The UAE's Federal Penal Code is set out in Federal Law No 31 of 2021, which came into force on 2 January 2022, replacing Federal Law No 3 of 1987.

Article 27 of the Penal Code provides three categories of offences: felonies, misdemeanours and contraventions. Each crime has a material and a mental element. The material element of a crime consists of a criminal act committed or omitted in violation of a law forbidding or requiring it, while the mental element of the crime consists of the intention or the error. Intention exists when the offender’s will is to commit or omit an act that is legally considered a crime. The intention must be aimed at producing a direct effect, or any other effect, which the law deems criminal and which the offender expected to occur.

A person may also be held liable for attempting to commit an offence. An attempt is considered to mean an effort or endeavour to accomplish a crime, which has been prevented or has fallen short of the intended action for reasons beyond the offender’s will. It is the commission of an act that is deemed a constituent part of the basic material element of the crime, or that entails such an element immediately and directly.

However, neither the intention to commit a crime nor the preparation or planning for it shall be considered an attempt, unless the law stipulates otherwise.

Limitation periods in the UAE, the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) are contained in a variety of different laws and vary depending on the cause of action brought.

Federal Decree-Law No 38 of 2022 (the Criminal Procedural Law) came into force on 1 March 2023, replacing Federal Law No 35 of 1992. The Criminal Procedural Law provides that, for criminal cases, the limitation periods are 20 years for most felonies, five years for misdemeanours, and one year for contraventions, starting from the date on which the crime was committed (Article 21).

There is no specific statute of limitations dealing with concealed and/or continuing offences. The Penal Code explicitly states that no time limitations shall apply to:

• crimes against the security of the UAE or involving embezzlement and damage to public funds (Articles 227 and 270 of the Penal Code); or
• crimes related to positions held in public office (ie, bribery) (Article 286), nor shall there be a time limit on any related civil action.

In general, a criminal offence will only occur in the UAE where it took place within the jurisdiction. However, in some cases there are specific provisions within the relevant legislation that enable the courts to exercise extraterritorial jurisdiction.

Offences with extraterritorial effect under Article 21 the Penal Code include:

• crimes committed against the internal or external security of the State, or against its constitutional regime or its bonds issued under legal licence, or in connection with its stamps, or crimes of falsification or counterfeiting of its official documents or seals;
• crimes of falsification, counterfeiting or forgery of the State’s money, or putting such money into circulation or the possession thereof with the intention of putting it into circulation, no matter whether such acts are committed in or out of the State;
• crimes of falsification, counterfeiting or forgery of coined or paper money that is legally in circulation in the State, or crimes of putting such coined or paper money into circulation in the State or the possession thereof with the intention of putting it into circulation; or
• a deliberate murder committed against one of the citizens of the State.

Per Article 22 of the Penal Code, a person who is found in the state after they have committed one of the following crimes, whether as a perpetrator or an accomplice, shall be subject to extraterritorial effect:

• a crime involving the destruction or interruption of international means of communications;
• drugs or human trafficking;
• piracy and international terrorism; or
• money laundering crimes.

The provisions of the Penal Code shall also apply outside of the UAE to any person who commits a bribery offence if either the offender or the victim is a UAE citizen, if the crime is committed by an employee in the UAE public or private sector, or if the crime involves public funds (Article 285).

Article 21 of Federal Decree-Law No 32 of 2021 (the Companies Law) entered into force on 2 January 2022, replacing Federal Law No 2 of 2015. The Companies Law states that a company shall acquire “legal personality” upon incorporation; therefore, there is a corporate veil between the company and its shareholders and managers (although this can be pierced in certain situations).

Article 66 of the Penal Code sets out the basis for corporate criminal liability in the UAE: “Legal persons, with the exception of the government agencies and their official departments and public entities and corporations, shall be criminally liable for crimes committed by their representatives, directors or agents acting in favour of or on behalf of them.”

The effect of Article 66 of the Penal Code is that a company can be found guilty of any offence prescribed under the Penal Code committed by one of its representatives acting in its favour or on its behalf. However, the Dubai Court of Cassation has held that a company may not be held criminally responsible for its employee's actions if the employee in question was merely negligent, acted without intent or was not acting in the name of the company.

Managers of a company generally have a statutory duty of care. If a manager does not fulfil their duty of care, the courts may hold them personally liable. For example, managers have been held liable for their actions if it is established that their acts resulted in a harm, that they acted in breach of their obligations or that their actions can be classified as gross misconduct or negligence. This can also include the abuse of a right or any other breach of the law, such as fraud.

Previously, managers have been held personally liable for bounced cheques due to insufficient funds, which was considered a crime under Article 401 of Federal Law No 3 of 1987. However, the new Penal Code decriminalised the issuance of cheques with insufficient funds, barring a few noted exceptions. The beneficiary of a bounced cheque still has the right to pursue a civil claim, including the right to seize assets in the name of the drawer.

A victim of a crime may request that a claim for compensation be annexed to the criminal charges and considered by the Criminal Court (Article 23 of the Criminal Procedural Law), which would be determined when criminal liability has been established.

In practice, the Criminal Court will transfer the civil claim to the Civil Court upon conviction and sentence in accordance with Article 27 of the Criminal Procedural Law, in order for the Civil Court to decide the quantum of damages (as the fact of the conviction allows the Civil Court to assume that liability has been established).

There is no class action regime in the UAE. However, multiple victims could seek to have their claim for compensation heard by the Criminal Court, as noted above.

