Corporate fraud in the UAE: first-step

Mainstream

The moment when the company first discovered signs of corporate fraud is not the beginning of a panic, but the beginning of a strategic operation. The decisions made in the first hours and days will determine whether the business can recover assets, protect reputations and avoid accusations of complicity or negligence by UAE regulators.

The main mistake is to immediately confront a suspect or to disclose information within the company. The correct sequence looks different: To record, isolate, protect evidence and then act, relying on UAE criminal and corporate law, the Dubai Financial Services Authority (DFSA), Abu Dhabi Global Market (ADGM) rules and federal law.

The most important questions to answer in the first few hours are: How to keep digital footprints safe without violating local cybersecurity and data protection laws? When should I report it to the Dubai Police or the Attorney General’s Office? How can you avoid the civil and criminal liability of the business itself if the fraud was committed by top management? And, most importantly, how to return stolen money before it is withdrawn from the UAE.

When an urgent fraud investigation is needed

Corporate fraud in the UAE can take many forms, and practice shows that the following are typical triggers for an emergency reaction:

• Detection of fictitious contracts, shell suppliers or “rollback” schemes within the company;
• Unauthorized transfers from the Company’s accounts, especially in jurisdictions with weakened control;
• falsifying financial statements to obtain funding or conceal theft;
• Manipulation of procurements, tenders and contracts, including collusion with external counterparties;
• Theft of confidential information, customer bases or trade secrets;
• C-level fraud by executives hidden through complex corporate structures in the Dubai Multi Commodities Centre (DMCC), Jebel Ali Free Zone (JAFZA) and others;
• Withdrawal of funds through controlled companies in DIFC or ADGM, followed by cross-border movement;
• use of corporate credit cards and representation expenses for personal needs;
• suspicious transactions identified by the bank, which threatens to block accounts and investigate by the Central Bank of UAE or the Financial Intelligence Unit (FIU);
• An internal whistleblowing signal requiring immediate verification and at the same time protecting the applicant from possible revenge.

The mistake most companies make

The first reaction of many owners and CEOs in the UAE is to immediately summon the suspect to the carpet, demand an explanation or dismiss him with a high-profile scandal. This is a fatal mistake.

Why can't we do that?

• The suspect destroys evidence: e-mails, files, correspondence in messengers, recordings from surveillance cameras;
• accounts on which money has gone are cleared, assets are urgently withdrawn to offshore;
• The company loses the opportunity to apply for an emergency travel ban and seizure of assets under the UAE Penal Code and Civil Procedures Law.
• Intra-corporate conflict can be interpreted by the police as a civil dispute rather than a criminal offence, which will reduce the chances of prosecution.
• The business itself risks being the subject of counter-charges of defamation, violation of labor laws or illegal access to electronic devices.

The right first step is not to talk to the suspect, but to immediately activate a confidential investigation mode under the guidance of an outside lawyer.

Step 1. Stop losses and secure assets

Before a detailed investigation is initiated, it is important to physically block further damage. This may include:

• emergency freezing of bank accounts of the company through communication with the bank-holder (preferably through a lawyer) based on suspicions of fraud;
• blocking of corporate cards and access to Internet banking for discrete persons;
• If there is a risk, apply to the Dubai police or the prosecutor’s office with a request to seize specific accounts and prohibit the disposal of property within the UAE;
• - filing an urgent petition to the court (in the mainland of the UAE or in DIFC/ADGM Courts) for the imposition of a precautionary attachment on the assets of the suspect, if there is evidence of the risk of their alienation;
• Suspension of the powers of suspected employees by corporate decisions (through Board resolution), strictly within the framework of the law and the company charter.

In the Emirates, unlike many European jurisdictions, with a properly formulated criminal statement, the police can act very quickly - up to the immediate arrest of a suspect and his passport. However, this tool works only with a competent presentation: An unprepared statement may be perceived as a commercial dispute and left unmoved.

