Article 27 of the UAE’s Penal Code (Federal Law No 31 of 2021, as amended by Federal Decree Law No 36 of 2022) (the “Penal Code”) classifies offences as felonies, misdemeanours and contraventions. Each crime requires two elements:

• A material element – an act or omission violating a legal provision.
• A mental element – either by intent or error. Intent exists when the offender deliberately commits or omits an act deemed criminal, aiming to produce a direct or legally recognised criminal effect.

Intent is generally required, while motive is not necessary for punishment.

Attempting to commit an offence (Article 35 of the Penal Code) is punishable, defined as an intent to accomplish a crime, which has been prevented or has fallen short of the intended action for reasons beyond the offender’s will. It is the commission of an act that is deemed a constituent part of the basic material element of the crime.

Mere intention or preparation does not constitute an attempt, unless the law stipulates otherwise.

In addition to the Penal Code, Sharia provides for certain crimes with retaliation (qisas) and blood money (diya) as potential punishments. Further, cybercrimes and the misuse and abuse of online technologies are addressed in Federal Decree Law No 34 of 2021 on Combating Rumours and Cybercrimes (the “Cybercrimes Law”).

In the UAE, the Public Prosecution bears the burden of proof to establish the defendant’s liability by satisfying all elements of the offence. Under Article 2 of the Penal Code, a defendant is innocent until proved guilty. There are no specific standards of proof; judges have full discretion to assess the evidence and determine liability.

Limitation periods in the UAE vary by offence category and are governed by Federal Decree-Law No 38 of 2022 (the “Criminal Procedural Law”):

• felonies – 20 years;
• misdemeanours – five years; and
• contraventions – one year.

These periods begin from the date the crime was committed (Article 21).

There is no specific statute of limitations addressing concealed or continuing offences. The Penal Code states that no time limitations apply to:

• crimes against State security, embezzlement, or damage to public funds (Articles 227 and 270); or
• crimes relating to public office (ie, bribery), including civil action (Article 286).

Limitation rules also differ in the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM), depending on the cause of action.

Generally, a criminal offence occurs where it took place within the jurisdiction (Article 17 of the Penal Code). However, there are specific provisions that enable the courts to exercise extraterritorial jurisdiction.

Offences with extraterritorial effect include (Article 21 of the Penal Code):

• crimes against internal or external State security, its constitutional regime or bonds issued under legal licence, or in connection with its stamps, or falsification or counterfeiting of official documents or seals;
• crimes of falsification, counterfeiting or forgery of the State’s money, or circulation or possession with intent to circulate, whether such acts are committed in or outside the State;
• crimes of falsification, counterfeiting or forgery of coins or paper money legally circulated in the State, or circulation or possession with intent to circulate; or
• premeditated murder of a citizen of the State.

Under Article 22 of the Penal Code, a person found in the State after committing the following crimes, whether as a perpetrator or an accomplice, is subject to extraterritorial effect:

• destruction or interruption of international communications;
• drug or human trafficking;
• piracy and international terrorism; or
• money laundering crimes.

Article 285 of the Penal Code extends jurisdiction to bribery offences committed outside the UAE if:

• the offender or victim is a UAE citizen;
• the crime involves UAE public/private sector employees; or
• UAE public funds are affected.

Federal Law No 39 of 2006 on International Judicial Co-operation in Criminal Matters (as amended) governs international judicial co-operation in criminal matters. Extradition requests must meet key conditions (Article 7):

• the offence is punishable by ≥ one year imprisonment in both countries; and
• if in relation to the execution of a sentence, the remaining sentence is ≥ six months.

The offence need not be identically defined in both jurisdictions.

The UAE adheres to:

• multilateral treaties, including the Riyadh-Arab Agreement for Judicial Co-operation (the “Riyadh Convention”), which was signed by most Arab countries, which applies to civil, commercial and administrative matters. Article 38 provides that each contracting party must undertake to extradite the persons in its territory and against whom an accusation is brought by the competent authorities or by a judgment issued by the legal authorities of any other contracting parties; and
• bilateral treaties for judicial co-operation including with Australia, China, Egypt, France, India, Iran, the Kyrgyz Republic, Nigeria, Pakistan, Spain, the United Kingdom, Vietnam and South Africa (some cover criminal and civil matters, others only criminal or civil/commercial).

Extradition may be rejected if jurisdictional conflicts arise or if dual criminality is not met.

Many extraditions rest on active co-operation with INTERPOL and Europol. Operation HAECHI VI, conducted between April and August 2025, saw the UAE join 40 countries to combat cyber-enabled financial crimes, such as investment fraud, phishing, and money laundering. The operation recovered USD439 million globally, including significant seizures within the UAE. Other recent extraditions include Kinahan gang member Sean McGovern to Ireland, a drug-trafficking suspect to the Netherlands, and the arrest of three of Europe’s most wanted fugitives in Dubai.

Between 2021 and 2022, the UAE handled 521 money laundering cases, collaborating with international law enforcement agencies to arrest 387 individuals and confiscate AED4 billion (approximately USD1.09 billion). From 2022 to 2024, the Dubai police tackled 500+ cases, exchanging 1,733 financial crime-related dossiers with international partners.

The Companies Law

Under Article 21 of Federal Decree-Law No 32 of 2021 (the “Companies Law”), a company acquires “legal personality” upon incorporation, creating a corporate veil between the company and its shareholders/managers. This may be pierced in certain cases of fraud, deception or gross error, as confirmed by the Dubai Court of Cassation.

