Anti-Bribery and Anti-Corruption in the UAE: How to Reduce Corporate Risks

Anti-Bribery and Anti-Corruption: How to reduce corporate risks in the UAE

A Practical Guide for Companies Doing Business in Dubai and Other Emirates

Mainstream

Anti-Bribery and Anti-Corruption (ABAC) in the UAE are not an abstract ethical setup, but a strict legal necessity. Local legislation is rapidly tightening, and the extraterritorial effect of the FCPA and UK Bribery Act turns any transaction with a Middle Eastern element into a potential multi-jurisdictional risk.

The main question is not whether the company faces liability for corruption. The question is whether the company is willing to prove to the regulator that it did everything reasonably necessary to prevent this action.

Effective management of corruption risks begins with three checks:

• How corrupt and vulnerable is your business model in the UAE.
• Does your compliance system meet the standards that regulators and law enforcement agencies recognize as adequate?
• Do you have a documented history of good faith conduct in case of sudden inspection or prosecution?

If these issues are not resolved in advance, the company will face not just a fine, but with the paralysis of business, the arrest of accounts and personal responsibility of managers.

When Anti-Corruption Risks Appear in the UAE

Anti-corruption risks are activated not only when money is transferred directly to an official. In the UAE, high-risk areas include:

• interaction with state customers and companies with state participation;
• obtaining licenses, permits, visas and customs clearances;
• the involvement of agents, consultants and commercial intermediaries (especially with exclusive powers);
• offer of gifts, hospitality, sponsorship;
• M&A transactions, especially in the inheritance of corrupt practices of the acquired company;
• Employment of relatives of public officials (PEPs);
• use of cash payments and unaccounted commissions;
• Settlement of disputes bypassing formal procedures.

The mistake most companies make

Many companies start with the question:

How can we protect ourselves if we are accused of bribery?

That's the wrong first question.

The right question is:

How do we build a business environment where corrupt behavior becomes virtually impossible and is instantly identified and documented when an incident occurs?

Sometimes the best result is a preventive compliance transformation. Sometimes it is due diligence. Sometimes a strict contract audit. Sometimes, a properly conducted internal investigation before the regulator arrives. But never passive waiting.

Step 1. Assessment of corruption risks (Risk Assessment)

The first step is not to write a code of ethics, but to honestly assess the vulnerabilities of businesses in the UAE.

Key areas of analysis:

• sector of the economy (construction, defense, healthcare, energy – high-risk);
• the share of the state order in revenue;
• geography of operations (including Dubai and mainland free zones);
• use of agents and distributors, especially with a “per-per-per-per-per-per-per-per-per-per-sequence” payment;
• practice of representation expenses, gifts and business trips;
• the presence of affiliated persons among employees of state bodies;
• Historical incidents or whistleblowing signals.

Without risk assessment, compliance programs risk becoming a formal set of documents that will not protect the company from either violation or prosecution.

Step 2. Develop and implement an ABAC compliance program

The programme should be lively and tailored to the UAE, not copied from its head office in London. Minimum elements:

• Anti-Bribery & Anti-Corruption Policy in Arabic and English, signed by senior management
• Gifts, hospitality and sponsorship approval procedures with limits that are tailored to local business culture but not cross the line;
• Code of Conduct with a prohibition of facilitation payments (payments for simplification of formalities);
• the procedure for escalation of red flags;
• Regular training of employees, agents and partners with testing;
• Procedure for assessment of corruption risks of counterparties (third-party due diligence);
• Compliance officer with direct access to the board of directors.

A key principle that both local and foreign regulators value: tone from the top. Without a visible and consistent position of the first persons, a program is not worth the paper it is printed on.

Step 3. Conduct due diligence of counterparties and intermediaries

In the UAE, a significant part of corruption cases is not related to direct actions of employees, but to the behavior of agents and “consultants”. The third step is to verify all third parties.

Check it out.

