Risks and reforms: the UAE adjusts to a shifting landscape

In summary

The UAE has revised its regulatory and legal frameworks in recent years, including with regard to money laundering, terrorism financing, sanctions, cybercrime, data privacy, bankruptcy and whistle-blower protections. Despite these efforts, in 2022, the FATF listed the UAE on its ‘grey list’ for money laundering. The recent influx to the UAE of Russians fleeing because of the war in Ukraine has further complicated the UAE’s efforts. As the UAE revises its regulatory frameworks to adjust to the FATF designation and the influx of Russian money, multinational companies in the UAE must assess their compliance-related risks and bring sensitivity to decisions relating to conducting investigations.

Discussion points

• The UAE’s regulatory regimes have become more robust as it has become more attractive for foreign investment
• The large number of Russians who have immigrated to the UAE since the start of the war in Ukraine has complicated the UAE’s AML efforts
• The UAE’s free trade zones in Dubai and Abu Dhabi have established robust regimes relating to AML, digital assets and data privacy

Referenced in this article

• FATF
• ADGM and FSRA
• DIFC and DFSA
• Federal Law No. 20 of 2018
• Federal Decree-Law No. 34 of 2021
• Federal Decree-Law No. 45 of 2021
• Federal Decree-Law No. 9 of 2016

Introduction

The United Arab Emirates (UAE), including its commercial centres in Dubai and Abu Dhabi, has delivered significant and sustained economic growth over the past several decades. Many multinational companies have established regional headquarters in the country, and, as it has become a destination for foreign investment, prominent financial and legal firms have similarly established major presences in the country. The UAE is continuing with its ambitious development plans, as evidenced by Expo 2020, the Abu Dhabi 2030 Economic Vision and the Dubai 2040 Urban Master Plan.

While the UAE has managed sustained economic growth, companies have faced numerous risks because of the underdeveloped regulatory and legal framework. In particular, they have faced significant exposure to money-laundering and sanctions-related issues, including from criminals using the UAE as a safe haven for illicit gains.

This exposure was highlighted by the decision of the Financial Action Task Force (FATF) in 2022 to list the UAE on its ‘grey list’ for money laundering. This was further exacerbated by the arrival of hundreds of thousands of Russians fleeing because of the war in Ukraine, often bringing significant assets with them. Criminals wishing to prey on individuals and corporations alike through fraud, cybercrime and other misconduct have also been able to exploit the regulatory and legal gaps.

In recent years the UAE has worked to adapt its regulatory and legal frameworks to reduce this exposure and make its economy more attractive to outside investors, including by enhancing its regulatory regimes relating to anti-money laundering (AML) and counterterrorism financing (CFT), sanctions, cybercrime and digital currencies, data protection and privacy, bankruptcy and whistle-blower protections. In addition to passing national legislation specifically targeting AML and CFT (AML/CFT), the free trade zones in Dubai and Abu Dhabi have also taken the initiative to implement robust due diligence procedures for registered companies.

These efforts are ongoing, and, as the UAE works to adjust its regulatory and legal frameworks, many multinational companies will need to assess their money-laundering and related risks in the UAE, including bringing a greater sensitivity to decisions of whether and how to conduct investigations.

AML and sanctions

In March 2022, the FATF listed the UAE on its grey list for money laundering, noting that there were ‘strategic deficiencies’ in the UAE’s efforts to prevent money laundering and terrorist financing.^[1] The FATF uses the grey list designation for countries for which it determines there to be significant risks in their AML/CFT regimes but that are also ‘actively working with the FATF’ to address deficiencies and ‘committed to resolving swiftly’ the issues identified.^[2] Further, the European Commission added the UAE to its blacklist for money laundering in late 2022.^[3]

Regulatory efforts

In response to concerns by the international community, including the FATF grey list designation, the UAE has taken several steps to strengthen its AML/CFT framework. For instance, the UAE has set up the Executive Office of Anti-Money Laundering and Counter Terrorism Financing (the AML/CFT Executive Office) and an AML task force, led by the foreign minister, that aims to coordinate efforts among the seven emirates and ensure consistent standards. The task force has worked to create a corporate registry of UAE companies, making the list available to the FATF and the international community.^[4] Further, the Central Bank of the UAE (the Central Bank) has issued AML/CFT guidance that, among other things, requires financial institutions to develop compliance-related frameworks for identifying politically exposed persons (PEPs) and ensuring the legitimacy of PEPs’ sources of wealth.^[5]

In recent years, the UAE has taken steps to shed its reputation as a financial crime hotspot. For instance, it has updated key legal instruments, such as Federal Law No. 20 of 2018 on AML/CFT, which has been further enhanced and amended by Federal Decree-Law No. 26 of 2021.