Alternatively, a victim of a white-collar offence can claim compensation for any loss though the Civil Courts. A claim for compensation for harm (which is similar to tort) would need to show three factors:

• that the act has been committed;
• that damage has been sustained; and
• that there is causation between the act and the damage sustained.

The Dubai Financial Services Authority (DFSA) penalised the Bank of Singapore Limited's DIFC branch with a fine of USD1.12 million in November 2022 in relation to several contraventions of DFSA legislation, including the bank's inadequate anti-money laundering controls.

The DFSA imposed its largest ever fine on an individual – the founder and former CEO of Abraaj Group, Mr Arif Naqvi, who was fined approximately USD135 million (which was upheld by the Financial Markets Tribunal) after the DFSA found that he was knowingly involved in misleading and deceiving investors over the misuse of their funds. Mr Naqvi was also restricted and prohibited from carrying out functions in or from the DIFC.

The process of prosecuting a company for a white-collar criminal offence is governed by the Criminal Procedural Law, as is the case for any other criminal prosecution in the UAE. Article 9 of the Criminal Procedural Law gives the Public Prosecutor exclusive jurisdiction to initiate and oversee criminal proceedings.

The process is as follows.

• A complaint is filed either with the Public Prosecution or with a Judicial Police Officer (Article 12), or the Public Prosecutor files a criminal offence of its own motion.
• If a complaint is filed with the police, they will conduct an investigation into the alleged offence. The police have the power to interview the complainant and the accused, and to take statements from them both. The police can also interview and take a statement from other witnesses. All the evidence is compiled into a matter file.

• The matter file is then referred to the Public Prosecutor, who will conduct an investigation, and may request the assistance of the Judicial Police (or investigating officers) to assist with gathering evidence in the investigation. For more serious offences, the Public Prosecutor's office may conduct the investigation itself.
• Following the investigation, the Public Prosecutor makes a decision on whether to refer the complaint to the competent court or to dismiss the complaint.
• The Public Prosecutor will consider all the evidence in the matter file before deciding whether to issue an indictment order against the accused and refer the matter to court or to dismiss the complaint.
• The Judicial Police have the power to collect the necessary information and evidence for the investigation and indictment of a criminal offence. In collecting evidence, the Judicial Police also have the power to interview the complainants, victims and accused, take statements and engage the assistance of experts.

There are specialist departments within the police and Public Prosecutor’s office that deal with certain types of crime, such as financial crime, including bribery, money laundering, abuse of power, embezzlement and the misuse of funds, and cybercrimes.

The Public Prosecutor may conduct an investigation independently and will generally do so for more serious offences. There are no rules regarding the initiation of investigations that are specific to white-collar offences.

Article 8 of the Criminal Procedural Law provides that criminal investigations should be conducted in Arabic. The Public Prosecutor can order for translators to be present at all interviews and other relevant parts of an investigation.

If the Public Prosecutor determines that a crime has been committed, it can issue a summons or an arrest warrant, or order a travel ban against the accused (Article 99).

If the Public Prosecutor dismisses the allegation, the complainant can appeal the Public Prosecutor's decision within ten days (Articles 134–135).

The Court of Appeal will hear the appeal and can conduct a complementary investigation. If it finds there are sufficient grounds for the matter to be pursued, it will send the matter file back to the Public Prosecutor and order it to be referred to the competent Criminal Court (Article 138).

The Public Prosecutor has broad powers when conducting a criminal investigation (Articles 70–73 of the Criminal Procedural Law), including the ability to:

• enter a place to determine the status of the persons, places and objects related to the crime, and to search any place and seize any papers, arms and anything that may be likely to be used in the perpetration of the crime or to result therefrom, as well as anything that may help in revealing the truth – it is common practice for electronic media to be seized;
• seize all correspondence, letters, papers, printed materials and parcels belonging to the accused at the post office and include these in the matter file, which will ultimately be seen by the court; and
• monitor and record conversations, including wired and wireless conversations, with the prior approval of the Attorney General, if they deem it to be required for the investigation.

In addition, the Public Prosecutor can order the accused to surrender anything that the Public Prosecutor deems is in the possession of the accused and should be seized (Article 76).

During an investigation, the Public Prosecutor can interview witnesses that the accused and any other interested party ask to be heard.

The Public Prosecutor can also appoint an expert to consider the issues and prepare a report. This is common in complex or fact-intensive matters. The expert's report is very often determinative of the outcome in relation to the matters covered by it.

Following the investigation, if the Public Prosecutor finds there is sufficient evidence against the accused, it shall refer the case for examination to the competent Criminal Court.

UAE law does not require internal investigations. However, Federal Decree-Law No 20 of 2018 (the AML Law) requires financial institutions and designated non-financial businesses and professions to set forth policies, controls and internal procedures approved by senior management to enable such entities to manage and limit risks, and to review and continuously update them (and to apply the same procedures to all branches and affiliates in which they own a majority shareholding) (Article 16(d)).

Similarly, the ADGM Regulations and the DFSA Rulebook require all relevant persons (or authorised persons) to establish and maintain policies, procedures, systems and controls in order to prevent financial crime, and to monitor and detect suspicious activity or transactions in relation to potential money laundering or terrorist financing.

Regulated entities may therefore conduct internal investigations as part of their internal procedures or in any event in response to an incident. Regulators may expect to see the outcome of such investigations in order to assess a firm’s compliance with its internal policies and procedures, to assist in determining the facts pertaining to an incident and/or in deciding upon sanctions.

Federal Law No 39 of 2006 on International Judicial Co-operation in Criminal Matters sets out a modern framework for processing extradition requests received by the UAE from other countries. Any request for extradition must comply with the law's necessary requirements. Failure to comply will lead to refusal of the request by the UAE courts.