• beneficial owners of the counterparty;
• PEPs or persons associated with ruling families;
• reputational background and media risks;
• signs of artificial overstatement of commissions (red flag – the amount of remuneration does not correspond to the volume of real services);
• opaque payment structure (offshore chains, accounts in high-secret jurisdictions)
• the existence of an anti-corruption clause in the contract and the right to audit;
• The willingness of the counterparty to disclose information – the refusal should be considered as a stop signal.

Special attention is paid to agents recommended by the customer or official. This “recommendation” is itself a classic indicator of corruption risk.

Step 4. Control gifts, representation costs and sponsorship

The UAE’s business culture is one of generous hospitality. This is normal, as long as it does not turn into a hidden reward for the actions or omissions of the official.

An effective control system shall include:

• Clear cost limits for gifts and entertainment;
• Compliance with the mandatory prior approval of gifts to civil servants;
• documenting the business purpose of each expense;
• maintaining a register of gifts and representative events;
• Special treatment for sponsorship and charitable contributions (prohibition of contributions that may be perceived as benefits).

Important: Under UAE law and the domestic policies of many emirates, the acceptance of gifts by public servants can be severely restricted or prohibited. Offering such a gift may constitute a crime on both sides.

Step 5. Establish channels for reporting violations and procedures for responding

Whistleblowing in the UAE is a sensitive topic. Data protection legislation, the risk of defamation and cultural idiosyncrasies require caution. Without the channels, the company is blind.

Minimum necessary elements:

• A secure hotline (possibly anonymous, hosted outside UAE)
• Guarantees of non-retribution for bona fide applicants, enshrined in the policy;
• Rules of consideration of communications: registration, assessment, escalation, investigation, documentation;
• protection of the applicant’s and the participants in the investigation.

The availability of channels and the company’s response to signals are what regulators are testing to determine whether corruption was a “random episode” or a consequence of a lack of oversight.

Step 6. Provide financial control and monitoring of payments

The corruption payments almost always leave a financial trail. The task of compliance is to see it before the regulator does.

What is needed:

• prohibition of unaccounted cash payments;
• Segregation of duties (initiation, approval, payment – for different persons);
• automated checks of payments on sanctions lists and PEPs lists;
• monitoring of unusual transactions (splitting of amounts, payments to third countries, discrepancy between the recipient of the payment and the counterparty);
• mandatory binding of payment to the real volume of services and the market price.

Payments through agents and consultants are particularly dangerous, which can then be used as a conduit for bribes. A company that has not verified the ultimate recipient of the money risks being accused of aiding.

Step 7. Conduct regular audits and improve the system

The compliance program cannot be static. A cycle of continuous improvement is needed:

• Annual audit of the effectiveness of ABAC controls;
• random compliance checks (gifts, representation costs, agent commissions)
• Analyzing incidents — even those that did not lead to charges — and refining procedures;
• Update the risk assessment when entering new markets, changing business structure or following an M&A.

Regulators in the UAE and abroad are looking not only at the availability of the program, but also at its actual performance. A documented audit is the best proof of seriousness.

Step 8. What to do when a violation is detected or an investigation is initiated

Even in the best company, an incident can happen. The main thing is not to aggravate the situation by chaotic actions.

When a signal of possible corruption appears:

• Ensure the safety of documents and data (hold notice) immediately;
• to engage an external legal adviser to ensure the legal privilege of the investigation;
• Determine the scope of the internal investigation without destroying evidence or creating grounds for obstruction charges;
• assess the need for self-disclosure in the UAE and, if applicable, in the DOJ/SFO;
• to isolate suspected employees from the subject of the investigation;
• refrain from public statements and notifications to counterparties before forming a position.

The UAE does not have the Deferred Prosecution Agreement (DPA) in the form it does in the US or UK, but cooperation with the investigation, a full internal investigation and remediation can significantly mitigate the consequences within the framework of judicial discretion and in interaction with the prosecutor's office.