In 2021, the Central Bank fined 11 banks a combined total of US$12.5 million for having inadequate AML and sanctions controls at the end of 2019.^[6] Changes in the UAE’s legislation and the development of enforcement guidelines have also helped advance money laundering investigations and prosecutions.^[7]

Separate from these national initiatives, the UAE’s free trade zones, namely the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC), have implemented additional regulatory AML/CFT frameworks. Both the Dubai Financial Services Authority (DFSA), which serves as the regulator for the DIFC, and the Financial Services Regulatory Authority (FSRA), which regulates the ADGM, have issued AML/CFT rulebooks that entities must comply with in addition to the UAE federal laws.^[8] Among other requirements, these rulebooks establish robust programmes that entities must use in connection with customer vetting to mitigate money laundering and terrorism financing risks.

Further, business applications for the DIFC and the ADGM are reviewed using a risk-based methodology that assesses the funding of the proposed entity, where it does business and other relevant information.^[9]

Separate from the UAE’s AML efforts, its sanctions laws are relatively ad hoc. The UAE publishes lists of individuals and entities that are subject to sanctions,^[10] which primarily target terrorism. It also enforces US, EU and United Nations (UN) sanctions through internal directives. Nevertheless, these efforts are ad hoc and are based on the circumstances of the specific request from foreign authorities.^[11]

International cooperation

The UAE has taken formal steps to increase its cooperation with foreign enforcement authorities. In 2022, it signed mutual legal assistance treaties with the United States, Ethiopia, Denmark, Lithuania and Serbia. Such agreements allow for improved cooperation among authorities, including in relation to money laundering, terrorism and cybercrime, among other offences.^[12] The AML/CFT Executive Office also signed a memorandum of understanding in 2022 with the UN Office on Drugs and Crime to expand cooperation relating to AML/CFT.^[13]

War in Ukraine

The war in Ukraine has complicated the UAE’s AML/CFT and sanctions efforts. Thousands of Russians have emigrated to the UAE since the start of the war, with many setting up businesses and attempting to move as much of their wealth as possible to avoid Western sanctions.^[14]

The Dubai real estate market experienced unprecedented growth in the past year. Russians became the leading non-resident buyers of Dubai real estate, with purchases by Russians increasing by 220 per cent by some estimates.^[15] Prices for the most expensive homes in Dubai rose by 44 per cent – more than anywhere else in the world.^[16] Rent in Dubai also increased, growing by 27 per cent in the past year.^[17] These figures, however, come largely from records maintained by individual real estate agencies because Dubai does not provide easy access to databases recording property records.^[18]

The UAE’s efforts to welcome investments from Russia are straining its relationships with the United States and the European Union. In May 2022, a group of European Parliament members accused the UAE of facilitating ‘money laundering at a grand scale’,^[19] and, as mentioned, in late 2022, the European Commission ultimately decided to put the UAE on its blacklist, even if that decision has drawn criticism that it was politically motivated.^[20]

Similar to its AML-related efforts, the UAE’s sanctions-related enforcement efforts have also been complicated by the current political situation, creating tensions between the UAE and its Western allies. For instance, US and EU officials have said that Russia continues to access foreign chips and technology through intermediaries in the UAE.^[21] There have also been news reports of Russian companies using affiliates in the UAE to facilitate oil trades to evade Western sanctions.^[22] Western concerns with the way Russia has been able to evade sanctions through intermediaries in the UAE were made public in January 2023 when officials from the US Department of the Treasury visited the UAE, warning Emirati leaders that the United States would block their access to G7 markets if the UAE helped Russia evade sanctions.^[23]

Considerations for multinational companies

These developments have several consequences for multinational companies operating in the UAE.

In the context of corporate investigations, companies should ensure they have adequate AML compliance programmes in place. The heightened scrutiny by US and EU regulators should make many multinationals more sensitive to the risks and more willing to conduct investigations. More specifically, there may be political pressure in the United States and certain EU jurisdictions to bring enforcement actions against any companies determined to have been complicit in money laundering or sanctions actions associated with Russian companies.