The Penal Code

Article 66 of the Penal Code establishes that legal persons (excluding government entities) are criminally liable for offences committed by their representatives, directors or agents acting in favour of or on behalf of the company.

However, the Dubai Court of Cassation has held that liability does not apply if the employee acted negligently, without intent or not in the name of the company.

The maximum penalty is a fine of AED5 million. However, victims may also seek compensation under the Civil Procedures Law.

Managers’ Liability

Managers have a statutory duty of care, and may be personally liable for:

• acts causing harm;
• breaches of obligations;
• gross misconduct or negligence; and
• abuse of rights or any other legal breaches (eg, fraud).

Liability of the Parent Company

There is no automatic law which imposes liability on a parent company for the acts of its subsidiaries. Liability may arise if:

• there is direct involvement in the wrongful act;
• there is fraud or abuse that justify piercing the veil; or
• the subsidiary is a branch which lacks an independent legal personality and serves as an extension of the parent company’s operations.

The UAE does not recognise corporate liability for “failure to prevent” offences.

Under Article 213 of the Criminal Procedural Law, once a defendant is found guilty of a white-collar offence, the prescribed sentence in the relevant law is enforced. Aggravating circumstances outlined in the law are considered during sentencing. Defendants may appeal a judgment/sentence from the court of first instance within 15 days of the verdict. UAE criminal law does not recognise deferred prosecution agreements, non-prosecution agreements or plea agreements, so there are no rules or guidelines for penalty assessment under such arrangements.

There is no specific law requiring courts to consider corporate culture or remediation as mitigating factors and there are no known cases where these have influenced sentencing. Under Article 97 of the Penal Code, potential mitigating factors include the young age of the perpetrator and committing the crime for non-malicious motives.

Under Article 23 of the Criminal Procedural Law, victims may seek compensation through two main avenues:

Criminal Proceedings

A victim can request that a civil claim be annexed to the criminal case:

• the criminal court considers the claim after criminal liability is established; and
• per Article 27, the claim is then transferred to the civil court to determine the quantum of damages, based on the conviction.

Civil Proceedings

Victims may also file a standalone civil claim for harm suffered. To succeed, they must prove:

• the act was committed;
• damage was sustained; and
• a causal link between the act and the damage.

There is no class action regime or equivalent collective redress mechanism for white-collar crime in the UAE. However, multiple victims could seek to have their claim for compensation heard by the criminal court, as noted above.

White-collar crime prosecutions follow the Criminal Procedural Law. Article 9 gives the public prosecutor exclusive jurisdiction to initiate and oversee criminal proceedings.

The process is as follows:

• A complaint is filed with the public prosecution or a law enforcement officer (Article 12), or is initiated by the public prosecutor.
• Law enforcement officers investigate and compile a matter file, including conducting interviews and taking statements from the complainant, the accused, and other witnesses.
• The matter file is referred to the public prosecutor, who may conduct further investigations and may request the assistance of law enforcement officers with gathering evidence. For more serious offences, the public prosecutor’s office may conduct the investigation itself.
• The public prosecutor will consider all the evidence before deciding whether to issue an indictment order against the accused and refer the matter to court, or dismiss the complaint.

There are specialist departments within the police and public prosecutor’s office for financial crimes, including bribery, money laundering, abuse of power, embezzlement and the misuse of funds, and cybercrimes.

The UAE has been under international pressure (eg, from the Financial Action Task Force (FATF), EU and international financial institutions) to align its AML/CFT framework with global standards. In recent years, the UAE has taken substantial steps to fight financial crime, resulting in it being removed from the FATF grey list in February 2024 and the EU’s list of high-risk third countries in July 2025. Importantly, the UAE has committed to maintaining momentum in this area. This commitment is evident in its prioritisation of robust enforcement and implementation of significant reforms, including the creation of specialised prosecution units and courts, increased regulatory sanctions and high-profile enforcement actions.

The public prosecutor may investigate independently and will generally do so for more serious offences. There are no rules regarding the initiation of investigations that are specific to white-collar offences.

Under Article 8 of the Criminal Procedural Law, criminal investigations should be conducted in Arabic. The public prosecutor can order for translators to be present at interviews and other relevant parts of an investigation.

The public prosecutor can issue a summons or an arrest warrant, or order a travel ban against the accused (Article 99).

A complainant can appeal the public prosecutor’s decision to dismiss an allegation within ten days (Articles 134–135). The Court of Appeal will hear the appeal and can conduct a complementary investigation. If it finds there are sufficient grounds for the matter to be pursued, it will send the matter file back to the public prosecutor and order it to be referred to court (Article 138).

Under the Criminal Procedural Law (Articles 70–73), the public prosecutor may:

• enter and search premises, and seize items (eg, documents, weapons and electronic media) linked to the crime;
• seize all correspondence, letters, papers, printed materials and parcels belonging to the accused at the post office; and
• monitor and record conversations (wired/wireless), with the approval of the Attorney General.

The public prosecutor can order the accused to surrender anything deemed relevant (Article 76).

The public prosecutor can interview witnesses requested by the accused or other interested parties (Article 86).

The public prosecutor can also appoint an expert to prepare a report (Article 94). This is common in complex or fact-intensive matters. The expert’s report is very often determinative of the outcome in relation to the matters covered by it.

Article 83 of the Penal Code allows the court to confiscate property connected to a crime upon conviction – whether used, intended to be used, or derived – as a complementary penalty.

