Search
Close this search box.
Search
Close this search box.

UAE: A shifting landscape of risk and reform

IN SUMMARY

The United Arab Emirates (UAE) has revised its regulatory and legal frameworks in recent years, including with regard to money laundering, terrorism financing, sanctions, cybercrime, data privacy, bankruptcy and whistle-blower protections. Despite these efforts, the Financial Action Task Force (FATF) listed the UAE on its ‘grey list’ for money laundering from 2022 to 2024. The influx to the UAE of Russians fleeing because of the war in Ukraine has further complicated the UAE’s anti-money laundering (AML) and sanctions efforts. As the UAE revises its regulatory frameworks to adjust to the FATF designation and the influx of Russian money, multinational companies in the UAE must assess their compliance-related risks and bring sensitivity to decisions relating to conducting investigations.

 

DISCUSSION POINTS

  • The UAE’s regulatory regimes have become more robust as it has become more attractive for foreign investment
  • The large number of Russians who immigrated to the UAE following the start of the war in Ukraine has complicated the UAE’s AML, sanctions and export controls efforts
  • The UAE’s free trade zones in Dubai and Abu Dhabi have established robust regimes relating to AML, digital assets and data privacy

 

REFERENCED IN THIS ARTICLE

  • The FATF
  • The Abu Dhabi Global Market and the Financial Services Regulatory Authority
  • The Dubai International Financial Centre and the Dubai Financial Services Authority
  • Federal Law No. 20 of 2018
  • Federal Decree-Law No. 34 of 2021
  • Federal Decree-Law No. 45 of 2021
  • Federal Decree-Law No. 51 of 2023

 

INTRODUCTION

The United Arab Emirates (UAE), including its commercial centres in Dubai and Abu Dhabi, has delivered significant and sustained economic growth over the past several decades. Many multinational companies have established regional headquarters in the country, and, as it has become a destination for foreign investment, prominent financial and legal firms have similarly established major presences in the country. The UAE is continuing with its ambitious development plans, as evidenced by Expo 2020, the Abu Dhabi 2030 Economic Vision, the Dubai Economic Agenda D33 and the Dubai 2040 Urban Master Plan.

Even as the UAE has managed sustained economic growth, companies have faced numerous risks because of the underdeveloped regulatory and legal framework. In particular, they have faced significant exposure to money-laundering and sanctions-related issues, including from criminals using the UAE as a safe haven for illicit gains.

This exposure was highlighted by the decision of the Financial Action Task Force (FATF) to list the UAE on its ‘grey list’ for money laundering from 2022 to 2024. Money laundering and sanctions-related risks were further exacerbated by the arrival of hundreds of thousands of Russians fleeing as a result of the war in Ukraine, often bringing significant assets with them. Criminals wishing to prey on individuals and corporations alike through fraud, cybercrime and other misconduct have also been able to exploit the regulatory and legal gaps.

In recent years, the UAE has worked to adapt its regulatory and legal frameworks to reduce this exposure and make its economy more attractive to outside investors, including by enhancing its regulatory regimes relating to anti-money laundering (AML) and counterterrorism financing (CFT), sanctions, cybercrime and digital currencies, data protection and privacy, bankruptcy and whistle-blower protections. In addition to passing national legislation specifically targeting AML and CFT (AML/CFT), the free trade zones in Dubai and Abu Dhabi have also taken the initiative to implement robust due diligence procedures for registered companies.

These efforts are ongoing, and, as the UAE works to adjust its regulatory and legal frameworks, many multinational companies will need to assess their money-laundering and related risks in the UAE, including bringing a greater sensitivity to decisions of whether and how to conduct investigations.