Step 9. Protecting a business in regulatory scrutiny or charges

If the company is subject to inspection or charges under articles of federal law (including penalties provided for by Federal Decree-Law No. 31 of 2021 – UAE Criminal Code, a defense strategy must be built immediately.

Key elements of protection:

• Jurisdictional Risk Analysis (UAE + Potential FCPA/UKBA)
• Interaction with local lawyers who have the right to practice in the UAE;
• Developing a unified position that eliminates the contradictions between protections in different jurisdictions;
• Active presentation of evidence of the ABAC program to the regulator – this can be a decisive factor in determining liability;
• remediation: dismissal of the guilty, return of illegally received, reorganization of processes.

Remember: In the absence of an effective compliance program, responsibility may be assigned to the company itself, not only to individuals.

Step 10. International aspects: FCPA, UK Bribery Act and Multi-Jurisdictional Risks

Companies operating in Dubai and the UAE are often subject to extraterritorial regimes:

• FCPA (USA) – applies to issuers, US residents and any person doing business in the United States (including using dollar correspondent accounts);
• UK Bribery Act – extraterritorial for UK companies and citizens Section 7 also makes the company strictly liable for failing to take measures to prevent bribery by affiliates unless adequate procedures are proven.

Therefore, the ABAC program must be designed to meet the requirements of all relevant jurisdictions. A single standard, built to the highest requirements (usually the UK Bribery Act), is the most reliable choice for business in the UAE.

Proactive compliance or reactive protection: pick

The choice is always for business, but the cost of making a mistake is increasing with each year of increasing control in the UAE.

Common mistakes of companies in the UAE in the field of ABAC

1. To believe that the local mentality allows for “gratitude” to the official – criminal liability comes regardless of cultural customs.
2. To use standard global policies without adapting to the UAE, the peculiarities of state structures and free zones are not taken into account.
3. Trusting an agent because “he solves issues” is the most dangerous red flag.
4. Do not record due diligence documented - the regulator has nothing to show.
5. Ignoring extraterritorial laws – The FCPA and UK Bribery Act are also in place in Dubai.
6. Hiding an incident instead of self-disclosure can turn an administrative risk into a criminal case.
7. Conducting an internal investigation without legal privilege – interrogation records can become evidence of the prosecution.
8. Not training local staff in their native language – employees may not understand what is prohibited.

Checklist: 15 Questions to Evaluate the Anti-Corruption Protection of a Company in the UAE

1. Has the UAE made a formal risk assessment of corruption risks in the past 12 months?
2. Is there a written ABAC policy approved by the board of directors?
3. Has the due diligence procedure been implemented by all intermediaries and agents in the region?
4. Are the ultimate beneficiaries of the contractors checked for PEPs?
5. Are there limits on gifts and representation costs for civil servants?
6. Are all sponsorship and charitable payments approved?
7. Is cash payments without documentary evidence prohibited?
8. Does a secure reporting channel work?
9. Has ABAC training been provided to all employees, including local staff in the UAE?
10. Are there anti-corruption clauses and audit rights included in the contracts with agents?
11. Are all outgoing payments checked for sanctions and red flags?
12. Is there a plan to respond to a corruption incident?
13. Is there a legal privilege for internal investigations?
14. Has the ABAC program been independently audited?
15. Have the FCPA/UK Bribery Act risks been assessed for the company’s operations in Dubai?

What a strong strategy to reduce corruption risks looks like

A strong strategy in the UAE is based on five levels:

1. Prevention Development and implementation of ABAC policies, due diligence of counterparties, training, tone from the top.
2. Detection Financial monitoring, whistleblowing channels, regular audit of transactions and compliance controls.
3. Response Incident Response Plan, Internal Investigation under Privileged, Self-Disclosure Decision.
4. Remediation of consequences, dismissal of perpetrators, refund of funds, refinement of the control system.
5. Cross-border Coordination Multi-jurisdictional Risk Management (UAE + FCPA + UKBA), a unified protection strategy.