Under Federal Decree-Law No 20 of 2018, as amended (the “AML Law”), “funds” are defined to include tangible, intangible, electronic and digital assets. Under Article 5 of the AML Law, the public prosecutor or the court may order the freezing and seizure of suspicious assets until the investigation or trial is complete. Article 18 of the AML Law provides for such seizure/freezing to be carried out in the context of supporting a foreign investigation or trial.

The UAE has made a significant investment into integrating AI and advanced technologies into the investigation and enforcement of white-collar crime. While comprehensive legislation is still evolving, several regulatory instruments guide responsible use. The Artificial Intelligence Strategy 2031 builds on the original 2017 strategy to position the UAE as a global leader and integrate AI into all government services.

Frameworks Addressing Data Protection

The use of AI can give rise to privacy concerns and the UAE has begun to implement some frameworks to address the protection of data. The Federal Decree-Law No 45 of 2021 Concerning the Protection of Personal Data (the “PDPL 2021”) came into force on 2 January 2022. The executive regulations setting out further detail on the data protection requirements businesses must meet are yet to be issued, and it is not clear when this will occur. The PDPL 2021 is largely in line with international privacy practices. Both the DIFC and ADGM have their own data protection frameworks: the DIFC Data Protection Law No 5 of 2020 and the ADGM Data Protection Regulations 2021 (the “ADGM Regulations”). These frameworks and the PDPL 2021 address AI-related data processing and privacy concerns.

In the DIFC, Practical Guidance Note No 2 of 2023 published by the DIFC courts regulates the use of large language models and generative AI in DIFC court proceedings, requiring transparency, accuracy and risk management when using AI during proceedings.

The UAE published its International Stance on Artificial Intelligence Policy, confirming that it has also adopted an AI Principles and Ethics framework, which promotes transparency, accountability, data protection, risk assessment, and ethical use.

Enforcement Authorities’ Use of AI

Enforcement authorities actively use AI: the UAE Public Prosecution announced a strategy to digitise operations using AI, blockchain and emerging technologies such as the metaverse. These tools are intended to reduce investigation time, while improving accuracy, security and transparency. The Ministry of Interior, through its Cybercrime Combating Department, has also confirmed its use of AI to fight cyber and economic crime, using predictive analytics and data analysis to detect threats, uncover hidden connections, and prevent breaches and phishing attempts.

The ADGM’s 2025–2026 Business Plan sets out how technologies will be leveraged (including through the development of AI and other automation tools, such as AI agents) to facilitate the detection and investigation of crimes, and enforce penalties. Notably, in September 2025 in Abu Dhabi, UK firm Themis launched its AI Investigator, which automates large data processing and due diligence. The AI Investigator has been promoted as a tool capable of analysing millions of data points in seconds to unmask hidden links to financial crimes. It is unclear whether the Abu Dhabi authorities will leverage such technology to assist in investigations, but it is plausible given the scale of Abu Dhabi’s commitment to investing in AI over the next two years (AED13 billion between 2025 and 2027 as part of its “Falcon Economy” vision).

UAE law does not generally mandate that internal investigations be conducted (save, for instance, in the employment context where an employee can only be terminated without notice after an internal investigation has been conducted to prove wrongdoing, see Article 44 of Federal Decree-Law No 33 of 2021, the “Labour Law”).

However, the AML Law requires financial institutions and designated non-financial businesses and professions (DNFBPs) to establish internal policies, controls and procedures approved by senior management to manage and mitigate risks, and to apply these across all majority-owned branches and affiliates (Article 16(d)).

Similarly, the ADGM Regulations and the Dubai Financial Services Authority (DFSA) Rulebook require regulated entities to maintain systems and controls to detect and prevent financial crime, including monitoring for suspicious activity or transactions in relation to potential money laundering or terrorist financing. See also 4.4 Whistle-Blower Protection for more detail.

While in most cases, internal investigations are not legally mandated, they are often conducted in response to incidents or regulatory inquiries. Regulators may expect to see the outcome of such investigations to assess compliance, determine facts and decide sanctions. There is no general obligation to share findings with authorities unless required by regulators or otherwise required pursuant to the general obligation in the Penal Code to report crimes in the UAE.

PDPL 2021 (Article 4) prohibits the processing of personal data without the consent of the owner, except in some cases, including where:

• the processing is necessary to protect a public interest;
• the processing is necessary for claiming legal rights or as part of a judicial or security procedure; or
• a controller or data subject needs to meet obligations or exercise employment or social protection rights.

While the DIFC and ADGM recognise common-law legal privilege, there is no statutory recognition under federal UAE law and, although legal advice may be confidential, the authorities can still compel its disclosure.

See 2.1 White-Collar Enforcement Authorities.

Deferred prosecution agreements are not recognised under UAE law.

Although not an example of deferred prosecution, it is possible for a claimant and a defendant to enter into reconciliation or an amicable settlement prior to trial in certain circumstances. In practical terms, this is more likely to result in criminal charges not being pursued where the amicable settlement is reached at the investigation stage (before the complaint is referred to court).

Article 236 of the Penal Code provides a list of crimes for which the public prosecutor may accept conciliation in return for the defendant’s payment of an amount between AED50,000 and AED500,000. These include cases of defamation against the State, the dissemination of false or malicious news, and a public assembly that threatens state security.

These settlements do not appear to have been contingent on the implementation of compliance improvements. It is more likely that such remediation will be required by regulators where regulated entities have committed breaches of the applicable regulatory framework.