Step 2. Preserve evidence – in compliance with local laws

The evidence base is the foundation. In the UAE, it is important to remember that the collection of evidence must not violate Federal Decree-Law No. 34 of 2021. Anti-Cybercrime, Data Protection Laws (PDPL and DIFC/ADGM Regulations) and Privacy Regulations.

Priority action:

• Create a secure copy (forensic image) of the electronic devices of the suspect and key employees: laptops, corporate phones, servers. This should be done by IT specialists under the supervision of a lawyer to maintain the chain of custody.
• Keep all corporate correspondence (email, Microsoft Teams, Slack, WhatsApp, if used in business), log files, login history, video surveillance camera recordings;
• unload transaction data from the company’s banking system;
• fix the contents of the desktop, physical documents, draft contracts;
• Seal and seal paper media in a sealed room with limited access.

The entire process of gathering evidence must be documented as if it were to be presented in a jury trial tomorrow, even if it is only an internal review. The mistake here is expensive: In DIFC Courts and local courts in the UAE, evidence obtained in violation of the law can be excluded, and the company can be accused of illegal access.

Step 3. Involve an external lawyer and provide legal privilege

The internal investigation must immediately be brought under the supervision of an external legal adviser. The reason is legal professional privilege. If the investigation is conducted by a full-time lawyer or the CEO himself, the reports, interview records and analytics will not be protected by privilege and may be seized by the police or an opponent in a civil lawsuit.

What this means in practice in the UAE:

• Communications between an external lawyer and a company created for the purpose of obtaining legal advice or preparing for a possible litigation are protected from disclosure (especially important in DIFC/ADGM processes, where the common law approach to privilege);
• The lawyer will properly build cooperation with the police and the prosecutor’s office, avoiding premature statements that can be used against the company;
• The lawyer can independently assess the criminal and regulatory risks for the company, including the risk of being accused of lack of proper control (corporate criminal liability), which is being discussed more actively in the UAE, including within the framework of anti-corruption legislation.

Step 4. Identify jurisdictional forks: Mainland Courts, DIFC, ADGM or Arbitration

Corporate fraud in Dubai is rarely confined to one area. It is important to know where to look for protection and where to apply:

• If the company is registered with the DIFC, part of the measures (security seizure of assets, lawsuits against directors) will be more effective in DIFC Courts, which can issue an urgent freezing order like the English Mareva injunction.
• ADGM Courts for companies in Abu Dhabi Global Market.
• For mainland companies and most free zones, criminal applications are filed with the Dubai or other emirate police, and civil claims for refunds are filed with local courts (Civil Courts).
• If the fraud involves an international element (the funds have gone abroad), the simultaneous use of Interpol mechanisms, legal assistance requests (MLA) and arbitration may be required, with an arbitration clause in the contracts with the fraudsters.

The right jurisdiction in the early days determines the speed of asset seizure and the real prospect of money recovery.

Step 5. Evaluate the obligation and timing of regulatory notification

In the UAE, a company’s silence after fraud was detected can be construed as a violation. Depending on the scope of the business and the registration area, the following duties may apply:

• DFSA and ADGM impose strict requirements on licensed companies (banks, financial institutions, investment companies): Significant incidents, including fraud, should be notified to the regulator immediately.
• If fraud is suspected to be related to money laundering or terrorist financing, the company is required to file a suspicious transaction report (SAR/STR) with the FIU (Financial Intelligence Unit of the UAE Central Bank). Non-communication is a serious violation of its own.
• In cases of large-scale fraud that may affect the interests of investors or creditors, obligations to disclose material facts in the framework of corporate governance arise.

An external lawyer will help to adjust the tone of such notifications to minimize risks to the company and at the same time demonstrate a zero-tolerance compliance position.

Step 6. Conduct structured interviews in the right sequence

Only after the assets are blocked, evidence is preserved and the legal framework is established can conversations with employees proceed. A hard rule: The suspect is questioned last (if questioned at all inside the company, rather than leaving this function to the police).

