Law prohibits establishments enjoying a dominant position in the relevant market, or an important and influential part thereof, from conducting any acts or works that may lead to an abuse of the dominant position and to the violation or reduction or prevention of competition. A dominant position is a position whereby any establishment can, by itself or in collaboration with other establishments, control or affect the relevant market. A dominant position is achieved if the share of any establishment surpasses the proportion of the overall transactions in the market as determined by the Cabinet.

Violations of Articles 5 and 6 will give rise to a criminal liability consisting of a fine of a minimum of AED500,000 and a maximum of AED5,000,000.

There are many exceptions to the Competition Law (see 4.2 Exceptions) and at present, limited enforcement cases that would assist in determining how the law will be applied in practice.

Under Federal Law No 24 of 2006 on Consumer Protection (the Consumer Protection Law), a supplier is subject to several obligations in relation to consumers. The obligations are the following:

• to affix details of the product onto the goods;
• not to display, offer, promote or advertise any goods or services which are adulterated, putrid or misleading and which may inflict damage to the consumer interest or health in the course of ordinary usage;
• to provide a clear warning if the usage of goods encompasses any risk;
• not to hide any goods or refrain from selling them with an aim to control the market price or force the purchase of certain quantities or the purchase of other goods with them or receive a price higher than the advertised price;
• to repair, provide maintenance or after-sale services for a period of not less than five years or a period that is adequate to the nature of the goods;
• immediately after discovering any defect in the goods or services whereby the goods or services upon their proper use may injure the consumer, to inform the Consumer Protection Department in the Ministry of Economy, the concerned parties and the consumer of the potential risk and precautionary measures;
• to withdraw the goods from the local market and consumers upon discovery of a defect or upon publication of the defect in a report or memorandum, and replace, repair or pay back the value of the withdrawn goods to the consumer; and
• not to discriminate between consumers in terms of selling price or quality of goods.

A violation of the Consumer Protection Law would cause the supplier to be criminally liable for a maximum fine of AED1 million. The court may also confiscate or destroy the product or object of the crime and the materials and tools used in its production.

The offences in relation to cybercrimes and computer fraud are governed by Federal Law No 34 of 2021 Concerning the Fight Against Rumors and Cybercrime (the Cyber Crime Law).

The offences under the Cyber Crime Law include accessing electronic sites illegally or without permission or extending the limits of that permission, as well as obtaining, modifying or forging the contents on an electronic site. Disabling access, compromising information systems, conducting denial of service attacks and using a false or misleading address (or an address which belongs to a third party) is also prohibited.

The new Cyber Crime Law contains a provision that makes it a criminal offence to collect, store or process personal data of UAE nationals or residents in violation of other laws. The criminal penalties introduced by the Cyber Crime Law would seem to be applicable in addition to any sanctions stated in the UAE Data Protection Law.

The Cyber Crime Law further criminalises fraudulent activity by prohibiting the unauthorised obtaining of a moveable asset, benefit, document or signature by using a fraudulent method or by taking a false name or impersonation of a false capacity online. Fraudulent conduct in relation to credit or debit cards, and blackmailing or threatening another person online to perform or refrain from action, is also prohibited.

Similarly, the Cyber Crime Law prohibits the facilitation of money laundering by criminalising the transfer, acquisition or concealment or the disguising of the source of illegal funds online.

The maximum penalty under the Cyber Crime Law is a fine of AED4 million and/or life imprisonment (if committed by a natural person) (Article 21). Other penalties include deportation of foreigners or supervision and control orders. An attempt to commit any of the above offences is also punishable.

Breach of Company Secrets

Under Article 369 of the Companies Law, a penalty of imprisonment for a maximum period of six months and a maximum fine of AED500,000 will be imposed on any of the following who utilise or disclose the company secrets or deliberately attempt to damage a company’s business:

• any legal or financial consultants, subscription managers, underwriters or parties participating in the incorporation procedures, or their delegates, who utilise data or information obtained thereby by the founding committee at any stage of company incorporation; and
• the chairman, director or employees of the company.

Under Article 432 of the Penal Code, an individual who, by reason of their profession, craft, situation or art, is entrusted with a secret and who discloses it in cases other than those permitted by law, or who uses it for their own advantage or another person’s advantage, will be punished with up to five years' imprisonment and/or a fine of at least AED20,000, unless the individual to whom the secret pertains has consented that it be disclosed or used.