 

AML AND SANCTIONS

New, Heightened Risks

The UAE has long been regarded by certain advocates, journalists and non-governmental organisations as enabling financial secrecy through opaque and inadequate commercial and financial regulation.[1] Notably, the FATF listed the UAE on its grey list for money laundering from March 2022 until February 2024, stating when placing the UAE on the grey list that there were ‘strategic deficiencies’ in the UAE’s efforts to prevent money laundering and terrorist financing.[2] The FATF uses the grey list designation for countries for which it determines there to be significant risks in their AML/CFT regimes but that are also ‘actively working with the FATF’ to address deficiencies and ‘committed to resolving swiftly’ the issues identified.[3]

The war in Ukraine further heightened international attention on the UAE’s AML/CFT regime. Thousands of Russians emigrated to the UAE after the start of the war, with many setting up businesses and attempting to move as much of their wealth as possible to avoid Western sanctions.[4] The Dubai real estate market experienced unprecedented growth as a result of the influx, with purchases by Russians increasing by 220 per cent by some estimates.[5] A 2022 report based on a leak of Dubai property data from 2020 identified many ‘members of Russia’s political elite, public officials, or business people close to the Kremlin, as well as dozens of Europeans implicated in money laundering and corruption’ who owned properties in Dubai.[6] This influx of Russian money was a factor in the European Commission (EC) adding the UAE to its blacklist for money laundering in late 2022.[7]

Separately, the UAE also became central to Russia’s efforts to circumvent Western economic and export control sanctions, straining its relationships with the United States and the European Union.[8] For instance, US and EU officials have claimed that Russia continues to access foreign chips and technology through intermediaries in the UAE,[9] with some reports noting that the UAE exported 15 times more computer chips to Russia in 2022 than in 2021.- [10]

There have also been news reports of Russian companies using affiliates in the UAE to facilitate oil trades to evade Western sanctions.[11] Western concerns with the way Russia evaded sanctions through intermediaries in the UAE were made public several times in 2023, including as part of visits to the UAE by US and European officials.[12] Officials from the US Department of the Treasury warned Emirati leaders that the United States would block their access to G7 markets if the UAE helped Russia evade sanctions.[13]

Regulatory Efforts

In response to concerns by the international community, including the FATF and EC designations, the UAE has taken several steps in recent years to strengthen its AML/CFT framework and sanctions regime and otherwise shed its reputation as a financial crime hotspot. For instance, as noted in a June 2023 FATF report highlighting the progress the UAE had made to improve compliance with FATF standards, the country has updated key legal instruments, such as Federal Law No. 20 of 2018 on AML/CFT, which has been further enhanced and amended by Federal Decree-Law No. 26 of 2021, Cabinet Decision No. 24 of 2022 and Law No. 4 of 2022.[14] These additional regulatory measures strengthened due diligence requirements for financial institutions, designated non-financial business providers and virtual asset providers.

The UAE also set up the Executive Office of Anti-Money Laundering and Counter Terrorism Financing (the AML/CFT Executive Office) and an AML task force, led by the foreign minister, that aims to coordinate efforts among the seven emirates and ensure consistent standards. The task force has worked to create a corporate registry of UAE companies, making the list available to the FATF and the international community.[15] Further, the Central Bank of the UAE (the Central Bank) has issued AML/CFT guidance that, among other things, requires financial institutions to develop compliance-related frameworks for identifying politically exposed persons (PEPs) and ensuring the legitimacy of PEPs’ sources of wealth.[16]

In 2023, the Central Bank assessed fines on banks, exchange houses, insurance companies and other entities totalling US$31 million for non-compliance with the bank’s regulatory requirements relating to AML and terrorist financing.[17] The development of enforcement guidelines has also helped advance money laundering investigations and prosecutions.[18] For instance, the UAE has established a special court to prosecute financial crimes and adopted a new penal code that strengthens the legal framework relating to AML, terrorist financing and anticorruption.[19]