There are multilateral and bilateral treaties that the UAE courts are obliged to apply, including the Riyadh Arab Convention on Judicial Co-operation, which was signed by most Arab countries, including Algeria, Bahrain, Iraq, Jordan, Kuwait, Lebanon, Libya, Morocco, Oman, Qatar, Saudi Arabia and Tunisia. The Riyadh Convention applies to civil, commercial and administrative matters. Article 38 of the Riyadh Arab Convention provides that each of the contracting parties undertakes to extradite the persons existing in its territory and against whom an accusation is brought by the competent authorities or a judgment is issued by the legal authorities of any other contracting parties.

Bilateral treaties signed and ratified by the UAE for judicial co-operation include agreements with Australia, China, Egypt, France, India, Iran, the Kyrgyz Republic, Nigeria, Pakistan, Spain, the United Kingdom and South Africa. The bilateral treaties signed with China, Egypt, France, Iran and the UK apply to both criminal and civil matters, while the treaties signed with Australia and Spain apply only to criminal matters and the treaties signed with India, the Kyrgyz Republic, Nigeria and Pakistan only apply to civil and commercial matters.

An extradition request can be rejected if there is a conflict in jurisdiction. Furthermore, an individual will only be extradited if their actions constitute an offence in both the requesting state and the requested state.

See 2.1 Enforcement Authorities.

Although not an example of deferred prosecution, it is possible for a claimant and a defendant to enter into reconciliation or an amicable settlement prior to trial in certain circumstances. In practical terms, this is more likely to result in criminal charges not being pursued where the amicable settlement is reached at the investigation stage – ie, before the complaint is referred to court.

Article 236 of the Penal Code provides a list of crimes for which the public prosecutor may accept conciliation in return for the defendant's payment of an amount between AED50,000 and AED500,000. These include cases of defamation against the State, the dissemination of false or malicious news, and public assembly that threatens state security.

The new Criminal Procedural Law introduced a plea bargaining mechanism for misdemeanours and felonies.

Plea bargaining shall not apply to certain misdemeanours, including (Article 361):

• criminal offences affecting national security;
• criminal offences for which the law does not allow reduced sentences; and
• offences inseparably associated with offences for which plea bargains are not available.

Plea bargaining shall apply to felonies punishable by temporary imprisonment and to their inseparably associated misdemeanours (Article 369).

A defendant accepting a plea bargain must hand over any objects or funds involved in or resulting from the criminal offence, where these are in the defendant's direct or indirect possession (Article 377). The plea bargain will have no effect on civil damages accruing to the victim (Article 380).

The Penal Code sets out a number of criminal offences applicable to companies in the UAE. See 1.4 Corporate Liability and Personal Liability for details of corporate liability under Article 66 of the Penal Code.

Sentences that can be imposed on legal persons under Article 66 include fines, forfeiture and criminal measures provided for the crime under the Penal Code. If the Penal Code provides a principal penalty other than a fine, the penalty will be limited to a fine not exceeding AED5 million. The corporate liability of legal persons does not prevent the punishment of the offender with penalties prescribed under the Penal Code.

Corporate Fraud

Under Article 451 of the Penal Code, a company that uses fraudulent practices to deceive a victim and cause them to surrender a legal right will be punished by a fine of AED5 million. Such conduct can include:

• assuming a false name or quality;
• taking possession for themselves or for others of any movable property or written instrument;
• obtaining any signature upon that instrument; or
• cancelling, destroying or amending the instrument.

A company will also be punished by the same penalty if its representatives, directors or agents acting in its favour or on its behalf alienate any real or movable property in the following circumstances:

• being fully aware that it is not owned by the company;
• being fully aware that they have no right to dispose of it;
• after having previously disposed of it where the act injures others; or
• having concluded any agreement to dispose of it.

Bribery of public officials (and foreign public officials), as well as between private parties, is criminalised in the UAE under the Penal Code. The provisions of the Penal Code apply to domestic and foreign persons in the UAE where their actions were committed either in or outside the UAE if the results of such actions have effect or were intended to have effect in the UAE.

Bribery in the Public Sector

The Penal Code prohibits a person or company from directly or indirectly promising, offering or granting a bribe to a public servant, a person assigned to a public service, a foreign public servant or an employee of an international organisation for the following purposes:

• in return for performing or not performing an act that falls within the duties of their job or that is in violation of the duties of their job;
• to incite any such person to use their actual or assumed power for the purpose of obtaining an undeserved advantage in favour of the principal inciter or in favour of any other person in a public department or authority; or
• to use their actual or assumed power for the purpose of obtaining an undeserved advantage from a public department or authority.

Bribery in the Private Sector

It is a criminal offence for a manager of an entity or establishment of the private sector, or for someone who works in any capacity, to solicit or accept, directly or indirectly, for themselves or for another person, a bribe in return for the following:

• the performance or refraining from the performance of their duties; or
• defaulting on the duties of their job (even if they do not intend to effect the act or to refrain from it, or if the demand, acceptance or promise comes after the performance of the act or the refraining from its performance).

Providing a bribe in the private sector is addressed under Articles 278–279 of the Penal Code.

A bribery conviction will lead to a fine equivalent to what has been demanded, offered or accepted (provided that the fine is not less than AED5,000). A person convicted of bribery will be imprisoned for a maximum period of five years.

The bribe itself will also be subject to confiscation.