The UAE Federal Decree-Law No 45 of 2021 Regarding the Protection of Data Protection (the Data Protection Law) became effective on 2 January 2022. Under the Data Protection Law, companies will have an obligation to implement appropriate technical and organisational measures to protect personal data. Controllers must, on becoming aware of any personal data breach that would “prejudice the privacy, confidentiality and security of a data subject’s personal data”, inform the newly-created UAE Data Office of the breach and any subsequent investigation.

In the DIFC, trade secrets are protected under DIFC Law No 4 of 2019 (the DIFC Intellectual Property Law). Under Article 53(3) of the DIFC Intellectual Property Law, a person lawfully in control of a trade secret shall have the right to prevent any person from misappropriation of the trade secret, and shall have the right to claim compensation for any damage caused due to misappropriation thereof by any person. The following may be directed by the Commissioner of Intellectual Property by way of remedy:

• order the wrongdoer to refrain from the violation and carry out all necessary acts to abide by the law;
• request the DIFC Registrar of Companies to temporarily suspend the DIFC licence of the person in violation of this law;
• order confiscation of all materials, goods, tools, machines, equipment, signs and advertisements related to the violation and order their transfer/storage and/or destruction at the expense of the violator;
• a maximum fine of USD30,000; or
• injunctive relief by the DIFC Court, provided that the application is made within three years.

Under Article 15 of the Cabinet Decision No 74 of 2020 Concerning the UAE List of Terrorists and the Implementation of UN Security Council Decisions Relating to Preventing and Countering Financing Terrorism and Leveraging Non-Proliferation of Weapons of Mass Destruction (the Sanctions Regulation), it is prohibited for a physical or moral person to make funds in its possession or under its management, or any financial services or other, available directly or indirectly to or in favour of any person or organisation listed on the Sanctions List unless authorised by the Executive Office of the Committee for Goods and Materials. The Sanctions List is the list containing the names of the persons or organisations that are subject to the sanctions specified by virtue of the Security Council Sanctions Committee.

In addition, it is a crime under Article 170 of the Penal Code for a person, themselves or through an intermediary, during war time, whether directly or through another country, to export goods or products or other items from the UAE to a hostile country, or to import any such materials from such a country. The penalties imposed are imprisonment for between ten and 25 years and a fine not to exceed double the value of the exported or imported goods, provided that it is not less than AED1 million.

Furthermore, under Article 3 of Federal Law No 43 of 2021 on the Goods Subject to Non-Proliferation Controls, customs departments are entitled to ban or restrict the importation or exportation of any resources, systems, equipment, technology, etc, stipulated as controlled commodities under law.

Federal Decree Law No 4 of 2020 announced the abolition of the sanctions UAE had in place against Israel under Federal Decree Law No 15 of 1972 concerning the Arab League boycott of Israel. This reinforces the countries’ commitment to normalise diplomatic relations under the Abraham Accords, which were signed by UAE, Israel, the US and Bahrain in Washington on 15 September 2020. 

An air, land and sea blockade and cessation of diplomatic relations was imposed on Qatar by the UAE, Saudi Arabia, Egypt and Bahrain in 2017. The UAE restored diplomatic relations with Qatar in January 2021.

Under Article 315 of the Penal Code, a person who conceals the evidence of a crime, assets subject to a court attachment order, or an instrument or document submitted to the investigative authorities in respect of the crime in order to obstruct justice will be punished by imprisonment if committed by an individual and a maximum fine of AED500,000 if committed by a corporate.

Under Article 337 of the Penal Code, an individual who, having knowledge that a crime was committed, helps its perpetrator escape justice by concealing evidence will be punished by imprisonment or a fine.

Under Article 456 of the Penal Code, a person who knowingly conceals or possesses property resulting from a crime in which they did not participate will be punished by the penalty prescribed for the crime from which they know that property was obtained. However, if the culprit does not know such things have resulted from a crime, but has obtained them in circumstances which lead them to believe that their sources are illegal, the culprit will be penalised by detention for a period not exceeding six months and/or a fine not exceeding AED20,000.

There are also criminal offences in relation to concealment under the Cyber Crime Law (see 3.9 Cybercrimes, Computer Fraud and Protection of Company Secrets).