Interview procedure:

• whistleblower (if any)
• witnesses from related units whose loyalty is beyond doubt;
• Managers who may have unwittingly signed dubious documents
• And only then – a person in respect of whom there are reasonable suspicions.

All interviews should be conducted in the presence of a lawyer, with the maintenance of a protocol, which can subsequently be provided to law enforcement agencies. The UAE labour legislation must be complied with: The employee has the right to refuse to answer questions if they can be used against him in criminal proceedings, and pressure can be qualified as extortion of confession.

Step 7. Formulate an asset recovery strategy

From the first day, in parallel with the fixation of evidence, you need to set the task of asset tracing and recovery.

Key actions:

• track the money chain through bank statements (including swift messages) and blockchain analytics, if there were cryptocurrency transfers;
• identify all related companies, real estate, vehicles and other assets of the suspect in the UAE through official registers, cadastres, trade license data;
• immediately initiate through the court or the prosecutor’s office measures to arrest these assets in order to prevent their implementation;
• If a withdrawal of money is detected abroad, apply for international legal assistance and, if possible, use arbitration or judicial mechanisms in the country of receipt of funds.

In the UAE, filing a civil lawsuit for fraud and damages in parallel with a criminal case can be an effective tool. Criminal proceedings are often used as a powerful tool: The threat of a real prison term encourages the accused to settle and compensate for the damage, since in some cases the repayment of damages mitigates the punishment.

Step 8. Manage reputational risks and crisis communications

The information vacuum surrounding the Dubai-based fraud investigation is quickly being filled with rumors. Without a well-built communication strategy, you can lose banking lines, key customers and investors.

The reputation management plan includes:

• appointing a single speaker (usually an external lawyer or PR consultant under the guidance of a lawyer);
• preparation of an internal message for employees explaining the fact of the inspection without details that violate the secrecy of the investigation;
• proactive communication with banks and key counterparties, demonstrating that the company is in control of the situation and is acting in strict compliance with the law;
• Monitoring of media and social networks to stop disinformation in a timely manner.

Important: Any public statements about the guilt of specific persons before the court verdict can be regarded as slander and lead to counterclaims.

Common mistakes of business in UAE at the start of the investigation

1. Independent collection of “kompromat” without lawyers. Leads to breaching cybercrime and privacy laws, rendering evidence unusable.
2. Fire of a suspect "one day" without legal training. It can trigger the destruction of evidence, a lawsuit for unlawful dismissal and the refusal of the police to initiate criminal proceedings.
3. Delaying the filing of a criminal complaint. Money is leaking, witnesses forget details, assets are disappearing.
4. Ignoring DFSA/ADGM/FIU regulatory obligations Even if the company is a victim, it can be fined for notifying you in a timely manner.
5. Trying to solve it with an internal audit without a police report. An internal report will not replace a criminal investigation and may be subsequently requested by a court.
6. Blind belief that the bank will pay it back. The bank can freeze the account, but the refund will occur only by a court order or the order of law enforcement officers.

Checklist: 15 First Questions After Detecting Fraud

1. What exactly do you think is a fraud under the UAE Penal Code?
2. Who is potentially involved – employees, management, third parties?
3. Are DIFC/ADGM jurisdictions affected or only the mainland UAE?
4. What accounts are involved and where are they opened?
5. Can the remaining funds be blocked immediately?
6. Is digital evidence maintained in compliance with the chain of custody?
7. Is there a risk that the suspect will leave the country and that an immediate travel ban is needed?
8. Is a company legally required to report to the DFSA, FIU or other regulator?
9. What is the DIFC Employment Law or UAE Labour Law?
10. What external counterparties could be involved in the scheme?
11. Are there any insurance policies that cover employee fraud?
12. Where are the stolen funds most likely to be located – in the UAE or abroad?
13. Do you need to file a civil suit and a criminal complaint at the same time?
14. Who will manage internal and external communications?
15. How will this affect existing contracts and banking arrangements?