There is no general obligation to prevent bribery in the UAE, nor is there an obligation to maintain a compliance programme. However, under Article 282 of the Penal Code, any person who acts as an intermediary between the briber or the bribe-taker can also be imprisoned for a maximum period of five years.

In the DIFC, rule 5.3.20 of the DFSA General Module Rule Book requires DIFC entities to establish and maintain systems and controls that ensure, as far as reasonably practical, that the DIFC entity and its employees do not engage in conduct that may constitute a financial crime under any applicable UAE laws, nor facilitate others to engage in such conduct. There is a similar requirement under rule 3.3.20 of the ADGM General Rulebook.

Insider dealing is criminalised in the UAE under Federal Law No 4 of 2000 Concerning the Emirates Securities and Commodities Authority and Market (the Securities Law).

Article 37 of the Securities Law prohibits the exploitation of undeclared information that may affect the prices of securities to gain a personal benefit. Article 39 also prohibits individuals from dealing in securities using undeclared or non-disclosed information which they may know by virtue of their office. The chairperson, directors and employees of a company are also prohibited from:

• exploiting the internal information they have regarding that company in purchasing or selling shares; and
• trading in securities of that company or any of its subsidiaries or sister companies, either themselves or through others during the 15-day period prior to disclosure of that company’s financial statements if they have access to insider information.

Market Manipulation

Article 36 of the Securities Law prohibits the submission of any untrue details, statements or information that affect the market value of securities or investment decisions.

The penalties for violating these provisions include imprisonment for a maximum period of three years and/or a maximum fine of AED1 million. In addition, a person found guilty of insider trading in the UAE, or the equivalent in any other jurisdiction, may not act as a director in the UAE at any time. Any dealing carried out by any person contrary to these prohibitions under the Securities Law will be deemed null and void (Article 37).

DIFC and ADGM Law

DIFC Law No 1 of 2012 (the Markets Law) also provides restrictions on the disclosure and manipulation of insider information in the DIFC and outside the DIFC if the conduct affects the DIFC markets or users of the DIFC markets. It therefore governs entities listed on NASDAQ Dubai. The consequences for violating these provisions are civil in nature.

Article 58 of the Markets Law restricts insiders, in the DIFC or elsewhere, from dealing, directly or indirectly, or attempting to deal in an investment (ie, securities or derivatives, but excluding commodity derivatives) on the basis of insider information. Under Article 63, a person is deemed to be an “insider” if they have inside information as a result of:

• their membership of the board of directors, or the governing body of the relevant listed Reporting Entity;
• their holding of capital in the relevant Reporting Entity;
• having access to the information through the exercise of their employment, profession or duties;
• their criminal activities; or
• other means, and they know, or could reasonably be expected to know, the information is inside information.

Article 59 of the Markets Law prohibits the disclosure of insider information by restricting insiders from disclosing inside information to another person, other than in the necessary course of business. An insider is also prohibited from inducing or encouraging another person by direct or indirect means to deal in the investments in which the insider has inside information.

Market abuse is also prohibited under the Markets Law, including the making of misleading statements and impressions. Under Article 54, persons are also prohibited from engaging and participating in conduct that:

• results in or contributes to, or may result in or contribute to, a false or misleading impression as to the supply of, demand for or price of one or more investments;
• creates or is likely to create an artificial price for one or more investments; or
• perpetrates a fraud on any person.

The DFSA may impose the following sanctions in respect of the contravention of the Markets Law on such terms as it may direct by way of penalty:

• a fine;
• censure;
• direct restitution or compensation of any other person;
• direct the cessation from such activity consisting or connected to the contravention;
• direct the doing of an act or thing by way of remedy; or
• prohibit the person from holding office in or being an employee of any DIFC entity.

The insider dealing and market abuse regime in the ADGM is similar to that of the DIFC.

Tax evasion under Federal Decree-Law No 28 of 2022 on Tax Procedures (the Tax Procedures Law) is defined as the use of illegal means to reduce the amount of tax due, non-payment thereof or the refund of a tax that a person did not have the right to have refunded under any UAE tax law.

A company that engages in the following fraudulent conduct in relation to tax will be liable to pay a fine not exceeding three times the amount of the evaded tax (Article 25):

• deliberately failing to settle any payable tax or administrative penalties;
• deliberately understating the actual value of the relevant business and failing to consolidate its related businesses, with the intent of remaining below the required registration limit;
• imposing and collecting amounts from their clients as a tax without being registered; and
• deliberately decreasing the payable tax through tax evasion or complicity in tax evasion.

A company that engages in the following fraudulent conduct in relation to tax will be liable to pay a fine not exceeding AED1 million (Article 25):

• deliberately submitting wrong information and incorrect data to the Federal Tax Authority (FTA);
• deliberately concealing or destroying documents or other materials that they are required to keep and submit to the FTA;
• stealing, misusing or causing the destruction of documents or other materials in the possession of the FTA; and
• preventing the FTA’s employees from performing their duties.

There is no specific obligation to prevent tax evasion under Federal Law, except for the DFSA and ADGM requirements for the maintenance of systems and controls noted in 3.3 Anti-bribery Regulation.

Onshore companies in the UAE are subject to the requirements of the Companies Law.

Article 26 of the Companies Law requires companies to keep accounting records with details of their dealings in order to reveal the company’s financial condition, accurately and at any time. The records must be maintained at the company’s main office for no less than five years as of the date of the end of the company’s fiscal year. The accounts and auditor's report must also be provided to the Securities and Commodities Authority and any Competent Authority within seven days of the General Assembly meeting at which the accounts were submitted (Article 238).