Separate from these national initiatives, the UAE’s free trade zones, namely the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC), have implemented additional regulatory AML/CFT frameworks. Both the Dubai Financial Services Authority (DFSA), which serves as the regulator for the DIFC, and the Financial Services Regulatory Authority (FSRA), which regulates the ADGM, have issued AML/CFT rulebooks that entities must comply with in addition to the UAE federal laws.[20] Among other requirements, these rulebooks establish robust programmes that entities must use in connection with customer vetting to mitigate money laundering and terrorism financing risks. Further, business applications for the DIFC and the ADGM are reviewed using a risk-based methodology that assesses the funding of the proposed entity, where it does business and other relevant information.[21]

Distinct from the UAE’s AML/CFT efforts, its economic sanctions and export control laws and enforcement efforts are relatively ad hoc. There were reports in late 2023 that the UAE had agreed to restrict re-exports to Russia of sensitive dual-use products, namely goods that could be used for military purposes in Ukraine, although the exact steps that the UAE will take remain unclear.[22] The UAE also publishes lists of individuals and entities that are subject to sanctions,[23] which primarily target terrorism. The country also enforces US, EU and UN sanctions through internal directives. However, these efforts are based on the circumstances of the specific request from foreign authorities.[24]

Additionally, it should be noted that Russian President Vladimir Putin visited the UAE in December 2023, with Putin stating that relations between the two countries had ‘reached
an unprecedently high level’.[25]

International Cooperation

The UAE has taken formal steps to increase its cooperation with foreign enforcement authorities. Notably, it has signed a total of 45 mutual legal assistance treaties, including with the United States in 2022.[26] Such agreements allow for improved cooperation among authorities, including in relation to money laundering, terrorism and cybercrime, among other offences.[27] The AML/CFT Executive Office also signed a memorandum of understanding in 2022 with the UN Office on Drugs and Crime to expand cooperation relating to AML/CFT.[28]

Considerations For Multinational Companies

These developments have several consequences for multinational companies operating in the UAE.

In the context of corporate investigations, companies should ensure that they have adequate AML/CFT, sanctions and export controls compliance programmes in place. The heightened scrutiny by US and EU regulators should make many multinationals more sensitive to the risks and more willing to conduct investigations. More specifically, there may be political pressure in the United States and certain EU jurisdictions to bring enforcement actions against any companies determined to have been complicit in money laundering or sanctions actions associated with Russian companies.

Companies that proactively implement robust compliance programmes or that cooperate with enforcement authorities, including by conducting their own comprehensive internal reviews as soon as they learn of allegations, are generally more likely to receive favourable treatment from authorities, including cooperation credit.[29]

CYBERCRIME LAWS AND REGULATIONS

Regulatory Efforts

The UAE’s Cybercrime Law[30] addresses a number of cyber-related issues. Among other things, it provides a framework for criminal penalties relating to hacking, fake news, impersonation, internet bots and cryptocurrency.[31] For instance, it prohibits posting misleading advertisements or data online as well as promoting or dealing in cryptocurrencies that are not ‘officially recognised in the UAE’.[32]

Additionally, on 1 January 2024, the DFSA published cyber risk management rules for firms listed in the DFSA. The rules require firms to take a number of measures to manage their cyber risks, including maintaining compliance programmes to identify and assess risks as well as testing the resilience of their IT systems.

As well as seeking to safeguard companies and individuals from cyberattacks and cryptocurrency scams, the UAE is also seeking to establish itself as a regional or global hub for digital assets firms. Notably, Abu Dhabi’s free trade zone and financial hub, the ADGM, established in 2018 what it has described as the world’s first fully comprehensive regulatory framework for digital assets. As part of that framework, the FSRA has set out clear guidelines on its approach to virtual asset regulation and supervision to outline its expectations for the sector’s asset class and service providers.[33]

On 1 November 2022, the DFSA established its own regime in the DIFC to regulate crypto tokens, which the DFSA has stated is intended ‘to foster innovation in a measured, responsible and transparent manner while still meeting the DFSA’s regulatory objectives’.[34] In the first year of the programme, the DFSA recognised five crypto tokens.[35] In addition to addressing risks relating to consumer protection and market integrity, the regimes in both the ADGM and the DFSA are intended to address money laundering and terrorism financing risks associated with cryptocurrencies by ensuring the appropriate regulation of crypto-assets.