Without the fifth level, local efforts can be nullified by extraterritorial prosecution.

FAQ

Is a private company in the UAE obliged to have an anti-corruption program?There is no direct requirement of the federal law on the existence of an ABAC program. However, in a criminal investigation, having an effective program is a key factor in distinguishing the company’s responsibility from the actions of individual employees. For a number of regulated sectors (finance, DIFC) compliance requirements have already been formalized.

Yes, if the company does business in the UK, has a branch there, or if it is associated with British citizens or organizations. Even without a direct link, a partnership with the UK could indirectly involve business in the UAE in the SFO’s orbit.

The punishment under the UAE Criminal Code includes imprisonment and large fines for individuals. Legal entities may be fined, deprived of their license, and also subjected to confiscation of property. In addition, there are risks of reputational consequences and blocking of bank accounts.

Symbolic gifts of low value, bearing the character of ordinary business hospitality, as a rule, are permissible if not associated with the expectation of a counter-action. Many governments have zero tolerance for any gift. The company must determine the policy of the particular agency in advance and in any case document and coordinate each such case.

This is a classic red flag requiring immediate termination of the operation, escalation of compliance to the officer and possibly severing relations with the agent. Continued interaction can be qualified as complicity in corruption.

It is possible, but its results and the fact of the investigation can become known to the regulator. It is important to ensure the privilege of attorney from the outset by engaging outside lawyers. Voluntary disclosure is decided individually based on a balance of risks.

The FCPA applies if the company is an “issuer” of securities in the United States or if any action in support of the corruption scheme is committed in the United States (phone call, dollar transfer through a correspondent account in the United States). Almost any business in Dubai can be subject to the FCPA.

It is necessary to immediately conduct due diligence after the fact, investigate the incident, assess the need for self-disclosure and implement the ABAC program of the acquired company. Responsibility for past violations may pass to the buyer if urgent action is not taken.

More importantly: Avoiding a breach or preparing for a review?Both are important for business. But if the prevention system fails, the only shield is documented readiness to check: evidence of a working compliance program, trainings and timely response to incidents.

Related services

• Corporate Investigations, Regulatory Investigations & Business Integrity
• Compliance & Regulatory Advisory (UAE, DIFC, ADGM)
• International Trade, Sanctions & Export Controls
• Commercial Contracts & Agency Agreements
• International Arbitration & Cross-Border Litigation
• Strategic Risk Advisory & Corporate Governance

Related material

• FCPA and UK Bribery Act: Extraterritorial risks for business in UAE
• How to conduct due diligence in Dubai: Red flags and verification of beneficiaries
• Internal investigation of corruption violations: step-by-step
• Whistleblowing in the UAE: Legal boundaries and protection of whistleblowers
• Anti-corruption clause in an international commercial agreement
• Gifts and hospitality in the UAE: wherein lies the red line
• The role of the Compliance Officer in the company: From formality to real protection
• How to prepare a company for regulatory audit in the UAE
• Anti-Money Laundering and Anti-Corruption: intersections and differences
• Risks of using agents and intermediaries in the Middle East

Conclusion

Reducing corruption risks in the UAE does not require a formal set of documents, but a lively, integrated risk management system. A key priority is to create an environment in which corrupt behavior is unprofitable, risky, and nearly impossible.

A strong position is based on risk assessment, a working ABAC program, end-to-end due diligence of third parties, transparent financial flows and a pre-prepared incident response strategy. The UAE’s local legislation and the extraterritorial scope of the FCPA and the UK Bribery Act must be considered simultaneously.

In the anti-corruption sphere, the winner is not the one who defends himself better in court, but the one who does so that it does not come to trial and charges. And if it does, it is the one who can present the regulator not with an empty folder, but with evidence of genuine good faith.