The manager of a company is responsible for the preparation of the profit-and-loss account and annual report regarding the company’s activity and financial position. This must be presented to the shareholders by way of a General Assembly meeting within three months of the end of the fiscal year (Article 87).

A company that provides information that is false or contrary to law may be fined between AED200,000 and AED1 million (Article 346). Any manager or director who deliberately gives false information to conceal the company's financial position shall also face imprisonment of between six months and three years and/or a fine of between AED100,000 and AED500,000 (Article 349).

Article 122(1) of Companies Law No 5 of 2018 (the DIFC Companies Law) requires companies in the DIFC to keep accounting records with details of their transactions in order to evidence the financial position of the company at any time with reasonable accuracy.

If Article 122 is not complied with, or if the following requirements are not met, the company will be liable to a fine of USD25,000. The company’s accounting records must be:

• kept at such a place as the directors think fit, except where otherwise prescribed in the Regulations;
• preserved by the company for at least six years from the date upon which they were created, or for a period as prescribed by the Regulations; and
• open to inspection by an officer or auditor of the company at all reasonable times.

A company must file a copy of the accounts, the auditor’s report and, in the case of a public company, a copy of the directors’ report with the Registrar of Companies, within 30 days after the circulation thereof to shareholders. If a company fails to comply with these requirements in relation to accounts, it shall be subject to a fine of USD10,000.

Furthermore, a company must not knowingly or recklessly omit to provide information to an auditor which the auditor reasonably requires, nor provide information that is false, misleading or deceptive. A person will be liable for a fine of USD5,000 for a failure to co-operate with the auditor.

The provisions in relation to financial record-keeping in the ADGM are similar to those of the DIFC.

Federal Law No 4 of 2012 on the Regulation of Competition (the Competition Law) provides penal sanctions for violation of the restrictions contained therein. The Competition Law governs all establishments with regard to their economic activities in the UAE and exploitation of intellectual property rights inside and outside the UAE, as well as economic activities conducted outside the UAE that affect competition in the UAE.

Article 5 of the Competition Law prohibits establishments from entering into restrictive agreements with the aim of violating, reducing or preventing competition.

Furthermore, Article 6 of the Competition Law prohibits establishments that enjoy a dominant position in the relevant market, or an important and influential part thereof, from conducting any acts or works that may lead to an abuse of the dominant position and to the violation or reduction or prevention of competition. A dominant position is a position whereby any establishment can, by itself or in collaboration with other establishments, control or affect the relevant market. A dominant position is achieved if the share of any establishment surpasses the proportion of the overall transactions in the market as determined by the Cabinet.

Violations of Articles 5 and 6 will give rise to a liability consisting of a fine of a minimum of between AED500,000 and AED5 million.

There are many exceptions to the Competition Law (see 4.2 Exceptions) and, at present, limited enforcement cases that would assist in determining how the law will be applied in practice.

Under Federal Law No 15 of 2020 on Consumer Protection (the Consumer Protection Law) and Cabinet Decision No 66 of 2023 (the Consumer Protection Implementing Regulations), which replaced Federal Law No 24 of 2006 on Consumer Protection, a supplier is subject to several obligations in relation to consumers, including:

• to affix details of the product onto the goods;
• not to display, offer, promote or advertise any goods or services that are misleading and may inflict damage to the consumer interest or health in the course of ordinary usage;
• to provide a clear warning if the usage of goods encompasses any risk;
• not to hide any goods or refrain from selling them with an aim to control the market price or force the purchase of certain quantities or the purchase of other goods with them or receive a price higher than the advertised price;
• to implement all warranties and required after-sales services as may be published by the Ministry of Economy;
• to provide necessary spare parts for the operation and repair of commodities under certain circumstances;
• to inform the body concerned and the consumer of the potential risk and precautionary measures immediately after discovering any defect in the goods or services whereby the goods or services upon their proper use may injure the consumer;
• to recall the goods from the local market and consumers upon discovery of a defect, and replace, repair or pay back the value of the withdrawn goods to the consumer; and
• not to discriminate between consumers in the sale of the goods or utilisation of the service.

A violation of the Consumer Protection Law could result in imprisonment and/or a fine up to AED2 million. The competent court may also order the confiscation or destruction of the product or object of the crime and the materials and tools used in its production.

The offences in relation to cybercrimes and computer fraud are governed by Federal Law No 34 of 2021 on Combatting Rumors and Cybercrimes (the Cybercrimes Law).

The offences under the Cybercrimes Law include accessing electronic sites illegally or without permission, or extending the limits of that permission, as well as obtaining, modifying or forging the contents on an electronic site. Disabling access, compromising information systems, conducting denial of service attacks and using a false or misleading address (or an address that belongs to a third party) are also prohibited.

The Cybercrimes Law contains a provision that makes it a criminal offence to collect, store or process personal data of UAE nationals or residents in violation of other laws (Article 6). The criminal penalties introduced by the Cybercrimes Law would seem to be applicable, in addition to any sanctions stated in Federal Decree-Law No 45 of 2021 Regarding the Protection of Data Protection (the Data Protection Law).

The Cybercrimes Law further criminalises fraudulent activity by prohibiting the unauthorised obtaining of a movable asset, benefit, document or signature by using a fraudulent method or by using a false name or impersonating a false capacity online (Article 40). Fraudulent conduct in relation to credit or debit cards, and blackmailing or threatening another person online to perform or refrain from action, is also prohibited.

Similarly, the Cybercrimes Law prohibits the facilitation of money laundering by criminalising the transfer, acquisition, concealment or disguising of the source of illegal funds online (Article 30).