Separate from the efforts in the ADGM and the DIFC free trade zones, Dubai has passed the Virtual Asset Regulation Law, setting up an advanced legal framework to protect investors and provide international standards for industry governance.[36] The Law regulates virtual asset financial services everywhere in the emirate other than the DIFC. Pursuant to the Virtual Asset Regulation Law, Dubai further established the Virtual Assets Regulatory Authority (VARA) in 2023 to act as an independent body to regulate virtual assets.[37] In addition to authorising and licensing all businesses involved in digital assets, VARA also has the sole authority to classify or prohibit digital assets. It is also responsible for ensuring that virtual asset service providers do not engage in money laundering.

Considerations For Multinational Companies

The UAE regulatory regimes seek to regulate digital assets to protect individuals and companies, recognising that cryptocurrencies are a favoured choice for criminals, including those engaged in ransomware attacks and those interested in purchasing illicit services.- [38] Multinationals, particularly financial institutions whose businesses include dealing in virtual assets, must be especially aware of the various UAE regulatory regimes to ensure their compliance. For instance, companies that trade in digital assets must implement appropriate controls to ensure compliance with the regulatory provisions relating to AML/CFT. Given that some individuals invest in digital assets precisely for the anonymity that the assets promise, ensuring compliance with AML rules may prove challenging.

Companies conducting internal investigations into allegations of fraud or corruption should be aware of the unique challenges digital assets pose for identifying, tracing or seizing illicitly gained funds and assets. For instance, investigations of foreign corruption often involve an analysis of the ultimate beneficiary of a payment, which can be complicated when cryptocurrencies have been used to effect the payment. Similarly, tracking embezzled corporate funds may also be more challenging when cryptocurrencies have been involved.

DATA PRIVACY LAWS

Regulatory Regime

The UAE and its free market zones in Dubai and Abu Dhabi have joined more than 130 jurisdictions in having comprehensive data privacy laws intended to safeguard individuals against the misuse of their personal data by organisations that receive or use that data, specifically Federal Decree-Law No. 45 of 2021, which came into effect on 2 January 2022,[39] DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 all bring the UAE’s laws in line with international standards, including with regard to providing strict penalties for the misuse of data or violations of the law.[40]

These regulations potentially have an impact on global organisations as the territorial scope encompasses any organisation that carries out processing activities about data subjects[41] in the UAE, regardless of where the organisations are established. In this regard, the regulations are similar to the EU General Data Protection Regulation (GDPR), under which authorities have issued hundreds of thousands of data breach notifications since its inception in 2018.[42]

Considerations For Multinational Companies

The obligations for multinational companies under the UAE data protection regime are relatively similar to those they generally face under the GDPR. Accordingly, organisations should ensure that they implement appropriate policies and procedures to ensure compliance with the regulations. As part of the programme, the company will likely need to investigate and report the alleged violation when a breach is suspected.

One difference between the GDPR and the UAE Data Protection Law is that the latter does not include a ‘legitimate interest’ basis for processing personal data. For this reason, companies conducting investigations should pay particular attention to receiving a data subject’s consent to process their personal data or confirming that there is another lawful circumstance for processing that data (eg, the data subject has made the personal data public or the processing is required to protect the interests of the data subject or as part of a judicial or security procedure).