Under Article 45-46 of the Penal Code, persons who conduct the following acts will be deemed to be accomplices:

• commits the crime in association with others;
• commits one of a series of acts which constitutes the crime;
• makes use of another person for the perpetration of the act constituting the crime;
• agrees with another person to commit the crime, and the crime is committed based on such agreement;
• gives the offender a weapon, tools or any other thing which the latter has knowingly used in the commission of the crime; or
• intentionally aids the offender in any other way in the preparation, facilitation or completion of the crime.

Under Article 48 of the Penal Code, accomplices will be subject to the same punishment imposed on the perpetrator (although exemptions may apply to the perpetrator's spouse or relatives). However, under Article 53 of the Penal Code, where the characterisation of the crime or penalty is to vary according to the offender’s intention or knowledge of the circumstances, accomplices will be punished according to their knowledge and intention.

Money laundering is criminalised under the AML Law. A legal person will be held criminally responsible for a crime under the AML Law if it is committed in its name or on its behalf (although this is without prejudice to the personal liability of the perpetrator of that crime and the administrative penalties stipulated under the AML Law).

Under the AML Law, money laundering means transferring or moving proceeds or conducting any transaction with the aim of concealing or disguising their illegal source. The AML Law also provides offences relating to the funding of terrorism (Article 3).

The following are the substantive money-laundering offences:

• transferring or moving proceeds or conducting any transaction with the aim of concealing or disguising their illegal source;
• concealing or disguising the true nature, source or location of the proceeds, as well as the method involving their disposition, movement, ownership, or rights with respect to those proceeds;
• acquiring, possessing or using such proceeds upon receipt; and
• assisting the perpetrator of the predicate offence to escape punishment.

Article 2 of the AML Law provides that any person who intentionally commits any of the acts knowing that the funds are the proceeds of a felony or a misdemeanour shall be deemed to have committed a money-laundering crime. It is also an offence under the AML Law to warn or tip off a person or reveal transactions under review or that the competent authorities are investigating such suspicious transactions.

The maximum penalty for breach of the AML Law is a fine of AED10 million and imprisonment for a period not exceeding ten years (if committed by an individual). Notably, the AML Law provides no time bar on the prosecution of money laundering and terrorist financing.

Obligations to Prevent Money Laundering

There are specific obligations imposed by the AML Law on Financial Institutions to prevent money laundering. Financial institutions must do the following:

• put in place indicators that can be used to identify suspicious money laundering transactions in order to report Suspicious Transaction Reports (STRs), and they must update these indicators on an ongoing basis;
• appoint a compliance officer in charge of reviewing the company’s compliance with the anti-money laundering laws and regulations;
• identify and assess any risks of money laundering and terrorism financing when developing new and existing products or professional services, including when developing existing products;
• prepare and file promptly with the Financial Information Unit (FIU) detailed STRs upon the identification of any plausible reasons to suspect money laundering or terror financing;
• assess a client’s money laundering risk, assign a risk level to each client, and carry out the prescribed client due diligence (CDD) in accordance with the risk level given to each client;
• not carry out a CDD if the financial institution, on reasonable grounds, believes that carrying out the CDD may tip off the customer that it may be reported and, instead, make an STR to the FIU along with the reasons for not undertaking the CDD measures. The financial institution must not disclose to the customer its intention of reporting (or that they had reported) to the FIU that an investigation is ongoing (if reported); and
• maintain all records, documents, data and statistics for financial transactions and local and international commercial and cash transactions for a period of no less than five years from the date of completion of the relevant transaction or termination of the business relationship with the customer. Documents relating to CDD measures undertaken by financial institutions, monitoring, account files, personal identification documents and STRs and the analysis performed under these measures must also be kept for a period of no less than five years. These documents and files must be ready for inspection or requests from the relevant authorities on an as-requested basis.

Regulatory and Supervisory Bodies

The FIU is an independent unit within the UAE Central Bank, and has the authority to do the following:

• request that the financial institutions provide any information or additional documents relevant to the reports and information received by the FIU, in addition to other information the FIU considers necessary to perform its tasks within the time and in the form determined by the FIU; and
• exchange information with counterpart units in other States concerning STRs (where the UAE has entered into co-operation agreements with such States).