Criminal Offences

The Penal Code sets out criminal offences applicable to companies. See 1.5 Corporate and Personal Liability for details of corporate liability under Article 66 of the Penal Code. Sentences that can be imposed on legal persons under Article 66 include fines, forfeiture and criminal measures provided for the crime under the Penal Code. If the Penal Code provides a principal penalty other than a fine, the penalty will be limited to a fine not exceeding AED5 million. The corporate liability of legal persons does not prevent the punishment of the offender with penalties prescribed under the Penal Code.

Corporate Fraud

Under Article 451 of the Penal Code, a company that uses fraudulent practices to deceive a victim and cause them to surrender a legal right will be punished with a fine of AED5 million. Such conduct can include:

• assuming a false name or quality;
• taking possession of any movable property or written instrument;
• obtaining any signature upon that instrument; or
• cancelling, destroying or amending the instrument.

A company will also be punished with the same penalty if its representatives, directors or agents, acting in its favour or on its behalf, alienate any real or movable property in the following circumstances:

• being aware that it is not owned by the company;
• being aware that they have no right to dispose of it;
• after having previously disposed of it where the act injured others; or
• concluding any agreement to dispose of it.

Bribery is criminalised under the Penal Code, and applies to domestic and foreign persons in the UAE whose actions occur in or outside the UAE, if the results of such actions have or were intended to have effect in the UAE.

Bribery in the Public Sector (Articles 275–287)

The Penal Code prohibits a person or company from directly or indirectly promising, offering or granting a bribe to a public servant, a person assigned to a public service, a foreign public servant or an employee of an international organisation in return for:

• performing or omitting acts within or against their duties; and/or
• using real or alleged influence for the purpose of obtaining an undeserved advantage from a public department or authority.

Under Federal Decree-Law No 49 of 2022 on Human Resources in the Federal Government (the “UAE Human Resources Law”), public sector employees are prohibited from accepting gifts unless they are symbolic, marked with the name of the gift bearer, and provided through an assigned government unit.

Bribery in the Private Sector

It is a criminal offence for a manager of an entity or establishment in the private sector, or for someone who works in any capacity, to solicit or accept, directly or indirectly, for themselves or for another person, a bribe in return for performing or omitting acts within or against their duties (even if they do not intend to effect the act or to refrain from it, or if the bribe comes after the act or omission).

Providing a bribe in the private sector is addressed under Articles 278–279 of the Penal Code.

A bribery conviction will lead to a fine equivalent to the bribe, provided that the fine is not less than AED5,000 (Article 283). The maximum sentence is five years’ imprisonment.

The bribe itself will also be subject to confiscation.

Facilitation payments (being a small bribe made to public officials with the intention of expediting a government administration process) would constitute bribes under the Penal Code and are therefore prohibited.

There are also emirate-level offences in relation to bribery.

There is no general obligation to prevent bribery in the UAE, nor is there an obligation to maintain a compliance programme. However, under Article 282 of the Penal Code, any person who acts as an intermediary between the briber or the bribe-taker can also be imprisoned for a maximum period of five years.

In the DIFC, rule 5.3.20 of the DFSA General Module Rule Book requires DFSA “Authorised Persons” to establish and maintain reasonable systems and controls that ensure the entity and its employees do not engage in conduct that may constitute a financial crime, nor facilitate others to engage in such conduct. There is a similar requirement under rule 3.3.20 of the ADGM General Rulebook.

Article 323 of the Penal Code imposes a positive general obligation to report crimes, including bribery. In addition, Article 15 of the AML Law requires financial institutions, DNFBPs and virtual asset service providers to file Suspicious Activity Reports (STRs) with the UAE Intelligence Unit if they suspect that funds are linked to a crime. Failure to report may result in fines, sanctions and/or imprisonment. Free zone regulators, such as the DIFC’s DFSA and the ADGM’s Financial Services Regulatory Authority (the “FSRA”), impose similar obligations.

Insider dealing is criminalised in the UAE under Federal Law No 4 of 2000 Concerning the Emirates Securities and Commodities Authority and Market (the “Securities Law”).

Article 37 of the Securities Law prohibits the exploitation of undeclared information that may affect the prices of securities to gain a personal benefit. Article 39 also prohibits individuals from dealing in securities using undeclared or non-disclosed information which they may know by virtue of their office.

Market Manipulation

Article 36 of the Securities Law prohibits the submission of any untrue details, statements or information that affect the market value of securities or investment decisions.

The penalties for violating these provisions include imprisonment for a maximum period of three years and/or a maximum fine of AED1 million. In addition, a person found guilty of insider trading in the UAE, or the equivalent in any other jurisdiction, may not act as a director in the UAE at any time. Any dealing carried out by any person contrary to these prohibitions under the Securities Law will be deemed null and void (Article 37).

DIFC and ADGM Law

DIFC Law No 1 of 2012 (the “Markets Law”) (as amended) also provides restrictions on the disclosure and manipulation of insider information inside or outside the DIFC if the conduct affects the DIFC markets or users of the DIFC markets. It therefore governs entities listed on NASDAQ Dubai. The consequences for violating these provisions are civil in nature.

Article 58 of the Markets Law restricts insiders, in the DIFC or elsewhere, from dealing, directly or indirectly, or attempting to deal in an investment (ie, securities or derivatives, but excluding commodity derivatives) on the basis of insider information. Article 59 of the Markets Law prohibits the disclosure of insider information by restricting insiders from disclosing inside information to another person, other than in the necessary course of business. An insider is also prohibited from inducing or encouraging another person by direct or indirect means to deal in the investments in which the insider has inside information.