The maximum penalty under the Cybercrimes Law is a fine of AED5 million and/or life imprisonment (if committed by a natural person) (Articles 20–21). A legal person shall also be jointly and severally liable for the fines arising from its employees' violations if those violations were committed in the legal person's name or for its benefit (Article 58). Other penalties include the deportation of foreigners or supervision and control orders. An attempt to commit any of the above offences is also punishable.

Breach of Company Secrets

Under Article 354 of the Companies Law, a penalty of imprisonment for a maximum period of six months and a maximum fine of AED500,000 will be imposed on any of the following who utilise or disclose the company secrets or deliberately attempt to damage a company’s business:

• any legal or financial consultants, subscription managers, underwriters or parties participating in the incorporation procedures, or their delegates, who utilise data or information obtained thereby by the founding committee at any stage of company incorporation; and
• the chairperson, director or employees of the company.

Under Article 432 of the Penal Code, an individual who, by reason of their profession, craft, situation or art, is entrusted with a secret and who discloses it in cases other than those permitted by law, or who uses it for their own advantage or another person’s advantage, will be punished with imprisonment for a period of at least one year and/or a fine of at least AED20,000, unless the individual to whom the secret pertains has consented that it be disclosed or used.

The Data Protection Law became effective on 2 January 2022, and obliges companies to implement appropriate technical and organisational measures to protect personal data. Upon becoming aware of any personal data breach that would “prejudice the privacy, confidentiality and security” of a data subject’s personal data, controllers must inform the UAE Data Office of the breach and any subsequent investigation.

In the DIFC, trade secrets are protected under DIFC Law No 4 of 2019 (the DIFC Intellectual Property Law). Under Article 53(3) of the DIFC Intellectual Property Law, a person lawfully in control of a trade secret shall have the right to prevent any person from misappropriation of the trade secret, and shall have the right to claim compensation for any damage caused due to misappropriation thereof by any person. The Commissioner of Intellectual Property may do the following by way of remedy:

• order the wrongdoer to refrain from the violation and carry out all necessary acts to abide by the law;
• request the DIFC Registrar of Companies to temporarily suspend the DIFC licence of the person in violation of this law;
• order the confiscation of all materials, goods, tools, machines, equipment, signs and advertisements related to the violation and order their transfer/storage and/or destruction at the expense of the wrongdoer;
• impose a maximum fine of USD30,000; or
• impose injunctive relief by the DIFC court, provided that the application is made within three years of the discovery of the misappropriation or when it should reasonably have been discovered by the innocent party.

Under Article 15 of Cabinet Decision No 74 of 2020 Concerning the UAE List of Terrorists and the Implementation of UN Security Council Decisions Relating to Preventing and Countering Financing Terrorism and Leveraging Non-Proliferation of Weapons of Mass Destruction (the Sanctions Regulation), it is prohibited for a natural or legal person to make funds in its possession or under its management, or any financial services, available directly or indirectly to or in favour of any person or organisation listed on the Sanctions List unless authorised by the Executive Office of the Committee for Goods and Materials Subjected to Import and Export Control. The Sanctions List contains the names of the persons or organisations that are subject to the sanctions specified by virtue of the Security Council Sanctions Committee.

It is also a crime under Article 170 of the Penal Code for a person, themselves or through an intermediary, during war time, whether directly or through another country, to export goods or products or other items from the UAE to a hostile country, or to import any such materials from such a country. The penalties imposed are imprisonment for between ten and 25 years and a fine not to exceed double the value of the exported or imported goods, provided that it is not less than AED1 million.

Furthermore, under Article 3 of Federal Law No 43 of 2021 on the Goods Subject to Non-Proliferation Controls, customs departments are entitled to ban or restrict the importation or exportation of any resources, systems, equipment, technology, etc, stipulated as controlled commodities under law.

Federal Decree-Law No 4 of 2020 announced the abolition of the sanctions the UAE had in place against Israel under Federal Decree-Law No 15 of 1972 concerning the Arab League boycott of Israel. This reinforces the countries’ commitment to normalising diplomatic relations under the Abraham Accords, which were signed by the UAE, Israel, the USA and Bahrain in Washington, DC on 15 September 2020.

In June 2023, the UAE and Qatar reopened their embassies, restoring diplomatic relations following cessation in 2017.

Under Article 315 of the Penal Code, a person who conceals the evidence of a crime, assets subject to a court attachment order, or an instrument or document submitted to the investigative authorities in respect of the crime in order to obstruct justice will be punished by imprisonment if committed by an individual and a maximum fine of AED5 million if committed by a corporate.

Under Article 337 of the Penal Code, an individual who, having knowledge that a crime was committed, helps its perpetrator escape justice by concealing evidence will be punished by imprisonment or a fine.

Under Article 456 of the Penal Code, a person who knowingly conceals or possesses property resulting from a crime in which they did not participate will be punished by the penalty prescribed for the crime from which they know that property was obtained. However, if the culprit does not know such things have resulted from a crime, but has obtained them in circumstances which led them to believe that their sources are illegal, the culprit will be penalised by detention for a period not exceeding six months and/or a fine not exceeding AED20,000.

There are also criminal offences in relation to concealment under the Cybercrimes Law (see 3.9 Cybercrimes, Computer Fraud and Protection of Company Secrets).

Under Article 45-46 of the Penal Code, persons who conduct the following acts will be deemed to be accomplices:

• commit the crime in association with others;
• commit one of a series of acts that constitutes the crime;
• make use of another person for the perpetration of the act constituting the crime;
• agree with another person to commit the crime, and the crime is committed based on such agreement;
• give the offender a weapon, tools or any other thing which the latter has knowingly used in the commission of the crime; or
• intentionally aid the offender in any other way in the preparation, facilitation or completion of the crime.