The supervisory authorities under the AML Law are the Department of Economic Development of Abu Dhabi and the Department of Economic Development of Dubai – each has the power to do the following:

• conduct a risk evaluation of the possible occurrence of the crime in financial institutions;
• conduct control and office and field search operations of financial institutions; and
• issue the decisions related to administrative penalties pursuant to the AML Law and its Executive Regulations and the mechanism of appealing against such penalties and keeping statistics about the measures taken and penalties imposed.

The AML Law empowers the supervisory authorities to impose continuing reporting obligations on financial institutions, which can be in addition to imposing administrative penalties, the arrest of responsible individuals, and the disqualification of activities or operations.

In line with this mandate, a new Executive Office has been established to function as the primary body co-ordinating anti-money laundering and counter terrorism financing initiatives in the UAE, and implement the UAE’s National AML/CFT Strategy and National Action Plan (NAP). The remit of the Executive Office includes:

• enhancing international co-ordination and co-operation on AML/CFT issues at the policy and operational levels;
• improving the UAE's ML/CFT framework and legislation in co-ordination with the UAE Ministry of Foreign Affairs and International Cooperation (MOFAIC) and other relevant UAE stakeholders;
• increasing the sharing of information between supervisory authorities, law enforcement agencies and the private sector; and
• facilitating closer collaboration with both regional and international organisations, such as the G20 intergovernmental forum, the Financial Action Task Force (FATF) and the Gulf Cooperation Council (GCC) AML/CFT Working Group.

Dubai and Abu Dhabi have also recently established new specialist money laundering courts that exclusively hear money laundering cases. This development is a key part of the UAE's strategy to embed a robust financial crime compliance framework that is aligned with FATF recommendations.

There are no uniform or common defences for white-collar offences in the UAE. The existence of an effective compliance programme in particular is not a defence to a white-collar crime, although regulated entities may incur lower sanctions where a white-collar crime offence occurred notwithstanding a robust compliance programme. 

There is no de minimis threshold for bribery offences.

The prohibitions contained in the Competition Law do not apply to the following sectors, activities and services:

• telecommunication;
• financial sector;
• cultural activities (readable, audible and visual);
• oil and gas;
• production and distribution of pharmaceutical products;
• postal services;
• activities related to the production, distribution and transportation of electricity and water;
• activities related to sewerage, garbage disposal, hygiene and the like, in addition to supportive environmental services thereof;
• land, marine or air transport, railway transport and services related thereto; and
• conduct initiated by the federal government or a local government (including establishments owned or controlled by them); and
• acts carried out by establishments based on a decision or authorisation granted by the federal government or a local government, or under the supervision of one of them.

Furthermore, under Article 7 of the Competition Law, the Minister of Economy can issue a decision excluding restrictive agreements, or practices, related to the dominant position from having to abide by the provisions of Articles 5 and 6 of the Competition Law, if criteria set out under law are met. 

Under Article 232 of the Penal Code, a person who conspires to commit a crime shall be exempt from the relevant punishments if they report the conspiracy and the participants to the competent authorities before the commission of any of the specified crimes. Similarly, under Article 284 if a briber or inducer of bribery informs the judicial or administrative authorities of the crime before the crime is discovered, the briber or mediator will be exempted from punishment.

Under Article 22(5) of the AML Law, the court may commute or set aside the sentence against any perpetrator of an AML crime if they provide the judicial or administrative authorities with information relating to a money laundering offence and the information provided leads to the discovery of a crime, the identification of its perpetrators or their arrest.

Under Article 377 of the Penal Code, an offender under Article 377 of the Penal Code (see 3.11 Concealment) will be exempt from punishment if they provide the authorities without delay with details of the matter and before the matter is disclosed to the judicial or administrative authorities. The court may, however, exempt them from punishment where they inform the authorities after the crime is disclosed if the information results in the arrest of offenders.

Penalties imposed as a result of violations of the provisions of the Competition Law may be reconciled under Article 15 of the Cabinet Decision No 37 of 2014 on the Implementing Regulation of Federal Law No 4 of 2012 on the Regulation of Competition, provided that this takes place before filing a criminal lawsuit and the parties pay not less than double the minimum fine. If any of the parties abstain from implementing what has been reconciled, the competent authority shall refer the violations to the competent court.

Under Article 61 of the Cyber Crime Law, the court, based on a request of the public prosecutor, may mitigate or exempt from the punishment any perpetrators who gave information to the judicial or administrative authorities related to any of the crimes pertaining to the security of the UAE whenever this leads to discovering the crime and its perpetrators, or to proving the crime or to the arrest of any of the perpetrators.