Market abuse is also prohibited under the Markets Law, including making misleading statements and impressions.

The DFSA may impose a broad range of sanctions in respect of the contravention of the Markets Law on such terms as it may direct by way of penalty.

The insider dealing and market abuse regime in the ADGM is similar to that of the DIFC.

Tax evasion under Federal Decree-Law No 28 of 2022 on Tax Procedures (the “Tax Procedures Law”) is defined as the use of illegal means to reduce the amount of tax due, non-payment thereof or the refund of a tax that a person did not have the right to have refunded under any UAE tax law.

A company that engages in the following fraudulent conduct in relation to tax will be liable to pay a fine not exceeding three times the amount of the evaded tax (Article 25):

• deliberately failing to settle any payable tax or administrative penalties;
• deliberately understating the actual value of the relevant business and failing to consolidate its related businesses, with the intent of remaining below the required registration limit;
• imposing and collecting amounts from their clients as a tax without being registered; and
• deliberately decreasing the payable tax through tax evasion or complicity in tax evasion.

A company that engages in the following fraudulent conduct in relation to tax will be liable to pay a fine not exceeding AED1 million (Article 25):

• deliberately submitting wrong information and incorrect data to the Federal Tax Authority (FTA);
• deliberately concealing or destroying documents or other materials that they are required to keep and submit to the FTA;
• stealing, misusing or causing the destruction of documents or other materials in the possession of the FTA; and
• preventing the FTA’s employees from performing their duties.

There is no specific obligation to prevent tax evasion under Federal Law, except for the DFSA and ADGM requirements for the maintenance of systems and controls noted in 3.3 Anti-Bribery Regulation. However, the FTA does operate the Raqeeb whistle-blower programme, which allows individuals to confidentially report tax violations and evasion, including corporate tax, VAT and excise tax offences, with potential monetary rewards for credible information.

Article 26 of the Companies Law requires UAE companies to keep accounting records with details of their dealings in order to reveal the company’s financial situation, accurately and at any time. The records must be maintained at the company’s main office for no less than five years as of the date of the end of the company’s fiscal year. The accounts and auditor’s report must also be provided to the securities and commodities authority and any competent authority within seven days of the general assembly meeting at which the accounts were submitted (Article 238). The manager of a company is responsible for the preparation of the profit-and-loss account and annual report regarding the company’s activity and financial position. This must be presented to the shareholders by way of a general assembly meeting within three months of the end of the fiscal year (Article 87). A company that provides information that is false or contrary to law may be fined between AED200,000 and AED1 million (Article 346). Any manager or director who deliberately gives false information to conceal the company’s financial position will also face imprisonment of between six months and three years and/or a fine of between AED100,000 and AED500,000 (Article 349). Article 122(1) of Companies Law No 5 of 2018 (the “DIFC Companies Law”) requires companies in the DIFC to keep accounting records with details of their transactions in order to provide evidence of the financial position of the company at any time with reasonable accuracy. If Article 122 is not complied with, or if the following requirements are not met, the company will be liable to a fine of USD25,000. The company’s accounting records must be:

• kept at such a place as the directors think fit, except where otherwise prescribed in the regulations;
• preserved by the company for at least six years from the date upon which they were created, or for a period as prescribed by the regulations; and
• open to inspection by an officer or auditor of the company at all reasonable times.

A company must file a copy of the accounts, the auditor’s report and, in the case of a public company, a copy of the directors’ report with the Registrar of Companies, within 30 days after the circulation thereof to shareholders. If a company fails to comply with these requirements in relation to accounts, it will be subject to a fine of USD10,000.

Furthermore, a company must not knowingly or recklessly omit to provide information to an auditor which the auditor reasonably requires, nor provide information that is false, misleading or deceptive. A person will be liable for a fine of USD5,000 for failure to co-operate with the auditor.

The provisions in relation to financial record-keeping in the ADGM are similar to those of the DIFC.

Federal Law No 36 of 2023 on the Regulation of Competition (the “Competition Law”) introduced a significant overhaul of the UAE’s competition regime. It applies to all establishments with regard to their economic activities in the UAE and exploitation of intellectual property rights inside and outside the UAE, as well as economic activities conducted outside the UAE that affect competition in the UAE.

Article 5 of the Competition Law prohibits establishments from entering into restrictive agreements with the aim of violating, reducing, preventing or restricting competition.

Article 6 of the Competition Law prohibits establishments that enjoy a dominant position in the relevant market, or an important and influential part thereof, from conducting any acts or works that may lead to an abuse of the dominant position and to the violation or reduction or prevention or restriction of competition.

Violations of Articles 5 and 6 will give rise to a liability consisting of a fine of a minimum of between AED100,000 and 10% of the annual total sales realised by the violation during that fiscal year (Article 24). If the annual total sales cannot be calculated, then the fine will be between AED500,000 and AED5 million.

The overhaul of the Competition Law was implemented via Cabinet Ministerial Decree No 3 on 31 March 2025. Key changes include:

• the introduction of a mandatory pre-merger notification regime;
• expanded enforcement powers for the Ministry of Economy, including dawn raids and compulsory information requests; and
• narrowed exemptions, requiring specific legal authority for sectoral exemptions, and Cabinet-level identification for government-owned entities.