Under Article 48 of the Penal Code, accomplices will be subject to the same punishment imposed on the perpetrator (although exemptions may apply for the perpetrator's spouse or relatives). However, under Article 53 of the Penal Code, where the characterisation of the crime or penalty is to vary according to the offender’s intention or knowledge of the circumstances, accomplices will be punished according to their knowledge and intention.

Money laundering is criminalised under the AML Law. A legal person will be held criminally responsible for a crime under the AML Law if it is committed in its name or on its behalf (although this is without prejudice to the personal liability of the perpetrator of that crime and the administrative penalties stipulated under the AML Law).

Under the AML Law, money laundering means transferring or moving proceeds or conducting any transaction with the aim of concealing or disguising their illegal source. The AML Law also provides offences relating to the funding of terrorism (Article 3).

The substantive money laundering offences are as follows (Article 2):

• transferring or moving proceeds or conducting any transaction with the aim of concealing or disguising their illegal source;
• concealing or disguising the true nature, source or location of the proceeds, as well as the method of their disposition, movement or ownership, or rights with respect to those proceeds;
• acquiring, possessing or using such proceeds upon receipt; and
• assisting the perpetrator of the predicate offence to escape punishment.

Article 2 of the AML Law provides that any person who intentionally commits any of the acts knowing that the funds are the proceeds of a felony or a misdemeanour shall be deemed to have committed a money laundering crime. It is also an offence under the AML Law to warn or tip off a person or reveal transactions under review, or reveal that the competent authorities are investigating such suspicious transactions.

The maximum penalty for breach of the AML Law is a fine of AED50 million and imprisonment for a period not exceeding ten years (if committed by an individual). Notably, the AML Law provides no time bar on the prosecution of money laundering and terrorist financing.

Obligations to Prevent Money Laundering

Financial institutions have specific obligations to prevent money laundering under the AML Law and Cabinet Decision No 10 of 2019 Concerning the Implementing Regulation of the AML Law (AML Implementing Regulation), and must:

• put indicators in place to identify suspicious money laundering transactions and submit Suspicious Transaction Reports (STRs), and they must update these indicators on an ongoing basis (Article 16);
• appoint a compliance officer in charge of reviewing the company’s compliance with the anti-money laundering laws and regulations (Article 21);
• identify and assess any risks of money laundering and terrorism financing when developing new and existing products or professional services (Article 23);
• prepare and file detailed STRs promptly with the Financial Information Unit (FIU) upon the identification of any plausible reasons to suspect money laundering or terror financing (Article 17);
• assess a client’s money laundering risk and carry out the prescribed client due diligence (CDD) in accordance with the risk level given to each client (Section 3);
• not carry out CDD if the financial institution, on reasonable grounds, believes that doing so may tip off the customer that it may be reported and, instead, make a STR to the FIU along with the reasons for not undertaking the CDD measures (Article 13) – the financial institution must not disclose to the customer its intention of reporting (or that it had reported) to the FIU that an investigation is ongoing (if reported) (Article 18); and
• maintain all records, documents, data and statistics for financial transactions and local and international commercial and cash transactions for no less than five years from the date of completion of the relevant transaction or termination of the business relationship with the customer. Documents relating to CDD measures undertaken by financial institutions, monitoring, account files, personal identification documents and STRs, and the analysis performed under these measures, must also be kept for no less than five years. These documents and files must be ready for inspection or produced upon request from the relevant authorities on an as-requested basis (Article 24).

Regulatory and Supervisory Bodies

The FIU is an independent unit within the UAE Central Bank, and has the authority to:

• request that financial institutions provide any information or additional documents relevant to the reports and information received by the FIU, in addition to other information the FIU considers necessary to perform its tasks within the time and in the form it determines; and
• exchange information with counterpart units in other states concerning STRs (where the UAE has entered into co-operation agreements with such states).

There are several supervisory authorities under the various AML laws and regulations, including the Ministry of Economy for Designated Non-Financial Businesses and Professions at the Federal Level. These authorities have the power to:

• conduct a risk evaluation of the possible occurrence of a crime in financial institutions;
• conduct control and office and field search operations of financial institutions; and
• issue decisions related to administrative penalties pursuant to the AML Law and its Executive Regulations and the mechanism of appealing against such penalties and keeping statistics about the measures taken and penalties imposed.

The AML Law empowers the supervisory authorities to impose continuing reporting obligations on financial institutions, which can be in addition to imposing administrative penalties, the arrest of responsible individuals and the disqualification of activities or operations.

In addition, the National Anti Money Laundering and Combatting Financing of Terrorism and Financing of Illegal Organizations (NAMLCFTC) Committee was established as the UAE's primary AML and CTF policymaking body. NAMLCFTC's remit includes:

• preparing and developing a national strategy to combat financial crime;
• determining and assessing risks on a national level;
• increasing information sharing between the various bodies represented therein; and
• co-ordinating with domestic and international authorities to identify high-risk countries and instructing supervisory authorities to implement necessary countermeasures.

Specialist money laundering courts have been established across the UAE. The Federal Judicial Council also recently approved the creation of specialist federal prosecution entities to address economic crimes and money laundering. This aligns with the UAE's strategy to embed a robust financial crime compliance framework that is aligned with FATF recommendations.

There are no uniform or common defences for white-collar offences in the UAE. The existence of an effective compliance programme in particular is not a defence to a white-collar crime, although regulated entities may incur lower sanctions where an offence occurred notwithstanding a robust compliance programme.