Whilst there is a general obligation to report knowledge of a crime under Article 323 of the Penal Code, there is no over-arching whistle-blower protection in the UAE at a federal level. However, in July 2021 the Dubai Financial Services Authority (DFSA) released Consultation Paper No 141, proposing the introduction of measures aimed at ensuring a more consistent approach to reporting and recording misconduct by DFSA-regulated entities (the Whistleblowing Regime).

Under the Whistleblowing Regime, a whistle-blower who has made a qualifying disclosure to a specified person, whether anonymously or not, shall not, for reason of having made the disclosure:

• be subject to civil or contractual liability;
• have any contractual, civil, or other remedy or right enforced against them by another person; or
• be dismissed from their current employment, or otherwise subject to action by their employer (or its related parties) that is reasonably likely to cause them detriment.

A whistle-blower will also have the right to apply to court for relief, should there be any violation of these protections. It is important to note, however, that the statutory protections under the Regulatory Law do not guard against any criminal liability that may arise from a whistle-blower's disclosures for reasons such as, for example, breach of confidence or defamation.

In addition, under the Dubai Law No 4 of 2016 on Financial Crime (the Financial Crime Law), the Dubai Economic Security Centre will provide protection to a whistle-blower where the disclosure provided by the whistle-blower is true, relates to an activity that may impact the economic security of Dubai and is made to the Dubai Economic Security Centre.

The Financial Crime Law provides the following as whistle-blower protection:

• necessary protection at their place of residence and workplace;
• non-disclosure of information related to their identity and location; and
• protection from discrimination or mistreatment.

In the DIFC, Article 64 of the DIFC Operating Law No 7 of 2018, provides whistle-blower protection to a person who makes a disclosure of information to the DIFC Registrar of Companies, or a DIFC entity’s auditor or member of the auditor team, or a director or other officer of a DIFC entity. The disclosure must meet the following requirements to attract protection:

• include the identity of that person;
• relate to a reasonable suspicion that the registered person has or may have contravened a provision of this Law, the Regulations or any other legislation administered by the Registrar; and
• be made in good faith.

The whistle-blower protection provided under the DIFC Operating Law is as follows:

• protection from any legal or contractual liability for making that disclosure;
• protection from enforcement of any contractual, civil or other remedy or right by another person for making that disclosure, or any consequence resulting from such disclosure; and
• protection from dismissal from their current employment, or any action by the employer or any related party of the employer which is reasonably likely to cause detriment to that person.

Under Article 27 of the AML Law, no penal, civil or administrative responsibility shall be borne by supervisory authorities, the FIU, law-enforcement agencies and financial institutions and designated non-financial businesses and professions, the Boards of Directors of such agencies, employees and duly authorised representatives due to providing any information required or exceeding any restriction imposed by a legislative, contractual or administrative provision to ensure the confidentiality of information, unless the reporting is proved to be malicious and for the purpose of harming a third party.

As such, there is no general requirement under UAE law for companies to maintain whistle-blowing policies. However, certain companies in the UAE (such as Expo 2020 Dubai and the UAE Central Bank) have voluntarily put policies in place to encourage people to report information relating to illegal practices or violations that the person in question has reasonable cause to believe is credible. In June 2021, the Central Bank launched an online whistle-blowing portal with the intention of facilitating the reporting of misconduct by Central Bank employees, contractors and representatives. The portal can be used by both employees and external stakeholders, who can report their concerns without fear of reprisal. Accordingly, whistle-blowers are protected from retaliation or adverse employment consequences (if an employee) under such policies.

The burden of proof will be placed on the Public Prosecution to prove liability of the perpetrator for satisfying the elements of the crime. In the UAE, there are no specific standards of proof adhered to in the courts. It is within the discretion of the judge(s) adjudicating the case to reach the final decision on liability.

When a defendant is deemed guilty of a white-collar offence by a Criminal Court, the sentence provided in the relevant law will be enforced. Any aggravating circumstances noted in the relevant law will be taken into account when imposing the sentence. UAE criminal law does not recognise deferred prosecution agreements, non-prosecution agreements or plea agreements and therefore there are no rules or guidelines governing the assessment of penalties in the event that such agreements are entered into.