Under Federal Law No 15 of 2020 on Consumer Protection (the “Consumer Protection Law”) and Cabinet Decision No 66 of 2023 (the “Consumer Protection Implementing Regulations”), a supplier is subject to several obligations in relation to consumers, including:

• to affix details of the product onto the goods;
• not to display, offer, promote or advertise any goods or services that are misleading and may inflict damage to consumer interest or health in the course of ordinary usage;
• to provide a clear warning if the usage of goods encompasses any risk;
• not to hide any goods or refrain from selling them with an aim to control the market price or force the purchase of certain quantities or the purchase of other goods with them, or receive a price higher than the advertised price;
• to implement all warranties and required after-sales services as may be published by the Ministry of Economy;
• to provide necessary spare parts for the operation and repair of commodities under certain circumstances;
• to inform the body concerned and the consumer of any potential risk and precautionary measures immediately after discovering any defect in the goods or services whereby the goods or services upon their proper use may injure the consumer;
• to recall the goods from the local market and consumers upon discovery of a defect, and to replace, repair or pay back the value of the withdrawn goods to the consumer; and
• not to discriminate between consumers in the sale of the goods or utilisation of the service.

A violation of the Consumer Protection Law could result in imprisonment and/or a fine of up to AED2 million. The competent court may also order the confiscation or destruction of the product or object of the crime and the materials and tools used in its production.

The Cybercrimes Law

Offences in relation to cybercrimes and computer fraud are governed by the Cybercrimes Law.

They include accessing electronic sites illegally or without permission, or extending the limits of that permission, as well as obtaining, modifying or forging the contents on an electronic site. Disabling access, compromising information systems, conducting denial-of-service attacks and using a false or misleading address (or an address that belongs to a third party) are also prohibited.

The Cybercrimes Law contains a provision that makes it a criminal offence to collect, store or process personal data of UAE nationals or residents in violation of other laws (Article 6). The criminal penalties introduced by the Cybercrimes Law would seem to be applicable, in addition to any sanctions stated in PDPL 2021.

The Cybercrimes Law further criminalises fraudulent activity by prohibiting the unauthorised obtaining of a movable asset, benefit, document or signature by using a fraudulent method or by using a false name or impersonating a false capacity online (Article 40). Fraudulent conduct in relation to credit or debit cards, and blackmailing or threatening another person online to perform or refrain from action, is also prohibited.

Similarly, the Cybercrimes Law prohibits the facilitation of money laundering by criminalising the transfer, acquisition, concealment or disguising of the source of illegal funds online (Article 30).

The maximum penalty under the Cybercrimes Law is a fine of AED4 million and life imprisonment (if committed by a natural person) (Articles 20–21). A legal person will also be jointly and severally liable for the fines arising from its employees’ violations if those violations were committed in the legal person’s name or for its benefit (Article 58). Other penalties include the deportation of foreigners or supervision and control orders. An attempt to commit any of the above offences is also punishable.

Breach of Information

Company secrets

Under Article 354 of the Companies Law, a penalty of imprisonment for a maximum period of six months and a maximum fine of AED500,000 will be imposed on a broad range of persons, including directors or employees, who utilise or disclose company secrets or deliberately attempt to damage a company’s business.

Under Article 432 of the Penal Code, an individual who, by reason of their profession, craft, situation or art, is entrusted with a secret and who discloses it in cases other than those permitted by law, or who uses it for their own advantage or another person’s advantage, will be punished with imprisonment for a period of at least one year and/or a fine of at least AED20,000, unless the individual to whom the secret pertains has consented that it be disclosed or used.

Personal data

PDPL 2021 obliges companies to implement appropriate technical and organisational measures to protect personal data. Upon becoming aware of any personal data breach that would “prejudice the privacy, confidentiality and security” of a data subject’s personal data, controllers must inform the UAE Data Office of the breach and any subsequent investigation.

Trade secrets

In the DIFC, trade secrets are protected under DIFC Law No 4 of 2019 (the “DIFC Intellectual Property Law”). Under Article 53(3) of the DIFC Intellectual Property Law, a person lawfully in control of a trade secret has the right to prevent any person from misappropriation of the trade secret, and has the right to claim compensation for any damage caused due to misappropriation thereof by any person. The Commissioner of Intellectual Property may impose a broad range of sanctions.

The UAE sanctions regime provides targeted financial sanctions against individuals and entities on the UN Consolidated Sanctions List and the Local Terrorism List issued by the UAE. Although the UAE is mandated to implement UN sanctions, it tends to adopt resolutions only on an ad hoc basis.

Under Article 15 of Cabinet Decision No 74, it is prohibited for a natural or legal person to make funds in its possession or under its management, or any financial services, available directly or indirectly to or in favour of any person or organisation listed on the Sanctions List unless authorised by the Executive Office of the Committee for Goods and Materials Subjected to Import and Export Control. The Sanctions List contains the names of the persons or organisations that are subject to the sanctions specified by virtue of the Security Council Sanctions Committee.

It is also a crime under Article 170 of the Penal Code for a person themselves or through an intermediary during war time, whether directly or through another country, to export goods or products or other items from the UAE to a hostile country, or to import any such materials from such a country. The penalties imposed are imprisonment of between ten and 25 years and a fine not to exceed double the value of the exported or imported goods, provided that it is not less than AED1 million.