There is no de minimis threshold for bribery offences.

The prohibitions contained in the Competition Law do not apply to certain sectors, activities and services, such as the telecommunications and financial sectors, nor to acts carried out by establishments based on a decision or authorisation granted by the federal government or a local government, or under their supervision.

Furthermore, under Article 7 of the Competition Law, the Minister of Economy can issue a decision excluding restrictive agreements or practices related to the dominant position from having to abide by the provisions of Articles 5 and 6.

Under Article 232 of the Penal Code, a person who conspires to commit a crime shall be exempt from the relevant punishments if they report the conspiracy and the participants to the competent authorities before the commission of any of the specified crimes. Similarly, under Article 284, if a briber or bribe-taker informs the judicial or administrative authorities of the crime before the crime is discovered, the briber or bribe-taker will be exempted from punishment.

Under Article 22(6) of the AML Law, the court may commute or set aside the sentence against any perpetrator of an AML crime if they provide the judicial or administrative authorities with information relating to a money laundering offence and the information provided leads to the discovery of a crime, the identification of its perpetrators or their arrest.

Under Article 457 of the Penal Code, an offender under Article 456 of the Penal Code (see 3.11 Concealment) will be exempt from punishment if they provide details of the matter to the authorities without delay, and before the matter is disclosed to the judicial or administrative authorities. The court may, however, exempt them from punishment where they inform the authorities after the crime is disclosed if the information results in the arrest of offenders.

Penalties imposed as a result of violations of the provisions of the Competition Law may be reconciled under Article 15 of Cabinet Decision No 37 of 2014, provided that this takes place before a criminal lawsuit is filed and the parties pay not less than double the minimum fine. If any of the parties abstain from implementing what has been reconciled, the competent authority shall refer the violations to the competent court.

Under Article 61 of the Cybercrimes Law, the court, based on a request of the public prosecutor, may reduce or exempt from punishment any perpetrators who gave information to the judicial or administrative authorities related to any of the crimes pertaining to the security of the UAE whenever this leads to discovering the crime and its perpetrators, or to proving the crime or to the arrest of any of the perpetrators.

Whilst there is a general obligation to report knowledge of a crime under Article 323 of the Penal Code, there is no over-arching whistle-blower protection in the UAE at a federal level. However, in April 2022, the DFSA established its Whistleblowing Regime applicable to DFSA-regulated entities.

Under the DFSA Rulebook and Article 68A of DIFC Law No 1 of 2004 (the Regulatory Law), a whistle-blower who has made a qualifying disclosure to a specified person, whether anonymously or not, shall not, for reason of having made the disclosure:

• be subject to civil or contractual liability;
• have any contractual, civil or other remedy or right enforced against them by another person; or
• be dismissed from their current employment, or otherwise subject to action by their employer (or its related parties) that is reasonably likely to cause them detriment.

A whistle-blower will also have the right to apply to court for relief, should there be any violation of these protections. It is important to note, however, that the statutory protections under the Regulatory Law do not guard against any criminal liability that may arise from a whistle-blower's disclosures for reasons such as breach of confidence or defamation.

In addition, under Dubai Law No 4 of 2016 on Financial Crime (the Financial Crime Law), the Dubai Economic Security Centre will provide protection to a whistle-blower where the disclosure provided by the whistle-blower is true, relates to an activity that may impact the economic security of Dubai and is made to the Dubai Economic Security Centre.

The Financial Crime Law provides the following as whistle-blower protection:

• necessary protection at their place of residence and workplace;
• non-disclosure of information related to their identity and location; and
• protection from discrimination or mistreatment.

In the DIFC, Article 64 of DIFC Operating Law No 7 of 2018 provides whistle-blower protection to a person who makes a disclosure of information to the DIFC Registrar of Companies, or a DIFC entity’s auditor or member of the auditor team, or a director or other officer of a DIFC entity. In order to attract protection, the disclosure must:

• include the identity of that person;
• relate to a reasonable suspicion that the registered person has or may have contravened a provision of this Law, the Regulations or any other legislation administered by the Registrar; and
• be made in good faith.

The DIFC Operating Law provides a whistle-blower protection from:

• any legal or contractual liability for making that disclosure;
• enforcement of any contractual, civil or other remedy or right by another person for making that disclosure, or any consequence resulting from such disclosure; and
• dismissal from their current employment, or any action by the employer or any related party of the employer which is reasonably likely to cause detriment to that person.

Under Article 27 of the AML Law, no penal, civil or administrative responsibility shall be borne by supervisory authorities, the FIU, law enforcement agencies, financial institutions and designated non-financial businesses and professions, the Boards of Directors of such agencies or their employees and duly authorised representatives due to providing any information required or exceeding any restriction imposed by a legislative, contractual or administrative provision to ensure the confidentiality of information, unless the reporting is proved to be malicious and for the purpose of harming a third party.

The burden of proof will be placed on the Public Prosecution to prove liability of the perpetrator for satisfying the elements of the crime. In the UAE, there are no specific standards of proof adhered to in the courts; it is within the discretion of the judge(s) adjudicating the case to reach the final decision on liability.

When a defendant is deemed guilty of a white-collar offence by a Criminal Court, the sentence provided in the relevant law will be enforced. Any aggravating circumstances noted in the relevant law will be taken into account when imposing the sentence. UAE criminal law does not recognise deferred prosecution agreements, non-prosecution agreements or plea agreements, so there are no rules or guidelines governing the assessment of penalties in the event that such agreements are entered into.