Companies that proactively implement robust compliance programmes or that cooperate with enforcement authorities, including by conducting their own, comprehensive internal reviews as soon as they learn of allegations, are generally more likely to receive favourable treatment from authorities, including cooperation credit.^[24]

Cybercrime laws and regulations

Regulatory efforts

The UAE’s Cybercrime Law^[25] addresses a number of cyber-related issues. Among other things, it provides a framework for criminal penalties relating to hacking, fake news, impersonation, internet bots and cryptocurrency.^[26] For instance, it prohibits posting misleading advertisements or data online as well as promoting or dealing in cryptocurrencies that are not ‘officially recognised in the UAE’.^[27]

As well as seeking to safeguard individuals from cryptocurrency scams, the UAE is also seeking to establish itself as a regional or global hub for digital assets firms. Notably, Abu Dhabi’s free trade zone and financial hub, the ADGM, established in 2018 what it has described as the world’s first fully comprehensive regulatory framework for digital assets. As part of that framework, the FSRA has set out clear guidelines on its approach to virtual asset regulation and supervision to outline its expectations for the sector’s asset class and service providers.^[28]

On 1 November 2022, the DFSA established its own regime in the DIFC to regulate crypto tokens, which the DFSA has stated is intended ‘to foster innovation in a measured, responsible and transparent manner while still meeting the DFSA’s regulatory objectives’.^[29] In addition to addressing risks relating to consumer protection and market integrity, the regimes in both the ADGM and the DFSA are intended to address money laundering and terrorism financing risks associated with cryptocurrencies by ensuring the appropriate regulation of cryptoassets.

Separate from the efforts in the ADGM and the DIFC free trade zones, Dubai has passed the Virtual Asset Regulation Law, setting up an advanced legal framework to protect investors and provide international standards for industry governance.^[30] The Law regulates virtual asset financial services everywhere in the emirate other than the DIFC.

Pursuant to the Virtual Asset Regulation Law, Dubai further established the Virtual Assets Regulatory Authority (VARA) in 2023 to act as an independent body to regulate virtual assets.^[31] In addition to authorising and licensing all businesses involved in digital assets, VARA also has the sole authority to classify or prohibit digital assets. It is also responsible for ensuring that virtual asset service providers do not engage in money laundering.

Considerations for multinational companies

The regulatory regimes seek to regulate digital assets to protect individuals and companies, recognising that cryptocurrencies are a favoured choice for criminals, including those engaged in ransomware attacks and those interested in purchasing illicit services.^[32] Multinationals, particularly financial institutions, whose businesses include dealing in virtual assets must be especially aware of the various UAE regulatory regimes to ensure their compliance. For instance, companies that trade in digital assets must implement appropriate controls to ensure compliance with the regulatory provisions relating to AML/CFT. Given that some individuals invest in digital assets precisely for the anonymity that the assets promise, ensuring compliance with AML rules may prove challenging.

Companies conducting internal investigations into allegations of fraud or corruption should be aware of the unique challenges digital assets pose for identifying, tracing or seizing illicitly gained funds and assets. For instance, investigations of foreign corruption often involve an analysis of the ultimate beneficiary of a payment, which can be complicated when cryptocurrencies have been used to effect the payment. Similarly, tracking embezzled corporate funds may also be more challenging when cryptocurrencies have been involved.

Data privacy laws

Regulatory regime

The UAE and its free market zones in Dubai and Abu Dhabi have joined more than 130 jurisdictions in having comprehensive data privacy laws intended to safeguard individuals against the misuse of their personal data by organisations that receive or use that data, specifically Federal Decree-Law No. 45 of 2021, which came into effect on 2 January 2022,^[33] DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 all bring the UAE’s laws in line with international standards, including with regard to providing strict penalties for the misuse of data or violations of the law.

These regulations potentially impact global organisations as the territorial scope encompasses any organisation that carries out processing activities about data subjects^[34] in the UAE, regardless of where the organisations are established. In this regard, the regulations are similar to the EU General Data Protection Regulation (GDPR), under which authorities have issued hundreds of thousands of data breach notifications since its inception in 2018.^[35]

Considerations for multinational companies

The obligations for multinational companies under the UAE data protection regime are relatively similar to those they generally face under the GDPR. Accordingly, organisations should ensure that they implement appropriate policies and procedures to ensure compliance with the regulations. As part of the programme, the company will likely need to investigate and report the alleged violation when a breach is suspected.