Furthermore, under Article 3 of Federal Law No 43 of 2021 on the Goods Subject to Non-Proliferation Controls, customs departments are entitled to ban or restrict the importation or exportation of any resources, systems, equipment, technology, etc, stipulated as controlled commodities under law.

Under Article 315 of the Penal Code, a natural person who conceals the evidence of a crime, assets subject to a court attachment order, or an instrument or document submitted to the investigative authorities in respect of a crime in order to obstruct justice will be punished by imprisonment. If committed by a corporate, the maximum fine is AED5 million (Article 66).

Under Article 337 of the Penal Code, an individual who, having knowledge that a crime has been committed, helps its perpetrator escape justice by concealing evidence will be punished by imprisonment or a fine.

Under Article 456 of the Penal Code, a person who knowingly conceals or possesses property resulting from a crime in which they did not participate will be punished by the penalty prescribed for the crime from which they know that property was obtained. However, if the culprit does not know such things have resulted from a crime, but has obtained them in circumstances which led them to believe that their sources are illegal, the culprit will be penalised by detention for a period not exceeding six months and/or a fine not exceeding AED20,000.

There are also criminal offences in relation to concealment under the Cybercrimes Law (see 3.9 Cybercrimes, Computer Fraud and Protection of Company Secrets).

Under Article 45–46 of the Penal Code, persons who conduct the following acts will be deemed to be accomplices:

• commit the crime in association with others;
• commit one of a series of acts that constitutes the crime;
• make use of another person for the perpetration of the act constituting the crime;
• agree with another person to commit the crime, and the crime is committed based on such agreement;
• give the offender a weapon, tools or any other thing which the latter has knowingly used in the commission of the crime; or
• intentionally aid the offender in any other way in the preparation, facilitation or completion of the crime.

Under Article 48 of the Penal Code, accomplices will be subject to the same punishment imposed on the perpetrator (although exemptions may apply for the perpetrator’s spouse or relatives). However, under Article 53 of the Penal Code, where the characterisation of the crime or penalty varies according to the offender’s intention or knowledge of the circumstances, accomplices will be punished according to their own knowledge or intention.

Money laundering is criminalised under the AML Law.

The substantive money-laundering offences are in Article 2 of the AML and include, for example, transferring or moving the proceeds of a crime or conducting any transaction with the aim of concealing or disguising its illegal source.

Article 2 of the AML Law provides that any person who intentionally commits any of the acts knowing that the funds are the proceeds of a felony or misdemeanour will be deemed to have committed a money-laundering crime. It is also an offence under the AML Law to warn or tip off a person or reveal transactions under review, or reveal that the competent authorities are investigating such suspicious transactions.

The maximum penalty for an individual for breach of the AML Law is a fine of AED50 million and imprisonment for a period not exceeding ten years. Notably, the AML Law provides no time bar on the prosecution of money laundering and terrorist financing.

Obligations to Prevent Money Laundering

Financial institutions have specific obligations to prevent money laundering under the AML Law and Cabinet Decision No 10 of 2019 Concerning the Implementing Regulation of the AML Law (the “AML Implementing Regulation”), and must put in place specific measures as provided for in the AML Implementing Regulation. For example, they must put indicators in place to identify suspicious money-laundering transactions and submit STRs, and appoint a compliance officer in charge of reviewing the company’s compliance with the anti-money laundering laws and regulations (Article 21). There are numerous other obligations, including conducting client due diligence checks and maintaining records for a prescribed period of time.

Regulatory and Supervisory Bodies

The FIU is an independent unit within the UAE Central Bank, and has the authority to:

• request that financial institutions provide any information or additional documents relevant to the reports and information received by the FIU, in addition to other information the FIU considers necessary to perform its tasks within the time and in the form it determines; and
• exchange information with counterpart units in other states concerning STRs (where the UAE has entered into co-operation agreements with such states).

There are several supervisory authorities under the various AML laws and regulations, including the Ministry of Economy for Designated Non-Financial Businesses and Professions at the Federal Level, which have broad powers in respect of conducting checks and imposing penalties on financial institutions to mitigate the occurrence of money laundering.

In addition, the National Anti-Money Laundering and Combating Financing of Terrorism and Financing of Illegal Organisations Committee (“NAMLCFTC”) was established as the UAE’s primary AML and CFT policymaking body. Specialist money-laundering courts have been established across the UAE. The federal judicial council also recently approved the creation of specialist federal prosecution entities to address economic crimes and money laundering. This aligns with the UAE’s strategy to embed a robust financial crime compliance framework that is aligned with FATF recommendations.

There is no comprehensive ESG-related criminal framework in the UAE. Enforcement of ESG obligations is primarily administrative and regulatory.

Specific offences exist in relation to environmental and social misconduct. Federal Law No 24 of 1999 Concerning the Protection and Development of the Environment criminalises violations such as pollution, illegal waste disposal, damage to ecosystems, and poaching or illegal trade in endangered species. Sanctions include fines of up to AED500,000 and/or imprisonment.

Federal Decree-Law No 24 of 2023 on Combating Human Trafficking penalises conduct including sexual exploitation, forced labour, organ trafficking, slavery and servitude. Sanctions include a minimum fine of AED1 million and a minimum of five years’ imprisonment.

There are no specific criminal offences relating to the misuse of AI, algorithmic trading, or automated decision-making in financial or commercial contexts in the UAE. The Penal Code and Cybercrimes Law indirectly criminalise AI misuse such as AI-generated fraud or deepfakes (see 3.1 Criminal Company Law and Corporate Fraudand 3.9 Cybercrimes, Computer Fraud and Protection of Company Secrets).