 

BANKRUPTCY AND INSOLVENCY REGULATIONS

Regulatory Regime

In recent years, the UAE has sought to attract foreign investment by creating a more modern, recognisable insolvency regime that contains modern restructuring tools for businesses facing distress. Notably, the UAE’s Decree-Law No. 51 of 2023 (the UAE Bankruptcy Law) replaced the Federal Law No. 9 of 2016 on Bankruptcy (itself amended in 2020).[43]

The Bankruptcy Law revisions are intended to make restructuring companies easier. Historically, many UAE companies avoided petitioning for bankruptcy, which was difficult to obtain because of the preference of the regulators for companies to find alternative or deferred payment plans with creditors. Further, the new bankruptcy regime reduces, but does not eliminate, potential liability for corporate directors and general managers in connection with bankruptcies. The revisions continue to try to free the country from over-indebted, overvalued companies by removing obstacles from companies declaring insolvency.

Considerations For Multinational Companies

In response to these changes, companies and authorities are conducting investigations to understand whether fraud or management error may be leading companies to insolvency or bankruptcy rather than just bad business practices or market pressures. For instance, the US Securities and Exchange Commission (SEC) announced fraud charges against UAE-based Brooge Energy in December 2023, claiming that the company had misstated its revenues by between 30 and 80 per cent during the years 2018 to 2021.[44] The SEC further claimed that its former CEO and former chief strategy officer knew or were reckless in not knowing of the fraud.

In another example, the Dubai-based Abraaj Group has been accused of engaging in a massive fraud, including transferring funds from Abraaj Growth Markets Health Fund to a separate entity to cover cash shortfalls for corporate expenses and other purposes unrelated to the health fund.[45] Abraaj Group is currently engaged in liquidation – the largest private equity failure in history – and its founder, Arif Naqvi, has been accused in multiple jurisdictions of fraud and misleading investors.[46]

The conduct at issue in these cases, much of which occurred prior to the revisions to the Bankruptcy Law, may arguably have been exacerbated by the difficulties the companies
might have faced had they sought to file for bankruptcy.[47]

WHISTLE-BLOWER REGULATIONS

Regulatory Developments

The UAE has made some efforts to enhance its regulatory regime relating to the protections afforded to whistle-blowers. First, the DFSA introduced a regulatory regime for
whistle-blowing for regulated entities within the DIFC. The regulations aim to enhance legal protections for persons who report misconduct internally or externally.[48]

The ADGM has also published non-binding principles that are intended to encourage companies to adopt whistle-blowing policies.[49]

Finally, the Abu Dhabi Accountability Authority (ADAA), which has regulatory oversight over government agencies and state-owned entities in that emirate, has launched a platform to allow whistle-blowers to make confidential reports relating to organisations that the ADAA oversees.

Considerations For Multinational Companies

The UAE has made only modest efforts to date to institutionalise protections for whistle-blowers across government departments and private companies; however, such efforts may gain momentum. As they do, multinational companies should ensure that they have appropriate mechanisms in place to comply with the UAE’s requirements. Further, they will increasingly need to be more sensitive to investigating allegations of wrongdoing, given the increased focus on whistle-blower protection and the likelihood that the number of allegations may increase.

CONCLUSION

The UAE has made significant efforts in recent years to create regulatory regimes – including revising its regulatory and legal frameworks relating to AML/CFT, sanctions, cybercrime and digital currencies, data protection and privacy, bankruptcy and whistle-blower protections – that match its status as a hub for international finance, business and law. However, its status as a global safe haven for both foreign investment and individuals has complicated these efforts. In particular, its status as a safe haven has attracted hundreds of thousands of Russian and Ukrainian immigrants, who have simultaneously invested heavily in the emirates, and the money laundering and sanctions risks associated with the influx of Russians have created tensions with certain Western governments.

The UAE will need to be both dynamic and flexible in accommodating concerns while remaining an attractive destination for foreign investment. Multinational companies operating in the UAE must continually assess their compliance with UAE regulatory requirements, including specific money laundering risks. Further, given the heightened risks, companies should bring greater sensitivity to decisions of whether and how to conduct investigations.

 


Morgan Heavener – Partner / Roberto Maluf – Director / Steve Molloy – Director