One difference between the GDPR and the UAE Data Protection Law is that the latter does not include a ‘legitimate interest’ basis for processing personal data. For this reason, companies conducting investigations should pay particular attention to receiving a data subject’s consent to process their personal data or confirming that there is another lawful circumstance for processing that data (eg, the data subject has made the personal data public or the processing is required to protect the interests of the data subject or as part of a judicial or security procedure).

Bankruptcy and insolvency regulations

Regulatory regime

In recent years, the UAE has sought to attract foreign investment by creating a more modern, recognisable insolvency regime, which contains modern restructuring tools for businesses facing distress. Specifically, the Bankruptcy Law,^[36] which was further amended in 2020, helped to update the bankruptcy regulatory regime.^[37]

Prior to the revisions of the Bankruptcy Law, companies avoided petitioning for bankruptcy, which was difficult to obtain because of the preference of the regulators for companies to find alternate or deferred payment plans with creditors. Further, the new bankruptcy regime reduces, but does not eliminate, potential criminal liability for corporate directors and general managers in connection with bankruptcies.^[38] The new bankruptcy regime frees the country from over-indebted, overvalued companies by removing obstacles from companies declaring insolvency.

Considerations for multinational companies

In response to these changes, companies and authorities are conducting investigations to understand whether fraud or management error may be leading companies to insolvency or bankruptcy rather than just bad business practices or market pressures. For instance, the Dubai-based Abraaj Group has been accused of engaging in a massive fraud, including transferring funds from Abraaj Growth Markets Health Fund to a separate entity to cover cash shortfalls for corporate expenses and other purposes unrelated to the health fund.^[39]

Abraaj Group is currently engaged in liquidation – the largest private equity failure in history – and its founder, Arif Naqvi, has been accused in multiple jurisdictions of fraud and misleading investors.^[40] The conduct at issue, much of which occurred prior to the revisions to the bankruptcy law, may arguably have been exacerbated by the difficulties the health fund might have faced had it sought to file for bankruptcy.

In another example, NMC Health, a healthcare company listed on the London Stock Exchange and headquartered in Abu Dhabi, came under scrutiny in 2020 after allegations of financial irregularities surfaced, leading to a sharp decline in its share price and prompting an investigation by the UK Financial Conduct Authority.^[41] The investigation revealed several serious governance and financial reporting failures, leading to the company’s collapse.

Whistle-blower regulations

Regulatory developments

The UAE has made some efforts to enhance its regulatory regime relating to the protections afforded to whistle-blowers. First, the DFSA introduced a regulatory regime for whistle-blowing for regulated entities within the DIFC. The regulations aim to enhance legal protections for persons who report misconduct internally or externally.^[42]

Additionally, the Abu Dhabi Accountability Authority (ADAA), which has regulatory oversight over government agencies and state-owned entities in that emirate, has launched a platform to allow whistle-blowers to make confidential reports relating to organisations that the ADAA oversees.

Considerations for multinational companies

The UAE has only made modest efforts to date to institutionalise protections for whistle-blowers across government departments and private companies; however, such efforts may gain momentum. As they do, multinational companies should ensure that they have appropriate mechanisms in place to comply with the UAE’s requirements. Further, they will increasingly need to be more sensitive to investigating allegations of wrongdoing, given the increased focus on whistle-blower protection and the likelihood that the number of allegations may increase.

Conclusion

The UAE has made significant efforts in recent years to create regulatory regimes – including revising its regulatory and legal frameworks relating to AML/CFT, sanctions, cybercrime and digital currencies, data protection and privacy, bankruptcy and whistle-blower protections – that match its status as a hub for international finance, business and law; however, its status as a global safe haven for both foreign investment and individuals has complicated these efforts. In particular, its status as a safe haven has attracted hundreds of thousands of Russian and Ukrainian immigrants in the past year, who have simultaneously invested heavily in the emirates, and the money laundering and sanctions risks associated with the influx of Russians have created tensions with certain Western governments.

The UAE will need to be both dynamic and flexible in accommodating concerns while remaining an attractive destination for foreign investment. Multinational companies operating in the UAE must continually assess their compliance with UAE regulatory requirements, including specific money laundering risks. Further, given the heightened risks, companies should bring greater sensitivity to decisions of whether and how to conduct investigations.

Notes