While not specifically enacted to tackle cryptocurrency fraud, the Cybercrimes Law contains many offences commonly committed by crypto-fraudsters, including hacking and the fabrication of websites, electronic mail and electronic accounts. It also criminalises unlicensed cryptocurrency trading and cryptocurrency’s unauthorised/unlicensed marketing.

Crypto-assets are classified based on their function rather than a single legal category. Crypto-assets classified as security tokens are regulated (depending on their jurisdiction) by the Securities and Commodities Authority in the UAE, the Virtual Asset Regulatory Authority in Dubai, and the DFSA or FSRA in the DIFC and ADGM free zones respectively. Entities must secure a licence from each of these authorities to conduct financial services involving crypto-tokens.

The UAE’s broader civil and criminal regime also applies to crypto-asset activities. Regulated companies dealing with crypto-assets classified as securities or financial instruments must comply with the UAE’s general AML/CFT laws.

There are no uniform or common defences for white-collar offences in the UAE. The existence of an effective compliance programme in particular is not a defence to a white-collar crime, although regulated entities may incur lower sanctions where an offence has occurred despite the existence of a robust compliance programme.

There is no de minimis threshold for bribery offences.

The latest Criminal Procedural Law introduced a plea-bargaining mechanism for misdemeanours and felonies.

Although plea bargaining does not apply to certain offences (Article 361), it does apply to felonies punishable by temporary imprisonment and to their inseparably associated misdemeanours (Article 369).

A defendant accepting a plea bargain must hand over any objects or funds involved in or resulting from the criminal offence, where these are in the defendant’s direct or indirect possession (Article 377). The plea bargain will have no effect on civil damages accruing to the victim (Article 380).

Under Article 232 of the Penal Code, a person who conspires to commit a crime will be exempt from the relevant punishments if they report the conspiracy and the participants to the competent authorities before the commission of any of the specified crimes. Similarly, under Article 284, if a briber or bribe-taker informs the judicial or administrative authorities about the crime before the crime is discovered, the briber or bribe-taker will be exempted from punishment.

Under Article 22(6) of the AML Law, the court may commute or set aside the sentence against any perpetrator of a money-laundering crime if they provide the judicial or administrative authorities with information relating to a money-laundering offence and the information provided leads to the discovery of a crime, the identification of its perpetrators or their arrest.

Under Article 457 of the Penal Code, an offender under Article 456 of the Penal Code (see 3.11 Concealment) may be exempt from punishment if they proactively inform the judicial or administrative authorities of the crime and the perpetrators, before the crime is discovered. If the disclosure occurs after the crime is discovered, the court may still grant an exemption if the information leads to the arrest of the offenders.

Under Article 61 of the Cybercrimes Law, the court, based on a request from the public prosecutor, may reduce or exempt from punishment any perpetrators who give information to the judicial or administrative authorities related to any crimes pertaining to the security of the UAE, whenever this leads to discovering the crime and its perpetrators, or to proving the crime or to the arrest of any of the perpetrators.

While Article 323 of the Penal Code imposes a general obligation to report crimes, there is no overarching federal whistle-blower protection regime. However, free zone-specific frameworks have emerged in the DIFC and ADGM.

In the DIFC, whistle-blower protections were first introduced under Article 64 of the DIFC Operating Law No 7 of 2018, where a disclosure qualifies for protection if it is made in good faith, includes the whistle-blower’s identity, and relates to a reasonable suspicion of contravention of DIFC laws or regulations. In 2022, the DFSA expanded this framework under Article 68A of the DIFC Regulatory Law 2004 and the DFSA Rulebook, applicable to DFSA-regulated entities only. In July 2024, the ADGM introduced a comprehensive whistle-blower regime through the Whistleblower Protection Regulations 2024 and amendments to the Employment Regulations 2019.

To qualify for protection under both the DIFC and ADGM regimes, a disclosure must be:

• based on reasonable suspicion of a contravention of applicable laws or rules, or financial crimes;
• made in good faith; and
• submitted through an internal or external reporting channel (auditors, the DFSA or FSRA, or other law enforcement authorities).

Disclosures may be made anonymously.

Whistle-blowers are explicitly protected from retaliation, including civil or contractual liability and termination or adverse employment actions by employers or affiliated parties.

DIFC and ADGM entities must implement and maintain “appropriate and effective” arrangements to facilitate disclosures, assess and escalate concerns, protect confidentiality and prevent retaliation. Entities must also maintain written records of disclosures and investigations – in the case of ADGM entities, for a minimum of six years.

Separately, there are sector-specific developments aimed at encouraging the reporting of misconduct:

• under Dubai Law No 4 of 2016 on Financial Crime, a disclosure made to the Dubai Economic Security Centre will be protected if it is true and relates to an activity that may impact the economic security of Dubai;
• the UAE Ministry of Finance developed a platform called “Wajib”, a mobile app-based platform that allows individuals to confidentially report financial or administrative misconduct within UAE government entities; and
• under Article 47, the Labour Law introduced quasi whistle-blower protections prohibiting the termination of an employee or legal action against them for filing a serious and truthful complaint with the Ministry of Human Resources and Emiratisation.

There is no formal mechanism for co-ordinated defence involving multiple jurisdictions. If parallel proceedings are a risk, fact-specific defence strategies must consider simultaneous engagement with UAE and foreign authorities.

See the Trends and Developments section.