What a great strategy for the first days

A strong strategy is usually built on five parallel tracks:

1. Crisis response and safety of assets Blocking accounts, withdrawal of powers of attorney, travel ban, interim measures.
2. Digital and documentary forensic Device imaging, mail mirroring, document collection – all under the control of the lawyer.
3. Legal framework and interaction with the state Determination of notification obligations, filing a complaint with the police, initiating a criminal case.
4. Internal personnel and corporate hygiene Isolation of persons involved from operational activities, decisions of the board of directors, compliance with labor procedures.
5. Asset tracing strategy, international cooperation, settlement pressure through criminal proceedings.

If one of the tracks falls out, the overall result is threatened: You can punish the guilty party, but not return the money, or return some of the money, but get a fine from the regulator.

FAQ Is a company in the UAE required to report fraud to the police?

In some cases, yes. If a criminal offence is committed, concealment of the fact may be regarded as obstruction of justice. For DIFC/ADGM financial institutions and for signs of money laundering, FIU notification is mandatory by law.

Can you just fire an employee without reporting to the police?

You can, but it's risky. The company remains without a criminal-legal lever of money refund, and an unscrupulous employee can go to a competitor with stolen data. Sometimes a settlement with dismissal without the police is permissible, but only after a comprehensive assessment by a lawyer.

How quickly does Dubai police respond to a fraud claim?

If a person is properly filed with primary evidence, especially if there is a threat of a suspect fleeing, the police can detain a person for several hours. However, with a weak evidence base, the application can be reclassified as a civil dispute.

What if the fraudster is the CEO or the sole owner of the business?

This is a scenario that requires special care. If minority shareholders or investors find majoritarian fraud, they need a separate strategy: emergency appeal to DIFC/ADGM Courts for the protection of minority shareholders and the appointment of an external manager or the freezing of the company's assets. At the same time, a criminal statement to establish personal responsibility.

Can an internal investigation be conducted without the results being reported to the police?

There is no guarantee that the report will remain internal. If the police or prosecutors open a case, they can request documents. This is why an internal investigation must be conducted initially under the guidance of an external lawyer to protect privileged materials as much as possible.

What to do if fraud is related to cryptocurrencies and DeFi platforms?

It is necessary to immediately involve blockchain analysts and prepare a statement to the police indicating the addresses of wallets and the time of transactions. In the UAE, law enforcement officers already have the practice of seizing crypto assets and interacting with exchanges, especially those licensed by VARA in Dubai.

Related services

• Corporate and Regulatory Investigations, Business Integrity
• Fraud and asset tracing
• Criminal law, protection for economic crimes and extradition
• Data Protection, Cybersecurity and Digital Forensics
• Commercial disputes and cross-border proceedings
• Sanctions, export controls and international compliance

Related material

• How to Protect Your Company from Corporate Fraud in the UAE
• Duty to Notify Regulators of Cyber Incidents and Fraud in DIFC
• Asset Seizure in Dubai: Inspection of counterparties and employees in the UAE: Features of criminal liability of legal entities in the Emirates Withdrawal of assets through free zones: How to get money back

Conclusion

The first action after a corporate fraud is detected in Dubai or any other emirate is not so much an investigation as a military operation to preserve assets, evidence and legal position. Key principles: silence, speed, total fixation and immediate inclusion of a lawyer with experience in white-collar crime and knowledge local UAE practice. The winner will not be the one who louder declares the theft, but the one who, by the time the suspect became aware of the suspicions, has already received a travel ban, arrested bills and handed over a flawless statement to the police. In the UAE, where the law combines elements of the continental and Anglo-Saxon systems, and the DIFC/ADGM courts have powerful security mechanisms, a professionally conducted fraud investigation turns the shock of betrayal into a clear plan for repaying money and protecting business.